Merge pull request #146 from ipnet-mesh/chore/codecov-tests

Add Test upload

.agentmap.yaml

@@ -0,0 +1,103 @@
+# MeshCore Hub — codebase orientation map
+# See: https://github.com/anthropics/agentmap
+
+meta:
+  project: meshcore-hub
+  version: 1
+  updated: "2026-02-27"
+  stack:
+    - python 3.13
+    - fastapi
+    - sqlalchemy (async)
+    - paho-mqtt
+    - click
+    - lit-html SPA
+    - tailwind + daisyui
+    - sqlite
+
+tasks:
+  install: "pip install -e '.[dev]'"
+  test: "pytest"
+  run: "meshcore-hub api --reload"
+  lint: "pre-commit run --all-files"
+
+tree:
+  src/meshcore_hub/:
+    __main__.py: "Click CLI entry point, registers subcommands"
+    common/:
+      config.py: "pydantic-settings, all env vars [config]"
+      database.py: "async SQLAlchemy session management"
+      mqtt.py: "MQTT client helpers"
+      i18n.py: "translation loader, t() function"
+      models/:
+        base.py: "Base, UUIDMixin, TimestampMixin"
+        node.py: null
+        member.py: null
+        advertisement.py: null
+        message.py: null
+        telemetry.py: null
+        node_tag.py: null
+      schemas/:
+        events.py: "inbound MQTT event schemas"
+        commands.py: "outbound command schemas"
+        nodes.py: "API request/response schemas"
+        members.py: null
+        messages.py: null
+    interface/:
+      receiver.py: "reads device events, publishes to MQTT"
+      sender.py: "subscribes MQTT commands, writes to device"
+      device.py: "meshcore library wrapper"
+      mock_device.py: "fake device for testing"
+    collector/:
+      subscriber.py: "MQTT subscriber, routes events to handlers"
+      handlers/: "per-event-type DB persistence"
+      cleanup.py: "data retention and node cleanup"
+      webhook.py: "forward events to HTTP endpoints"
+      tag_import.py: "seed node tags from YAML"
+      member_import.py: "seed members from YAML"
+    api/:
+      app.py: "FastAPI app factory"
+      auth.py: "API key authentication"
+      dependencies.py: "DI for db session and auth"
+      metrics.py: "Prometheus /metrics endpoint"
+      routes/: "REST endpoints per resource"
+    web/:
+      app.py: "FastAPI app factory, SPA shell"
+      pages.py: "custom markdown page loader"
+      middleware.py: null
+      templates/:
+        spa.html: "single Jinja2 shell template"
+      static/js/spa/:
+        app.js: "SPA entry, route registration"
+        router.js: "History API client-side router"
+        api.js: "fetch wrapper for API calls"
+        components.js: "shared lit-html helpers, t() re-export"
+        icons.js: "SVG icon functions"
+        pages/: "lazy-loaded page modules"
+  alembic/: "DB migrations"
+  etc/:
+    prometheus/: "Prometheus scrape + alert rules"
+    alertmanager/: null
+  seed/: "YAML seed data (node_tags, members)"
+  tests/:
+
+key_symbols:
+  - src/meshcore_hub/__main__.py::cli — Click root group [entry-point]
+  - src/meshcore_hub/common/config.py::CommonSettings — shared env config base
+  - src/meshcore_hub/common/database.py::DatabaseManager — async session factory
+  - src/meshcore_hub/common/models/base.py::Base — declarative base for all models
+  - src/meshcore_hub/api/app.py::create_app — API FastAPI factory
+  - src/meshcore_hub/web/app.py::create_app — Web FastAPI factory
+  - src/meshcore_hub/api/auth.py::require_read — read-key auth dependency
+  - src/meshcore_hub/api/auth.py::require_admin — admin-key auth dependency
+  - src/meshcore_hub/collector/subscriber.py::MQTTSubscriber — event ingestion loop
+  - src/meshcore_hub/interface/receiver.py::Receiver — device→MQTT bridge
+  - src/meshcore_hub/interface/sender.py::Sender — MQTT→device bridge
+
+conventions:
+  - four Click subcommands: interface, collector, api, web
+  - "MQTT topic pattern: {prefix}/{pubkey}/event/{name} and .../command/{name}"
+  - env config via pydantic-settings, no manual os.environ
+  - web SPA: ES modules + lit-html, pages export async render()
+  - i18n via t() with JSON locale files in static/locales/
+  - node tags are freeform key-value pairs, standard keys in AGENTS.md

.claude/commands/label-issue.md

@@ -0,0 +1,60 @@
+---
+allowed-tools: Bash(gh label list:*),Bash(gh issue view:*),Bash(gh issue edit:*),Bash(gh search:*)
+description: Apply labels to GitHub issues
+---
+
+You're an issue triage assistant for GitHub issues. Your task is to analyze the issue and select appropriate labels from the provided list.
+
+IMPORTANT: Don't post any comments or messages to the issue. Your only action should be to apply labels.
+
+Issue Information:
+
+- REPO: ${{ github.repository }}
+- ISSUE_NUMBER: ${{ github.event.issue.number }}
+
+TASK OVERVIEW:
+
+1. First, fetch the list of labels available in this repository by running: `gh label list`. Run exactly this command with nothing else.
+
+2. Next, use gh commands to get context about the issue:
+
+   - Use `gh issue view ${{ github.event.issue.number }}` to retrieve the current issue's details
+   - Use `gh search issues` to find similar issues that might provide context for proper categorization
+   - You have access to these Bash commands:
+     - Bash(gh label list:\*) - to get available labels
+     - Bash(gh issue view:\*) - to view issue details
+     - Bash(gh issue edit:\*) - to apply labels to the issue
+     - Bash(gh search:\*) - to search for similar issues
+
+3. Analyze the issue content, considering:
+
+   - The issue title and description
+   - The type of issue (bug report, feature request, question, etc.)
+   - Technical areas mentioned
+   - Severity or priority indicators
+   - User impact
+   - Components affected
+
+4. Select appropriate labels from the available labels list provided above:
+
+   - Choose labels that accurately reflect the issue's nature
+   - Be specific but comprehensive
+   - IMPORTANT: Add a priority label (P1, P2, or P3) based on the label descriptions from gh label list
+   - Consider platform labels (android, ios) if applicable
+   - If you find similar issues using gh search, consider using a "duplicate" label if appropriate. Only do so if the issue is a duplicate of another OPEN issue.
+
+5. Apply the selected labels:
+   - Use `gh issue edit` to apply your selected labels
+   - DO NOT post any comments explaining your decision
+   - DO NOT communicate directly with users
+   - If no labels are clearly applicable, do not apply any labels
+
+IMPORTANT GUIDELINES:
+
+- Be thorough in your analysis
+- Only select labels from the provided list above
+- DO NOT post any comments to the issue
+- Your ONLY action should be to apply labels using gh issue edit
+- It's okay to not add any labels if none are clearly applicable
+
+---

.claude/skills/documentation/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: documentation
+description: Audit and update project documentation to accurately reflect the current codebase. Use when documentation may be outdated, after significant code changes, or when the user asks to review or update docs.
+---
+
+# Documentation Audit
+
+Audit and update all project documentation so it accurately reflects the current state of the codebase. Documentation must only describe features, options, configurations, and functionality that actually exist in the code.
+
+## Files to Review
+
+- **README.md** - Project overview, setup instructions, usage examples
+- **AGENTS.md** - AI coding assistant guidelines, project structure, conventions
+- **.env.example** - Example environment variables
+
+Also check for substantial comments or inline instructions within the codebase that may be outdated.
+
+## Process
+
+1. **Read all documentation files** listed above in full.
+
+2. **Cross-reference against the codebase.** For every documented item (features, env vars, CLI commands, routes, models, directory paths, conventions), search the code to verify:
+   - It actually exists.
+   - Its described behavior matches the implementation.
+   - File paths and directory structures are accurate.
+
+3. **Identify and fix discrepancies:**
+   - **Version updates** — ensure documentation reflects any new/updated/removed versions. Check .python-version, pyproject.toml, etc.
+   - **Stale/legacy content** — documented but no longer in the code. Remove it.
+   - **Missing content** — exists in the code but not documented. Add it.
+   - **Inaccurate descriptions** — documented behavior doesn't match implementation. Correct it.
+
+4. **Apply updates** to each file. Preserve existing style and structure.
+
+5. **Verify consistency** across all documentation files — they must not contradict each other.
+
+## Rules
+
+- Do NOT invent features or options that don't exist in the code.
+- Do NOT remove documentation for features that DO exist.
+- Do NOT change the fundamental structure or style of the docs.
+- Do NOT modify CLAUDE.md.
+- Focus on accuracy, not cosmetic changes.
+- When in doubt, check the source code.

.claude/skills/git-branch/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: git-branch
+description: Create a new branch from latest main with the project's naming convention (feat/fix/chore). Use when starting new work on a feature, bug fix, or chore.
+---
+
+# Git Branch
+
+Create a new branch from the latest `main` branch using the project's naming convention.
+
+## Arguments
+
+The user may provide arguments in the format: `<type>/<description>`
+
+- `type` — one of `feat`, `fix`, or `chore`
+- `description` — short kebab-case description (e.g., `add-map-clustering`)
+
+If not provided, ask the user for the branch type and description.
+
+## Process
+
+1. **Fetch latest main:**
+
+```bash
+git fetch origin main
+```
+
+2. **Determine branch name:**
+
+   - If the user provided arguments (e.g., `/git-branch feat/add-map-clustering`), use them directly.
+   - Otherwise, ask the user for:
+     - **Branch type**: `feat`, `fix`, or `chore`
+     - **Short description**: a brief kebab-case slug describing the work
+   - Construct the branch name as `{type}/{slug}` (e.g., `feat/add-map-clustering`).
+
+3. **Create and switch to the new branch:**
+
+```bash
+git checkout -b {branch_name} origin/main
+```
+
+4. **Confirm** by reporting the new branch name to the user.
+
+## Rules
+
+- Branch names MUST follow the `{type}/{slug}` convention.
+- Valid types are `feat`, `fix`, and `chore` only.
+- The slug MUST be kebab-case (lowercase, hyphens, no spaces or underscores).
+- Always branch from `origin/main`, never from the current branch.
+- Do NOT push the branch — just create it locally.

.claude/skills/git-pr/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: git-pr
+description: Create a pull request to main from the current branch. Runs quality checks, commits changes, pushes, and opens a PR via gh CLI. Use when ready to submit work for review.
+---
+
+# Git PR
+
+Create a pull request to `main` from the current feature branch.
+
+## Process
+
+### Phase 1: Pre-flight Checks
+
+1. **Verify branch:**
+
+```bash
+git branch --show-current
+```
+
+   - The current branch must NOT be `main`. If on `main`, tell the user to create a feature branch first (e.g., `/git-branch`).
+
+2. **Check for uncommitted changes:**
+
+```bash
+git status
+```
+
+   - If there are uncommitted changes, ask the user for a commit message and commit them using the `/git-commit` skill conventions (no Claude authoring details).
+
+### Phase 2: Quality Checks
+
+1. **Determine changed components** by comparing against `main`:
+
+```bash
+git diff --name-only main...HEAD
+```
+
+2. **Run targeted tests** based on changed files:
+   - `tests/test_web/` for web-only changes (templates, static JS, web routes)
+   - `tests/test_api/` for API changes
+   - `tests/test_collector/` for collector changes
+   - `tests/test_interface/` for interface/sender/receiver changes
+   - `tests/test_common/` for common models/schemas/config changes
+   - Run the full `pytest` if changes span multiple components
+
+3. **Run pre-commit checks:**
+
+```bash
+pre-commit run --all-files
+```
+
+   - If checks fail and auto-fix files, commit the fixes and re-run until clean.
+
+4. If tests or checks fail and cannot be auto-fixed, report the issues to the user and stop.
+
+### Phase 3: Push and Create PR
+
+1. **Push the branch to origin:**
+
+```bash
+git push -u origin HEAD
+```
+
+2. **Generate PR content:**
+   - **Title**: Derive from the branch name. Convert `feat/add-map-clustering` to `Add map clustering`, `fix/login-error` to `Fix login error`, etc. Keep under 70 characters.
+   - **Body**: Generate a summary from the commit history:
+
+```bash
+git log main..HEAD --oneline
+```
+
+3. **Create the PR:**
+
+```bash
+gh pr create --title "{title}" --body "$(cat <<'EOF'
+## Summary
+{bullet points summarizing the changes}
+
+## Test plan
+{checklist of testing steps}
+EOF
+)"
+```
+
+4. **Return the PR URL** to the user.
+
+## Rules
+
+- Do NOT create a PR from `main`.
+- Do NOT skip quality checks — tests and pre-commit must pass.
+- Do NOT force-push.
+- Always target `main` as the base branch.
+- Keep the PR title concise (under 70 characters).
+- If quality checks fail, fix issues or report to the user — do NOT create the PR with failing checks.

.claude/skills/quality/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: quality
+description: Run the full test suite, pre-commit checks, and re-run tests to ensure code quality. Fixes any issues found. Use after code changes, before commits, or when the user asks to check quality.
+---
+
+# Quality Check
+
+Run the full quality pipeline: tests, pre-commit checks, and a verification test run. Fix any issues discovered at each stage.
+
+## Prerequisites
+
+Before running checks, ensure the environment is ready:
+
+1. Check for `.venv` directory — create with `python -m venv .venv` if missing.
+2. Activate the virtual environment: `source .venv/bin/activate`
+3. Install dependencies: `pip install -e ".[dev]"`
+
+## Process
+
+### Phase 1: Initial Test Run
+
+Run the full test suite to establish a baseline:
+
+```bash
+pytest
+```
+
+- If tests **pass**, proceed to Phase 2.
+- If tests **fail**, investigate and fix the failures before continuing. Re-run the failing tests to confirm fixes. Then proceed to Phase 2.
+
+### Phase 2: Pre-commit Checks
+
+Run all pre-commit hooks against the entire codebase:
+
+```bash
+pre-commit run --all-files
+```
+
+- If all checks **pass**, proceed to Phase 3.
+- If checks **fail**:
+  - Many hooks (black, trailing whitespace, end-of-file) auto-fix issues. Re-run `pre-commit run --all-files` to confirm auto-fixes resolved the issues.
+  - For remaining failures (flake8, mypy, etc.), investigate and fix manually.
+  - Re-run `pre-commit run --all-files` until all checks pass.
+  - Then proceed to Phase 3.
+
+### Phase 3: Verification Test Run
+
+Run the full test suite again to ensure pre-commit fixes (formatting, import sorting, etc.) haven't broken any functionality:
+
+```bash
+pytest
+```
+
+- If tests **pass**, the quality check is complete.
+- If tests **fail**, the pre-commit fixes introduced a regression. Investigate and fix, then re-run both `pre-commit run --all-files` and `pytest` until both pass cleanly.
+
+## Rules
+
+- Always run the FULL test suite (`pytest`), not targeted tests.
+- Always run pre-commit against ALL files (`--all-files`).
+- Do NOT skip or ignore failing tests — investigate and fix them.
+- Do NOT skip or ignore pre-commit failures — investigate and fix them.
+- Do NOT modify test assertions to make tests pass unless the test is genuinely wrong.
+- Do NOT disable pre-commit hooks or add noqa/type:ignore unless truly justified.
+- Fix root causes, not symptoms.
+- If a fix requires changes outside the scope of a simple quality fix (e.g., a design change), report it to the user rather than making the change silently.

.claude/skills/release/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: release
+description: Full release workflow — quality gate, semantic version tag, push, and GitHub release. Use when ready to cut a new release from main.
+---
+
+# Release
+
+Run the full release workflow: quality checks, version tagging, push, and GitHub release creation.
+
+## Arguments
+
+The user may optionally provide a version number (e.g., `/release 1.2.0`). If not provided, one will be suggested based on commit history.
+
+## Process
+
+### Phase 1: Pre-flight Checks
+
+1. **Verify on `main` branch:**
+
+```bash
+git branch --show-current
+```
+
+   - Must be on `main`. If not, tell the user to switch to `main` first.
+
+2. **Verify working tree is clean:**
+
+```bash
+git status --porcelain
+```
+
+   - If there are uncommitted changes, tell the user to commit or stash them first.
+
+3. **Pull latest:**
+
+```bash
+git pull origin main
+```
+
+### Phase 2: Quality Gate
+
+1. **Run full test suite:**
+
+```bash
+pytest
+```
+
+2. **Run pre-commit checks:**
+
+```bash
+pre-commit run --all-files
+```
+
+3. If either fails, report the issues and stop. Do NOT proceed with a release that has failing checks.
+
+### Phase 3: Determine Version
+
+1. **Get the latest tag:**
+
+```bash
+git describe --tags --abbrev=0 2>/dev/null || echo "none"
+```
+
+2. **List commits since last tag:**
+
+```bash
+git log {last_tag}..HEAD --oneline
+```
+
+   If no previous tag exists, list the last 20 commits:
+
+```bash
+git log --oneline -20
+```
+
+3. **Determine next version:**
+   - If the user provided a version, use it.
+   - Otherwise, suggest a version based on commit prefixes:
+     - Any commit starting with `feat` or `Add` → **minor** bump
+     - Only `fix` or `Fix` commits → **patch** bump
+     - If no previous tag, suggest `0.1.0`
+   - Present the suggestion and ask the user to confirm or provide a different version.
+
+### Phase 4: Tag and Release
+
+1. **Create annotated tag:**
+
+```bash
+git tag -a v{version} -m "Release v{version}"
+```
+
+2. **Push tag to origin:**
+
+```bash
+git push origin v{version}
+```
+
+3. **Create GitHub release:**
+
+```bash
+gh release create v{version} --title "v{version}" --generate-notes
+```
+
+4. **Report** the release URL to the user.
+
+## Rules
+
+- MUST be on `main` branch with a clean working tree.
+- MUST pass all quality checks before tagging.
+- Tags MUST follow the `v{major}.{minor}.{patch}` format (e.g., `v1.2.0`).
+- Always create an annotated tag, not a lightweight tag.
+- Always confirm the version with the user before tagging.
+- Do NOT skip quality checks under any circumstances.
+- Do NOT force-push tags.

.env.example

@@ -80,6 +80,14 @@ MQTT_PREFIX=meshcore
 # When enabled, uses TLS with system CA certificates (e.g., for Let's Encrypt)
 MQTT_TLS=false
 
+# MQTT transport protocol
+# Options: tcp, websockets
+MQTT_TRANSPORT=tcp
+
+# MQTT WebSocket path (used only when MQTT_TRANSPORT=websockets)
+# Common values: /mqtt, /
+MQTT_WS_PATH=/mqtt
+
 # External port mappings for local MQTT broker (--profile mqtt only)
 MQTT_EXTERNAL_PORT=1883
 MQTT_WS_PORT=9001
@@ -107,11 +115,46 @@ MESHCORE_DEVICE_NAME=
 NODE_ADDRESS=
 NODE_ADDRESS_SENDER=
 
+# -------------------
+# Contact Cleanup Settings (RECEIVER mode only)
+# -------------------
+# Automatic removal of stale contacts from the MeshCore companion node
+
+# Enable automatic removal of stale contacts from companion node
+CONTACT_CLEANUP_ENABLED=true
+
+# Remove contacts not advertised for this many days
+CONTACT_CLEANUP_DAYS=7
+
 # =============================================================================
 # COLLECTOR SETTINGS
 # =============================================================================
 # The collector subscribes to MQTT events and stores them in the database
 
+# Collector MQTT ingest mode
+# - native: expects <prefix>/<pubkey>/event/<event_name> topics
+# - letsmesh_upload: expects LetsMesh observer uploads on
+#   <prefix>/<pubkey>/(packets|status|internal)
+COLLECTOR_INGEST_MODE=native
+
+# LetsMesh decoder support (used only when COLLECTOR_INGEST_MODE=letsmesh_upload)
+# Set to false to disable external packet decoding
+COLLECTOR_LETSMESH_DECODER_ENABLED=true
+
+# Decoder command (must be available in container PATH)
+# Examples: meshcore-decoder, /usr/local/bin/meshcore-decoder, npx meshcore-decoder
+COLLECTOR_LETSMESH_DECODER_COMMAND=meshcore-decoder
+
+# Optional: channel secret keys (comma or space separated) used to decrypt GroupText
+# packets. This supports unlimited keys.
+# Note: Public + #test keys are built into the collector code by default.
+# To show friendly channel names in the web feed, use label=hex (example: bot=ABCDEF...).
+# Without keys, encrypted packets cannot be shown as plaintext.
+# COLLECTOR_LETSMESH_DECODER_KEYS=
+
+# Timeout in seconds per decode invocation
+COLLECTOR_LETSMESH_DECODER_TIMEOUT_SECONDS=2.0
+
 # -------------------
 # Webhook Settings
 # -------------------
@@ -179,6 +222,25 @@ API_PORT=8000
 API_READ_KEY=
 API_ADMIN_KEY=
 
+# -------------------
+# Prometheus Metrics
+# -------------------
+# Prometheus metrics endpoint exposed at /metrics on the API service
+
+# Enable Prometheus metrics endpoint
+# Default: true
+METRICS_ENABLED=true
+
+# Seconds to cache metrics output (reduces database load)
+# Default: 60
+METRICS_CACHE_TTL=60
+
+# External Prometheus port (when using --profile metrics)
+PROMETHEUS_PORT=9090
+
+# External Alertmanager port (when using --profile metrics)
+ALERTMANAGER_PORT=9093
+
 # =============================================================================
 # WEB DASHBOARD SETTINGS
 # =============================================================================
@@ -187,21 +249,56 @@ API_ADMIN_KEY=
 # External web port
 WEB_PORT=8080
 
+# API endpoint URL for the web dashboard
+# Default: http://localhost:8000
+# API_BASE_URL=http://localhost:8000
+
+# API key for web dashboard queries (optional)
+# If API_READ_KEY is set on the API, provide it here
+# API_KEY=
+
 # Default theme for the web dashboard (dark or light)
 # Users can override via the theme toggle; their preference is saved in localStorage
 # Default: dark
 # WEB_THEME=dark
 
+# Locale/language for the web dashboard
+# Default: en
+# Supported: en (see src/meshcore_hub/web/static/locales/ for available translations)
+# WEB_LOCALE=en
+
+# Locale used for date/time formatting in the web dashboard
+# Controls date ordering only; 24-hour clock is still used by default
+# Examples: en-US (MM/DD/YYYY), en-GB (DD/MM/YYYY)
+# Default: en-US
+# WEB_DATETIME_LOCALE=en-US
+
+# Auto-refresh interval in seconds for list pages (nodes, advertisements, messages)
+# Set to 0 to disable auto-refresh
+# Default: 30
+# WEB_AUTO_REFRESH_SECONDS=30
+
+# Enable admin interface at /a/ (requires auth proxy in front)
+# Default: false
+# WEB_ADMIN_ENABLED=false
+
 # Timezone for displaying dates/times on the web dashboard
 # Uses standard IANA timezone names (e.g., America/New_York, Europe/London)
 # Default: UTC
 TZ=UTC
 
+# Directory containing custom content (pages/, media/)
+# Default: ./content
+# CONTENT_HOME=./content
+
 # -------------------
 # Network Information
 # -------------------
 # Displayed on the web dashboard homepage
 
+# Network domain name (optional)
+# NETWORK_DOMAIN=
+
 # Network display name
 NETWORK_NAME=MeshCore Network
 

.github/FUNDING.yml

@@ -0,0 +1 @@
+buy_me_a_coffee: jinglemansweep

.github/workflows/ci.yml

@@ -1,39 +1,44 @@
 name: CI
 
 on:
+  push:
+    branches: [main]
   pull_request:
     branches: [main]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "alembic/**"
+      - ".python-version"
+      - "pyproject.toml"
+      - ".pre-commit-config.yaml"
+      - ".github/workflows/**"
 
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version-file: ".python-version"
 
       - name: Run pre-commit
         uses: pre-commit/action@v3.0.1
 
   test:
-    name: Test (Python ${{ matrix.python-version }})
+    name: Test
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ["3.13"]
-
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+      - name: Set up Python
+        uses: actions/setup-python@v6
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version-file: ".python-version"
 
       - name: Install dependencies
         run: |
@@ -42,27 +47,35 @@ jobs:
 
       - name: Run tests with pytest
         run: |
-          pytest --cov=meshcore_hub --cov-report=xml --cov-report=term-missing
+          pytest --cov=meshcore_hub --cov-report=xml --cov-report=term-missing --junitxml=junit.xml -o junit_family=legacy
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        if: matrix.python-version == '3.13'
+        uses: codecov/codecov-action@v5
+        if: always()
         with:
           files: ./coverage.xml
           fail_ci_if_error: false
           verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+      - name: Upload test results to Codecov
+        uses: codecov/codecov-action@v5
+        if: ${{ !cancelled() }}
+        with:
+          report_type: test_results
+          token: ${{ secrets.CODECOV_TOKEN }}
 
   build:
     name: Build Package
     runs-on: ubuntu-latest
     needs: [lint, test]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version-file: ".python-version"
 
       - name: Install build tools
         run: |
@@ -73,7 +86,7 @@ jobs:
         run: python -m build
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/

.github/workflows/docker.yml

@@ -3,6 +3,15 @@ name: Docker
 on:
   push:
     branches: [main]
+    paths:
+      - "src/**"
+      - "alembic/**"
+      - "alembic.ini"
+      - ".python-version"
+      - "pyproject.toml"
+      - "Dockerfile"
+      - "docker-compose.yml"
+      - ".github/workflows/**"
     tags:
       - "v*"
 
@@ -19,17 +28,17 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -37,7 +46,7 @@ jobs:
 
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -48,7 +57,7 @@ jobs:
             type=sha
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile

.gitignore

@@ -3,6 +3,7 @@
 !example/data/
 /seed/
 !example/seed/
+/content/
 
 # Byte-compiled / optimized / DLL files
 __pycache__/

.plans/2026/03/09/01-security-fixes/changelog.md

@@ -0,0 +1,100 @@
+## TASK-001: Remove legacy HTML dashboard endpoint
+**Status:** completed
+### Files Modified
+- `src/meshcore_hub/api/routes/dashboard.py`
+- `tests/test_api/test_dashboard.py`
+### Notes
+Removed the `dashboard()` route handler and its `@router.get("")` decorator. Removed `HTMLResponse` and `Request` imports no longer used. Updated existing tests to verify the HTML endpoint returns 404/405. All JSON sub-routes (`/stats`, `/activity`, `/message-activity`, `/node-count`) remain intact.
+---
+
+## TASK-002: Replace API key comparisons with constant-time comparison
+**Status:** completed
+### Files Modified
+- `src/meshcore_hub/api/auth.py`
+- `src/meshcore_hub/api/metrics.py`
+### Notes
+Added `import hmac` to both files. Replaced `==` comparisons with `hmac.compare_digest()` in `require_read`, `require_admin`, and `verify_basic_auth`. Added truthiness guards for `read_key`/`admin_key` in `require_read` since either can be `None` and `hmac.compare_digest()` raises `TypeError` on `None`.
+---
+
+## TASK-003: Add WEB_TRUSTED_PROXY_HOSTS configuration setting
+**Status:** completed
+### Files Modified
+- `src/meshcore_hub/common/config.py`
+### Notes
+Added `web_trusted_proxy_hosts: str = Field(default="*", ...)` to `WebSettings` class. Automatically configurable via `WEB_TRUSTED_PROXY_HOSTS` env var through Pydantic Settings.
+---
+
+## TASK-004: Integrate trusted proxy hosts into web app middleware and add startup warning
+**Status:** completed
+### Files Modified
+- `src/meshcore_hub/web/app.py`
+### Notes
+Replaced hardcoded `trusted_hosts="*"` in `ProxyHeadersMiddleware` with configured value. If value is `"*"`, passes string directly; otherwise splits on commas. Added startup warning when `WEB_ADMIN_ENABLED=true` and `WEB_TRUSTED_PROXY_HOSTS="*"`. `_is_authenticated_proxy_request` unchanged.
+---
+
+## TASK-005: Escape config JSON in template script block to prevent XSS breakout
+**Status:** completed
+### Files Modified
+- `src/meshcore_hub/web/app.py`
+### Notes
+Added `.replace("</", "<\\/")` to `_build_config_json` return value. Prevents `</script>` breakout in the Jinja2 template's `<script>` block. `<\/` is valid JSON per spec and parsed correctly by `JSON.parse()`.
+---
+
+## TASK-006: Fix stored XSS in admin node-tags page
+**Status:** completed
+### Files Modified
+- `src/meshcore_hub/web/static/js/spa/pages/admin/node-tags.js`
+### Notes
+Added `escapeHtml` to imports. Escaped `nodeName` with `escapeHtml()` in copy-all and delete-all confirmation dialogs (2 `unsafeHTML()` calls). Escaped `activeTagKey` with `escapeHtml()` in single tag delete confirmation (`innerHTML` assignment). Translation template `<strong>` tags preserved.
+---
+
+## TASK-007: Fix stored XSS in admin members page
+**Status:** completed
+### Files Modified
+- `src/meshcore_hub/web/static/js/spa/pages/admin/members.js`
+### Notes
+Added `escapeHtml` to imports. Escaped `memberName` with `escapeHtml()` before passing to `t()` in delete confirmation dialog. `innerHTML` retained for `<strong>` tag rendering from translation template.
+---
+
+## TASK-008: Write tests for legacy dashboard endpoint removal
+**Status:** completed
+### Files Modified
+- `tests/test_api/test_dashboard.py`
+### Notes
+Added 5 new tests: 1 for trailing-slash 404/405 verification, 4 for authenticated JSON sub-route responses. Total 20 dashboard tests passing.
+---
+
+## TASK-009: Write tests for constant-time API key comparison
+**Status:** completed
+### Files Modified
+- `tests/test_api/test_auth.py`
+### Notes
+Restructured from 10 tests (2 classes) to 22 tests (4 classes): `TestReadAuthentication` (9), `TestAdminAuthentication` (4), `TestMetricsAuthentication` (7), `TestHealthEndpoint` (2). Added coverage for multi-endpoint read/admin key acceptance, missing auth header rejection, and metrics credential validation.
+---
+
+## TASK-010: Write tests for trusted proxy hosts configuration and startup warning
+**Status:** completed
+### Files Modified
+- `tests/test_common/test_config.py`
+- `tests/test_web/test_app.py`
+### Notes
+Added 3 config tests (default value, specific IP, comma-separated list) and 5 web app tests (warning logged with wildcard+admin, no warning with specific hosts, no warning with admin disabled, comma list parsing, wildcard passed as string).
+---
+
+## TASK-011: Write tests for config JSON script block escaping
+**Status:** completed
+### Files Created
+- `tests/test_web/test_app.py`
+### Notes
+Added 5 tests in `TestConfigJsonXssEscaping` class: rendered HTML escaping, normal values unaffected, escaped JSON parseable, direct `_build_config_json` escaping, direct no-escaping-needed.
+---
+
+## TASK-012: Update documentation for WEB_TRUSTED_PROXY_HOSTS setting
+**Status:** completed
+### Files Modified
+- `README.md`
+- `AGENTS.md`
+- `PLAN.md`
+### Notes
+Added `WEB_TRUSTED_PROXY_HOSTS` to environment variables sections in all three docs. Documented default value (`*`), production recommendation, and startup warning behavior.
+---

.plans/2026/03/09/01-security-fixes/prd.md

@@ -0,0 +1,162 @@
+# Product Requirements Document
+
+> Source: `.plans/2026/03/09/01-security-fixes/prompt.md`
+
+## Project Overview
+
+This project addresses CRITICAL and HIGH severity vulnerabilities identified in a security audit of MeshCore Hub. The fixes span stored XSS in server-rendered and client-side code, timing attacks on authentication, proxy header forgery, and a legacy endpoint with missing authentication. All changes must be backward-compatible and preserve existing API contracts.
+
+## Goals
+
+- Eliminate all CRITICAL and HIGH severity security vulnerabilities found in the audit
+- Harden API key comparison against timing side-channel attacks
+- Prevent XSS vectors in both Jinja2 templates and client-side JavaScript
+- Add configurable proxy trust to defend against header forgery while maintaining backward compatibility
+- Remove the redundant legacy HTML dashboard endpoint that lacks authentication
+
+## Functional Requirements
+
+### REQ-001: Remove legacy HTML dashboard endpoint
+
+**Description:** Remove the `GET /api/v1/dashboard/` route handler that renders a standalone HTML page with unescaped database content (stored XSS) and no authentication. The JSON sub-routes (`/stats`, `/activity`, `/message-activity`, `/node-count`) must remain intact and unchanged.
+
+**Acceptance Criteria:**
+
+- [ ] The `dashboard()` route handler in `api/routes/dashboard.py` is removed
+- [ ] The `HTMLResponse` import is removed (if no longer used)
+- [ ] `GET /api/v1/dashboard/` returns 404 or Method Not Allowed
+- [ ] `GET /api/v1/dashboard/stats` continues to return valid JSON with authentication
+- [ ] `GET /api/v1/dashboard/activity` continues to return valid JSON with authentication
+- [ ] `GET /api/v1/dashboard/message-activity` continues to return valid JSON with authentication
+- [ ] `GET /api/v1/dashboard/node-count` continues to return valid JSON with authentication
+- [ ] Existing API tests for JSON sub-routes still pass
+
+### REQ-002: Use constant-time comparison for API key validation
+
+**Description:** Replace all Python `==` comparisons of API keys and credentials with `hmac.compare_digest()` to prevent timing side-channel attacks that could leak key material.
+
+**Acceptance Criteria:**
+
+- [ ] All API key comparisons in `api/auth.py` use `hmac.compare_digest()` instead of `==`
+- [ ] All credential comparisons in `api/metrics.py` use `hmac.compare_digest()` instead of `==`
+- [ ] `hmac` is imported in all files where secret comparison occurs
+- [ ] The authentication behavior is unchanged — valid keys are accepted, invalid keys are rejected
+- [ ] Tests confirm authentication still works correctly with valid and invalid keys
+
+### REQ-003: Add configurable trusted proxy hosts for admin authentication
+
+**Description:** Add a `WEB_TRUSTED_PROXY_HOSTS` configuration setting that controls which hosts are trusted for proxy authentication headers (`X-Forwarded-User`, `X-Auth-Request-User`, `Authorization: Basic`). The setting defaults to `*` for backward compatibility. A startup warning is emitted when admin is enabled with the wildcard default. The `Authorization: Basic` header check must be preserved for Nginx Proxy Manager compatibility.
+
+**Acceptance Criteria:**
+
+- [ ] A `WEB_TRUSTED_PROXY_HOSTS` setting is added to the configuration (Pydantic Settings)
+- [ ] The setting defaults to `*` (backward compatible)
+- [ ] `ProxyHeadersMiddleware` uses the configured `trusted_hosts` value instead of hardcoded `*`
+- [ ] A warning is logged at startup when `WEB_ADMIN_ENABLED=true` and `WEB_TRUSTED_PROXY_HOSTS` is `*`
+- [ ] The warning message recommends restricting trusted hosts to the operator's proxy IP
+- [ ] The `_is_authenticated_proxy_request` function continues to accept `X-Forwarded-User`, `X-Auth-Request-User`, and `Authorization: Basic` headers
+- [ ] OAuth2 proxy setups continue to function correctly
+- [ ] Setting `WEB_TRUSTED_PROXY_HOSTS` to a specific IP restricts proxy header trust to that IP
+
+### REQ-004: Escape config JSON in template script block
+
+**Description:** Prevent XSS via `</script>` breakout in the `config_json|safe` template injection by escaping `</` sequences in the serialized JSON string before passing it to the Jinja2 template.
+
+**Acceptance Criteria:**
+
+- [ ] `config_json` is escaped by replacing `</` with `<\\/` before template rendering (in `web/app.py`)
+- [ ] The `|safe` filter continues to be used (the escaping happens in Python, not Jinja2)
+- [ ] A config value containing `</script><script>alert(1)</script>` does not execute JavaScript
+- [ ] The SPA application correctly parses the escaped config JSON on the client side
+- [ ] Normal config values (without special characters) render unchanged
+
+### REQ-005: Fix stored XSS in admin page JavaScript
+
+**Description:** Sanitize API-sourced data (node names, tag keys, member names) before rendering in admin pages. Replace `unsafeHTML()` and direct `innerHTML` assignment with safe alternatives — either `escapeHtml()` (already available in `components.js`) or lit-html safe templating (`${value}` interpolation without `unsafeHTML`).
+
+**Acceptance Criteria:**
+
+- [ ] Node names in `admin/node-tags.js` are escaped or safely templated before HTML rendering
+- [ ] Tag keys in `admin/node-tags.js` are escaped or safely templated before HTML rendering
+- [ ] Member names in `admin/members.js` are escaped or safely templated before HTML rendering
+- [ ] All `unsafeHTML()` calls on API-sourced data in the identified files are replaced with safe alternatives
+- [ ] All direct `innerHTML` assignments of API-sourced data in the identified files are replaced with safe alternatives
+- [ ] A node name containing `<img src=x onerror=alert(1)>` renders as text, not as an HTML element
+- [ ] A member name containing `<script>alert(1)</script>` renders as text, not as executable script
+- [ ] Normal names (without special characters) continue to display correctly
+
+## Non-Functional Requirements
+
+### REQ-006: Backward compatibility
+
+**Category:** Reliability
+
+**Description:** All security fixes must maintain backward compatibility with existing deployments. No breaking changes to API contracts, configuration defaults, or deployment workflows.
+
+**Acceptance Criteria:**
+
+- [ ] All existing API endpoints (except the removed HTML dashboard) return the same response format
+- [ ] Default configuration values preserve existing behavior without requiring operator action
+- [ ] Docker Compose deployments continue to function without configuration changes
+- [ ] All existing tests pass after the security fixes are applied
+
+### REQ-007: No regression in authentication flows
+
+**Category:** Security
+
+**Description:** The security hardening must not introduce authentication regressions. Valid credentials must continue to be accepted, and invalid credentials must continue to be rejected, across all authentication methods.
+
+**Acceptance Criteria:**
+
+- [ ] API read key authentication accepts valid keys and rejects invalid keys
+- [ ] API admin key authentication accepts valid keys and rejects invalid keys
+- [ ] Metrics endpoint authentication (if configured) accepts valid credentials and rejects invalid ones
+- [ ] Proxy header authentication continues to work with OAuth2 proxy setups
+- [ ] Basic auth header forwarding from Nginx Proxy Manager continues to work
+
+## Technical Constraints and Assumptions
+
+### Constraints
+
+- Python 3.13+ (specified by project `.python-version`)
+- Must use `hmac.compare_digest()` from the Python standard library for constant-time comparison
+- The `Authorization: Basic` header check in `_is_authenticated_proxy_request` must not be removed or modified to validate credentials server-side — credential validation is the proxy's responsibility
+- Changes must not alter existing API response schemas or status codes (except removing the HTML dashboard endpoint)
+
+### Assumptions
+
+- The `escapeHtml()` utility in `components.js` correctly escapes `<`, `>`, `&`, `"`, and `'` characters
+- The SPA client-side JavaScript can parse JSON containing escaped `<\/` sequences (standard behavior per JSON spec)
+- Operators using proxy authentication have a reverse proxy (e.g., Nginx, Traefik, NPM) in front of MeshCore Hub
+
+## Scope
+
+### In Scope
+
+- Removing the legacy HTML dashboard route handler (C1 + H2)
+- Replacing `==` with `hmac.compare_digest()` for all secret comparisons (H1)
+- Adding `WEB_TRUSTED_PROXY_HOSTS` configuration and startup warning (H3)
+- Escaping `</` in config JSON template injection (H4)
+- Fixing `unsafeHTML()`/`innerHTML` XSS in admin JavaScript pages (H5)
+- Updating tests to cover the security fixes
+- Updating documentation for the new `WEB_TRUSTED_PROXY_HOSTS` setting
+
+### Out of Scope
+
+- MEDIUM severity findings (CORS, error detail leakage, rate limiting, security headers, CSRF, CDN SRI, markdown sanitization, input validation, channel key exposure)
+- LOW severity findings (auth warnings, version disclosure, unbounded fields, credential logging, SecretStr, port exposure, cache safety, image pinning)
+- INFO findings (OpenAPI docs, proxy IP logging, alertmanager comments, DOM XSS in error handler, locale path)
+- Adding rate limiting infrastructure
+- Adding Content-Security-Policy or other security headers
+- Dependency version pinning or lockfile generation
+- Server-side credential validation for Basic auth (proxy responsibility)
+
+## Suggested Tech Stack
+
+| Layer | Technology | Rationale |
+|-------|-----------|-----------|
+| Secret comparison | `hmac.compare_digest()` (stdlib) | Specified by prompt; constant-time comparison prevents timing attacks |
+| Template escaping | Python `str.replace()` | Minimal approach to escape `</` in JSON before Jinja2 rendering |
+| Client-side escaping | `escapeHtml()` from `components.js` | Already available in the codebase; standard HTML entity escaping |
+| Configuration | Pydantic Settings | Specified by project stack; used for `WEB_TRUSTED_PROXY_HOSTS` |
+| Testing | pytest, pytest-asyncio | Specified by project stack |

.plans/2026/03/09/01-security-fixes/prompt.md

@@ -0,0 +1,65 @@
+# Phase: 01-security-fixes
+
+## Overview
+
+Address CRITICAL and HIGH severity vulnerabilities identified in the MeshCore Hub security audit across API and Web components. These findings represent exploitable vulnerabilities including XSS, timing attacks, authentication bypasses, and insecure defaults.
+
+## Goals
+
+- Eliminate all CRITICAL and HIGH severity security vulnerabilities
+- Harden authentication mechanisms against timing attacks and header forgery
+- Prevent XSS vectors in both server-rendered HTML and client-side JavaScript
+- Secure default MQTT configuration against unauthenticated access
+
+## Requirements
+
+### C1 + H2 — Remove legacy HTML dashboard endpoint
+- **File:** `src/meshcore_hub/api/routes/dashboard.py:367-536`
+- The `GET /api/v1/dashboard/` endpoint is a standalone HTML page with two CRITICAL/HIGH issues: stored XSS (unescaped DB content in f-string HTML) and missing authentication
+- The SPA web dashboard provides a full-featured replacement, making this endpoint redundant
+- **Fix:** Remove the `dashboard()` route handler and its `HTMLResponse` import. Keep all JSON sub-routes (`/stats`, `/activity`, `/message-activity`, `/node-count`) intact.
+
+### H1 — Fix timing attack on API key comparison
+- **Files:** `api/auth.py:82,127` | `api/metrics.py:57`
+- All secret comparisons use Python `==`, which is not constant-time
+- **Fix:** Replace with `hmac.compare_digest()` for all key/credential comparisons
+
+### H3 — Harden admin auth against proxy header forgery
+- **File:** `web/app.py:73-86,239`
+- Admin access trusts `X-Forwarded-User`, `X-Auth-Request-User`, or `Authorization: Basic` header
+- `ProxyHeadersMiddleware(trusted_hosts="*")` accepts forged headers from any client
+- The `Authorization: Basic` check must be preserved — it is required by the Nginx Proxy Manager (NPM) Access List setup documented in README.md (NPM validates credentials and forwards the header)
+- **Fix:** Add a `WEB_TRUSTED_PROXY_HOSTS` config setting (default `*` for backward compatibility). Pass it to `ProxyHeadersMiddleware(trusted_hosts=...)`. Add a startup warning when `WEB_ADMIN_ENABLED=true` and `trusted_hosts` is still `*`, recommending operators restrict it to their proxy IP. Do NOT remove the Basic auth header check or validate credentials server-side — that is the proxy's responsibility.
+
+### H4 — Fix XSS via config_json|safe script block breakout
+- **File:** `web/templates/spa.html:188` | `web/app.py:157-183`
+- Operator config values injected into `<script>` block with `|safe` — a value containing `</script>` breaks out and executes arbitrary JS
+- **Fix:** Escape `</` sequences in the JSON string: `config_json = json.dumps(config).replace("</", "<\\/")`
+
+### H5 — Fix stored XSS via unsafeHTML/innerHTML with API-sourced data
+- **Files:** `web/static/js/spa/pages/admin/node-tags.js:243,272,454` | `admin/members.js:309`
+- Node names, tag keys, and member names from the API are interpolated into HTML via `unsafeHTML()` and direct `innerHTML` assignment
+- **Fix:** Use `escapeHtml()` (already in `components.js`) on API data before HTML interpolation, or replace with lit-html safe templating
+
+
+## Constraints
+
+- Must not break existing functionality or API contracts
+- Changes to docker-compose.yml and mosquitto.conf must remain backward-compatible (use env var defaults)
+- The `_is_authenticated_proxy_request` function must continue to work with OAuth2 proxy setups — only add defense-in-depth, don't remove proxy header support entirely
+
+## Out of Scope
+
+- MEDIUM severity findings (CORS config, error detail leakage, rate limiting, security headers, CSRF, CDN SRI, markdown sanitization, input validation, channel key exposure)
+- LOW severity findings (auth warnings, version disclosure, unbounded fields, credential logging, SecretStr, port exposure, cache safety, image pinning)
+- INFO findings (OpenAPI docs, proxy IP logging, alertmanager comments, DOM XSS in error handler, locale path)
+- Adding rate limiting infrastructure
+- Adding Content-Security-Policy or other security headers
+- Dependency version pinning or lockfile generation
+
+## References
+
+- Security audit performed in this conversation (2026-03-09)
+- OWASP Top 10: XSS (A7:2017), Broken Authentication (A2:2017)
+- Python `hmac.compare_digest` documentation
+- FastAPI security best practices

.plans/2026/03/09/01-security-fixes/reviews/cycle/001.yaml

@@ -0,0 +1,54 @@
+# Code review round 001
+# Phase: .plans/2026/03/09/01-security-fixes
+# Scope: full
+# Generated by: /jp-codereview
+
+issues:
+  - id: "ISSUE-001"
+    severity: "MINOR"
+    category: "integration"
+    file: "src/meshcore_hub/web/app.py"
+    line: 251
+    description: |
+      The startup warning for insecure trusted proxy hosts checks `settings.web_admin_enabled`
+      instead of the effective admin_enabled value that gets stored in `app.state.admin_enabled`.
+      The `create_app()` function accepts an `admin_enabled` parameter (line 193) that can override
+      the setting. If a caller passes `admin_enabled=True` but `settings.web_admin_enabled` is False,
+      the warning will not fire despite admin being enabled. In practice this does not affect production
+      deployments (CLI always uses the settings value), only programmatic/test usage.
+    suggestion: |
+      Consider computing the effective admin_enabled value before the warning check and using
+      that for both the warning and `app.state.admin_enabled`, e.g.:
+      `effective_admin = admin_enabled if admin_enabled is not None else settings.web_admin_enabled`
+    related_tasks:
+      - "TASK-004"
+
+  - id: "ISSUE-002"
+    severity: "MINOR"
+    category: "style"
+    file: "src/meshcore_hub/web/static/js/spa/pages/admin/node-tags.js"
+    line: 3
+    description: |
+      The `unsafeHTML` import is retained and still used on lines 243 and 272. Although the
+      API-sourced data (`nodeName`) is now safely escaped via `escapeHtml()` before interpolation,
+      the continued use of `unsafeHTML()` may confuse future reviewers into thinking the XSS
+      fix is incomplete. The `unsafeHTML()` is needed to render the translation template's HTML
+      tags (e.g., `<strong>`), so this is functionally correct.
+    suggestion: |
+      Add a brief inline comment above each `unsafeHTML()` call explaining that the dynamic
+      values are pre-escaped and `unsafeHTML()` is only needed for the template's HTML formatting.
+    related_tasks:
+      - "TASK-006"
+
+summary:
+  total_issues: 2
+  critical: 0
+  major: 0
+  minor: 2
+  by_category:
+    integration: 1
+    architecture: 0
+    security: 0
+    duplication: 0
+    error-handling: 0
+    style: 1

.plans/2026/03/09/01-security-fixes/reviews/prd.md

@@ -0,0 +1,70 @@
+# PRD Review
+
+> Phase: `.plans/2026/03/09/01-security-fixes`
+> PRD: `.plans/2026/03/09/01-security-fixes/prd.md`
+> Prompt: `.plans/2026/03/09/01-security-fixes/prompt.md`
+
+## Verdict: PASS
+
+The PRD fully covers all five security requirements from the prompt with clear, implementable, and testable acceptance criteria. No contradictions, blocking ambiguities, or feasibility concerns were found. One prompt goal ("Secure default MQTT configuration") has no corresponding requirement in either the prompt or the PRD, but since no prompt requirement addresses it, the PRD correctly does not fabricate one.
+
+## Coverage Assessment
+
+| Prompt Item | PRD Section | Covered? | Notes |
+|---|---|---|---|
+| C1+H2: Remove legacy HTML dashboard endpoint | REQ-001 | Yes | Route removal, import cleanup, sub-route preservation all specified |
+| H1: Fix timing attack on API key comparison | REQ-002 | Yes | Files and `hmac.compare_digest()` approach match |
+| H3: Harden admin auth / proxy header forgery | REQ-003 | Yes | Config setting, default, warning, Basic auth preservation all covered |
+| H4: Fix XSS via config_json\|safe breakout | REQ-004 | Yes | Escape approach and XSS test payload specified |
+| H5: Fix stored XSS via unsafeHTML/innerHTML | REQ-005 | Yes | Files, fix approach, and XSS test payloads specified |
+| Constraint: No breaking changes to API contracts | REQ-006 | Yes | |
+| Constraint: docker-compose.yml/mosquitto.conf backward-compatible | REQ-006 | Partial | REQ-006 covers Docker Compose but not mosquitto.conf; moot since no requirement changes mosquitto.conf |
+| Constraint: _is_authenticated_proxy_request works with OAuth2 | REQ-003, REQ-007 | Yes | |
+| Goal: Secure default MQTT configuration | -- | No | Goal stated in prompt but no prompt requirement addresses it; PRD correctly does not fabricate one |
+| Out of scope items | Scope section | Yes | All exclusions match prompt |
+
+**Coverage summary:** 5 of 5 prompt requirements fully covered, 1 constraint partially covered (moot), 1 prompt goal has no corresponding requirement in the prompt itself.
+
+## Requirement Evaluation
+
+All requirements passed evaluation. Minor observations noted below.
+
+### REQ-003: Add configurable trusted proxy hosts
+
+- **Implementability:** Pass -- A developer familiar with Pydantic Settings and `ProxyHeadersMiddleware` can implement this without ambiguity. The env var format (comma-separated list vs. single value) is not explicitly stated but follows standard Pydantic patterns.
+- **Testability:** Pass
+- **Completeness:** Pass
+- **Consistency:** Pass
+
+### REQ-006: Backward compatibility
+
+- **Implementability:** Pass
+- **Testability:** Pass
+- **Completeness:** Pass -- The prompt constraint about mosquitto.conf backward compatibility is not explicitly mentioned, but no requirement modifies mosquitto.conf, making this moot.
+- **Consistency:** Pass
+
+## Structural Issues
+
+### Contradictions
+
+None found.
+
+### Ambiguities
+
+None that would block implementation. The `WEB_TRUSTED_PROXY_HOSTS` env var format is a minor detail resolvable by the developer from the `ProxyHeadersMiddleware` API and standard Pydantic Settings patterns.
+
+### Missing Edge Cases
+
+None significant. The `hmac.compare_digest()` change (REQ-002) assumes the existing code handles the "no key configured" case before reaching the comparison, which is standard practice and verifiable during implementation.
+
+### Feasibility Concerns
+
+None.
+
+### Scope Inconsistencies
+
+The prompt states a goal of "Secure default MQTT configuration against unauthenticated access" but provides no requirement for it. The PRD drops this goal without explanation. This is a prompt-level gap, not a PRD-level gap -- the PRD should not invent requirements that the prompt does not specify.
+
+## Action Items
+
+No action items. The PRD is ready for task breakdown.

.plans/2026/03/09/01-security-fixes/reviews/tasks.md

@@ -0,0 +1,90 @@
+# Task Review
+
+> Phase: `.plans/2026/03/09/01-security-fixes`
+> Tasks: `.plans/2026/03/09/01-security-fixes/tasks.yaml`
+> PRD: `.plans/2026/03/09/01-security-fixes/prd.md`
+
+## Verdict: PASS
+
+The task list is structurally sound, correctly ordered, and fully covers all 7 PRD requirements. The dependency graph is a valid DAG with no cycles or invalid references. No ordering issues, coverage gaps, vague tasks, or invalid fields were found. Two non-blocking warnings are noted: TASK-006 and TASK-007 (frontend XSS fixes) lack corresponding test tasks, and two pairs of independent tasks share output files but modify independent sections.
+
+## Dependency Validation
+
+### Reference Validity
+
+All dependency references are valid. Every task ID referenced in a `dependencies` list corresponds to an existing task in the inventory.
+
+### DAG Validation
+
+The dependency graph is a valid directed acyclic graph. No cycles detected.
+
+Topological layers:
+- **Layer 0 (roots):** TASK-001, TASK-002, TASK-003, TASK-005, TASK-006, TASK-007
+- **Layer 1:** TASK-004 (depends on TASK-003), TASK-008 (depends on TASK-001), TASK-009 (depends on TASK-002), TASK-011 (depends on TASK-005)
+- **Layer 2:** TASK-010 (depends on TASK-003, TASK-004), TASK-012 (depends on TASK-003, TASK-004)
+
+### Orphan Tasks
+
+No orphan tasks detected. All non-root tasks with dependencies are either terminal test/docs tasks (TASK-008, TASK-009, TASK-010, TASK-011, TASK-012) or integration tasks (TASK-004). Root tasks without dependents (TASK-006, TASK-007) are excluded from orphan detection per the review protocol.
+
+## Ordering Check
+
+No blocking ordering issues detected.
+
+**Observation (non-blocking):** Two pairs of independent tasks share output files:
+
+1. **TASK-004 and TASK-005** both modify `src/meshcore_hub/web/app.py` without a dependency between them. TASK-004 modifies `ProxyHeadersMiddleware` (line ~239) and adds a startup warning, while TASK-005 modifies `_build_config_json` (line ~183). These are independent functions in the same file; no actual conflict exists.
+
+2. **TASK-010 and TASK-011** both modify `tests/test_web/test_app.py` without a dependency between them. Both add new test functions to the same test file. No actual conflict exists.
+
+These are not blocking because neither task creates the shared file — both modify existing files in independent sections. Adding artificial dependencies would unnecessarily serialize parallelizable work.
+
+## Coverage Check
+
+### Uncovered Requirements
+
+All PRD requirements are covered.
+
+### Phantom References
+
+No phantom references detected.
+
+**Coverage summary:** 7 of 7 PRD requirements covered by tasks.
+
+| Requirement | Tasks |
+|---|---|
+| REQ-001 | TASK-001, TASK-008 |
+| REQ-002 | TASK-002, TASK-009 |
+| REQ-003 | TASK-003, TASK-004, TASK-010, TASK-012 |
+| REQ-004 | TASK-005, TASK-011 |
+| REQ-005 | TASK-006, TASK-007 |
+| REQ-006 | TASK-001, TASK-003, TASK-004, TASK-005, TASK-006, TASK-007, TASK-008, TASK-010, TASK-011, TASK-012 |
+| REQ-007 | TASK-002, TASK-004, TASK-009 |
+
+## Scope Check
+
+### Tasks Too Large
+
+No tasks flagged as too large. No task has `estimated_complexity: large`.
+
+### Tasks Too Vague
+
+No tasks flagged as too vague. All tasks have detailed descriptions (>50 chars), multiple testable acceptance criteria, and specific file paths in `files_affected`.
+
+### Missing Test Tasks
+
+Two implementation tasks lack corresponding test tasks:
+
+- **TASK-006** (Fix stored XSS in admin node-tags page) — modifies `admin/node-tags.js` but no test task verifies the XSS fix in this JavaScript file. The acceptance criteria include XSS payload testing, but no automated test is specified. This is a frontend JavaScript change where manual verification or browser-based testing may be appropriate.
+
+- **TASK-007** (Fix stored XSS in admin members page) — modifies `admin/members.js` but no test task verifies the XSS fix in this JavaScript file. Same reasoning as TASK-006.
+
+**Note:** These are warnings, not blocking issues. The project's test infrastructure (`tests/test_web/`) focuses on server-side rendering and API responses. Client-side JavaScript XSS fixes are typically verified through acceptance criteria rather than automated unit tests.
+
+### Field Validation
+
+All tasks have valid fields:
+
+- **Roles:** All `suggested_role` values are valid (`python`, `frontend`, `docs`).
+- **Complexity:** All `estimated_complexity` values are valid (`small`, `medium`).
+- **Completeness:** All 12 tasks have all required fields (`id`, `title`, `description`, `requirements`, `dependencies`, `suggested_role`, `acceptance_criteria`, `estimated_complexity`, `files_affected`). All list fields have at least one entry.

.plans/2026/03/09/01-security-fixes/state.yaml

@@ -0,0 +1,22 @@
+status: running
+phase_path: .plans/2026/03/09/01-security-fixes
+branch: fix/security-fixes
+current_phase: summary
+current_task: null
+fix_round: 0
+last_review_round: 1
+review_loop_exit_reason: success
+quality_gate: pass
+tasks:
+  TASK-001: completed
+  TASK-002: completed
+  TASK-003: completed
+  TASK-004: completed
+  TASK-005: completed
+  TASK-006: completed
+  TASK-007: completed
+  TASK-008: completed
+  TASK-009: completed
+  TASK-010: completed
+  TASK-011: completed
+  TASK-012: completed

.plans/2026/03/09/01-security-fixes/summary.md

@@ -0,0 +1,117 @@
+# Phase Summary
+
+> Phase: `.plans/2026/03/09/01-security-fixes`
+> Generated by: `/jp-summary`
+
+## Project Overview
+
+This phase addresses CRITICAL and HIGH severity vulnerabilities identified in a security audit of MeshCore Hub. The fixes span stored XSS in server-rendered and client-side code, timing attacks on authentication, proxy header forgery, and a legacy endpoint with missing authentication. All changes are backward-compatible and preserve existing API contracts.
+
+### Goals
+
+- Eliminate all CRITICAL and HIGH severity security vulnerabilities found in the audit
+- Harden API key comparison against timing side-channel attacks
+- Prevent XSS vectors in both Jinja2 templates and client-side JavaScript
+- Add configurable proxy trust to defend against header forgery while maintaining backward compatibility
+- Remove the redundant legacy HTML dashboard endpoint that lacks authentication
+
+## Task Execution
+
+### Overview
+
+| Metric | Value |
+|---|---|
+| Total tasks | 12 |
+| Completed | 12 |
+| Failed | 0 |
+| Blocked | 0 |
+| Skipped | 0 |
+
+### Task Details
+
+| ID | Title | Role | Complexity | Status |
+|---|---|---|---|---|
+| TASK-001 | Remove legacy HTML dashboard endpoint | python | small | completed |
+| TASK-002 | Replace API key comparisons with constant-time comparison | python | small | completed |
+| TASK-003 | Add WEB_TRUSTED_PROXY_HOSTS configuration setting | python | small | completed |
+| TASK-004 | Integrate trusted proxy hosts into web app middleware and add startup warning | python | medium | completed |
+| TASK-005 | Escape config JSON in template script block to prevent XSS breakout | python | small | completed |
+| TASK-006 | Fix stored XSS in admin node-tags page | frontend | medium | completed |
+| TASK-007 | Fix stored XSS in admin members page | frontend | small | completed |
+| TASK-008 | Write tests for legacy dashboard endpoint removal | python | small | completed |
+| TASK-009 | Write tests for constant-time API key comparison | python | small | completed |
+| TASK-010 | Write tests for trusted proxy hosts configuration and startup warning | python | medium | completed |
+| TASK-011 | Write tests for config JSON script block escaping | python | small | completed |
+| TASK-012 | Update documentation for WEB_TRUSTED_PROXY_HOSTS setting | docs | small | completed |
+
+### Requirement Coverage
+
+| Metric | Value |
+|---|---|
+| Total PRD requirements | 7 |
+| Requirements covered by completed tasks | 7 |
+| Requirements with incomplete coverage | 0 |
+
+All functional requirements (REQ-001 through REQ-005) and non-functional requirements (REQ-006, REQ-007) are fully covered by completed tasks.
+
+## Files Created and Modified
+
+### Created
+
+- `tests/test_web/test_app.py`
+
+### Modified
+
+- `src/meshcore_hub/api/routes/dashboard.py`
+- `src/meshcore_hub/api/auth.py`
+- `src/meshcore_hub/api/metrics.py`
+- `src/meshcore_hub/common/config.py`
+- `src/meshcore_hub/web/app.py`
+- `src/meshcore_hub/web/static/js/spa/pages/admin/node-tags.js`
+- `src/meshcore_hub/web/static/js/spa/pages/admin/members.js`
+- `tests/test_api/test_dashboard.py`
+- `tests/test_api/test_auth.py`
+- `tests/test_common/test_config.py`
+- `README.md`
+- `AGENTS.md`
+- `PLAN.md`
+
+## Review Rounds
+
+### Overview
+
+| Metric | Value |
+|---|---|
+| Total review rounds | 1 |
+| Total issues found | 2 |
+| Issues fixed | 2 |
+| Issues deferred | 0 |
+| Issues remaining | 0 |
+| Regressions introduced | 0 |
+
+### Round Details
+
+#### Round 1 (scope: full)
+
+- **Issues found:** 2 (0 CRITICAL, 0 MAJOR, 2 MINOR)
+- **Issues fixed:** 2 (both MINOR issues were addressed post-review)
+- **Exit reason:** success (no CRITICAL or MAJOR issues)
+
+## Known Issues and Deferred Items
+
+No known issues. Both MINOR issues identified in the code review were addressed:
+
+- **ISSUE-001** (MINOR, integration) -- Startup warning for proxy hosts used `settings.web_admin_enabled` instead of the effective admin_enabled value. Fixed by computing `effective_admin` before the warning check.
+- **ISSUE-002** (MINOR, style) -- `unsafeHTML()` calls on pre-escaped data lacked explanatory comments. Fixed by adding inline HTML comments explaining that dynamic values are pre-escaped.
+
+## Decisions
+
+- **Truthiness guards for `hmac.compare_digest()`** -- Added `read_key and ...` / `admin_key and ...` guards in `require_read` because either key can be `None` when only one is configured, and `hmac.compare_digest()` raises `TypeError` on `None` arguments. This ensures the existing behavior of accepting either key type when configured.
+- **`unsafeHTML()` retained with `escapeHtml()` pre-processing** -- The `unsafeHTML()` calls in admin JS pages were retained because translation strings contain intentional HTML formatting tags (e.g., `<strong>`). API-sourced data is escaped before interpolation, making this pattern safe.
+- **`innerHTML` retained for tag delete confirmation** -- The delete confirmation in `node-tags.js` uses `innerHTML` because the translation template includes `<span>` formatting. The dynamic tag key is escaped with `escapeHtml()` before interpolation.
+
+## Suggested Next Steps
+
+1. Run full manual testing of admin pages (node-tags, members) with XSS payloads to verify fixes in a browser environment.
+2. Test `WEB_TRUSTED_PROXY_HOSTS` with a real reverse proxy (Traefik/Nginx) to verify proxy header trust restriction works as expected.
+3. Push commits and create a pull request for merge into `main`.

.plans/2026/03/09/01-security-fixes/tasks.yaml

@@ -0,0 +1,401 @@
+# Task list generated from PRD: .plans/2026/03/09/01-security-fixes/prd.md
+# Generated by: /jp-task-list
+
+tasks:
+  - id: "TASK-001"
+    title: "Remove legacy HTML dashboard endpoint"
+    description: |
+      Remove the `dashboard()` route handler from `src/meshcore_hub/api/routes/dashboard.py` (lines ~367-536).
+      This handler renders a standalone HTML page using f-string HTML with unescaped database content (stored XSS)
+      and has no authentication. The JSON sub-routes (`/stats`, `/activity`, `/message-activity`, `/node-count`)
+      must remain intact and unchanged.
+
+      Specifically:
+      1. Delete the `dashboard()` async function and its `@router.get("")` decorator (the handler that returns HTMLResponse).
+      2. Remove the `HTMLResponse` import from `fastapi.responses` if it is no longer used by any remaining route.
+      3. Verify that `GET /api/v1/dashboard/stats`, `/activity`, `/message-activity`, and `/node-count` still function.
+    requirements:
+      - "REQ-001"
+      - "REQ-006"
+    dependencies: []
+    suggested_role: "python"
+    acceptance_criteria:
+      - "The `dashboard()` route handler is removed from `api/routes/dashboard.py`"
+      - "`HTMLResponse` import is removed if no longer used"
+      - "`GET /api/v1/dashboard/` returns 404 or 405"
+      - "`GET /api/v1/dashboard/stats` returns valid JSON with authentication"
+      - "`GET /api/v1/dashboard/activity` returns valid JSON with authentication"
+      - "`GET /api/v1/dashboard/message-activity` returns valid JSON with authentication"
+      - "`GET /api/v1/dashboard/node-count` returns valid JSON with authentication"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/api/routes/dashboard.py"
+
+  - id: "TASK-002"
+    title: "Replace API key comparisons with constant-time comparison"
+    description: |
+      Replace all Python `==` comparisons of API keys and credentials with `hmac.compare_digest()` to prevent
+      timing side-channel attacks.
+
+      In `src/meshcore_hub/api/auth.py`:
+      1. Add `import hmac` at the top of the file.
+      2. Line ~82 in `require_read`: replace `if token == read_key or token == admin_key:` with
+         `if hmac.compare_digest(token, read_key) or hmac.compare_digest(token, admin_key):`.
+      3. Line ~127 in `require_admin`: replace `if token == admin_key:` with
+         `if hmac.compare_digest(token, admin_key):`.
+
+      In `src/meshcore_hub/api/metrics.py`:
+      1. Add `import hmac` at the top of the file.
+      2. Line ~57: replace `return username == "metrics" and password == read_key` with
+         `return hmac.compare_digest(username, "metrics") and hmac.compare_digest(password, read_key)`.
+
+      Note: `hmac.compare_digest()` requires both arguments to be strings (or both bytes). The existing code
+      already works with strings, so no type conversion is needed.
+    requirements:
+      - "REQ-002"
+      - "REQ-007"
+    dependencies: []
+    suggested_role: "python"
+    acceptance_criteria:
+      - "All API key comparisons in `api/auth.py` use `hmac.compare_digest()`"
+      - "All credential comparisons in `api/metrics.py` use `hmac.compare_digest()`"
+      - "`hmac` is imported in both files"
+      - "Valid API keys are accepted and invalid keys are rejected (no behavior change)"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/api/auth.py"
+      - "src/meshcore_hub/api/metrics.py"
+
+  - id: "TASK-003"
+    title: "Add WEB_TRUSTED_PROXY_HOSTS configuration setting"
+    description: |
+      Add a `web_trusted_proxy_hosts` field to the web settings in `src/meshcore_hub/common/config.py`.
+
+      1. In the `WebSettings` class (or the relevant settings class containing web config), add:
+         ```python
+         web_trusted_proxy_hosts: str = Field(default="*", description="Comma-separated list of trusted proxy hosts or '*' for all")
+         ```
+      2. The field should accept a string value. The `ProxyHeadersMiddleware` in uvicorn accepts either `"*"` or a list of strings.
+         If the value is `"*"`, pass it directly. Otherwise, split on commas and strip whitespace to produce a list.
+
+      This task only adds the configuration field. The middleware integration and startup warning are in TASK-004.
+    requirements:
+      - "REQ-003"
+      - "REQ-006"
+    dependencies: []
+    suggested_role: "python"
+    acceptance_criteria:
+      - "A `web_trusted_proxy_hosts` setting exists in the configuration with default value `*`"
+      - "The setting can be configured via the `WEB_TRUSTED_PROXY_HOSTS` environment variable"
+      - "The setting accepts `*` or a comma-separated list of hostnames/IPs"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/common/config.py"
+
+  - id: "TASK-004"
+    title: "Integrate trusted proxy hosts into web app middleware and add startup warning"
+    description: |
+      Update `src/meshcore_hub/web/app.py` to use the new `WEB_TRUSTED_PROXY_HOSTS` setting and emit a
+      startup warning when using the insecure default.
+
+      1. Find the `ProxyHeadersMiddleware` addition (line ~239):
+         ```python
+         app.add_middleware(ProxyHeadersMiddleware, trusted_hosts="*")
+         ```
+         Replace the hardcoded `"*"` with the configured value. If the config value is `"*"`, pass `"*"`.
+         Otherwise, split the comma-separated string into a list of strings.
+
+      2. Add a startup warning (in the app factory or lifespan) when `WEB_ADMIN_ENABLED=true` and
+         `WEB_TRUSTED_PROXY_HOSTS` is `"*"`:
+         ```python
+         import logging
+         logger = logging.getLogger(__name__)
+         if settings.web_admin_enabled and settings.web_trusted_proxy_hosts == "*":
+             logger.warning(
+                 "WEB_ADMIN_ENABLED is true but WEB_TRUSTED_PROXY_HOSTS is '*' (trust all). "
+                 "Consider restricting to your reverse proxy IP for production deployments."
+             )
+         ```
+
+      3. Verify that the `_is_authenticated_proxy_request` function still accepts `X-Forwarded-User`,
+         `X-Auth-Request-User`, and `Authorization: Basic` headers — do not modify that function.
+    requirements:
+      - "REQ-003"
+      - "REQ-006"
+      - "REQ-007"
+    dependencies:
+      - "TASK-003"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "`ProxyHeadersMiddleware` uses the configured `trusted_hosts` value instead of hardcoded `*`"
+      - "A warning is logged at startup when admin is enabled and trusted hosts is `*`"
+      - "The warning recommends restricting trusted hosts to the proxy IP"
+      - "`_is_authenticated_proxy_request` still accepts all three header types"
+      - "Setting `WEB_TRUSTED_PROXY_HOSTS` to a specific IP restricts proxy header trust"
+    estimated_complexity: "medium"
+    files_affected:
+      - "src/meshcore_hub/web/app.py"
+
+  - id: "TASK-005"
+    title: "Escape config JSON in template script block to prevent XSS breakout"
+    description: |
+      Prevent XSS via `</script>` breakout in the config JSON template injection in `src/meshcore_hub/web/app.py`.
+
+      In the `_build_config_json` function (or wherever `config_json` is prepared for the template, around
+      line 183), after calling `json.dumps(config)`, escape `</` sequences:
+      ```python
+      config_json = json.dumps(config).replace("</", "<\\/")
+      ```
+
+      This prevents a config value containing `</script><script>alert(1)</script>` from breaking out of the
+      `<script>` block in `spa.html` (line ~188: `window.__APP_CONFIG__ = {{ config_json|safe }};`).
+
+      The `|safe` filter in the template remains unchanged — the escaping happens in Python before the value
+      reaches Jinja2. The SPA client-side JavaScript can parse JSON containing `<\/` sequences because this
+      is valid JSON per the spec.
+    requirements:
+      - "REQ-004"
+      - "REQ-006"
+    dependencies: []
+    suggested_role: "python"
+    acceptance_criteria:
+      - "`config_json` is escaped by replacing `</` with `<\\/` before template rendering"
+      - "The `|safe` filter continues to be used in the template"
+      - "A config value containing `</script><script>alert(1)</script>` does not execute JavaScript"
+      - "The SPA application correctly parses the escaped config JSON"
+      - "Normal config values without special characters render unchanged"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/web/app.py"
+
+  - id: "TASK-006"
+    title: "Fix stored XSS in admin node-tags page"
+    description: |
+      Sanitize API-sourced data in `src/meshcore_hub/web/static/js/spa/pages/admin/node-tags.js` to prevent
+      stored XSS.
+
+      Three locations need fixing:
+
+      1. **Line ~243** — `unsafeHTML()` with nodeName in copy-all confirmation:
+         ```javascript
+         <p class="mb-4">${unsafeHTML(t('common.copy_all_entity_description', { count: tags.length, entity: t('entities.tags').toLowerCase(), name: nodeName }))}</p>
+         ```
+         Replace `unsafeHTML()` with safe rendering. Either escape `nodeName` with `escapeHtml()` before
+         passing to `t()`, or use `textContent`-based rendering.
+
+      2. **Line ~272** — `unsafeHTML()` with nodeName in delete-all confirmation:
+         ```javascript
+         <p class="mb-4">${unsafeHTML(t('common.delete_all_entity_confirm', { count: tags.length, entity: t('entities.tags').toLowerCase(), name: nodeName }))}</p>
+         ```
+         Same fix as above.
+
+      3. **Line ~454** — `innerHTML` with tag key in delete confirmation:
+         ```javascript
+         container.querySelector('#delete_tag_confirm_message').innerHTML = confirmMsg;
+         ```
+         where `confirmMsg` is built with `activeTagKey` interpolated into an HTML span. Replace `innerHTML`
+         with `textContent`, or escape `activeTagKey` with `escapeHtml()` before interpolation.
+
+      Import `escapeHtml` from `../components.js` if not already imported. The function escapes `<`, `>`,
+      `&`, `"`, and `'` characters using DOM textContent.
+    requirements:
+      - "REQ-005"
+      - "REQ-006"
+    dependencies: []
+    suggested_role: "frontend"
+    acceptance_criteria:
+      - "Node names in node-tags.js are escaped before HTML rendering"
+      - "Tag keys in node-tags.js are escaped before HTML rendering"
+      - "All `unsafeHTML()` calls on API-sourced data are replaced with safe alternatives"
+      - "All `innerHTML` assignments of API-sourced data are replaced with safe alternatives"
+      - "A node name containing `<img src=x onerror=alert(1)>` renders as text"
+      - "Normal names without special characters display correctly"
+    estimated_complexity: "medium"
+    files_affected:
+      - "src/meshcore_hub/web/static/js/spa/pages/admin/node-tags.js"
+
+  - id: "TASK-007"
+    title: "Fix stored XSS in admin members page"
+    description: |
+      Sanitize API-sourced data in `src/meshcore_hub/web/static/js/spa/pages/admin/members.js` to prevent
+      stored XSS.
+
+      **Line ~309** — `innerHTML` with memberName in delete confirmation:
+      ```javascript
+      container.querySelector('#delete_confirm_message').innerHTML = confirmMsg;
+      ```
+      where `confirmMsg` is built from `t('common.delete_entity_confirm', { entity: ..., name: memberName })`.
+      `memberName` comes from `row.dataset.memberName` which is API-sourced data.
+
+      Fix by escaping `memberName` with `escapeHtml()` before passing to `t()`, or replace `innerHTML` with
+      `textContent`.
+
+      Import `escapeHtml` from `../components.js` if not already imported.
+    requirements:
+      - "REQ-005"
+      - "REQ-006"
+    dependencies: []
+    suggested_role: "frontend"
+    acceptance_criteria:
+      - "Member names in members.js are escaped before HTML rendering"
+      - "The `innerHTML` assignment of API-sourced data is replaced with a safe alternative"
+      - "A member name containing `<script>alert(1)</script>` renders as text"
+      - "Normal member names display correctly"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/web/static/js/spa/pages/admin/members.js"
+
+  - id: "TASK-008"
+    title: "Write tests for legacy dashboard endpoint removal"
+    description: |
+      Add or update tests in `tests/test_api/` to verify that the legacy HTML dashboard endpoint is removed
+      while JSON sub-routes remain functional.
+
+      Tests to add/update:
+      1. `GET /api/v1/dashboard/` returns 404 or 405 (no longer serves HTML).
+      2. `GET /api/v1/dashboard/stats` returns 200 with valid JSON when authenticated.
+      3. `GET /api/v1/dashboard/activity` returns 200 with valid JSON when authenticated.
+      4. `GET /api/v1/dashboard/message-activity` returns 200 with valid JSON when authenticated.
+      5. `GET /api/v1/dashboard/node-count` returns 200 with valid JSON when authenticated.
+
+      Use the existing test fixtures and patterns from `tests/test_api/`. Check `tests/conftest.py` for
+      available fixtures (test client, db session, auth headers).
+    requirements:
+      - "REQ-001"
+      - "REQ-006"
+    dependencies:
+      - "TASK-001"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "Test confirms `GET /api/v1/dashboard/` returns 404 or 405"
+      - "Tests confirm all four JSON sub-routes return valid JSON with authentication"
+      - "All tests pass"
+    estimated_complexity: "small"
+    files_affected:
+      - "tests/test_api/test_dashboard.py"
+
+  - id: "TASK-009"
+    title: "Write tests for constant-time API key comparison"
+    description: |
+      Add or update tests in `tests/test_api/` to verify that authentication still works correctly after
+      switching to `hmac.compare_digest()`.
+
+      Tests to add/update:
+      1. Valid read key is accepted by read-protected endpoints.
+      2. Valid admin key is accepted by admin-protected endpoints.
+      3. Invalid keys are rejected with 401/403.
+      4. Valid admin key also grants read access.
+      5. Metrics endpoint accepts valid credentials and rejects invalid ones (if metrics auth is testable).
+
+      These tests verify no behavioral regression from the `==` to `hmac.compare_digest()` change.
+      Use existing test patterns and fixtures from `tests/test_api/`.
+    requirements:
+      - "REQ-002"
+      - "REQ-007"
+    dependencies:
+      - "TASK-002"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "Tests confirm valid read key is accepted"
+      - "Tests confirm valid admin key is accepted"
+      - "Tests confirm invalid keys are rejected"
+      - "Tests confirm metrics auth works correctly"
+      - "All tests pass"
+    estimated_complexity: "small"
+    files_affected:
+      - "tests/test_api/test_auth.py"
+
+  - id: "TASK-010"
+    title: "Write tests for trusted proxy hosts configuration and startup warning"
+    description: |
+      Add tests to verify the `WEB_TRUSTED_PROXY_HOSTS` configuration setting and the startup warning.
+
+      Tests to add:
+      1. Default value of `WEB_TRUSTED_PROXY_HOSTS` is `*`.
+      2. Setting `WEB_TRUSTED_PROXY_HOSTS` to a specific IP is correctly parsed.
+      3. Setting `WEB_TRUSTED_PROXY_HOSTS` to a comma-separated list is correctly parsed into a list.
+      4. A warning is logged when `WEB_ADMIN_ENABLED=true` and `WEB_TRUSTED_PROXY_HOSTS` is `*`.
+      5. No warning is logged when `WEB_TRUSTED_PROXY_HOSTS` is set to a specific value.
+
+      Place config tests in `tests/test_common/` and web app tests in `tests/test_web/`.
+    requirements:
+      - "REQ-003"
+      - "REQ-006"
+    dependencies:
+      - "TASK-003"
+      - "TASK-004"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "Tests confirm default value is `*`"
+      - "Tests confirm specific IP/list parsing works"
+      - "Tests confirm startup warning is emitted with wildcard default"
+      - "Tests confirm no warning when specific hosts are configured"
+      - "All tests pass"
+    estimated_complexity: "medium"
+    files_affected:
+      - "tests/test_common/test_config.py"
+      - "tests/test_web/test_app.py"
+
+  - id: "TASK-011"
+    title: "Write tests for config JSON script block escaping"
+    description: |
+      Add tests in `tests/test_web/` to verify that the config JSON escaping prevents XSS breakout.
+
+      Tests to add:
+      1. A config value containing `</script><script>alert(1)</script>` is escaped to `<\/script>...` in
+         the rendered HTML.
+      2. A config value without special characters renders unchanged.
+      3. The escaped JSON is still valid and parseable by `json.loads()` (after un-escaping `<\/` back to `</`
+         if needed, though `json.loads` handles `<\/` fine).
+
+      Test by calling the config JSON builder function directly or by checking the rendered template output.
+    requirements:
+      - "REQ-004"
+      - "REQ-006"
+    dependencies:
+      - "TASK-005"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "Test confirms `</script>` in config values is escaped to `<\\/script>`"
+      - "Test confirms normal config values are unaffected"
+      - "Test confirms escaped JSON is still valid and parseable"
+      - "All tests pass"
+    estimated_complexity: "small"
+    files_affected:
+      - "tests/test_web/test_app.py"
+
+  - id: "TASK-012"
+    title: "Update documentation for WEB_TRUSTED_PROXY_HOSTS setting"
+    description: |
+      Update project documentation to document the new `WEB_TRUSTED_PROXY_HOSTS` environment variable.
+
+      Files to update:
+
+      1. **README.md** — Add `WEB_TRUSTED_PROXY_HOSTS` to the environment variables table with description:
+         "Comma-separated list of trusted proxy hosts for admin authentication headers. Default: `*` (all hosts).
+         Recommended: set to your reverse proxy IP in production."
+
+      2. **AGENTS.md** — Add `WEB_TRUSTED_PROXY_HOSTS` to the Environment Variables section with the same description.
+
+      3. **PLAN.md** — If there is a configuration section, add the new variable there as well.
+
+      Ensure the documentation notes:
+      - Default is `*` for backward compatibility
+      - A startup warning is emitted when using the default with admin enabled
+      - Operators should set this to their reverse proxy IP in production
+    requirements:
+      - "REQ-003"
+      - "REQ-006"
+    dependencies:
+      - "TASK-003"
+      - "TASK-004"
+    suggested_role: "docs"
+    acceptance_criteria:
+      - "`WEB_TRUSTED_PROXY_HOSTS` is documented in README.md"
+      - "`WEB_TRUSTED_PROXY_HOSTS` is documented in AGENTS.md"
+      - "Documentation notes the default value, startup warning, and production recommendation"
+    estimated_complexity: "small"
+    files_affected:
+      - "README.md"
+      - "AGENTS.md"
+      - "PLAN.md"

.plans/2026/03/17/01-multibyte-support/changelog.md

@@ -0,0 +1,81 @@
+## TASK-001: Verify meshcore_py v2.3.0+ backwards compatibility
+**Status:** completed
+### Files Created
+_(none)_
+### Files Modified
+_(none)_
+### Notes
+Research-only task. meshcore_py v2.3.0 handles multibyte path hashes transparently at the protocol level. Path hash size is self-describing in the wire format (upper 2 bits of path length byte encode hash size). The interface receiver, sender, and device wrapper pass event payloads through without manipulation, so no code changes are needed. pyproject.toml dependency confirmed at meshcore>=2.3.0.
+---
+
+## TASK-002: Update _normalize_hash_list to accept variable-length hex strings
+**Status:** completed
+### Files Created
+_(none)_
+### Files Modified
+- `src/meshcore_hub/collector/letsmesh_normalizer.py`
+### Notes
+Changed length validation from `if len(token) != 2` to `if len(token) < 2 or len(token) % 2 != 0`. Updated docstring to describe variable-length hex hash support. Existing hex validation and uppercase normalization unchanged. All 98 collector tests pass.
+---
+
+## TASK-003: Update Pydantic schema descriptions for path_hashes fields
+**Status:** completed
+### Files Created
+_(none)_
+### Files Modified
+- `src/meshcore_hub/common/schemas/events.py`
+- `src/meshcore_hub/common/schemas/messages.py`
+- `src/meshcore_hub/common/models/trace_path.py`
+### Notes
+Updated TraceDataEvent.path_hashes, TracePathRead.path_hashes, and TracePath model docstring to reflect variable-length hex strings. No Pydantic validators needed changes - both schemas use Optional[list[str]] with no per-element length constraints.
+---
+
+## TASK-004: Update SCHEMAS.md documentation for multibyte path hashes
+**Status:** completed
+### Files Created
+_(none)_
+### Files Modified
+- `SCHEMAS.md`
+### Notes
+Updated path_hashes field description from "2-character" to variable-length hex. Updated example to include mixed-length hashes ["4a", "b3fa", "02"]. Added firmware v1.14 compatibility note.
+---
+
+## TASK-008: Verify web dashboard trace path display handles variable-length hashes
+**Status:** completed
+### Files Created
+_(none)_
+### Files Modified
+_(none)_
+### Notes
+Verification-only task. The web dashboard SPA has no trace path page and no JavaScript/CSS code referencing path_hash or pathHash. Trace path data is only served by the REST API which returns path_hashes as list[str] with no length constraints. No changes needed.
+---
+
+## TASK-005: Write tests for multibyte path hash normalizer
+**Status:** completed
+### Files Created
+- `tests/test_collector/test_letsmesh_normalizer.py`
+### Files Modified
+- `tests/test_collector/test_subscriber.py`
+### Notes
+Created 12 unit tests for _normalize_hash_list covering all 7 required scenarios plus edge cases. Added 2 integration tests to test_subscriber.py verifying multibyte path hashes flow through the full collector pipeline. All 35 collector tests pass.
+---
+
+## TASK-006: Write tests for database round-trip of multibyte path hashes
+**Status:** completed
+### Files Created
+_(none)_
+### Files Modified
+- `tests/test_common/test_models.py`
+### Notes
+Added 2 new test methods to TestTracePathModel: test_multibyte_path_hashes_round_trip and test_mixed_length_path_hashes_round_trip. Verified JSON column handles variable-length strings natively. All 10 model tests pass. No Alembic migration needed.
+---
+
+## TASK-007: Write tests for API trace path responses with multibyte hashes
+**Status:** completed
+### Files Created
+_(none)_
+### Files Modified
+- `tests/test_api/test_trace_paths.py`
+### Notes
+Added TestMultibytePathHashes class with 2 tests: list endpoint with multibyte hashes and detail endpoint with mixed-length hashes. All 9 API trace path tests pass.
+---

.plans/2026/03/17/01-multibyte-support/prd.md

@@ -0,0 +1,146 @@
+# Product Requirements Document
+
+> Source: `.plans/2026/03/17/01-multibyte-support/prompt.md`
+
+## Project Overview
+
+MeshCore Hub must be updated to support multibyte path hashes introduced in MeshCore firmware v1.14 and the meshcore_py v2.3.0 Python bindings. Path hashes — node identifiers embedded in trace and route data — were previously fixed at 1 byte (2 hex characters) per hop but can now be multiple bytes, allowing longer repeater IDs at the cost of reduced maximum hops. The update must maintain backwards compatibility with nodes running older single-byte firmware.
+
+## Goals
+
+- Support variable-length (multibyte) path hashes throughout the data pipeline: interface → MQTT → collector → database → API → web dashboard.
+- Maintain backwards compatibility so single-byte path hashes from older firmware nodes continue to work without modification.
+- Update documentation and schemas to accurately describe the new variable-length path hash format.
+
+## Functional Requirements
+
+### REQ-001: Accept Variable-Length Path Hashes in Collector
+
+**Description:** The collector's event handlers and normalizer must accept path hash strings of any even length (not just 2-character strings). Path hashes arriving from both the meshcore_py interface and LetsMesh-compatible ingest must be processed correctly regardless of byte length.
+
+**Acceptance Criteria:**
+
+- [ ] Path hashes with 2-character values (legacy single-byte) are accepted and stored correctly
+- [ ] Path hashes with 4+ character values (multibyte) are accepted and stored correctly
+- [ ] Mixed-length path hash arrays (e.g. `["4a", "b3fa", "02"]`) are accepted when the mesh contains nodes with different firmware versions
+- [ ] The LetsMesh normalizer handles multibyte `pathHashes` values from decoded payloads
+
+### REQ-002: Update Pydantic Schema Validation for Path Hashes
+
+**Description:** The `path_hashes` field in event and message Pydantic schemas currently describes values as "2-character node hash identifiers". The schema description and any validation constraints must be updated to permit variable-length hex strings.
+
+**Acceptance Criteria:**
+
+- [ ] `TraceDataEvent.path_hashes` field description reflects variable-length hex strings
+- [ ] `MessageEventBase.path_hashes` field description reflects variable-length hex strings (if applicable)
+- [ ] No schema validation rejects path hash strings longer than 2 characters
+
+### REQ-003: Verify Database Storage Compatibility
+
+**Description:** The `path_hashes` column on the `trace_paths` table uses a JSON column type. Confirm that variable-length path hash strings are stored and retrieved correctly without requiring a schema migration.
+
+**Acceptance Criteria:**
+
+- [ ] Multibyte path hash arrays are round-tripped correctly through SQLAlchemy JSON column (store and retrieve)
+- [ ] No Alembic migration is required (JSON column already supports arbitrary string lengths)
+
+### REQ-004: Update API Responses for Variable-Length Path Hashes
+
+**Description:** The trace paths API must return multibyte path hashes faithfully. API response schemas and any serialization logic must not truncate or assume a fixed length.
+
+**Acceptance Criteria:**
+
+- [ ] `GET /trace-paths` returns multibyte path hash arrays as-is from the database
+- [ ] `GET /trace-paths/{id}` returns multibyte path hash arrays as-is from the database
+- [ ] API response examples in documentation reflect variable-length path hashes
+
+### REQ-005: Update Web Dashboard Trace/Path Display
+
+**Description:** If the web dashboard displays path hashes (e.g. in trace path views), the rendering must handle variable-length strings without layout breakage or truncation.
+
+**Acceptance Criteria:**
+
+- [ ] Trace path views display multibyte path hashes correctly
+- [ ] No fixed-width formatting assumes 2-character hash strings
+
+### REQ-006: Verify meshcore_py Library Compatibility
+
+**Description:** Confirm that the meshcore_py v2.3.0+ library handles backwards compatibility with single-byte firmware nodes transparently, so that MeshCore Hub does not need to implement compatibility logic itself.
+
+**Acceptance Criteria:**
+
+- [ ] meshcore_py v2.3.0+ is confirmed to handle mixed single-byte and multibyte path hashes at the protocol level
+- [ ] The interface receiver and sender components work with the updated library without code changes beyond the dependency version bump (or with minimal changes if the library API changed)
+
+## Non-Functional Requirements
+
+### REQ-007: Backwards Compatibility
+
+**Category:** Reliability
+
+**Description:** The system must continue to operate correctly when receiving events from nodes running older (single-byte) firmware. No data loss or processing errors may occur for legacy path hash formats.
+
+**Acceptance Criteria:**
+
+- [ ] Existing test cases with 2-character path hashes continue to pass without modification
+- [ ] New test cases with multibyte path hashes pass alongside legacy test cases
+- [ ] No database migration is required that would break rollback to the previous version
+
+### REQ-008: Documentation Accuracy
+
+**Category:** Maintainability
+
+**Description:** All documentation referencing path hash format must be updated to reflect the variable-length nature of multibyte path hashes.
+
+**Acceptance Criteria:**
+
+- [ ] `SCHEMAS.md` path hash descriptions updated from "2-character" to "variable-length hex string"
+- [ ] Code docstrings and field descriptions in models/schemas updated
+- [ ] Example payloads in documentation include at least one multibyte path hash example
+
+## Technical Constraints and Assumptions
+
+### Constraints
+
+- Python 3.13+ (specified by project)
+- meshcore_py >= 2.3.0 (already set in `pyproject.toml`)
+- SQLite with JSON column for path hash storage (existing schema)
+- No breaking changes to the REST API response format
+
+### Assumptions
+
+- The meshcore_py library handles protocol-level backwards compatibility for multibyte path hashes, so MeshCore Hub only needs to ensure its data pipeline accepts variable-length strings
+- Path hashes are always valid hex strings (even number of characters)
+- The JSON column type in SQLite/SQLAlchemy does not impose length restrictions on individual array element strings
+- The `pyproject.toml` dependency has already been bumped to `meshcore>=2.3.0`
+
+## Scope
+
+### In Scope
+
+- Updating Pydantic schema descriptions and validation for variable-length path hashes
+- Updating collector handlers and normalizer for multibyte path hashes
+- Verifying database storage compatibility (no migration expected)
+- Verifying API response compatibility
+- Updating web dashboard path hash display if applicable
+- Updating `SCHEMAS.md` and code documentation
+- Adding/updating tests for multibyte path hashes
+- Confirming meshcore_py library handles backwards compatibility
+
+### Out of Scope
+
+- MeshCore firmware changes or device-side configuration
+- Adding UI controls for selecting single-byte vs. multibyte mode
+- Performance optimization of path hash processing
+- Changes to MQTT topic structure or message format
+- LetsMesh ingest protocol changes (beyond accepting multibyte values that LetsMesh already provides)
+
+## Suggested Tech Stack
+
+| Layer | Technology | Rationale |
+|-------|-----------|-----------|
+| MeshCore bindings | meshcore_py >= 2.3.0 | Specified by prompt; provides multibyte path hash support |
+| Validation | Pydantic v2 | Existing stack — schema descriptions updated |
+| Database | SQLAlchemy 2.0 + SQLite JSON | Existing stack — no migration needed |
+| API | FastAPI | Existing stack — no changes to framework |
+| Testing | pytest + pytest-asyncio | Existing stack — new test cases for multibyte |

.plans/2026/03/17/01-multibyte-support/prompt.md

@@ -0,0 +1,17 @@
+# Phase: 01-multibyte-support
+
+## Overview
+
+The latest MeshCore firmware (v1.14) has introduced multibyte support for multi-byte path hashes. The latest version of the MeshCore Python bindings (meshcore_py) has been updated to use this. This allows longer repeater IDs per hop, but reduces the maximum allowed hops. Nodes running older firmware only support 1-byte path hashes and will not receive messages if other nodes use multibyte path hashes.
+
+## Goals
+
+* Update Receiver/Sender component to use latest version of MeshCore Python bindings that support multibyte path hash handling.
+
+## Requirements
+
+* Must remain backwards compatible with previous version. Confirm whether this is handled by the Python library.
+
+## References
+
+* https://github.com/meshcore-dev/meshcore_py/releases/tag/v2.3.0

.plans/2026/03/17/01-multibyte-support/reviews/cycle/001.yaml

@@ -0,0 +1,19 @@
+# Code review round 001
+# Phase: .plans/2026/03/17/01-multibyte-support
+# Scope: full
+# Generated by: /jp-codereview
+
+issues: []
+
+summary:
+  total_issues: 0
+  critical: 0
+  major: 0
+  minor: 0
+  by_category:
+    integration: 0
+    architecture: 0
+    security: 0
+    duplication: 0
+    error-handling: 0
+    style: 0

.plans/2026/03/17/01-multibyte-support/reviews/prd.md

@@ -0,0 +1,57 @@
+# PRD Review
+
+> Phase: `.plans/2026/03/17/01-multibyte-support`
+> PRD: `.plans/2026/03/17/01-multibyte-support/prd.md`
+> Prompt: `.plans/2026/03/17/01-multibyte-support/prompt.md`
+
+## Verdict: PASS
+
+The PRD comprehensively addresses the narrow scope of the original prompt. All prompt items are covered by specific requirements with testable acceptance criteria. The PRD appropriately expands the prompt's Receiver/Sender focus to cover the full data pipeline (collector, schemas, database, API, web), which is necessary for end-to-end multibyte support. No contradictions, feasibility concerns, or scope inconsistencies were found.
+
+## Coverage Assessment
+
+| Prompt Item | PRD Section | Covered? | Notes |
+|---|---|---|---|
+| Update Receiver/Sender to use latest meshcore_py with multibyte support | REQ-006 | Yes | Covered by library compatibility verification; receiver/sender work with updated bindings |
+| Must remain backwards compatible with previous version | REQ-007 | Yes | Explicit non-functional requirement with 3 testable acceptance criteria |
+| Confirm whether backwards compat is handled by the Python library | REQ-006 | Yes | First AC specifically calls for confirming library-level protocol compatibility |
+| Reference to meshcore_py v2.3.0 release | Constraints, Tech Stack | Yes | Noted in constraints and suggested tech stack table |
+
+**Coverage summary:** 4 of 4 prompt items fully covered, 0 partially covered, 0 not covered.
+
+## Requirement Evaluation
+
+All requirements passed evaluation. Minor observations:
+
+### REQ-006: Verify meshcore_py Library Compatibility
+
+- **Implementability:** Pass
+- **Testability:** Pass -- though the first AC ("confirmed to handle...at the protocol level") is a verification/research task rather than an automated test, this is appropriate given the prompt explicitly asks to confirm library behavior
+- **Completeness:** Pass
+- **Consistency:** Pass
+
+## Structural Issues
+
+### Contradictions
+
+None found.
+
+### Ambiguities
+
+None found. The PRD is appropriately specific for the scope of work.
+
+### Missing Edge Cases
+
+None significant. The PRD covers the key edge case of mixed-length path hash arrays from heterogeneous firmware networks (REQ-001 AC3).
+
+### Feasibility Concerns
+
+None. The changes are primarily documentation/description updates and verification tasks. The JSON column type inherently supports variable-length strings, and the meshcore_py dependency is already bumped.
+
+### Scope Inconsistencies
+
+None. The PRD's scope appropriately extends beyond the prompt's Receiver/Sender focus to cover downstream components (collector, API, web) that also handle path hashes. This is a necessary expansion, not scope creep.
+
+## Action Items
+
+No action items -- verdict is PASS.

.plans/2026/03/17/01-multibyte-support/reviews/tasks.md

@@ -0,0 +1,89 @@
+# Task Review
+
+> Phase: `.plans/2026/03/17/01-multibyte-support`
+> Tasks: `.plans/2026/03/17/01-multibyte-support/tasks.yaml`
+> PRD: `.plans/2026/03/17/01-multibyte-support/prd.md`
+
+## Verdict: PASS
+
+The task list is structurally sound, correctly ordered, and fully covers all 8 PRD requirements. The dependency graph is a valid DAG with no cycles or invalid references. No ordering issues were found — no task references files that should be produced by a task outside its dependency chain. All tasks have valid roles, complexity values, and complete fields. The task breakdown is appropriate for the narrow scope of this phase.
+
+## Dependency Validation
+
+### Reference Validity
+
+All dependency references are valid. Every task ID in every `dependencies` list corresponds to an existing task in the inventory.
+
+### DAG Validation
+
+The dependency graph is a valid DAG with no cycles. Maximum dependency depth is 1 (two test tasks depend on one implementation task each).
+
+### Orphan Tasks
+
+The following tasks are never referenced as dependencies by other tasks:
+
+- **TASK-001** (Verify meshcore_py compatibility) — terminal verification task, expected
+- **TASK-004** (Update SCHEMAS.md) — terminal documentation task, expected
+- **TASK-005** (Tests for normalizer) — terminal test task, expected
+- **TASK-006** (Tests for DB round-trip) — terminal test task, expected
+- **TASK-007** (Tests for API responses) — terminal test task, expected
+- **TASK-008** (Verify web dashboard) — terminal verification task, expected
+
+All orphan tasks are leaf nodes (tests, docs, or verification tasks). No missing integration points.
+
+## Ordering Check
+
+No ordering issues detected. No task modifies a file that is also modified by another task outside its dependency chain. The `files_affected` sets across all tasks are disjoint except where proper dependency relationships exist.
+
+## Coverage Check
+
+### Uncovered Requirements
+
+All PRD requirements are covered.
+
+### Phantom References
+
+No phantom references detected. Every requirement ID referenced in tasks exists in the PRD.
+
+**Coverage summary:** 8 of 8 PRD requirements covered by tasks.
+
+| Requirement | Covered By |
+|---|---|
+| REQ-001 | TASK-002, TASK-005 |
+| REQ-002 | TASK-003 |
+| REQ-003 | TASK-006 |
+| REQ-004 | TASK-007 |
+| REQ-005 | TASK-008 |
+| REQ-006 | TASK-001 |
+| REQ-007 | TASK-005, TASK-006, TASK-007 |
+| REQ-008 | TASK-004 |
+
+## Scope Check
+
+### Tasks Too Large
+
+No tasks flagged as too large. All tasks are `small` complexity except TASK-005 (`medium`), which is appropriately scoped for a test suite covering 7 unit test scenarios plus an integration test.
+
+### Tasks Too Vague
+
+No tasks flagged as too vague. All tasks have detailed descriptions (well over 50 characters), multiple testable acceptance criteria, and specific file paths.
+
+### Missing Test Tasks
+
+- **TASK-001** (Verify meshcore_py compatibility) — no associated test task. This is a research/verification task that does not produce source code, so a test task is not applicable. (Warning only)
+- **TASK-004** (Update SCHEMAS.md) — no associated test task. This is a documentation-only task. (Warning only)
+- **TASK-008** (Verify web dashboard) — no associated test task. This is a verification task that may result in no code changes. (Warning only)
+
+All implementation tasks that modify source code (TASK-002, TASK-003) have corresponding test tasks (TASK-005, TASK-006, TASK-007).
+
+### Field Validation
+
+All tasks have valid fields:
+- All `suggested_role` values are valid (`python`, `docs`, `frontend`)
+- All `estimated_complexity` values are valid (`small`, `medium`)
+- All tasks have at least one entry in `requirements`, `acceptance_criteria`, and `files_affected`
+- All task IDs follow the `TASK-NNN` format with sequential numbering
+
+## Action Items
+
+No action items — verdict is PASS.

.plans/2026/03/17/01-multibyte-support/state.yaml

@@ -0,0 +1,18 @@
+status: completed
+phase_path: .plans/2026/03/17/01-multibyte-support
+branch: feature/multibyte-support
+current_phase: completed
+current_task: null
+fix_round: 0
+last_review_round: 1
+review_loop_exit_reason: success
+quality_gate: pass
+tasks:
+  TASK-001: completed
+  TASK-002: completed
+  TASK-003: completed
+  TASK-004: completed
+  TASK-005: completed
+  TASK-006: completed
+  TASK-007: completed
+  TASK-008: completed

.plans/2026/03/17/01-multibyte-support/summary.md

@@ -0,0 +1,102 @@
+# Phase Summary
+
+> Phase: `.plans/2026/03/17/01-multibyte-support`
+> Generated by: `/jp-summary`
+
+## Project Overview
+
+MeshCore Hub was updated to support multibyte path hashes introduced in MeshCore firmware v1.14 and meshcore_py v2.3.0. Path hashes — node identifiers embedded in trace and route data — were previously fixed at 1 byte (2 hex characters) per hop but can now be multiple bytes. The update maintains backwards compatibility with nodes running older single-byte firmware.
+
+### Goals
+
+- Support variable-length (multibyte) path hashes throughout the data pipeline: interface → MQTT → collector → database → API → web dashboard.
+- Maintain backwards compatibility so single-byte path hashes from older firmware nodes continue to work without modification.
+- Update documentation and schemas to accurately describe the new variable-length path hash format.
+
+## Task Execution
+
+### Overview
+
+| Metric | Value |
+|---|---|
+| Total tasks | 8 |
+| Completed | 8 |
+| Failed | 0 |
+| Blocked | 0 |
+| Skipped | 0 |
+
+### Task Details
+
+| ID | Title | Role | Complexity | Status |
+|---|---|---|---|---|
+| TASK-001 | Verify meshcore_py v2.3.0+ backwards compatibility | python | small | completed |
+| TASK-002 | Update _normalize_hash_list to accept variable-length hex strings | python | small | completed |
+| TASK-003 | Update Pydantic schema descriptions for path_hashes fields | python | small | completed |
+| TASK-004 | Update SCHEMAS.md documentation for multibyte path hashes | docs | small | completed |
+| TASK-005 | Write tests for multibyte path hash normalizer | python | medium | completed |
+| TASK-006 | Write tests for database round-trip of multibyte path hashes | python | small | completed |
+| TASK-007 | Write tests for API trace path responses with multibyte hashes | python | small | completed |
+| TASK-008 | Verify web dashboard trace path display handles variable-length hashes | frontend | small | completed |
+
+### Requirement Coverage
+
+| Metric | Value |
+|---|---|
+| Total PRD requirements | 8 |
+| Requirements covered by completed tasks | 8 |
+| Requirements with incomplete coverage | 0 |
+
+## Files Created and Modified
+
+### Created
+
+- `tests/test_collector/test_letsmesh_normalizer.py`
+
+### Modified
+
+- `pyproject.toml`
+- `SCHEMAS.md`
+- `src/meshcore_hub/collector/letsmesh_normalizer.py`
+- `src/meshcore_hub/common/schemas/events.py`
+- `src/meshcore_hub/common/schemas/messages.py`
+- `src/meshcore_hub/common/models/trace_path.py`
+- `tests/test_collector/test_subscriber.py`
+- `tests/test_common/test_models.py`
+- `tests/test_api/test_trace_paths.py`
+
+## Review Rounds
+
+### Overview
+
+| Metric | Value |
+|---|---|
+| Total review rounds | 1 |
+| Total issues found | 0 |
+| Issues fixed | 0 |
+| Issues deferred | 0 |
+| Issues remaining | 0 |
+| Regressions introduced | 0 |
+
+### Round Details
+
+#### Round 1 (scope: full)
+
+- **Issues found:** 0 (0 CRITICAL, 0 MAJOR, 0 MINOR)
+- **Exit reason:** success (clean review, no fix rounds needed)
+
+## Known Issues and Deferred Items
+
+No known issues.
+
+## Decisions
+
+- **meshcore_py handles backwards compatibility transparently** -- Research (TASK-001) confirmed that meshcore_py v2.3.0 handles multibyte path hashes at the protocol level via self-describing wire format. No compatibility logic needed in MeshCore Hub's interface layer.
+- **No database migration required** -- The existing JSON column type on `trace_paths.path_hashes` stores variable-length string arrays natively. Round-trip tests confirmed no data loss.
+- **No web dashboard changes needed** -- The SPA has no trace path rendering page. Path hashes are only served via the REST API which uses `list[str]` with no length constraints.
+- **Normalizer validation approach** -- Changed from exact length check (`len == 2`) to even-length minimum-2 check (`len >= 2 and len % 2 == 0`), preserving existing hex validation and uppercase normalization.
+
+## Suggested Next Steps
+
+1. Push the branch and create a pull request for review.
+2. Perform manual integration testing with a MeshCore device running firmware v1.14+ to verify multibyte path hashes flow end-to-end.
+3. Verify that mixed-firmware networks (some nodes v1.14+, some older) produce correct mixed-length path hash arrays in the database.

.plans/2026/03/17/01-multibyte-support/tasks.yaml

@@ -0,0 +1,274 @@
+# Task list generated from PRD: .plans/2026/03/17/01-multibyte-support/prd.md
+# Generated by: /jp-task-list
+
+tasks:
+  - id: "TASK-001"
+    title: "Verify meshcore_py v2.3.0+ backwards compatibility"
+    description: |
+      Research and confirm that meshcore_py v2.3.0+ handles backwards compatibility
+      with single-byte firmware nodes at the protocol level. Check the meshcore_py
+      v2.3.0 release notes and source code to determine whether the library
+      transparently handles mixed single-byte and multibyte path hashes, or whether
+      MeshCore Hub needs to implement any compatibility logic.
+
+      The pyproject.toml dependency is already set to meshcore>=2.3.0. Verify the
+      interface receiver (src/meshcore_hub/interface/receiver.py) and sender
+      (src/meshcore_hub/interface/sender.py) components work with the updated library
+      without code changes, or document any API changes that require updates.
+
+      Document findings as a comment block at the top of the PR description or in
+      the phase changelog.
+    requirements:
+      - "REQ-006"
+    dependencies: []
+    suggested_role: "python"
+    acceptance_criteria:
+      - "meshcore_py v2.3.0+ backwards compatibility behaviour is documented"
+      - "Any required interface code changes are identified (or confirmed unnecessary)"
+      - "pyproject.toml dependency version is confirmed correct at >=2.3.0"
+    estimated_complexity: "small"
+    files_affected:
+      - "pyproject.toml"
+
+  - id: "TASK-002"
+    title: "Update _normalize_hash_list to accept variable-length hex strings"
+    description: |
+      The LetsMesh normalizer method `_normalize_hash_list` in
+      src/meshcore_hub/collector/letsmesh_normalizer.py (line ~724) currently rejects
+      any path hash string that is not exactly 2 characters long:
+
+          if len(token) != 2:
+              continue
+
+      Update this method to accept variable-length hex strings (any even-length hex
+      string of 2+ characters). The validation should:
+      - Accept strings of length 2, 4, 6, etc. (even-length, minimum 2)
+      - Reject odd-length strings and empty strings
+      - Continue to validate that all characters are valid hexadecimal (0-9, A-F)
+      - Continue to uppercase-normalize the hex strings
+
+      Also update the method's docstring from "Normalize a list of one-byte hash
+      strings" to reflect variable-length support.
+    requirements:
+      - "REQ-001"
+    dependencies: []
+    suggested_role: "python"
+    acceptance_criteria:
+      - "_normalize_hash_list accepts 2-character hex strings (legacy single-byte)"
+      - "_normalize_hash_list accepts 4+ character hex strings (multibyte)"
+      - "_normalize_hash_list rejects odd-length strings"
+      - "_normalize_hash_list rejects non-hex characters"
+      - "_normalize_hash_list uppercases all hex strings"
+      - "Method docstring updated to describe variable-length support"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/collector/letsmesh_normalizer.py"
+
+  - id: "TASK-003"
+    done: true
+    title: "Update Pydantic schema descriptions for path_hashes fields"
+    description: |
+      Update the `path_hashes` field description in Pydantic schemas to reflect
+      variable-length hex strings instead of fixed 2-character strings.
+
+      Files and fields to update:
+
+      1. src/meshcore_hub/common/schemas/events.py - TraceDataEvent.path_hashes
+         (line ~134): Change description from "Array of 2-character node hash
+         identifiers" to "Array of hex-encoded node hash identifiers (variable
+         length, e.g. '4a' for single-byte or 'b3fa' for multibyte)"
+
+      2. src/meshcore_hub/common/schemas/messages.py - MessageEventBase.path_hashes
+         or TracePathRead.path_hashes (line ~157): Update description similarly
+         if it references fixed-length hashes.
+
+      3. src/meshcore_hub/common/models/trace_path.py - TracePath.path_hashes
+         docstring (line ~23): Change "JSON array of node hash identifiers" to
+         "JSON array of hex-encoded node hash identifiers (variable length)"
+
+      Ensure no Pydantic validators or Field constraints reject strings longer
+      than 2 characters. The current schemas use Optional[list[str]] with no
+      per-element length validation, so no validator changes should be needed.
+    requirements:
+      - "REQ-002"
+    dependencies: []
+    suggested_role: "python"
+    acceptance_criteria:
+      - "TraceDataEvent.path_hashes description reflects variable-length hex strings"
+      - "TracePathRead.path_hashes description reflects variable-length hex strings"
+      - "TracePath model docstring updated for variable-length path hashes"
+      - "No Pydantic validation rejects path hash strings longer than 2 characters"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/common/schemas/events.py"
+      - "src/meshcore_hub/common/schemas/messages.py"
+      - "src/meshcore_hub/common/models/trace_path.py"
+
+  - id: "TASK-004"
+    title: "Update SCHEMAS.md documentation for multibyte path hashes"
+    description: |
+      Update SCHEMAS.md to reflect the new variable-length path hash format
+      introduced in MeshCore firmware v1.14.
+
+      Changes needed:
+
+      1. Line ~228: Change "Array of 2-character node hash identifiers (ordered
+         by hops)" to "Array of hex-encoded node hash identifiers, variable length
+         (e.g. '4a' for single-byte, 'b3fa' for multibyte), ordered by hops"
+
+      2. Line ~239: Update the example path_hashes array to include at least one
+         multibyte hash, e.g.:
+         "path_hashes": ["4a", "b3fa", "02"]
+         This demonstrates mixed single-byte and multibyte hashes in the same trace.
+
+      3. Add a brief note explaining that firmware v1.14+ supports multibyte path
+         hashes and that older nodes use single-byte (2-character) hashes, so
+         mixed-length arrays are expected in heterogeneous networks.
+    requirements:
+      - "REQ-008"
+    dependencies: []
+    suggested_role: "docs"
+    acceptance_criteria:
+      - "path_hashes field description updated from '2-character' to 'variable-length hex'"
+      - "Example payload includes at least one multibyte path hash"
+      - "Note about firmware version compatibility is present"
+    estimated_complexity: "small"
+    files_affected:
+      - "SCHEMAS.md"
+
+  - id: "TASK-005"
+    done: true
+    title: "Write tests for multibyte path hash normalizer"
+    description: |
+      Add tests for the updated _normalize_hash_list method in the LetsMesh
+      normalizer to verify it handles variable-length hex strings correctly.
+
+      Add test cases in tests/test_collector/ (either in an existing normalizer
+      test file or a new test_letsmesh_normalizer.py if one doesn't exist):
+
+      1. Single-byte (2-char) hashes: ["4a", "b3", "fa"] -> accepted, uppercased
+      2. Multibyte (4-char) hashes: ["4a2b", "b3fa"] -> accepted, uppercased
+      3. Mixed-length hashes: ["4a", "b3fa", "02"] -> all accepted
+      4. Odd-length strings: ["4a", "b3f", "02"] -> "b3f" filtered out
+      5. Invalid hex characters: ["4a", "zz", "02"] -> "zz" filtered out
+      6. Empty list: [] -> returns None
+      7. Non-string items: [42, "4a"] -> 42 filtered out
+
+      Also add/update integration-level tests in tests/test_collector/test_subscriber.py
+      to verify that multibyte path hashes flow through the full collector pipeline
+      (subscriber -> handler -> database) correctly. The existing test cases at
+      lines ~607 and ~662 use 2-character hashes; add a parallel test case with
+      multibyte hashes.
+    requirements:
+      - "REQ-001"
+      - "REQ-007"
+    dependencies:
+      - "TASK-002"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "Unit tests for _normalize_hash_list cover all 7 scenarios listed"
+      - "Integration test verifies multibyte path hashes stored correctly in database"
+      - "All existing 2-character path hash tests continue to pass"
+      - "All new tests pass"
+    estimated_complexity: "medium"
+    files_affected:
+      - "tests/test_collector/test_letsmesh_normalizer.py"
+      - "tests/test_collector/test_subscriber.py"
+
+  - id: "TASK-006"
+    title: "Write tests for database round-trip of multibyte path hashes"
+    description: |
+      Verify that the SQLAlchemy JSON column on the TracePath model correctly
+      stores and retrieves variable-length path hash arrays without data loss
+      or truncation.
+
+      Add test cases in tests/test_common/test_models.py (where existing
+      TracePath tests are at line ~129):
+
+      1. Store and retrieve a TracePath with multibyte path_hashes:
+         ["4a2b", "b3fa", "02cd"] -> verify round-trip equality
+      2. Store and retrieve a TracePath with mixed-length path_hashes:
+         ["4a", "b3fa", "02"] -> verify round-trip equality
+      3. Verify existing test with 2-character hashes still passes
+
+      These tests confirm REQ-003 (no migration needed) and contribute to
+      REQ-007 (backwards compatibility).
+    requirements:
+      - "REQ-003"
+      - "REQ-007"
+    dependencies:
+      - "TASK-003"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "Test verifies multibyte path_hashes round-trip through JSON column correctly"
+      - "Test verifies mixed-length path_hashes round-trip correctly"
+      - "Existing 2-character path hash test continues to pass"
+      - "No Alembic migration is created or required"
+    estimated_complexity: "small"
+    files_affected:
+      - "tests/test_common/test_models.py"
+
+  - id: "TASK-007"
+    title: "Write tests for API trace path responses with multibyte hashes"
+    description: |
+      Add test cases in tests/test_api/test_trace_paths.py to verify that the
+      trace paths API returns multibyte path hashes faithfully.
+
+      The existing test fixtures in tests/test_api/conftest.py create
+      sample_trace_path objects with path_hashes like ["abc123", "def456",
+      "ghi789"] (line ~275). Note these are already 6-character strings, so
+      the API serialization likely already works. Add explicit test cases:
+
+      1. Create a trace path with multibyte path_hashes (e.g. ["4a2b", "b3fa"])
+         via the fixture, then GET /trace-paths and verify the response contains
+         the exact same array.
+      2. Create a trace path with mixed-length path_hashes (e.g. ["4a", "b3fa",
+         "02"]), then GET /trace-paths/{id} and verify the response.
+      3. Verify existing API tests with current path_hashes continue to pass.
+
+      These tests confirm REQ-004.
+    requirements:
+      - "REQ-004"
+      - "REQ-007"
+    dependencies:
+      - "TASK-003"
+    suggested_role: "python"
+    acceptance_criteria:
+      - "Test verifies GET /trace-paths returns multibyte path hashes correctly"
+      - "Test verifies GET /trace-paths/{id} returns mixed-length path hashes correctly"
+      - "Existing API trace path tests continue to pass"
+    estimated_complexity: "small"
+    files_affected:
+      - "tests/test_api/test_trace_paths.py"
+      - "tests/test_api/conftest.py"
+
+  - id: "TASK-008"
+    done: true
+    title: "Verify web dashboard trace path display handles variable-length hashes"
+    description: |
+      Verify that the web dashboard does not have any hardcoded assumptions about
+      2-character path hash strings. A grep of src/meshcore_hub/web/static/js/spa/
+      for "path_hash" and "trace" shows no direct references to path hashes in the
+      SPA JavaScript code, meaning path hashes are likely rendered generically
+      through the API data display.
+
+      Confirm this by:
+      1. Checking all web template and JavaScript files that render trace path data
+      2. Verifying no CSS or JS applies fixed-width formatting to path hash elements
+      3. If any fixed-width or truncation logic exists, update it to handle
+         variable-length strings
+
+      If no web code references path hashes directly (as initial grep suggests),
+      document that the web dashboard requires no changes for multibyte support.
+      This satisfies REQ-005.
+    requirements:
+      - "REQ-005"
+    dependencies: []
+    suggested_role: "frontend"
+    acceptance_criteria:
+      - "Web dashboard trace/path display verified to handle variable-length hashes"
+      - "No fixed-width formatting assumes 2-character hash strings"
+      - "Any necessary changes applied, or no-change finding documented"
+    estimated_complexity: "small"
+    files_affected:
+      - "src/meshcore_hub/web/static/js/spa/pages/trace-paths.js"

.pre-commit-config.yaml

@@ -1,3 +1,6 @@
+default_language_version:
+  python: python3
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
@@ -14,7 +17,6 @@ repos:
     rev: 24.3.0
     hooks:
       - id: black
-        language_version: python3.13
         args: ["--line-length=88"]
 
   - repo: https://github.com/pycqa/flake8

.python-version

@@ -1 +1 @@
-3.13
+3.14

AGENTS.md

@@ -12,6 +12,7 @@ This document provides context and guidelines for AI coding assistants working o
   - `source .venv/bin/activate`
 * You MUST install all project dependencies using `pip install -e ".[dev]"` command`
 * You MUST install `pre-commit` for quality checks
+* You MUST keep project documentation in sync with behavior/config/schema changes made in code (at minimum update relevant sections in `README.md`, `SCHEMAS.md`, `PLAN.md`, and/or `TASKS.md` when applicable)
 * Before commiting:
   - Run **targeted tests** for the components you changed, not the full suite:
     - `pytest tests/test_web/` for web-only changes (templates, static JS, web routes)
@@ -281,13 +282,15 @@ meshcore-hub/
 │   │   ├── app.py            # FastAPI app
 │   │   ├── auth.py           # Authentication
 │   │   ├── dependencies.py
+│   │   ├── metrics.py        # Prometheus metrics endpoint
 │   │   └── routes/           # API routes
 │   │       ├── members.py    # Member CRUD endpoints
 │   │       └── ...
 │   └── web/
 │       ├── cli.py
 │       ├── app.py            # FastAPI app
-│       ├── templates/        # Jinja2 templates (spa.html shell, base.html)
+│       ├── pages.py          # Custom markdown page loader
+│       ├── templates/        # Jinja2 templates (spa.html shell)
 │       └── static/
 │           ├── css/app.css   # Custom styles
 │           └── js/spa/       # SPA frontend (ES modules)
@@ -310,11 +313,19 @@ meshcore-hub/
 │   ├── env.py
 │   └── versions/
 ├── etc/
-│   └── mosquitto.conf        # MQTT broker configuration
+│   ├── mosquitto.conf        # MQTT broker configuration
+│   ├── prometheus/            # Prometheus configuration
+│   │   ├── prometheus.yml    # Scrape and alerting config
+│   │   └── alerts.yml        # Alert rules
+│   └── alertmanager/          # Alertmanager configuration
+│       └── alertmanager.yml  # Routing and receiver config
 ├── example/
-│   └── seed/                 # Example seed data files
-│       ├── node_tags.yaml    # Example node tags
-│       └── members.yaml      # Example network members
+│   ├── seed/                 # Example seed data files
+│   │   ├── node_tags.yaml    # Example node tags
+│   │   └── members.yaml      # Example network members
+│   └── content/              # Example custom content
+│       ├── pages/            # Example custom pages
+│       └── media/            # Example media files
 ├── seed/                     # Seed data directory (SEED_HOME)
 │   ├── node_tags.yaml        # Node tags for import
 │   └── members.yaml          # Network members for import
@@ -355,6 +366,25 @@ Examples:
 - JSON columns for flexible data (path_hashes, parsed_data, etc.)
 - Foreign keys reference nodes by UUID, not public_key
 
+## Standard Node Tags
+
+Node tags are flexible key-value pairs that allow custom metadata to be attached to nodes. While tags are completely optional and freeform, the following standard tag keys are recommended for consistent use across the web dashboard:
+
+| Tag Key | Description | Usage |
+|---------|-------------|-------|
+| `name` | Node display name | Used as the primary display name throughout the UI (overrides the advertised name) |
+| `description` | Short description | Displayed as supplementary text under the node name |
+| `member_id` | Member identifier reference | Links the node to a network member (matches `member_id` in Members table) |
+| `lat` | GPS latitude override | Overrides node-reported latitude for map display |
+| `lon` | GPS longitude override | Overrides node-reported longitude for map display |
+| `elevation` | GPS elevation override | Overrides node-reported elevation |
+| `role` | Node role/purpose | Used for website presentation and filtering (e.g., "gateway", "repeater", "sensor") |
+
+**Important Notes:**
+- All tags are optional - nodes can function without any tags
+- Tag keys are case-sensitive
+- The `member_id` tag should reference a valid `member_id` from the Members table
+
 ## Testing Guidelines
 
 ### Unit Tests
@@ -449,13 +479,103 @@ The web dashboard is a Single Page Application. Pages are ES modules loaded by t
 - Use `pageColors` from `components.js` for section-specific colors (reads CSS custom properties from `app.css`)
 - Return a cleanup function if the page creates resources (e.g., Leaflet maps, Chart.js instances)
 
+### Internationalization (i18n)
+
+The web dashboard supports internationalization via JSON translation files. The default language is English.
+
+**Translation files location:** `src/meshcore_hub/web/static/locales/`
+
+**Key files:**
+- `en.json` - English translations (reference implementation)
+- `languages.md` - Comprehensive translation reference guide for translators
+
+**Using translations in JavaScript:**
+
+Import the `t()` function from `components.js`:
+
+```javascript
+import { t } from '../components.js';
+
+// Simple translation
+const label = t('common.save');  // "Save"
+
+// Translation with variable interpolation
+const title = t('common.add_entity', { entity: t('entities.node') });  // "Add Node"
+
+// Composed patterns for consistency
+const emptyMsg = t('common.no_entity_found', { entity: t('entities.nodes').toLowerCase() });  // "No nodes found"
+```
+
+**Translation architecture:**
+
+1. **Entity-based composition:** Core entity names (`entities.*`) are referenced by composite patterns for consistency
+2. **Reusable patterns:** Common UI patterns (`common.*`) use `{{variable}}` interpolation for dynamic content
+3. **Separation of concerns:**
+   - Keys without `_label` suffix = table headers (title case, no colon)
+   - Keys with `_label` suffix = inline labels (sentence case, with colon)
+
+**When adding/modifying translations:**
+
+1. **Add new keys** to `en.json` following existing patterns:
+   - Use composition when possible (reference `entities.*` in `common.*` patterns)
+   - Group related keys by section (e.g., `admin_members.*`, `admin_node_tags.*`)
+   - Use `{{variable}}` syntax for dynamic content
+
+2. **Update `languages.md`** with:
+   - Key name, English value, and usage context
+   - Variable descriptions if using interpolation
+   - Notes about HTML content or special formatting
+
+3. **Add tests** in `tests/test_common/test_i18n.py`:
+   - Test new interpolation patterns
+   - Test required sections if adding new top-level sections
+   - Test composed patterns with entity references
+
+4. **Run i18n tests:**
+   ```bash
+   pytest tests/test_common/test_i18n.py -v
+   ```
+
+**Best practices:**
+
+- **Avoid duplication:** Use `common.*` patterns instead of duplicating similar strings
+- **Compose with entities:** Reference `entities.*` keys in patterns rather than hardcoding entity names
+- **Preserve variables:** Keep `{{variable}}` placeholders unchanged when translating
+- **Test composition:** Verify patterns work with all entity types (singular/plural, lowercase/uppercase)
+- **Document context:** Always update `languages.md` so translators understand usage
+
+**Example - adding a new entity and patterns:**
+
+```javascript
+// 1. Add entity to en.json
+"entities": {
+  "sensor": "Sensor"
+}
+
+// 2. Use with existing common patterns
+t('common.add_entity', { entity: t('entities.sensor') })  // "Add Sensor"
+t('common.no_entity_found', { entity: t('entities.sensors').toLowerCase() })  // "No sensors found"
+
+// 3. Update languages.md with context
+// 4. Add test to test_i18n.py
+```
+
+**Translation loading:**
+
+The i18n system (`src/meshcore_hub/common/i18n.py`) loads translations on startup:
+- Defaults to English (`en`)
+- Falls back to English for missing keys
+- Returns the key itself if translation not found
+
+For full translation guidelines, see `src/meshcore_hub/web/static/locales/languages.md`.
+
 ### Adding a New Database Model
 
 1. Create model in `common/models/`
 2. Export in `common/models/__init__.py`
-3. Create Alembic migration: `alembic revision --autogenerate -m "description"`
+3. Create Alembic migration: `meshcore-hub db revision --autogenerate -m "description"`
 4. Review and adjust migration file
-5. Test migration: `alembic upgrade head`
+5. Test migration: `meshcore-hub db upgrade`
 
 ### Running the Development Environment
 
@@ -477,7 +597,7 @@ pytest
 # Run specific component
 meshcore-hub api --reload
 meshcore-hub collector
-meshcore-hub interface --mode receiver --mock
+meshcore-hub interface receiver --mock
 ```
 
 ## Environment Variables
@@ -492,9 +612,13 @@ Key variables:
 - `MQTT_TLS` - Enable TLS/SSL for MQTT (default: `false`)
 - `API_READ_KEY`, `API_ADMIN_KEY` - API authentication keys
 - `WEB_ADMIN_ENABLED` - Enable admin interface at /a/ (default: `false`, requires auth proxy)
+- `WEB_TRUSTED_PROXY_HOSTS` - Comma-separated list of trusted proxy hosts for admin authentication headers. Default: `*` (all hosts). Recommended: set to your reverse proxy IP in production. A startup warning is emitted when using the default `*` with admin enabled.
 - `WEB_THEME` - Default theme for the web dashboard (default: `dark`, options: `dark`, `light`). Users can override via the theme toggle in the navbar, which persists their preference in browser localStorage.
+- `WEB_AUTO_REFRESH_SECONDS` - Auto-refresh interval in seconds for list pages (default: `30`, `0` to disable)
 - `TZ` - Timezone for web dashboard date/time display (default: `UTC`, e.g., `America/New_York`, `Europe/London`)
 - `FEATURE_DASHBOARD`, `FEATURE_NODES`, `FEATURE_ADVERTISEMENTS`, `FEATURE_MESSAGES`, `FEATURE_MAP`, `FEATURE_MEMBERS`, `FEATURE_PAGES` - Feature flags to enable/disable specific web dashboard pages (default: all `true`). Dependencies: Dashboard auto-disables when all of Nodes/Advertisements/Messages are disabled. Map auto-disables when Nodes is disabled.
+- `METRICS_ENABLED` - Enable Prometheus metrics endpoint at /metrics (default: `true`)
+- `METRICS_CACHE_TTL` - Seconds to cache metrics output (default: `60`)
 - `LOG_LEVEL` - Logging verbosity
 
 The database defaults to `sqlite:///{DATA_HOME}/collector/meshcore.db` and does not typically need to be configured.
@@ -517,7 +641,8 @@ ${CONTENT_HOME}/
 │   └── getting-started.md # Example: Getting Started (/pages/getting-started)
 └── media/            # Custom media files
     └── images/
-        └── logo.svg  # Custom logo (replaces default favicon and navbar/home logo)
+        ├── logo.svg          # Full-color custom logo (default)
+        └── logo-invert.svg   # Monochrome custom logo (darkened in light mode)
 ```
 
 Pages use YAML frontmatter for metadata:
@@ -715,9 +840,10 @@ await mc.start_auto_message_fetching()
 
 On startup, the receiver performs these initialization steps:
 1. Set device clock to current Unix timestamp
-2. Send a local (non-flood) advertisement
-3. Start automatic message fetching
-4. Sync the device's contact database
+2. Optionally set the device name (if `MESHCORE_DEVICE_NAME` is configured)
+3. Send a flood advertisement (broadcasts device name to the mesh)
+4. Start automatic message fetching
+5. Sync the device's contact database
 
 ### Contact Sync Behavior
 

Dockerfile

@@ -4,7 +4,7 @@
 # =============================================================================
 # Stage 1: Builder - Install dependencies and build package
 # =============================================================================
-FROM python:3.13-slim AS builder
+FROM python:3.14-slim AS builder
 
 # Set environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -39,7 +39,7 @@ RUN sed -i "s|__version__ = \"dev\"|__version__ = \"${BUILD_VERSION}\"|" src/mes
 # =============================================================================
 # Stage 2: Runtime - Final production image
 # =============================================================================
-FROM python:3.13-slim AS runtime
+FROM python:3.14-slim AS runtime
 
 # Labels
 LABEL org.opencontainers.image.title="MeshCore Hub" \
@@ -65,9 +65,26 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 RUN apt-get update && apt-get install -y --no-install-recommends \
     # For serial port access
     udev \
+    # LetsMesh decoder runtime
+    nodejs \
+    npm \
     && rm -rf /var/lib/apt/lists/* \
     && mkdir -p /data
 
+# Install meshcore-decoder CLI.
+RUN mkdir -p /opt/letsmesh-decoder \
+    && cd /opt/letsmesh-decoder \
+    && npm init -y >/dev/null 2>&1 \
+    && npm install --omit=dev @michaelhart/meshcore-decoder@0.2.7 patch-package
+
+# Apply maintained meshcore-decoder compatibility patch.
+COPY patches/@michaelhart+meshcore-decoder+0.2.7.patch /opt/letsmesh-decoder/patches/@michaelhart+meshcore-decoder+0.2.7.patch
+RUN cd /opt/letsmesh-decoder \
+    && npx patch-package --error-on-fail \
+    && npm uninstall patch-package \
+    && npm prune --omit=dev
+RUN ln -s /opt/letsmesh-decoder/node_modules/.bin/meshcore-decoder /usr/local/bin/meshcore-decoder
+
 # Copy virtual environment from builder
 COPY --from=builder /opt/venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"

PLAN.md

@@ -489,6 +489,16 @@ ${DATA_HOME}/
 |----------|---------|-------------|
 | DATABASE_URL | sqlite:///{DATA_HOME}/collector/meshcore.db | SQLAlchemy URL |
 | TAGS_FILE | {DATA_HOME}/collector/tags.json | Path to tags JSON file |
+| COLLECTOR_INGEST_MODE | native | Ingest mode (`native` or `letsmesh_upload`) |
+| COLLECTOR_LETSMESH_DECODER_ENABLED | true | Enable external packet decoding in LetsMesh mode |
+
+LetsMesh compatibility parity note:
+- `status` feed packets are stored as informational `letsmesh_status` events and do not create advertisement rows.
+- Advertisement rows in LetsMesh mode are created from decoded payload type `4` only.
+- Decoded payload type `11` is normalized to native `contact` updates.
+- Decoded payload type `9` is normalized to native `trace_data`.
+- Decoded payload type `8` is normalized to informational `path_updated`.
+- Decoded payload type `1` can map to native response-style events when decrypted structured content is available.
 
 ### API
 | Variable | Default | Description |
@@ -506,6 +516,10 @@ ${DATA_HOME}/
 | WEB_PORT | 8080 | Web bind port |
 | API_BASE_URL | http://localhost:8000 | API endpoint |
 | API_KEY | | API key for queries |
+| WEB_TRUSTED_PROXY_HOSTS | * | Comma-separated list of trusted proxy hosts for admin authentication headers. Default: `*` (all hosts). Recommended: set to your reverse proxy IP in production. |
+| WEB_LOCALE | en | UI translation locale |
+| WEB_DATETIME_LOCALE | en-US | Date formatting locale for UI timestamps |
+| TZ | UTC | Timezone used for UI timestamp rendering |
 | NETWORK_DOMAIN | | Network domain |
 | NETWORK_NAME | MeshCore Network | Network name |
 | NETWORK_CITY | | City location |

README.md

@@ -1,9 +1,19 @@
 # MeshCore Hub
 
+[![CI](https://github.com/ipnet-mesh/meshcore-hub/actions/workflows/ci.yml/badge.svg)](https://github.com/ipnet-mesh/meshcore-hub/actions/workflows/ci.yml)
+[![Docker](https://github.com/ipnet-mesh/meshcore-hub/actions/workflows/docker.yml/badge.svg)](https://github.com/ipnet-mesh/meshcore-hub/actions/workflows/docker.yml)
+[![codecov](https://codecov.io/github/ipnet-mesh/meshcore-hub/graph/badge.svg?token=DO4F82DLKS)](https://codecov.io/github/ipnet-mesh/meshcore-hub)
+[![BuyMeACoffee](https://raw.githubusercontent.com/pachadotdev/buymeacoffee-badges/main/bmc-donate-yellow.svg)](https://www.buymeacoffee.com/jinglemansweep)
+
 Python 3.13+ platform for managing and orchestrating MeshCore mesh networks.
 
 ![MeshCore Hub Web Dashboard](docs/images/web.png)
 
+> [!IMPORTANT]
+> **Help Translate MeshCore Hub** 🌍
+>
+> We need volunteers to translate the web dashboard! Currently only English is available. Check out the [Translation Guide](src/meshcore_hub/web/static/locales/languages.md) to contribute a language pack. Partial translations welcome!
+
 ## Overview
 
 MeshCore Hub provides a complete solution for monitoring, collecting, and interacting with MeshCore mesh networks. It consists of multiple components that work together:
@@ -66,6 +76,7 @@ flowchart LR
 - **Command Dispatch**: Send messages and advertisements via the API
 - **Node Tagging**: Add custom metadata to nodes for organization
 - **Web Dashboard**: Visualize network status, node locations, and message history
+- **Internationalization**: Full i18n support with composable translation patterns
 - **Docker Ready**: Single image with all components, easy deployment
 
 ## Getting Started
@@ -168,13 +179,14 @@ Docker Compose uses **profiles** to select which services to run:
 
 | Profile | Services | Use Case |
 |---------|----------|----------|
-| `core` | collector, api, web | Central server infrastructure |
+| `core` | db-migrate, collector, api, web | Central server infrastructure |
 | `receiver` | interface-receiver | Receiver node (events to MQTT) |
 | `sender` | interface-sender | Sender node (MQTT to device) |
 | `mqtt` | mosquitto broker | Local MQTT broker (optional) |
 | `mock` | interface-mock-receiver | Testing without hardware |
 | `migrate` | db-migrate | One-time database migration |
 | `seed` | seed | One-time seed data import |
+| `metrics` | prometheus, alertmanager | Prometheus metrics and alerting |
 
 **Note:** Most deployments connect to an external MQTT broker. Add `--profile mqtt` only if you need a local broker.
 
@@ -244,7 +256,7 @@ pip install -e ".[dev]"
 meshcore-hub db upgrade
 
 # Start components (in separate terminals)
-meshcore-hub interface --mode receiver --port /dev/ttyUSB0
+meshcore-hub interface receiver --port /dev/ttyUSB0
 meshcore-hub collector
 meshcore-hub api
 meshcore-hub web
@@ -267,6 +279,8 @@ All components are configured via environment variables. Create a `.env` file or
 | `MQTT_PASSWORD` | *(none)* | MQTT password (optional) |
 | `MQTT_PREFIX` | `meshcore` | Topic prefix for all MQTT messages |
 | `MQTT_TLS` | `false` | Enable TLS/SSL for MQTT connection |
+| `MQTT_TRANSPORT` | `tcp` | MQTT transport (`tcp` or `websockets`) |
+| `MQTT_WS_PATH` | `/mqtt` | MQTT WebSocket path (used when `MQTT_TRANSPORT=websockets`) |
 
 ### Interface Settings
 
@@ -275,6 +289,48 @@ All components are configured via environment variables. Create a `.env` file or
 | `SERIAL_PORT` | `/dev/ttyUSB0` | Serial port for MeshCore device |
 | `SERIAL_BAUD` | `115200` | Serial baud rate |
 | `MESHCORE_DEVICE_NAME` | *(none)* | Device/node name set on startup (broadcast in advertisements) |
+| `NODE_ADDRESS` | *(none)* | Override for device public key (64-char hex string) |
+| `NODE_ADDRESS_SENDER` | *(none)* | Override for sender device public key |
+| `CONTACT_CLEANUP_ENABLED` | `true` | Enable automatic removal of stale contacts from companion node |
+| `CONTACT_CLEANUP_DAYS` | `7` | Remove contacts not advertised for this many days |
+
+### Collector Settings
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `COLLECTOR_INGEST_MODE` | `native` | Ingest mode (`native` or `letsmesh_upload`) |
+| `COLLECTOR_LETSMESH_DECODER_ENABLED` | `true` | Enable external LetsMesh packet decoding |
+| `COLLECTOR_LETSMESH_DECODER_COMMAND` | `meshcore-decoder` | Decoder CLI command |
+| `COLLECTOR_LETSMESH_DECODER_KEYS` | *(none)* | Additional decoder channel keys (`label=hex`, `label:hex`, or `hex`) |
+| `COLLECTOR_LETSMESH_DECODER_TIMEOUT_SECONDS` | `2.0` | Timeout per decoder invocation |
+
+#### LetsMesh Upload Compatibility Mode
+
+When `COLLECTOR_INGEST_MODE=letsmesh_upload`, the collector subscribes to:
+
+- `<prefix>/+/packets`
+- `<prefix>/+/status`
+- `<prefix>/+/internal`
+
+Normalization behavior:
+
+- `status` packets are stored as informational `letsmesh_status` events and are not mapped to `advertisement` rows.
+- Decoder payload type `4` is mapped to `advertisement` when node identity metadata is present.
+- Decoder payload type `11` (control discover response) is mapped to `contact`.
+- Decoder payload type `9` is mapped to `trace_data`.
+- Decoder payload type `8` is mapped to informational `path_updated` events.
+- Decoder payload type `1` can map to native response events (`telemetry_response`, `battery`, `path_updated`, `status_response`) when decrypted structured content is available.
+- `packet_type=5` packets are mapped to `channel_msg_recv`.
+- `packet_type=1`, `2`, and `7` packets are mapped to `contact_msg_recv` when decryptable text is available.
+- For channel packets, if a channel key is available, a channel label is attached (for example `Public` or `#test`) for UI display.
+- In the messages feed and dashboard channel sections, known channel indexes are preferred for labels (`17 -> Public`, `217 -> #test`) to avoid stale channel-name mismatches.
+- Additional channel names are loaded from `COLLECTOR_LETSMESH_DECODER_KEYS` when entries are provided as `label=hex` (for example `bot=<key>`).
+- Decoder-advertisement packets with location metadata update node GPS (`lat/lon`) for map display.
+- This keeps advertisement listings closer to native mode behavior (node advert traffic only, not observer status telemetry).
+- Packets without decryptable message text are kept as informational `letsmesh_packet` events and are not shown in the messages feed; when decode succeeds the decoded JSON is attached to those packet log events.
+- When decoder output includes a human sender (`payload.decoded.decrypted.sender`), message text is normalized to `Name: Message` before storage; receiver/observer names are never used as sender fallback.
+- The collector keeps built-in keys for `Public` and `#test`, and merges any additional keys from `COLLECTOR_LETSMESH_DECODER_KEYS`.
+- Docker runtime installs `@michaelhart/meshcore-decoder@0.2.7` and applies `patches/@michaelhart+meshcore-decoder+0.2.7.patch` via `patch-package` for Node compatibility.
 
 ### Webhooks
 
@@ -287,7 +343,9 @@ The collector can forward certain events to external HTTP endpoints:
 | `WEBHOOK_MESSAGE_URL` | *(none)* | Webhook URL for all message events |
 | `WEBHOOK_MESSAGE_SECRET` | *(none)* | Secret for message webhook |
 | `WEBHOOK_CHANNEL_MESSAGE_URL` | *(none)* | Override URL for channel messages only |
+| `WEBHOOK_CHANNEL_MESSAGE_SECRET` | *(none)* | Secret for channel message webhook |
 | `WEBHOOK_DIRECT_MESSAGE_URL` | *(none)* | Override URL for direct messages only |
+| `WEBHOOK_DIRECT_MESSAGE_SECRET` | *(none)* | Secret for direct message webhook |
 | `WEBHOOK_TIMEOUT` | `10.0` | Request timeout in seconds |
 | `WEBHOOK_MAX_RETRIES` | `3` | Max retry attempts on failure |
 | `WEBHOOK_RETRY_BACKOFF` | `2.0` | Exponential backoff multiplier |
@@ -321,6 +379,8 @@ The collector automatically cleans up old event data and inactive nodes:
 | `API_PORT` | `8000` | API port |
 | `API_READ_KEY` | *(none)* | Read-only API key |
 | `API_ADMIN_KEY` | *(none)* | Admin API key (required for commands) |
+| `METRICS_ENABLED` | `true` | Enable Prometheus metrics endpoint at `/metrics` |
+| `METRICS_CACHE_TTL` | `60` | Seconds to cache metrics output (reduces database load) |
 
 ### Web Dashboard Settings
 
@@ -329,8 +389,15 @@ The collector automatically cleans up old event data and inactive nodes:
 | `WEB_HOST` | `0.0.0.0` | Web server bind address |
 | `WEB_PORT` | `8080` | Web server port |
 | `API_BASE_URL` | `http://localhost:8000` | API endpoint URL |
-| `WEB_ADMIN_ENABLED` | `false` | Enable admin interface at /a/ (requires auth proxy) |
+| `API_KEY` | *(none)* | API key for web dashboard queries (optional) |
+| `WEB_THEME` | `dark` | Default theme (`dark` or `light`). Users can override via theme toggle in navbar. |
+| `WEB_LOCALE` | `en` | Locale/language for the web dashboard (e.g., `en`, `es`, `fr`) |
+| `WEB_DATETIME_LOCALE` | `en-US` | Locale used for date formatting in the web dashboard (e.g., `en-US` for MM/DD/YYYY, `en-GB` for DD/MM/YYYY). |
+| `WEB_AUTO_REFRESH_SECONDS` | `30` | Auto-refresh interval in seconds for list pages (0 to disable) |
+| `WEB_ADMIN_ENABLED` | `false` | Enable admin interface at /a/ (requires auth proxy: `X-Forwarded-User`/`X-Auth-Request-User` or forwarded `Authorization: Basic ...`) |
+| `WEB_TRUSTED_PROXY_HOSTS` | `*` | Comma-separated list of trusted proxy hosts for admin authentication headers. Default: `*` (all hosts). Recommended: set to your reverse proxy IP in production. A startup warning is emitted when using the default `*` with admin enabled. |
 | `TZ` | `UTC` | Timezone for displaying dates/times (e.g., `America/New_York`, `Europe/London`) |
+| `NETWORK_DOMAIN` | *(none)* | Network domain name (optional) |
 | `NETWORK_NAME` | `MeshCore Network` | Display name for the network |
 | `NETWORK_CITY` | *(none)* | City where network is located |
 | `NETWORK_COUNTRY` | *(none)* | Country code (ISO 3166-1 alpha-2) |
@@ -339,8 +406,62 @@ The collector automatically cleans up old event data and inactive nodes:
 | `NETWORK_CONTACT_EMAIL` | *(none)* | Contact email address |
 | `NETWORK_CONTACT_DISCORD` | *(none)* | Discord server link |
 | `NETWORK_CONTACT_GITHUB` | *(none)* | GitHub repository URL |
+| `NETWORK_CONTACT_YOUTUBE` | *(none)* | YouTube channel URL |
 | `CONTENT_HOME` | `./content` | Directory containing custom content (pages/, media/) |
 
+Timezone handling note:
+- API timestamps that omit an explicit timezone suffix are treated as UTC before rendering in the configured `TZ`.
+
+#### Nginx Proxy Manager (NPM) Admin Setup
+
+Use two hostnames so the public map/site stays open while admin stays protected:
+
+1. Public host: no Access List (normal users).
+2. Admin host: Access List enabled (operators only).
+
+Both proxy hosts should forward to the same web container:
+- Scheme: `http`
+- Forward Hostname/IP: your MeshCore Hub host
+- Forward Port: `18080` (or your mapped web port)
+- Websockets Support: `ON`
+- Block Common Exploits: `ON`
+
+Important:
+- Do not host this app under a subpath (for example `/meshcore`); proxy it at `/`.
+- `WEB_ADMIN_ENABLED` must be `true`.
+
+In NPM, for the **admin host**, paste this in the `Advanced` field:
+
+```nginx
+# Forward authenticated identity for MeshCore Hub admin checks
+proxy_set_header Authorization $http_authorization;
+proxy_set_header X-Forwarded-User $remote_user;
+proxy_set_header X-Auth-Request-User $remote_user;
+proxy_set_header X-Forwarded-Email "";
+proxy_set_header X-Forwarded-Groups "";
+```
+
+Then attach your NPM Access List (Basic auth users) to that admin host.
+
+Verify auth forwarding:
+
+```bash
+curl -s -u 'admin:password' "https://admin.example.com/config.js?t=$(date +%s)" \
+  | grep -o '"is_authenticated":[^,]*'
+```
+
+Expected:
+
+```text
+"is_authenticated": true
+```
+
+If it still shows `false`, check:
+1. You are using the admin hostname, not the public hostname.
+2. The Access List is attached to that admin host.
+3. The `Advanced` block above is present exactly.
+4. `WEB_ADMIN_ENABLED=true` is loaded in the running web container.
+
 #### Feature Flags
 
 Control which pages are visible in the web dashboard. Disabled features are fully hidden: removed from navigation, return 404 on their routes, and excluded from sitemap/robots.txt.
@@ -361,13 +482,17 @@ Control which pages are visible in the web dashboard. Disabled features are full
 
 The web dashboard supports custom content including markdown pages and media files. Content is organized in subdirectories:
 
+Custom logo options:
+- `logo.svg` — full-color logo, displayed as-is in both themes (no automatic darkening)
+- `logo-invert.svg` — monochrome/two-tone logo, automatically darkened in light mode for visibility
 ```
 content/
 ├── pages/     # Custom markdown pages
 │   └── about.md
 └── media/     # Custom media files
     └── images/
-        └── logo.svg   # Custom logo (replaces favicon and navbar/home logo)
+        ├── logo.svg          # Full-color custom logo (default)
+        └── logo-invert.svg   # Monochrome custom logo (darkened in light mode)
 ```
 
 **Setup:**
@@ -455,15 +580,16 @@ Tags are keyed by public key in YAML format:
 ```yaml
 # Each key is a 64-character hex public key
 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef:
-  friendly_name: Gateway Node
+  name: Gateway Node
+  description: Main network gateway
   role: gateway
   lat: 37.7749
   lon: -122.4194
-  is_online: true
+  member_id: alice
 
 fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210:
-  friendly_name: Oakland Repeater
-  altitude: 150
+  name: Oakland Repeater
+  elevation: 150
 ```
 
 Tag values can be:
@@ -518,6 +644,7 @@ Health check endpoints are also available:
 
 - **Health**: http://localhost:8000/health
 - **Ready**: http://localhost:8000/health/ready (includes database check)
+- **Metrics**: http://localhost:8000/metrics (Prometheus format)
 
 ### Authentication
 
@@ -541,15 +668,21 @@ curl -X POST \
 |--------|----------|-------------|
 | GET | `/api/v1/nodes` | List all known nodes |
 | GET | `/api/v1/nodes/{public_key}` | Get node details |
+| GET | `/api/v1/nodes/prefix/{prefix}` | Get node by public key prefix |
 | GET | `/api/v1/nodes/{public_key}/tags` | Get node tags |
 | POST | `/api/v1/nodes/{public_key}/tags` | Create node tag |
 | GET | `/api/v1/messages` | List messages with filters |
 | GET | `/api/v1/advertisements` | List advertisements |
 | GET | `/api/v1/telemetry` | List telemetry data |
 | GET | `/api/v1/trace-paths` | List trace paths |
+| GET | `/api/v1/members` | List network members |
 | POST | `/api/v1/commands/send-message` | Send direct message |
 | POST | `/api/v1/commands/send-channel-message` | Send channel message |
+| POST | `/api/v1/commands/send-advertisement` | Send advertisement |
 | GET | `/api/v1/dashboard/stats` | Get network statistics |
+| GET | `/api/v1/dashboard/activity` | Get daily advertisement activity |
+| GET | `/api/v1/dashboard/message-activity` | Get daily message activity |
+| GET | `/api/v1/dashboard/node-count` | Get cumulative node count history |
 
 ## Development
 
@@ -614,24 +747,26 @@ meshcore-hub/
 │   ├── api/                # REST API
 │   └── web/                # Web dashboard
 │       ├── templates/      # Jinja2 templates (SPA shell)
-│       └── static/js/spa/  # SPA frontend (ES modules, lit-html)
+│       └── static/
+│           ├── js/spa/     # SPA frontend (ES modules, lit-html)
+│           └── locales/    # Translation files (en.json, languages.md)
 ├── tests/                  # Test suite
 ├── alembic/                # Database migrations
-├── etc/                    # Configuration files (mosquitto.conf)
-├── example/                # Example files for testing
+├── etc/                    # Configuration files (MQTT, Prometheus, Alertmanager)
+├── example/                # Example files for reference
 │   ├── seed/               # Example seed data files
 │   │   ├── node_tags.yaml  # Example node tags
 │   │   └── members.yaml    # Example network members
 │   └── content/            # Example custom content
 │       ├── pages/          # Example custom pages
-│       │   └── about.md    # Example about page
+│       │   └── join.md     # Example join page
 │       └── media/          # Example media files
 │           └── images/     # Custom images
 ├── seed/                   # Seed data directory (SEED_HOME, copy from example/seed/)
 ├── content/                # Custom content directory (CONTENT_HOME, optional)
 │   ├── pages/              # Custom markdown pages
 │   └── media/              # Custom media files
-│       └── images/         # Custom images (logo.svg replaces default logo)
+│       └── images/         # Custom images (logo.svg/png/jpg/jpeg/webp replace default logo)
 ├── data/                   # Runtime data directory (DATA_HOME, created at runtime)
 ├── Dockerfile              # Docker build configuration
 ├── docker-compose.yml      # Docker Compose services

SCHEMAS.md

@@ -45,15 +45,19 @@ Node advertisements announcing presence and metadata.
   "public_key": "string (64 hex chars)",
   "name": "string (optional)",
   "adv_type": "string (optional)",
-  "flags": "integer (optional)"
+  "flags": "integer (optional)",
+  "lat": "number (optional)",
+  "lon": "number (optional)"
 }
 ```
 
 **Field Descriptions**:
 - `public_key`: Node's full 64-character hexadecimal public key (required)
 - `name`: Node name/alias (e.g., "Gateway-01", "Alice")
-- `adv_type`: Node type - one of: `"chat"`, `"repeater"`, `"room"`, `"none"`
+- `adv_type`: Node type - common values: `"chat"`, `"repeater"`, `"room"`, `"companion"` (other values may appear from upstream feeds and are normalized by the collector when possible)
 - `flags`: Node capability/status flags (bitmask)
+- `lat`: GPS latitude when provided by decoder metadata
+- `lon`: GPS longitude when provided by decoder metadata
 
 **Example**:
 ```json
@@ -61,7 +65,9 @@ Node advertisements announcing presence and metadata.
   "public_key": "4767c2897c256df8d85a5fa090574284bfd15b92d47359741b0abd5098ed30c4",
   "name": "Gateway-01",
   "adv_type": "repeater",
-  "flags": 218
+  "flags": 218,
+  "lat": 42.470001,
+  "lon": -71.330001
 }
 ```
 
@@ -90,7 +96,7 @@ Direct/private messages between two nodes.
 ```
 
 **Field Descriptions**:
-- `pubkey_prefix`: First 12 characters of sender's public key
+- `pubkey_prefix`: First 12 characters of sender's public key (or source hash prefix in compatibility ingest modes)
 - `path_len`: Number of hops message traveled
 - `txt_type`: Message type indicator (0=plain, 2=signed, etc.)
 - `signature`: Message signature (8 hex chars) when `txt_type=2`
@@ -128,7 +134,9 @@ Group/broadcast messages on specific channels.
 **Payload Schema**:
 ```json
 {
-  "channel_idx": "integer",
+  "channel_idx": "integer (optional)",
+  "channel_name": "string (optional)",
+  "pubkey_prefix": "string (12 chars, optional)",
   "path_len": "integer (optional)",
   "txt_type": "integer (optional)",
   "signature": "string (optional)",
@@ -139,7 +147,9 @@ Group/broadcast messages on specific channels.
 ```
 
 **Field Descriptions**:
-- `channel_idx`: Channel number (0-255)
+- `channel_idx`: Channel number (0-255) when available
+- `channel_name`: Channel display label (e.g., `"Public"`, `"#test"`) when available
+- `pubkey_prefix`: First 12 characters of sender's public key when available
 - `path_len`: Number of hops message traveled
 - `txt_type`: Message type indicator (0=plain, 2=signed, etc.)
 - `signature`: Message signature (8 hex chars) when `txt_type=2`
@@ -166,6 +176,25 @@ Group/broadcast messages on specific channels.
 - Send only text: `$.data.text`
 - Send channel + text: `$.data.[channel_idx,text]`
 
+**Compatibility ingest note**:
+- In LetsMesh upload compatibility mode, packet type `5` is normalized to `CHANNEL_MSG_RECV` and packet types `1`, `2`, and `7` are normalized to `CONTACT_MSG_RECV` when decryptable text is available.
+- LetsMesh packets without decryptable message text are treated as informational `letsmesh_packet` events instead of message events.
+- For UI labels, known channel indexes are mapped (`17 -> Public`, `217 -> #test`) and preferred over ambiguous/stale channel-name hints.
+- Additional channel labels can be provided through `COLLECTOR_LETSMESH_DECODER_KEYS` using `label=hex` entries.
+- When decoder output includes a human sender (`payload.decoded.decrypted.sender`), message text is normalized to `Name: Message`; sender identity remains unknown when only hash/prefix metadata is available.
+
+**Compatibility ingest note (advertisements)**:
+- In LetsMesh upload compatibility mode, `status` feed payloads are persisted as informational `letsmesh_status` events and are not normalized to `ADVERTISEMENT`.
+- In LetsMesh upload compatibility mode, decoded payload type `4` is normalized to `ADVERTISEMENT` when node identity metadata is present.
+- Payload type `4` location metadata (`appData.location.latitude/longitude`) is mapped to node `lat/lon` for map rendering.
+- This keeps advertisement persistence aligned with native mode expectations (advertisement traffic only).
+
+**Compatibility ingest note (non-message structured events)**:
+- Decoded payload type `9` is normalized to `TRACE_DATA` (`traceTag`, flags, auth, path hashes, and SNR values).
+- Decoded payload type `11` (`Control/NodeDiscoverResp`) is normalized to `contact` events for node upsert parity.
+- Decoded payload type `8` is normalized to informational `PATH_UPDATED` events (`hop_count` + path hashes).
+- Decoded payload type `1` can be normalized to `TELEMETRY_RESPONSE`, `BATTERY`, `PATH_UPDATED`, or `STATUS_RESPONSE` when decrypted response content is structured and parseable.
+
 ---
 
 ## Persisted Events (Non-Webhook)
@@ -196,7 +225,7 @@ Network trace path results showing route and signal strength.
 - `path_len`: Length of the path
 - `flags`: Trace flags/options
 - `auth`: Authentication/validation data
-- `path_hashes`: Array of 2-character node hash identifiers (ordered by hops)
+- `path_hashes`: Array of hex-encoded node hash identifiers, variable length (e.g., `"4a"` for single-byte, `"b3fa"` for multibyte), ordered by hops
 - `snr_values`: Array of SNR values corresponding to each hop
 - `hop_count`: Total number of hops
 
@@ -207,12 +236,14 @@ Network trace path results showing route and signal strength.
   "path_len": 3,
   "flags": 0,
   "auth": 1,
-  "path_hashes": ["4a", "b3", "fa"],
+  "path_hashes": ["4a", "b3fa", "02"],
   "snr_values": [25.3, 18.7, 12.4],
   "hop_count": 3
 }
 ```
 
+**Note**: MeshCore firmware v1.14+ supports multibyte path hashes. Older nodes use single-byte (2-character) hashes. Mixed-length hash arrays are expected in heterogeneous networks where nodes run different firmware versions.
+
 **Webhook Trigger**: No
 **REST API**: `GET /api/v1/trace-paths`
 

TASKS.md

@@ -753,6 +753,9 @@ This document tracks implementation progress for the MeshCore Hub project. Each
 ### Decisions Made
 *(Record architectural decisions and answers to clarifying questions here)*
 
+- [x] LetsMesh/native advertisement parity: in `letsmesh_upload` mode, observer `status` feed stays informational (`letsmesh_status`) and does not populate `advertisements`.
+- [x] LetsMesh advertisement persistence source: decoded packet payload type `4` maps to `advertisement`; payload type `11` maps to `contact` parity updates.
+- [x] LetsMesh native-event parity extensions: payload type `9` maps to `trace_data`, payload type `8` maps to informational `path_updated`, and payload type `1` can map to response-style native events when decryptable structured content exists.
 - [ ] Q1 (MQTT Broker):
 - [ ] Q2 (Database):
 - [ ] Q3 (Web Dashboard Separation):

docker-compose.yml

@@ -48,6 +48,8 @@ services:
       - MQTT_PASSWORD=${MQTT_PASSWORD:-}
       - MQTT_PREFIX=${MQTT_PREFIX:-meshcore}
       - MQTT_TLS=${MQTT_TLS:-false}
+      - MQTT_TRANSPORT=${MQTT_TRANSPORT:-tcp}
+      - MQTT_WS_PATH=${MQTT_WS_PATH:-/mqtt}
       - SERIAL_PORT=${SERIAL_PORT:-/dev/ttyUSB0}
       - SERIAL_BAUD=${SERIAL_BAUD:-115200}
       - NODE_ADDRESS=${NODE_ADDRESS:-}
@@ -83,6 +85,8 @@ services:
       - MQTT_PASSWORD=${MQTT_PASSWORD:-}
       - MQTT_PREFIX=${MQTT_PREFIX:-meshcore}
       - MQTT_TLS=${MQTT_TLS:-false}
+      - MQTT_TRANSPORT=${MQTT_TRANSPORT:-tcp}
+      - MQTT_WS_PATH=${MQTT_WS_PATH:-/mqtt}
       - SERIAL_PORT=${SERIAL_PORT_SENDER:-/dev/ttyUSB1}
       - SERIAL_BAUD=${SERIAL_BAUD:-115200}
       - NODE_ADDRESS=${NODE_ADDRESS_SENDER:-}
@@ -115,6 +119,8 @@ services:
       - MQTT_PASSWORD=${MQTT_PASSWORD:-}
       - MQTT_PREFIX=${MQTT_PREFIX:-meshcore}
       - MQTT_TLS=${MQTT_TLS:-false}
+      - MQTT_TRANSPORT=${MQTT_TRANSPORT:-tcp}
+      - MQTT_WS_PATH=${MQTT_WS_PATH:-/mqtt}
       - MOCK_DEVICE=true
       - NODE_ADDRESS=${NODE_ADDRESS:-0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef}
     command: ["interface", "receiver", "--mock"]
@@ -152,6 +158,13 @@ services:
       - MQTT_PASSWORD=${MQTT_PASSWORD:-}
       - MQTT_PREFIX=${MQTT_PREFIX:-meshcore}
       - MQTT_TLS=${MQTT_TLS:-false}
+      - MQTT_TRANSPORT=${MQTT_TRANSPORT:-tcp}
+      - MQTT_WS_PATH=${MQTT_WS_PATH:-/mqtt}
+      - COLLECTOR_INGEST_MODE=${COLLECTOR_INGEST_MODE:-native}
+      - COLLECTOR_LETSMESH_DECODER_ENABLED=${COLLECTOR_LETSMESH_DECODER_ENABLED:-true}
+      - COLLECTOR_LETSMESH_DECODER_COMMAND=${COLLECTOR_LETSMESH_DECODER_COMMAND:-meshcore-decoder}
+      - COLLECTOR_LETSMESH_DECODER_KEYS=${COLLECTOR_LETSMESH_DECODER_KEYS:-}
+      - COLLECTOR_LETSMESH_DECODER_TIMEOUT_SECONDS=${COLLECTOR_LETSMESH_DECODER_TIMEOUT_SECONDS:-2.0}
       - DATA_HOME=/data
       - SEED_HOME=/seed
       # Webhook configuration
@@ -210,11 +223,15 @@ services:
       - MQTT_PASSWORD=${MQTT_PASSWORD:-}
       - MQTT_PREFIX=${MQTT_PREFIX:-meshcore}
       - MQTT_TLS=${MQTT_TLS:-false}
+      - MQTT_TRANSPORT=${MQTT_TRANSPORT:-tcp}
+      - MQTT_WS_PATH=${MQTT_WS_PATH:-/mqtt}
       - DATA_HOME=/data
       - API_HOST=0.0.0.0
       - API_PORT=8000
       - API_READ_KEY=${API_READ_KEY:-}
       - API_ADMIN_KEY=${API_ADMIN_KEY:-}
+      - METRICS_ENABLED=${METRICS_ENABLED:-true}
+      - METRICS_CACHE_TTL=${METRICS_CACHE_TTL:-60}
     command: ["api"]
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
@@ -251,6 +268,9 @@ services:
       - API_KEY=${API_ADMIN_KEY:-${API_READ_KEY:-}}
       - WEB_HOST=0.0.0.0
       - WEB_PORT=8080
+      - WEB_THEME=${WEB_THEME:-dark}
+      - WEB_LOCALE=${WEB_LOCALE:-en}
+      - WEB_DATETIME_LOCALE=${WEB_DATETIME_LOCALE:-en-US}
       - WEB_ADMIN_ENABLED=${WEB_ADMIN_ENABLED:-false}
       - NETWORK_NAME=${NETWORK_NAME:-MeshCore Network}
       - NETWORK_CITY=${NETWORK_CITY:-}
@@ -263,6 +283,7 @@ services:
       - NETWORK_WELCOME_TEXT=${NETWORK_WELCOME_TEXT:-}
       - CONTENT_HOME=/content
       - TZ=${TZ:-UTC}
+      - COLLECTOR_LETSMESH_DECODER_KEYS=${COLLECTOR_LETSMESH_DECODER_KEYS:-}
       # Feature flags (set to false to disable specific pages)
       - FEATURE_DASHBOARD=${FEATURE_DASHBOARD:-true}
       - FEATURE_NODES=${FEATURE_NODES:-true}
@@ -324,6 +345,48 @@ services:
     # Imports both node_tags.yaml and members.yaml if they exist
     command: ["collector", "seed"]
 
+  # ==========================================================================
+  # Prometheus - Metrics collection and monitoring (optional, use --profile metrics)
+  # ==========================================================================
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: meshcore-prometheus
+    profiles:
+      - all
+      - metrics
+    restart: unless-stopped
+    depends_on:
+      api:
+        condition: service_healthy
+    ports:
+      - "${PROMETHEUS_PORT:-9090}:9090"
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.retention.time=30d'
+    volumes:
+      - ./etc/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./etc/prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
+      - prometheus_data:/prometheus
+
+  # ==========================================================================
+  # Alertmanager - Alert routing and notifications (optional, use --profile metrics)
+  # ==========================================================================
+  alertmanager:
+    image: prom/alertmanager:latest
+    container_name: meshcore-alertmanager
+    profiles:
+      - all
+      - metrics
+    restart: unless-stopped
+    ports:
+      - "${ALERTMANAGER_PORT:-9093}:9093"
+    volumes:
+      - ./etc/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
+      - alertmanager_data:/alertmanager
+    command:
+      - '--config.file=/etc/alertmanager/alertmanager.yml'
+      - '--storage.path=/alertmanager'
+
 # ==========================================================================
 # Volumes
 # ==========================================================================
@@ -334,3 +397,7 @@ volumes:
     name: meshcore_mosquitto_data
   mosquitto_log:
     name: meshcore_mosquitto_log
+  prometheus_data:
+    name: meshcore_prometheus_data
+  alertmanager_data:
+    name: meshcore_alertmanager_data

etc/alertmanager/alertmanager.yml

@@ -0,0 +1,35 @@
+# Alertmanager configuration for MeshCore Hub
+#
+# Default configuration routes all alerts to a "blackhole" receiver
+# (logs only, no external notifications).
+#
+# To receive notifications, configure a receiver below.
+# See: https://prometheus.io/docs/alerting/latest/configuration/
+#
+# Examples:
+#
+#   Email:
+#     receivers:
+#       - name: 'email'
+#         email_configs:
+#           - to: 'admin@example.com'
+#             from: 'alertmanager@example.com'
+#             smarthost: 'smtp.example.com:587'
+#             auth_username: 'alertmanager@example.com'
+#             auth_password: 'password'
+#
+#   Webhook (e.g. Slack incoming webhook, ntfy, Gotify):
+#     receivers:
+#       - name: 'webhook'
+#         webhook_configs:
+#           - url: 'https://example.com/webhook'
+
+route:
+  receiver: 'default'
+  group_by: ['alertname']
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 4h
+
+receivers:
+  - name: 'default'

etc/prometheus/alerts.yml

@@ -0,0 +1,16 @@
+# Prometheus alert rules for MeshCore Hub
+#
+# These rules are evaluated by Prometheus and fired alerts are sent
+# to Alertmanager for routing and notification.
+
+groups:
+  - name: meshcore
+    rules:
+      - alert: NodeNotSeen
+        expr: time() - meshcore_node_last_seen_timestamp_seconds{role="infra"} > 48 * 3600
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Node {{ $labels.node_name }} ({{ $labels.role }}) not seen for 48+ hours"
+          description: "Node {{ $labels.public_key }} ({{ $labels.adv_type }}, role={{ $labels.role }}) last seen {{ $value | humanizeDuration }} ago."

etc/prometheus/prometheus.yml

@@ -0,0 +1,29 @@
+# Prometheus scrape configuration for MeshCore Hub
+#
+# This file is used when running Prometheus via Docker Compose:
+#   docker compose --profile core --profile metrics up -d
+#
+# The scrape interval matches the default metrics cache TTL (60s)
+# to avoid unnecessary database queries.
+
+global:
+  scrape_interval: 60s
+  evaluation_interval: 60s
+
+alerting:
+  alertmanagers:
+    - static_configs:
+        - targets: ['alertmanager:9093']
+
+rule_files:
+  - 'alerts.yml'
+
+scrape_configs:
+  - job_name: 'meshcore-hub'
+    metrics_path: '/metrics'
+    # Uncomment basic_auth if API_READ_KEY is configured
+    # basic_auth:
+    #   username: 'metrics'
+    #   password: '<API_READ_KEY>'
+    static_configs:
+      - targets: ['api:8000']

patches/@michaelhart+meshcore-decoder+0.2.7.patch

@@ -0,0 +1,58 @@
+diff --git a/node_modules/@michaelhart/meshcore-decoder/dist/crypto/ed25519-verifier.js b/node_modules/@michaelhart/meshcore-decoder/dist/crypto/ed25519-verifier.js
+index d33ffd6..8d040d0 100644
+--- a/node_modules/@michaelhart/meshcore-decoder/dist/crypto/ed25519-verifier.js
++++ b/node_modules/@michaelhart/meshcore-decoder/dist/crypto/ed25519-verifier.js
+@@ -36,7 +36,27 @@ var __importStar = (this && this.__importStar) || (function () {
+ })();
+ Object.defineProperty(exports, "__esModule", { value: true });
+ exports.Ed25519SignatureVerifier = void 0;
+-const ed25519 = __importStar(require("@noble/ed25519"));
++let _ed25519 = null;
++async function getEd25519() {
++    if (_ed25519) {
++        return _ed25519;
++    }
++    const mod = await import("@noble/ed25519");
++    _ed25519 = mod.default ? mod.default : mod;
++    try {
++        _ed25519.etc.sha512Async = sha512Hash;
++    }
++    catch (error) {
++        console.debug("Could not set async SHA-512:", error);
++    }
++    try {
++        _ed25519.etc.sha512Sync = sha512HashSync;
++    }
++    catch (error) {
++        console.debug("Could not set up synchronous SHA-512:", error);
++    }
++    return _ed25519;
++}
+ const hex_1 = require("../utils/hex");
+ const orlp_ed25519_wasm_1 = require("./orlp-ed25519-wasm");
+ // Cross-platform SHA-512 implementation
+@@ -90,16 +110,6 @@ function sha512HashSync(data) {
+         throw new Error('No SHA-512 implementation available for synchronous operation');
+     }
+ }
+-// Set up SHA-512 for @noble/ed25519
+-ed25519.etc.sha512Async = sha512Hash;
+-// Always set up sync version - @noble/ed25519 requires it
+-// It will throw in browser environments, which @noble/ed25519 can handle
+-try {
+-    ed25519.etc.sha512Sync = sha512HashSync;
+-}
+-catch (error) {
+-    console.debug('Could not set up synchronous SHA-512:', error);
+-}
+ class Ed25519SignatureVerifier {
+     /**
+      * Verify an Ed25519 signature for MeshCore advertisement packets
+@@ -116,6 +126,7 @@ class Ed25519SignatureVerifier {
+             // Construct the signed message according to MeshCore format
+             const message = this.constructAdvertSignedMessage(publicKeyHex, timestamp, appData);
+             // Verify the signature using noble-ed25519
++            const ed25519 = await getEd25519();
+             return await ed25519.verify(signature, message, publicKey);
+         }
+         catch (error) {

pyproject.toml

@@ -37,10 +37,11 @@ dependencies = [
     "python-multipart>=0.0.6",
     "httpx>=0.25.0",
     "aiosqlite>=0.19.0",
-    "meshcore>=2.2.0",
+    "meshcore>=2.3.0",
     "pyyaml>=6.0.0",
     "python-frontmatter>=1.0.0",
     "markdown>=3.5.0",
+    "prometheus-client>=0.20.0",
 ]
 
 [project.optional-dependencies]
@@ -52,6 +53,7 @@ dev = [
     "flake8>=6.1.0",
     "mypy>=1.5.0",
     "pre-commit>=3.4.0",
+    "beautifulsoup4>=4.12.0",
     "types-paho-mqtt>=1.6.0",
     "types-PyYAML>=6.0.0",
 ]
@@ -115,6 +117,7 @@ module = [
     "meshcore.*",
     "frontmatter.*",
     "markdown.*",
+    "prometheus_client.*",
 ]
 ignore_missing_imports = true
 

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

src/meshcore_hub/api/app.py

@@ -51,9 +51,15 @@ def create_app(
     admin_key: str | None = None,
     mqtt_host: str = "localhost",
     mqtt_port: int = 1883,
+    mqtt_username: str | None = None,
+    mqtt_password: str | None = None,
     mqtt_prefix: str = "meshcore",
     mqtt_tls: bool = False,
+    mqtt_transport: str = "tcp",
+    mqtt_ws_path: str = "/mqtt",
     cors_origins: list[str] | None = None,
+    metrics_enabled: bool = True,
+    metrics_cache_ttl: int = 60,
 ) -> FastAPI:
     """Create and configure the FastAPI application.
 
@@ -63,9 +69,15 @@ def create_app(
         admin_key: Admin API key
         mqtt_host: MQTT broker host
         mqtt_port: MQTT broker port
+        mqtt_username: MQTT username
+        mqtt_password: MQTT password
         mqtt_prefix: MQTT topic prefix
         mqtt_tls: Enable TLS/SSL for MQTT connection
+        mqtt_transport: MQTT transport protocol (tcp or websockets)
+        mqtt_ws_path: WebSocket path (used when transport=websockets)
         cors_origins: Allowed CORS origins
+        metrics_enabled: Enable Prometheus metrics endpoint at /metrics
+        metrics_cache_ttl: Seconds to cache metrics output
 
     Returns:
         Configured FastAPI application
@@ -86,8 +98,13 @@ def create_app(
     app.state.admin_key = admin_key
     app.state.mqtt_host = mqtt_host
     app.state.mqtt_port = mqtt_port
+    app.state.mqtt_username = mqtt_username
+    app.state.mqtt_password = mqtt_password
     app.state.mqtt_prefix = mqtt_prefix
     app.state.mqtt_tls = mqtt_tls
+    app.state.mqtt_transport = mqtt_transport
+    app.state.mqtt_ws_path = mqtt_ws_path
+    app.state.metrics_cache_ttl = metrics_cache_ttl
 
     # Configure CORS
     if cors_origins is None:
@@ -106,6 +123,12 @@ def create_app(
 
     app.include_router(api_router, prefix="/api/v1")
 
+    # Include Prometheus metrics endpoint
+    if metrics_enabled:
+        from meshcore_hub.api.metrics import router as metrics_router
+
+        app.include_router(metrics_router)
+
     # Health check endpoints
     @app.get("/health", tags=["Health"])
     async def health() -> dict:

src/meshcore_hub/api/auth.py

@@ -1,5 +1,6 @@
 """Authentication middleware for the API."""
 
+import hmac
 import logging
 from typing import Annotated
 
@@ -79,7 +80,9 @@ async def require_read(
         )
 
     # Check if token matches any key
-    if token == read_key or token == admin_key:
+    if (read_key and hmac.compare_digest(token, read_key)) or (
+        admin_key and hmac.compare_digest(token, admin_key)
+    ):
         return token
 
     raise HTTPException(
@@ -124,7 +127,7 @@ async def require_admin(
         )
 
     # Check if token matches admin key
-    if token == admin_key:
+    if hmac.compare_digest(token, admin_key):
         return token
 
     raise HTTPException(

src/meshcore_hub/api/cli.py

@@ -60,11 +60,25 @@ import click
     envvar="MQTT_PORT",
     help="MQTT broker port",
 )
+@click.option(
+    "--mqtt-username",
+    type=str,
+    default=None,
+    envvar="MQTT_USERNAME",
+    help="MQTT username",
+)
+@click.option(
+    "--mqtt-password",
+    type=str,
+    default=None,
+    envvar="MQTT_PASSWORD",
+    help="MQTT password",
+)
 @click.option(
     "--mqtt-prefix",
     type=str,
     default="meshcore",
-    envvar="MQTT_TOPIC_PREFIX",
+    envvar=["MQTT_PREFIX", "MQTT_TOPIC_PREFIX"],
     help="MQTT topic prefix",
 )
 @click.option(
@@ -74,6 +88,20 @@ import click
     envvar="MQTT_TLS",
     help="Enable TLS/SSL for MQTT connection",
 )
+@click.option(
+    "--mqtt-transport",
+    type=click.Choice(["tcp", "websockets"], case_sensitive=False),
+    default="tcp",
+    envvar="MQTT_TRANSPORT",
+    help="MQTT transport protocol",
+)
+@click.option(
+    "--mqtt-ws-path",
+    type=str,
+    default="/mqtt",
+    envvar="MQTT_WS_PATH",
+    help="MQTT WebSocket path (used when transport=websockets)",
+)
 @click.option(
     "--cors-origins",
     type=str,
@@ -81,6 +109,19 @@ import click
     envvar="CORS_ORIGINS",
     help="Comma-separated list of allowed CORS origins",
 )
+@click.option(
+    "--metrics-enabled/--no-metrics",
+    default=True,
+    envvar="METRICS_ENABLED",
+    help="Enable Prometheus metrics endpoint at /metrics",
+)
+@click.option(
+    "--metrics-cache-ttl",
+    type=int,
+    default=60,
+    envvar="METRICS_CACHE_TTL",
+    help="Seconds to cache metrics output (reduces database load)",
+)
 @click.option(
     "--reload",
     is_flag=True,
@@ -98,9 +139,15 @@ def api(
     admin_key: str | None,
     mqtt_host: str,
     mqtt_port: int,
+    mqtt_username: str | None,
+    mqtt_password: str | None,
     mqtt_prefix: str,
     mqtt_tls: bool,
+    mqtt_transport: str,
+    mqtt_ws_path: str,
     cors_origins: str | None,
+    metrics_enabled: bool,
+    metrics_cache_ttl: int,
     reload: bool,
 ) -> None:
     """Run the REST API server.
@@ -146,9 +193,12 @@ def api(
     click.echo(f"Data home: {effective_data_home}")
     click.echo(f"Database: {effective_db_url}")
     click.echo(f"MQTT: {mqtt_host}:{mqtt_port} (prefix: {mqtt_prefix})")
+    click.echo(f"MQTT transport: {mqtt_transport} (ws_path: {mqtt_ws_path})")
     click.echo(f"Read key configured: {read_key is not None}")
     click.echo(f"Admin key configured: {admin_key is not None}")
     click.echo(f"CORS origins: {cors_origins or 'none'}")
+    click.echo(f"Metrics enabled: {metrics_enabled}")
+    click.echo(f"Metrics cache TTL: {metrics_cache_ttl}s")
     click.echo(f"Reload mode: {reload}")
     click.echo("=" * 50)
 
@@ -178,9 +228,15 @@ def api(
             admin_key=admin_key,
             mqtt_host=mqtt_host,
             mqtt_port=mqtt_port,
+            mqtt_username=mqtt_username,
+            mqtt_password=mqtt_password,
             mqtt_prefix=mqtt_prefix,
             mqtt_tls=mqtt_tls,
+            mqtt_transport=mqtt_transport,
+            mqtt_ws_path=mqtt_ws_path,
             cors_origins=origins_list,
+            metrics_enabled=metrics_enabled,
+            metrics_cache_ttl=metrics_cache_ttl,
         )
 
         click.echo("\nStarting API server...")

src/meshcore_hub/api/dependencies.py

@@ -56,17 +56,25 @@ def get_mqtt_client(request: Request) -> MQTTClient:
     """
     mqtt_host = getattr(request.app.state, "mqtt_host", "localhost")
     mqtt_port = getattr(request.app.state, "mqtt_port", 1883)
+    mqtt_username = getattr(request.app.state, "mqtt_username", None)
+    mqtt_password = getattr(request.app.state, "mqtt_password", None)
     mqtt_prefix = getattr(request.app.state, "mqtt_prefix", "meshcore")
     mqtt_tls = getattr(request.app.state, "mqtt_tls", False)
+    mqtt_transport = getattr(request.app.state, "mqtt_transport", "tcp")
+    mqtt_ws_path = getattr(request.app.state, "mqtt_ws_path", "/mqtt")
 
     # Use unique client ID to allow multiple API instances
     unique_id = uuid.uuid4().hex[:8]
     config = MQTTConfig(
         host=mqtt_host,
         port=mqtt_port,
+        username=mqtt_username,
+        password=mqtt_password,
         prefix=mqtt_prefix,
         client_id=f"meshcore-api-{unique_id}",
         tls=mqtt_tls,
+        transport=mqtt_transport,
+        ws_path=mqtt_ws_path,
     )
 
     client = MQTTClient(config)

src/meshcore_hub/api/metrics.py

@@ -0,0 +1,334 @@
+"""Prometheus metrics endpoint for MeshCore Hub API."""
+
+import base64
+import hmac
+import logging
+import time
+from typing import Any
+
+from fastapi import APIRouter, Request, Response
+from fastapi.responses import PlainTextResponse
+from prometheus_client import CollectorRegistry, Gauge, generate_latest
+from sqlalchemy import func, select
+
+from meshcore_hub.common.models import (
+    Advertisement,
+    EventLog,
+    Member,
+    Message,
+    Node,
+    NodeTag,
+    Telemetry,
+    TracePath,
+)
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+# Module-level cache
+_cache: dict[str, Any] = {"output": b"", "expires_at": 0.0}
+
+
+def verify_basic_auth(request: Request) -> bool:
+    """Verify HTTP Basic Auth credentials for metrics endpoint.
+
+    Uses username 'metrics' and the API read key as password.
+    Returns True if no read key is configured (public access).
+
+    Args:
+        request: FastAPI request
+
+    Returns:
+        True if authentication passes
+    """
+    read_key = getattr(request.app.state, "read_key", None)
+
+    # No read key configured = public access
+    if not read_key:
+        return True
+
+    auth_header = request.headers.get("Authorization", "")
+    if not auth_header.startswith("Basic "):
+        return False
+
+    try:
+        decoded = base64.b64decode(auth_header[6:]).decode("utf-8")
+        username, password = decoded.split(":", 1)
+        return hmac.compare_digest(username, "metrics") and hmac.compare_digest(
+            password, read_key
+        )
+    except Exception:
+        return False
+
+
+def collect_metrics(session: Any) -> bytes:
+    """Collect all metrics from the database and generate Prometheus output.
+
+    Creates a fresh CollectorRegistry per call to avoid global state issues.
+
+    Args:
+        session: SQLAlchemy database session
+
+    Returns:
+        Prometheus text exposition format as bytes
+    """
+    from meshcore_hub import __version__
+
+    registry = CollectorRegistry()
+
+    # -- Info gauge --
+    info_gauge = Gauge(
+        "meshcore_info",
+        "MeshCore Hub application info",
+        ["version"],
+        registry=registry,
+    )
+    info_gauge.labels(version=__version__).set(1)
+
+    # -- Nodes total --
+    nodes_total = Gauge(
+        "meshcore_nodes_total",
+        "Total number of nodes",
+        registry=registry,
+    )
+    count = session.execute(select(func.count(Node.id))).scalar() or 0
+    nodes_total.set(count)
+
+    # -- Nodes active by time window --
+    nodes_active = Gauge(
+        "meshcore_nodes_active",
+        "Number of active nodes in time window",
+        ["window"],
+        registry=registry,
+    )
+    for window, hours in [("1h", 1), ("24h", 24), ("7d", 168), ("30d", 720)]:
+        cutoff = time.time() - (hours * 3600)
+        from datetime import datetime, timezone
+
+        cutoff_dt = datetime.fromtimestamp(cutoff, tz=timezone.utc)
+        count = (
+            session.execute(
+                select(func.count(Node.id)).where(Node.last_seen >= cutoff_dt)
+            ).scalar()
+            or 0
+        )
+        nodes_active.labels(window=window).set(count)
+
+    # -- Nodes by type --
+    nodes_by_type = Gauge(
+        "meshcore_nodes_by_type",
+        "Number of nodes by advertisement type",
+        ["adv_type"],
+        registry=registry,
+    )
+    type_counts = session.execute(
+        select(Node.adv_type, func.count(Node.id)).group_by(Node.adv_type)
+    ).all()
+    for adv_type, count in type_counts:
+        nodes_by_type.labels(adv_type=adv_type or "unknown").set(count)
+
+    # -- Nodes with location --
+    nodes_with_location = Gauge(
+        "meshcore_nodes_with_location",
+        "Number of nodes with GPS coordinates",
+        registry=registry,
+    )
+    count = (
+        session.execute(
+            select(func.count(Node.id)).where(
+                Node.lat.isnot(None), Node.lon.isnot(None)
+            )
+        ).scalar()
+        or 0
+    )
+    nodes_with_location.set(count)
+
+    # -- Node last seen timestamp --
+    node_last_seen = Gauge(
+        "meshcore_node_last_seen_timestamp_seconds",
+        "Unix timestamp of when the node was last seen",
+        ["public_key", "node_name", "adv_type", "role"],
+        registry=registry,
+    )
+    role_subq = (
+        select(NodeTag.node_id, NodeTag.value.label("role"))
+        .where(NodeTag.key == "role")
+        .subquery()
+    )
+    nodes_with_last_seen = session.execute(
+        select(
+            Node.public_key,
+            Node.name,
+            Node.adv_type,
+            Node.last_seen,
+            role_subq.c.role,
+        )
+        .outerjoin(role_subq, Node.id == role_subq.c.node_id)
+        .where(Node.last_seen.isnot(None))
+    ).all()
+    for public_key, name, adv_type, last_seen, role in nodes_with_last_seen:
+        node_last_seen.labels(
+            public_key=public_key,
+            node_name=name or "",
+            adv_type=adv_type or "unknown",
+            role=role or "",
+        ).set(last_seen.timestamp())
+
+    # -- Messages total by type --
+    messages_total = Gauge(
+        "meshcore_messages_total",
+        "Total number of messages by type",
+        ["type"],
+        registry=registry,
+    )
+    msg_type_counts = session.execute(
+        select(Message.message_type, func.count(Message.id)).group_by(
+            Message.message_type
+        )
+    ).all()
+    for msg_type, count in msg_type_counts:
+        messages_total.labels(type=msg_type).set(count)
+
+    # -- Messages received by type and window --
+    messages_received = Gauge(
+        "meshcore_messages_received",
+        "Messages received in time window by type",
+        ["type", "window"],
+        registry=registry,
+    )
+    for window, hours in [("1h", 1), ("24h", 24), ("7d", 168), ("30d", 720)]:
+        cutoff = time.time() - (hours * 3600)
+        cutoff_dt = datetime.fromtimestamp(cutoff, tz=timezone.utc)
+        window_counts = session.execute(
+            select(Message.message_type, func.count(Message.id))
+            .where(Message.received_at >= cutoff_dt)
+            .group_by(Message.message_type)
+        ).all()
+        for msg_type, count in window_counts:
+            messages_received.labels(type=msg_type, window=window).set(count)
+
+    # -- Advertisements total --
+    advertisements_total = Gauge(
+        "meshcore_advertisements_total",
+        "Total number of advertisements",
+        registry=registry,
+    )
+    count = session.execute(select(func.count(Advertisement.id))).scalar() or 0
+    advertisements_total.set(count)
+
+    # -- Advertisements received by window --
+    advertisements_received = Gauge(
+        "meshcore_advertisements_received",
+        "Advertisements received in time window",
+        ["window"],
+        registry=registry,
+    )
+    for window, hours in [("1h", 1), ("24h", 24), ("7d", 168), ("30d", 720)]:
+        cutoff = time.time() - (hours * 3600)
+        cutoff_dt = datetime.fromtimestamp(cutoff, tz=timezone.utc)
+        count = (
+            session.execute(
+                select(func.count(Advertisement.id)).where(
+                    Advertisement.received_at >= cutoff_dt
+                )
+            ).scalar()
+            or 0
+        )
+        advertisements_received.labels(window=window).set(count)
+
+    # -- Telemetry total --
+    telemetry_total = Gauge(
+        "meshcore_telemetry_total",
+        "Total number of telemetry records",
+        registry=registry,
+    )
+    count = session.execute(select(func.count(Telemetry.id))).scalar() or 0
+    telemetry_total.set(count)
+
+    # -- Trace paths total --
+    trace_paths_total = Gauge(
+        "meshcore_trace_paths_total",
+        "Total number of trace path records",
+        registry=registry,
+    )
+    count = session.execute(select(func.count(TracePath.id))).scalar() or 0
+    trace_paths_total.set(count)
+
+    # -- Events by type --
+    events_total = Gauge(
+        "meshcore_events_total",
+        "Total events by type from event log",
+        ["event_type"],
+        registry=registry,
+    )
+    event_counts = session.execute(
+        select(EventLog.event_type, func.count(EventLog.id)).group_by(
+            EventLog.event_type
+        )
+    ).all()
+    for event_type, count in event_counts:
+        events_total.labels(event_type=event_type).set(count)
+
+    # -- Members total --
+    members_total = Gauge(
+        "meshcore_members_total",
+        "Total number of network members",
+        registry=registry,
+    )
+    count = session.execute(select(func.count(Member.id))).scalar() or 0
+    members_total.set(count)
+
+    output: bytes = generate_latest(registry)
+    return output
+
+
+@router.get("/metrics")
+async def metrics(request: Request) -> Response:
+    """Prometheus metrics endpoint.
+
+    Returns metrics in Prometheus text exposition format.
+    Supports HTTP Basic Auth with username 'metrics' and API read key as password.
+    Results are cached with a configurable TTL to reduce database load.
+    """
+    # Check authentication
+    if not verify_basic_auth(request):
+        return PlainTextResponse(
+            "Unauthorized",
+            status_code=401,
+            headers={"WWW-Authenticate": 'Basic realm="metrics"'},
+        )
+
+    # Check cache
+    cache_ttl = getattr(request.app.state, "metrics_cache_ttl", 60)
+    now = time.time()
+
+    if _cache["output"] and now < _cache["expires_at"]:
+        return Response(
+            content=_cache["output"],
+            media_type="text/plain; version=0.0.4; charset=utf-8",
+        )
+
+    # Collect fresh metrics
+    try:
+        from meshcore_hub.api.app import get_db_manager
+
+        db_manager = get_db_manager()
+        with db_manager.session_scope() as session:
+            output = collect_metrics(session)
+
+        # Update cache
+        _cache["output"] = output
+        _cache["expires_at"] = now + cache_ttl
+
+        return Response(
+            content=output,
+            media_type="text/plain; version=0.0.4; charset=utf-8",
+        )
+    except Exception as e:
+        logger.exception("Failed to collect metrics: %s", e)
+        return PlainTextResponse(
+            f"# Error collecting metrics: {e}\n",
+            status_code=500,
+            media_type="text/plain; version=0.0.4; charset=utf-8",
+        )

src/meshcore_hub/api/routes/advertisements.py

@@ -29,6 +29,16 @@ def _get_tag_name(node: Optional[Node]) -> Optional[str]:
     return None
 
 
+def _get_tag_description(node: Optional[Node]) -> Optional[str]:
+    """Extract description tag from a node's tags."""
+    if not node or not node.tags:
+        return None
+    for tag in node.tags:
+        if tag.key == "description":
+            return tag.value
+    return None
+
+
 def _fetch_receivers_for_events(
     session: DbSession,
     event_type: str,
@@ -210,6 +220,7 @@ async def list_advertisements(
             "name": adv.name,
             "node_name": row.source_name,
             "node_tag_name": _get_tag_name(source_node),
+            "node_tag_description": _get_tag_description(source_node),
             "adv_type": adv.adv_type or row.source_adv_type,
             "flags": adv.flags,
             "received_at": adv.received_at,
@@ -292,6 +303,7 @@ async def get_advertisement(
         "name": adv.name,
         "node_name": result.source_name,
         "node_tag_name": _get_tag_name(source_node),
+        "node_tag_description": _get_tag_description(source_node),
         "adv_type": adv.adv_type or result.source_adv_type,
         "flags": adv.flags,
         "received_at": adv.received_at,

src/meshcore_hub/api/routes/dashboard.py

@@ -2,8 +2,7 @@
 
 from datetime import datetime, timedelta, timezone
 
-from fastapi import APIRouter, Request
-from fastapi.responses import HTMLResponse
+from fastapi import APIRouter
 from sqlalchemy import func, select
 
 from meshcore_hub.api.auth import RequireRead
@@ -362,175 +361,3 @@ async def get_node_count_history(
         data.append(DailyActivityPoint(date=date_str, count=count))
 
     return NodeCountHistory(days=days, data=data)
-
-
-@router.get("/", response_class=HTMLResponse)
-async def dashboard(
-    request: Request,
-    session: DbSession,
-) -> HTMLResponse:
-    """Simple HTML dashboard page."""
-    now = datetime.now(timezone.utc)
-    today_start = now.replace(hour=0, minute=0, second=0, microsecond=0)
-    yesterday = now - timedelta(days=1)
-
-    # Get stats
-    total_nodes = session.execute(select(func.count()).select_from(Node)).scalar() or 0
-
-    active_nodes = (
-        session.execute(
-            select(func.count()).select_from(Node).where(Node.last_seen >= yesterday)
-        ).scalar()
-        or 0
-    )
-
-    total_messages = (
-        session.execute(select(func.count()).select_from(Message)).scalar() or 0
-    )
-
-    messages_today = (
-        session.execute(
-            select(func.count())
-            .select_from(Message)
-            .where(Message.received_at >= today_start)
-        ).scalar()
-        or 0
-    )
-
-    # Get recent nodes
-    recent_nodes = (
-        session.execute(select(Node).order_by(Node.last_seen.desc()).limit(10))
-        .scalars()
-        .all()
-    )
-
-    # Get recent messages
-    recent_messages = (
-        session.execute(select(Message).order_by(Message.received_at.desc()).limit(10))
-        .scalars()
-        .all()
-    )
-
-    # Build HTML
-    html = f"""
-<!DOCTYPE html>
-<html>
-<head>
-    <title>MeshCore Hub Dashboard</title>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta http-equiv="refresh" content="30">
-    <style>
-        body {{
-            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
-            margin: 0;
-            padding: 20px;
-            background: #f5f5f5;
-            color: #333;
-        }}
-        h1 {{ color: #2c3e50; }}
-        .container {{ max-width: 1200px; margin: 0 auto; }}
-        .stats {{
-            display: grid;
-            grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
-            gap: 20px;
-            margin-bottom: 30px;
-        }}
-        .stat-card {{
-            background: white;
-            padding: 20px;
-            border-radius: 8px;
-            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-        }}
-        .stat-card h3 {{ margin: 0 0 10px 0; color: #666; font-size: 14px; }}
-        .stat-card .value {{ font-size: 32px; font-weight: bold; color: #2c3e50; }}
-        .section {{
-            background: white;
-            padding: 20px;
-            border-radius: 8px;
-            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-            margin-bottom: 20px;
-        }}
-        table {{ width: 100%; border-collapse: collapse; }}
-        th, td {{ padding: 10px; text-align: left; border-bottom: 1px solid #eee; }}
-        th {{ background: #f8f9fa; font-weight: 600; }}
-        .text-muted {{ color: #666; }}
-        .truncate {{ max-width: 200px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }}
-    </style>
-</head>
-<body>
-    <div class="container">
-        <h1>MeshCore Hub Dashboard</h1>
-        <p class="text-muted">Last updated: {now.strftime('%Y-%m-%d %H:%M:%S UTC')}</p>
-
-        <div class="stats">
-            <div class="stat-card">
-                <h3>Total Nodes</h3>
-                <div class="value">{total_nodes}</div>
-            </div>
-            <div class="stat-card">
-                <h3>Active Nodes (24h)</h3>
-                <div class="value">{active_nodes}</div>
-            </div>
-            <div class="stat-card">
-                <h3>Total Messages</h3>
-                <div class="value">{total_messages}</div>
-            </div>
-            <div class="stat-card">
-                <h3>Messages Today</h3>
-                <div class="value">{messages_today}</div>
-            </div>
-        </div>
-
-        <div class="section">
-            <h2>Recent Nodes</h2>
-            <table>
-                <thead>
-                    <tr>
-                        <th>Name</th>
-                        <th>Public Key</th>
-                        <th>Type</th>
-                        <th>Last Seen</th>
-                    </tr>
-                </thead>
-                <tbody>
-                    {"".join(f'''
-                    <tr>
-                        <td>{n.name or '-'}</td>
-                        <td class="truncate">{n.public_key[:16]}...</td>
-                        <td>{n.adv_type or '-'}</td>
-                        <td>{n.last_seen.strftime('%Y-%m-%d %H:%M') if n.last_seen else '-'}</td>
-                    </tr>
-                    ''' for n in recent_nodes)}
-                </tbody>
-            </table>
-        </div>
-
-        <div class="section">
-            <h2>Recent Messages</h2>
-            <table>
-                <thead>
-                    <tr>
-                        <th>Type</th>
-                        <th>From/Channel</th>
-                        <th>Text</th>
-                        <th>Received</th>
-                    </tr>
-                </thead>
-                <tbody>
-                    {"".join(f'''
-                    <tr>
-                        <td>{m.message_type}</td>
-                        <td>{m.pubkey_prefix or f'Ch {m.channel_idx}' or '-'}</td>
-                        <td class="truncate">{m.text[:50]}{'...' if len(m.text) > 50 else ''}</td>
-                        <td>{m.received_at.strftime('%Y-%m-%d %H:%M') if m.received_at else '-'}</td>
-                    </tr>
-                    ''' for m in recent_messages)}
-                </tbody>
-            </table>
-        </div>
-    </div>
-</body>
-</html>
-"""
-    return HTMLResponse(content=html)

src/meshcore_hub/api/routes/nodes.py

@@ -48,7 +48,39 @@ async def list_nodes(
         )
 
     if adv_type:
-        query = query.where(Node.adv_type == adv_type)
+        normalized_adv_type = adv_type.strip().lower()
+        if normalized_adv_type == "repeater":
+            query = query.where(
+                or_(
+                    Node.adv_type == "repeater",
+                    Node.adv_type.ilike("%repeater%"),
+                    Node.adv_type.ilike("%relay%"),
+                )
+            )
+        elif normalized_adv_type == "companion":
+            query = query.where(
+                or_(
+                    Node.adv_type == "companion",
+                    Node.adv_type.ilike("%companion%"),
+                    Node.adv_type.ilike("%observer%"),
+                )
+            )
+        elif normalized_adv_type == "room":
+            query = query.where(
+                or_(
+                    Node.adv_type == "room",
+                    Node.adv_type.ilike("%room%"),
+                )
+            )
+        elif normalized_adv_type == "chat":
+            query = query.where(
+                or_(
+                    Node.adv_type == "chat",
+                    Node.adv_type.ilike("%chat%"),
+                )
+            )
+        else:
+            query = query.where(Node.adv_type == adv_type)
 
     if member_id:
         # Filter nodes that have a member_id tag with the specified value

src/meshcore_hub/collector/cli.py

@@ -54,6 +54,31 @@ if TYPE_CHECKING:
     envvar="MQTT_TLS",
     help="Enable TLS/SSL for MQTT connection",
 )
+@click.option(
+    "--mqtt-transport",
+    type=click.Choice(["tcp", "websockets"], case_sensitive=False),
+    default="tcp",
+    envvar="MQTT_TRANSPORT",
+    help="MQTT transport protocol",
+)
+@click.option(
+    "--mqtt-ws-path",
+    type=str,
+    default="/mqtt",
+    envvar="MQTT_WS_PATH",
+    help="MQTT WebSocket path (used when transport=websockets)",
+)
+@click.option(
+    "--ingest-mode",
+    "collector_ingest_mode",
+    type=click.Choice(["native", "letsmesh_upload"], case_sensitive=False),
+    default="native",
+    envvar="COLLECTOR_INGEST_MODE",
+    help=(
+        "Collector ingest mode: native MeshCore events or LetsMesh upload "
+        "(packets/status/internal)"
+    ),
+)
 @click.option(
     "--data-home",
     type=str,
@@ -90,6 +115,9 @@ def collector(
     mqtt_password: str | None,
     prefix: str,
     mqtt_tls: bool,
+    mqtt_transport: str,
+    mqtt_ws_path: str,
+    collector_ingest_mode: str,
     data_home: str | None,
     seed_home: str | None,
     database_url: str | None,
@@ -134,6 +162,9 @@ def collector(
     ctx.obj["mqtt_password"] = mqtt_password
     ctx.obj["prefix"] = prefix
     ctx.obj["mqtt_tls"] = mqtt_tls
+    ctx.obj["mqtt_transport"] = mqtt_transport
+    ctx.obj["mqtt_ws_path"] = mqtt_ws_path
+    ctx.obj["collector_ingest_mode"] = collector_ingest_mode
     ctx.obj["data_home"] = data_home or settings.data_home
     ctx.obj["seed_home"] = settings.effective_seed_home
     ctx.obj["database_url"] = effective_db_url
@@ -149,6 +180,9 @@ def collector(
             mqtt_password=mqtt_password,
             prefix=prefix,
             mqtt_tls=mqtt_tls,
+            mqtt_transport=mqtt_transport,
+            mqtt_ws_path=mqtt_ws_path,
+            ingest_mode=collector_ingest_mode,
             database_url=effective_db_url,
             log_level=log_level,
             data_home=data_home or settings.data_home,
@@ -163,6 +197,9 @@ def _run_collector_service(
     mqtt_password: str | None,
     prefix: str,
     mqtt_tls: bool,
+    mqtt_transport: str,
+    mqtt_ws_path: str,
+    ingest_mode: str,
     database_url: str,
     log_level: str,
     data_home: str,
@@ -191,6 +228,8 @@ def _run_collector_service(
     click.echo(f"Data home: {data_home}")
     click.echo(f"Seed home: {seed_home}")
     click.echo(f"MQTT: {mqtt_host}:{mqtt_port} (prefix: {prefix})")
+    click.echo(f"MQTT transport: {mqtt_transport} (ws_path: {mqtt_ws_path})")
+    click.echo(f"Ingest mode: {ingest_mode}")
     click.echo(f"Database: {database_url}")
 
     # Load webhook configuration from settings
@@ -198,6 +237,7 @@ def _run_collector_service(
         WebhookDispatcher,
         create_webhooks_from_settings,
     )
+    from meshcore_hub.collector.letsmesh_decoder import LetsMeshPacketDecoder
     from meshcore_hub.common.config import get_collector_settings
 
     settings = get_collector_settings()
@@ -234,6 +274,24 @@ def _run_collector_service(
     if settings.data_retention_enabled or settings.node_cleanup_enabled:
         click.echo(f"  Interval: {settings.data_retention_interval_hours} hours")
 
+    if ingest_mode.lower() == "letsmesh_upload":
+        click.echo("")
+        click.echo("LetsMesh decode configuration:")
+        if settings.collector_letsmesh_decoder_enabled:
+            builtin_keys = len(LetsMeshPacketDecoder.BUILTIN_CHANNEL_KEYS)
+            env_keys = len(settings.collector_letsmesh_decoder_keys_list)
+            click.echo(
+                "  Decoder: Enabled " f"({settings.collector_letsmesh_decoder_command})"
+            )
+            click.echo(f"  Built-in keys: {builtin_keys}")
+            click.echo("  Additional keys from .env: " f"{env_keys} configured")
+            click.echo(
+                "  Timeout: "
+                f"{settings.collector_letsmesh_decoder_timeout_seconds:.2f}s"
+            )
+        else:
+            click.echo("  Decoder: Disabled")
+
     click.echo("")
     click.echo("Starting MQTT subscriber...")
     run_collector(
@@ -243,6 +301,9 @@ def _run_collector_service(
         mqtt_password=mqtt_password,
         mqtt_prefix=prefix,
         mqtt_tls=mqtt_tls,
+        mqtt_transport=mqtt_transport,
+        mqtt_ws_path=mqtt_ws_path,
+        ingest_mode=ingest_mode,
         database_url=database_url,
         webhook_dispatcher=webhook_dispatcher,
         cleanup_enabled=settings.data_retention_enabled,
@@ -250,6 +311,12 @@ def _run_collector_service(
         cleanup_interval_hours=settings.data_retention_interval_hours,
         node_cleanup_enabled=settings.node_cleanup_enabled,
         node_cleanup_days=settings.node_cleanup_days,
+        letsmesh_decoder_enabled=settings.collector_letsmesh_decoder_enabled,
+        letsmesh_decoder_command=settings.collector_letsmesh_decoder_command,
+        letsmesh_decoder_channel_keys=settings.collector_letsmesh_decoder_keys_list,
+        letsmesh_decoder_timeout_seconds=(
+            settings.collector_letsmesh_decoder_timeout_seconds
+        ),
     )
 
 
@@ -267,6 +334,9 @@ def run_cmd(ctx: click.Context) -> None:
         mqtt_password=ctx.obj["mqtt_password"],
         prefix=ctx.obj["prefix"],
         mqtt_tls=ctx.obj["mqtt_tls"],
+        mqtt_transport=ctx.obj["mqtt_transport"],
+        mqtt_ws_path=ctx.obj["mqtt_ws_path"],
+        ingest_mode=ctx.obj["collector_ingest_mode"],
         database_url=ctx.obj["database_url"],
         log_level=ctx.obj["log_level"],
         data_home=ctx.obj["data_home"],

src/meshcore_hub/collector/handlers/advertisement.py

@@ -14,6 +14,20 @@ from meshcore_hub.common.models import Advertisement, Node, add_event_receiver
 logger = logging.getLogger(__name__)
 
 
+def _coerce_float(value: Any) -> float | None:
+    """Convert int/float/string values to float when possible."""
+    if value is None:
+        return None
+    if isinstance(value, (int, float)):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value.strip())
+        except ValueError:
+            return None
+    return None
+
+
 def handle_advertisement(
     public_key: str,
     event_type: str,
@@ -40,6 +54,22 @@ def handle_advertisement(
     name = payload.get("name")
     adv_type = payload.get("adv_type")
     flags = payload.get("flags")
+    lat = payload.get("lat")
+    lon = payload.get("lon")
+
+    if lat is None:
+        lat = payload.get("adv_lat")
+    if lon is None:
+        lon = payload.get("adv_lon")
+
+    location = payload.get("location")
+    if isinstance(location, dict):
+        if lat is None:
+            lat = location.get("latitude")
+        if lon is None:
+            lon = location.get("longitude")
+    lat = _coerce_float(lat)
+    lon = _coerce_float(lon)
     now = datetime.now(timezone.utc)
 
     # Compute event hash for deduplication (30-second time bucket)
@@ -79,6 +109,10 @@ def handle_advertisement(
             node_query = select(Node).where(Node.public_key == adv_public_key)
             node = session.execute(node_query).scalar_one_or_none()
             if node:
+                if lat is not None:
+                    node.lat = lat
+                if lon is not None:
+                    node.lon = lon
                 node.last_seen = now
 
             # Add this receiver to the junction table
@@ -110,6 +144,10 @@ def handle_advertisement(
                 node.adv_type = adv_type
             if flags is not None:
                 node.flags = flags
+            if lat is not None:
+                node.lat = lat
+            if lon is not None:
+                node.lon = lon
             node.last_seen = now
         else:
             # Create new node
@@ -120,6 +158,8 @@ def handle_advertisement(
                 flags=flags,
                 first_seen=now,
                 last_seen=now,
+                lat=lat,
+                lon=lon,
             )
             session.add(node)
             session.flush()

src/meshcore_hub/collector/handlers/message.py

@@ -70,7 +70,7 @@ def _handle_message(
     now = datetime.now(timezone.utc)
 
     # Extract fields based on message type
-    pubkey_prefix = payload.get("pubkey_prefix") if message_type == "contact" else None
+    pubkey_prefix = payload.get("pubkey_prefix")
     channel_idx = payload.get("channel_idx") if message_type == "channel" else None
     path_len = payload.get("path_len")
     txt_type = payload.get("txt_type")

src/meshcore_hub/collector/letsmesh_decoder.py

@@ -0,0 +1,275 @@
+"""LetsMesh packet decoder integration.
+
+Provides an optional bridge to the external `meshcore-decoder` CLI so the
+collector can turn LetsMesh upload `raw` packet hex into decoded message data.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import shlex
+import shutil
+import string
+import subprocess
+from typing import Any, NamedTuple
+
+logger = logging.getLogger(__name__)
+
+
+class LetsMeshPacketDecoder:
+    """Decode LetsMesh packet payloads with `meshcore-decoder` CLI."""
+
+    class ChannelKey(NamedTuple):
+        """Channel key metadata for decryption and channel labeling."""
+
+        label: str | None
+        key_hex: str
+        channel_hash: str
+
+    # Built-in keys required by your deployment.
+    # - Public channel
+    # - #test channel
+    BUILTIN_CHANNEL_KEYS: tuple[tuple[str, str], ...] = (
+        ("Public", "8B3387E9C5CDEA6AC9E5EDBAA115CD72"),
+        ("test", "9CD8FCF22A47333B591D96A2B848B73F"),
+    )
+
+    def __init__(
+        self,
+        enabled: bool = True,
+        command: str = "meshcore-decoder",
+        channel_keys: list[str] | None = None,
+        timeout_seconds: float = 2.0,
+    ) -> None:
+        self._enabled = enabled
+        self._command_tokens = shlex.split(command.strip()) if command.strip() else []
+        self._channel_key_infos = self._normalize_channel_keys(channel_keys or [])
+        self._channel_keys = [info.key_hex for info in self._channel_key_infos]
+        self._channel_names_by_hash = {
+            info.channel_hash: info.label
+            for info in self._channel_key_infos
+            if info.label
+        }
+        self._decode_cache: dict[str, dict[str, Any] | None] = {}
+        self._decode_cache_maxsize = 2048
+        self._timeout_seconds = timeout_seconds
+        self._checked_command = False
+        self._command_available = False
+        self._warned_unavailable = False
+
+    @classmethod
+    def _normalize_channel_keys(cls, values: list[str]) -> list[ChannelKey]:
+        """Normalize key list (labels + key + channel hash, deduplicated)."""
+        normalized: list[LetsMeshPacketDecoder.ChannelKey] = []
+        seen_keys: set[str] = set()
+
+        for label, key in cls.BUILTIN_CHANNEL_KEYS:
+            entry = cls._normalize_channel_entry(f"{label}={key}")
+            if not entry:
+                continue
+            if entry.key_hex in seen_keys:
+                continue
+            normalized.append(entry)
+            seen_keys.add(entry.key_hex)
+
+        for value in values:
+            entry = cls._normalize_channel_entry(value)
+            if not entry:
+                continue
+            if entry.key_hex in seen_keys:
+                continue
+            normalized.append(entry)
+            seen_keys.add(entry.key_hex)
+
+        return normalized
+
+    @classmethod
+    def _normalize_channel_entry(cls, value: str | None) -> ChannelKey | None:
+        """Normalize one key entry (`label=hex`, `label:hex`, or `hex`)."""
+        if value is None:
+            return None
+
+        candidate = value.strip()
+        if not candidate:
+            return None
+
+        label: str | None = None
+        key_candidate = candidate
+        for separator in ("=", ":"):
+            if separator not in candidate:
+                continue
+            left, right = candidate.split(separator, 1)
+            right = right.strip()
+            right = right.removeprefix("0x").removeprefix("0X").strip()
+            if right and cls._is_hex(right):
+                label = left.strip().lstrip("#")
+                key_candidate = right
+                break
+
+        key_candidate = key_candidate.strip()
+        key_candidate = key_candidate.removeprefix("0x").removeprefix("0X").strip()
+        if not key_candidate or not cls._is_hex(key_candidate):
+            return None
+
+        key_hex = key_candidate.upper()
+        channel_hash = cls._compute_channel_hash(key_hex)
+        normalized_label = label.strip() if label and label.strip() else None
+        return cls.ChannelKey(
+            label=normalized_label,
+            key_hex=key_hex,
+            channel_hash=channel_hash,
+        )
+
+    @staticmethod
+    def _is_hex(value: str) -> bool:
+        """Return True if string contains only hex digits."""
+        return bool(value) and all(char in string.hexdigits for char in value)
+
+    @staticmethod
+    def _compute_channel_hash(key_hex: str) -> str:
+        """Compute channel hash (first byte of SHA-256 of channel key)."""
+        return hashlib.sha256(bytes.fromhex(key_hex)).digest()[:1].hex().upper()
+
+    def channel_name_from_decoded(
+        self,
+        decoded_packet: dict[str, Any] | None,
+    ) -> str | None:
+        """Resolve channel label from decoded payload channel hash."""
+        if not isinstance(decoded_packet, dict):
+            return None
+
+        payload = decoded_packet.get("payload")
+        if not isinstance(payload, dict):
+            return None
+
+        decoded = payload.get("decoded")
+        if not isinstance(decoded, dict):
+            return None
+
+        channel_hash = decoded.get("channelHash")
+        if not isinstance(channel_hash, str):
+            return None
+
+        return self._channel_names_by_hash.get(channel_hash.upper())
+
+    def channel_labels_by_index(self) -> dict[int, str]:
+        """Return channel labels keyed by numeric channel index (0-255)."""
+        labels: dict[int, str] = {}
+        for info in self._channel_key_infos:
+            if not info.label:
+                continue
+
+            label = info.label.strip()
+            if not label:
+                continue
+
+            if label.lower() == "public":
+                normalized_label = "Public"
+            else:
+                normalized_label = label if label.startswith("#") else f"#{label}"
+
+            channel_idx = int(info.channel_hash, 16)
+            labels.setdefault(channel_idx, normalized_label)
+
+        return labels
+
+    def decode_payload(self, payload: dict[str, Any]) -> dict[str, Any] | None:
+        """Decode packet payload `raw` hex and return decoded JSON if available."""
+        raw_hex = payload.get("raw")
+        if not isinstance(raw_hex, str):
+            return None
+        clean_hex = raw_hex.strip()
+        if not clean_hex:
+            return None
+        if not self._is_hex(clean_hex):
+            logger.debug("LetsMesh decoder skipped non-hex raw payload")
+            return None
+        cached = self._decode_cache.get(clean_hex)
+        if clean_hex in self._decode_cache:
+            return cached
+
+        decoded = self._decode_raw(clean_hex)
+        self._decode_cache[clean_hex] = decoded
+        if len(self._decode_cache) > self._decode_cache_maxsize:
+            # Drop oldest cached payload (insertion-order dict).
+            self._decode_cache.pop(next(iter(self._decode_cache)))
+        return decoded
+
+    def _decode_raw(self, raw_hex: str) -> dict[str, Any] | None:
+        """Decode raw packet hex with decoder CLI (cached per packet hex)."""
+        if not self._enabled:
+            return None
+        if not self._is_command_available():
+            return None
+
+        command = [*self._command_tokens, "decode", raw_hex, "--json"]
+        if self._channel_keys:
+            command.append("--key")
+            command.extend(self._channel_keys)
+
+        try:
+            result = subprocess.run(
+                command,
+                check=False,
+                capture_output=True,
+                text=True,
+                timeout=self._timeout_seconds,
+            )
+        except subprocess.TimeoutExpired:
+            logger.debug(
+                "LetsMesh decoder timed out after %.2fs",
+                self._timeout_seconds,
+            )
+            return None
+        except OSError as exc:
+            logger.debug("LetsMesh decoder failed to execute: %s", exc)
+            return None
+
+        if result.returncode != 0:
+            stderr = result.stderr.strip() if result.stderr else ""
+            logger.debug(
+                "LetsMesh decoder exited with code %s%s",
+                result.returncode,
+                f": {stderr}" if stderr else "",
+            )
+            return None
+
+        output = result.stdout.strip()
+        if not output:
+            return None
+
+        try:
+            decoded = json.loads(output)
+        except json.JSONDecodeError:
+            logger.debug("LetsMesh decoder returned non-JSON output")
+            return None
+
+        return decoded if isinstance(decoded, dict) else None
+
+    def _is_command_available(self) -> bool:
+        """Check decoder command availability once."""
+        if self._checked_command:
+            return self._command_available
+
+        self._checked_command = True
+        if not self._command_tokens:
+            self._command_available = False
+        else:
+            command = self._command_tokens[0]
+            if "/" in command:
+                self._command_available = shutil.which(command) is not None
+            else:
+                self._command_available = shutil.which(command) is not None
+
+        if not self._command_available and not self._warned_unavailable:
+            self._warned_unavailable = True
+            command_text = " ".join(self._command_tokens) or "<empty>"
+            logger.warning(
+                "LetsMesh decoder command not found (%s). "
+                "Messages will remain encrypted placeholders until decoder is installed.",
+                command_text,
+            )
+
+        return self._command_available

src/meshcore_hub/collector/subscriber.py

@@ -21,6 +21,8 @@ from typing import Any, Callable, Optional, TYPE_CHECKING
 from meshcore_hub.common.database import DatabaseManager
 from meshcore_hub.common.health import HealthReporter
 from meshcore_hub.common.mqtt import MQTTClient, MQTTConfig
+from meshcore_hub.collector.letsmesh_decoder import LetsMeshPacketDecoder
+from meshcore_hub.collector.letsmesh_normalizer import LetsMeshNormalizer
 
 if TYPE_CHECKING:
     from meshcore_hub.collector.webhook import WebhookDispatcher
@@ -32,9 +34,12 @@ logger = logging.getLogger(__name__)
 EventHandler = Callable[[str, str, dict[str, Any], DatabaseManager], None]
 
 
-class Subscriber:
+class Subscriber(LetsMeshNormalizer):
     """MQTT Subscriber for collecting and storing MeshCore events."""
 
+    INGEST_MODE_NATIVE = "native"
+    INGEST_MODE_LETSMESH_UPLOAD = "letsmesh_upload"
+
     def __init__(
         self,
         mqtt_client: MQTTClient,
@@ -45,6 +50,11 @@ class Subscriber:
         cleanup_interval_hours: int = 24,
         node_cleanup_enabled: bool = False,
         node_cleanup_days: int = 90,
+        ingest_mode: str = INGEST_MODE_NATIVE,
+        letsmesh_decoder_enabled: bool = True,
+        letsmesh_decoder_command: str = "meshcore-decoder",
+        letsmesh_decoder_channel_keys: list[str] | None = None,
+        letsmesh_decoder_timeout_seconds: float = 2.0,
     ):
         """Initialize subscriber.
 
@@ -57,6 +67,11 @@ class Subscriber:
             cleanup_interval_hours: Hours between cleanup runs
             node_cleanup_enabled: Enable automatic cleanup of inactive nodes
             node_cleanup_days: Remove nodes not seen for this many days
+            ingest_mode: Ingest mode ('native' or 'letsmesh_upload')
+            letsmesh_decoder_enabled: Enable external LetsMesh packet decoder
+            letsmesh_decoder_command: Decoder CLI command
+            letsmesh_decoder_channel_keys: Optional channel keys for decrypting group text
+            letsmesh_decoder_timeout_seconds: Decoder CLI timeout
         """
         self.mqtt = mqtt_client
         self.db = db_manager
@@ -79,6 +94,18 @@ class Subscriber:
         self._node_cleanup_days = node_cleanup_days
         self._cleanup_thread: Optional[threading.Thread] = None
         self._last_cleanup: Optional[datetime] = None
+        self._ingest_mode = ingest_mode.lower()
+        if self._ingest_mode not in {
+            self.INGEST_MODE_NATIVE,
+            self.INGEST_MODE_LETSMESH_UPLOAD,
+        }:
+            raise ValueError(f"Unsupported collector ingest mode: {ingest_mode}")
+        self._letsmesh_decoder = LetsMeshPacketDecoder(
+            enabled=letsmesh_decoder_enabled,
+            command=letsmesh_decoder_command,
+            channel_keys=letsmesh_decoder_channel_keys,
+            timeout_seconds=letsmesh_decoder_timeout_seconds,
+        )
 
     @property
     def is_healthy(self) -> bool:
@@ -125,14 +152,34 @@ class Subscriber:
             pattern: Subscription pattern
             payload: Message payload
         """
-        # Parse event from topic
-        parsed = self.mqtt.topic_builder.parse_event_topic(topic)
+        parsed: tuple[str, str, dict[str, Any]] | None
+        if self._ingest_mode == self.INGEST_MODE_LETSMESH_UPLOAD:
+            parsed = self._normalize_letsmesh_event(topic, payload)
+        else:
+            parsed_event = self.mqtt.topic_builder.parse_event_topic(topic)
+            parsed = (
+                (parsed_event[0], parsed_event[1], payload) if parsed_event else None
+            )
+
         if not parsed:
-            logger.warning(f"Could not parse event topic: {topic}")
+            logger.warning(
+                "Could not parse topic for ingest mode %s: %s",
+                self._ingest_mode,
+                topic,
+            )
             return
 
-        public_key, event_type = parsed
-        logger.debug(f"Received event: {event_type} from {public_key[:12]}...")
+        public_key, event_type, normalized_payload = parsed
+        logger.debug("Received event: %s from %s...", event_type, public_key[:12])
+        self._dispatch_event(public_key, event_type, normalized_payload)
+
+    def _dispatch_event(
+        self,
+        public_key: str,
+        event_type: str,
+        payload: dict[str, Any],
+    ) -> None:
+        """Route a normalized event to the appropriate handler."""
 
         # Find and call handler
         handler = self._handlers.get(event_type)
@@ -358,10 +405,20 @@ class Subscriber:
             logger.error(f"Failed to connect to MQTT broker: {e}")
             raise
 
-        # Subscribe to all event topics
-        event_topic = self.mqtt.topic_builder.all_events_topic()
-        self.mqtt.subscribe(event_topic, self._handle_mqtt_message)
-        logger.info(f"Subscribed to event topic: {event_topic}")
+        # Subscribe to topics based on ingest mode
+        if self._ingest_mode == self.INGEST_MODE_LETSMESH_UPLOAD:
+            letsmesh_topics = [
+                f"{self.mqtt.topic_builder.prefix}/+/packets",
+                f"{self.mqtt.topic_builder.prefix}/+/status",
+                f"{self.mqtt.topic_builder.prefix}/+/internal",
+            ]
+            for letsmesh_topic in letsmesh_topics:
+                self.mqtt.subscribe(letsmesh_topic, self._handle_mqtt_message)
+                logger.info(f"Subscribed to LetsMesh upload topic: {letsmesh_topic}")
+        else:
+            event_topic = self.mqtt.topic_builder.all_events_topic()
+            self.mqtt.subscribe(event_topic, self._handle_mqtt_message)
+            logger.info(f"Subscribed to event topic: {event_topic}")
 
         self._running = True
 
@@ -429,6 +486,9 @@ def create_subscriber(
     mqtt_password: Optional[str] = None,
     mqtt_prefix: str = "meshcore",
     mqtt_tls: bool = False,
+    mqtt_transport: str = "tcp",
+    mqtt_ws_path: str = "/mqtt",
+    ingest_mode: str = "native",
     database_url: str = "sqlite:///./meshcore.db",
     webhook_dispatcher: Optional["WebhookDispatcher"] = None,
     cleanup_enabled: bool = False,
@@ -436,6 +496,10 @@ def create_subscriber(
     cleanup_interval_hours: int = 24,
     node_cleanup_enabled: bool = False,
     node_cleanup_days: int = 90,
+    letsmesh_decoder_enabled: bool = True,
+    letsmesh_decoder_command: str = "meshcore-decoder",
+    letsmesh_decoder_channel_keys: list[str] | None = None,
+    letsmesh_decoder_timeout_seconds: float = 2.0,
 ) -> Subscriber:
     """Create a configured subscriber instance.
 
@@ -446,6 +510,9 @@ def create_subscriber(
         mqtt_password: MQTT password
         mqtt_prefix: MQTT topic prefix
         mqtt_tls: Enable TLS/SSL for MQTT connection
+        mqtt_transport: MQTT transport protocol (tcp or websockets)
+        mqtt_ws_path: WebSocket path (used when transport=websockets)
+        ingest_mode: Ingest mode ('native' or 'letsmesh_upload')
         database_url: Database connection URL
         webhook_dispatcher: Optional webhook dispatcher for event forwarding
         cleanup_enabled: Enable automatic event data cleanup
@@ -453,6 +520,10 @@ def create_subscriber(
         cleanup_interval_hours: Hours between cleanup runs
         node_cleanup_enabled: Enable automatic cleanup of inactive nodes
         node_cleanup_days: Remove nodes not seen for this many days
+        letsmesh_decoder_enabled: Enable external LetsMesh packet decoder
+        letsmesh_decoder_command: Decoder CLI command
+        letsmesh_decoder_channel_keys: Optional channel keys for decrypting group text
+        letsmesh_decoder_timeout_seconds: Decoder CLI timeout
 
     Returns:
         Configured Subscriber instance
@@ -467,6 +538,8 @@ def create_subscriber(
         prefix=mqtt_prefix,
         client_id=f"meshcore-collector-{unique_id}",
         tls=mqtt_tls,
+        transport=mqtt_transport,
+        ws_path=mqtt_ws_path,
     )
     mqtt_client = MQTTClient(mqtt_config)
 
@@ -483,6 +556,11 @@ def create_subscriber(
         cleanup_interval_hours=cleanup_interval_hours,
         node_cleanup_enabled=node_cleanup_enabled,
         node_cleanup_days=node_cleanup_days,
+        ingest_mode=ingest_mode,
+        letsmesh_decoder_enabled=letsmesh_decoder_enabled,
+        letsmesh_decoder_command=letsmesh_decoder_command,
+        letsmesh_decoder_channel_keys=letsmesh_decoder_channel_keys,
+        letsmesh_decoder_timeout_seconds=letsmesh_decoder_timeout_seconds,
     )
 
     # Register handlers
@@ -500,6 +578,9 @@ def run_collector(
     mqtt_password: Optional[str] = None,
     mqtt_prefix: str = "meshcore",
     mqtt_tls: bool = False,
+    mqtt_transport: str = "tcp",
+    mqtt_ws_path: str = "/mqtt",
+    ingest_mode: str = "native",
     database_url: str = "sqlite:///./meshcore.db",
     webhook_dispatcher: Optional["WebhookDispatcher"] = None,
     cleanup_enabled: bool = False,
@@ -507,6 +588,10 @@ def run_collector(
     cleanup_interval_hours: int = 24,
     node_cleanup_enabled: bool = False,
     node_cleanup_days: int = 90,
+    letsmesh_decoder_enabled: bool = True,
+    letsmesh_decoder_command: str = "meshcore-decoder",
+    letsmesh_decoder_channel_keys: list[str] | None = None,
+    letsmesh_decoder_timeout_seconds: float = 2.0,
 ) -> None:
     """Run the collector (blocking).
 
@@ -517,6 +602,9 @@ def run_collector(
         mqtt_password: MQTT password
         mqtt_prefix: MQTT topic prefix
         mqtt_tls: Enable TLS/SSL for MQTT connection
+        mqtt_transport: MQTT transport protocol (tcp or websockets)
+        mqtt_ws_path: WebSocket path (used when transport=websockets)
+        ingest_mode: Ingest mode ('native' or 'letsmesh_upload')
         database_url: Database connection URL
         webhook_dispatcher: Optional webhook dispatcher for event forwarding
         cleanup_enabled: Enable automatic event data cleanup
@@ -524,6 +612,10 @@ def run_collector(
         cleanup_interval_hours: Hours between cleanup runs
         node_cleanup_enabled: Enable automatic cleanup of inactive nodes
         node_cleanup_days: Remove nodes not seen for this many days
+        letsmesh_decoder_enabled: Enable external LetsMesh packet decoder
+        letsmesh_decoder_command: Decoder CLI command
+        letsmesh_decoder_channel_keys: Optional channel keys for decrypting group text
+        letsmesh_decoder_timeout_seconds: Decoder CLI timeout
     """
     subscriber = create_subscriber(
         mqtt_host=mqtt_host,
@@ -532,6 +624,9 @@ def run_collector(
         mqtt_password=mqtt_password,
         mqtt_prefix=mqtt_prefix,
         mqtt_tls=mqtt_tls,
+        mqtt_transport=mqtt_transport,
+        mqtt_ws_path=mqtt_ws_path,
+        ingest_mode=ingest_mode,
         database_url=database_url,
         webhook_dispatcher=webhook_dispatcher,
         cleanup_enabled=cleanup_enabled,
@@ -539,6 +634,10 @@ def run_collector(
         cleanup_interval_hours=cleanup_interval_hours,
         node_cleanup_enabled=node_cleanup_enabled,
         node_cleanup_days=node_cleanup_days,
+        letsmesh_decoder_enabled=letsmesh_decoder_enabled,
+        letsmesh_decoder_command=letsmesh_decoder_command,
+        letsmesh_decoder_channel_keys=letsmesh_decoder_channel_keys,
+        letsmesh_decoder_timeout_seconds=letsmesh_decoder_timeout_seconds,
     )
 
     # Set up signal handlers

src/meshcore_hub/common/config.py

@@ -1,6 +1,7 @@
 """Pydantic Settings for MeshCore Hub configuration."""
 
 from enum import Enum
+import re
 from typing import Optional
 
 from pydantic import Field, field_validator
@@ -24,6 +25,20 @@ class InterfaceMode(str, Enum):
     SENDER = "SENDER"
 
 
+class MQTTTransport(str, Enum):
+    """MQTT transport type."""
+
+    TCP = "tcp"
+    WEBSOCKETS = "websockets"
+
+
+class CollectorIngestMode(str, Enum):
+    """Collector MQTT ingest mode."""
+
+    NATIVE = "native"
+    LETSMESH_UPLOAD = "letsmesh_upload"
+
+
 class CommonSettings(BaseSettings):
     """Common settings shared by all components."""
 
@@ -55,6 +70,14 @@ class CommonSettings(BaseSettings):
     mqtt_tls: bool = Field(
         default=False, description="Enable TLS/SSL for MQTT connection"
     )
+    mqtt_transport: MQTTTransport = Field(
+        default=MQTTTransport.TCP,
+        description="MQTT transport protocol (tcp or websockets)",
+    )
+    mqtt_ws_path: str = Field(
+        default="/mqtt",
+        description="WebSocket path for MQTT transport (used when MQTT_TRANSPORT=websockets)",
+    )
 
 
 class InterfaceSettings(CommonSettings):
@@ -162,6 +185,42 @@ class CollectorSettings(CommonSettings):
         description="Remove nodes not seen for this many days (last_seen)",
         ge=1,
     )
+    collector_ingest_mode: CollectorIngestMode = Field(
+        default=CollectorIngestMode.NATIVE,
+        description=(
+            "Collector MQTT ingest mode. "
+            "'native' expects <prefix>/<pubkey>/event/<event_name>. "
+            "'letsmesh_upload' expects LetsMesh observer uploads on "
+            "<prefix>/<pubkey>/(packets|status|internal)."
+        ),
+    )
+    collector_letsmesh_decoder_enabled: bool = Field(
+        default=True,
+        description=(
+            "Enable external LetsMesh packet decoding via meshcore-decoder. "
+            "Only applies when COLLECTOR_INGEST_MODE=letsmesh_upload."
+        ),
+    )
+    collector_letsmesh_decoder_command: str = Field(
+        default="meshcore-decoder",
+        description=(
+            "Command used to run LetsMesh packet decoder CLI "
+            "(for example: meshcore-decoder, /usr/local/bin/meshcore-decoder, "
+            "or 'npx meshcore-decoder')."
+        ),
+    )
+    collector_letsmesh_decoder_keys: Optional[str] = Field(
+        default=None,
+        description=(
+            "Optional channel secret keys for LetsMesh message decryption. "
+            "Provide as comma/space separated hex values."
+        ),
+    )
+    collector_letsmesh_decoder_timeout_seconds: float = Field(
+        default=2.0,
+        description="Timeout in seconds for each decoder invocation.",
+        ge=0.1,
+    )
 
     @property
     def collector_data_dir(self) -> str:
@@ -201,6 +260,17 @@ class CollectorSettings(CommonSettings):
 
         return str(Path(self.effective_seed_home) / "members.yaml")
 
+    @property
+    def collector_letsmesh_decoder_keys_list(self) -> list[str]:
+        """Parse configured LetsMesh decoder keys into a normalized list."""
+        if not self.collector_letsmesh_decoder_keys:
+            return []
+        return [
+            part.strip()
+            for part in re.split(r"[,\s]+", self.collector_letsmesh_decoder_keys)
+            if part.strip()
+        ]
+
     @field_validator("database_url")
     @classmethod
     def validate_database_url(cls, v: Optional[str]) -> Optional[str]:
@@ -262,6 +332,32 @@ class WebSettings(CommonSettings):
         description="Default theme for the web dashboard (dark or light)",
     )
 
+    # Locale / language (default: English)
+    web_locale: str = Field(
+        default="en",
+        description="Locale/language for the web dashboard (e.g. 'en')",
+    )
+    web_datetime_locale: str = Field(
+        default="en-US",
+        description=(
+            "Locale used for date/time formatting in the web dashboard "
+            "(e.g. 'en-US', 'en-GB')."
+        ),
+    )
+
+    # Auto-refresh interval for list pages
+    web_auto_refresh_seconds: int = Field(
+        default=30,
+        description="Auto-refresh interval in seconds for list pages (0 to disable)",
+        ge=0,
+    )
+
+    # Trusted proxy hosts for X-Forwarded-For header processing
+    web_trusted_proxy_hosts: str = Field(
+        default="*",
+        description="Comma-separated list of trusted proxy hosts or '*' for all",
+    )
+
     # Admin interface (disabled by default for security)
     web_admin_enabled: bool = Field(
         default=False,

src/meshcore_hub/common/i18n.py

@@ -0,0 +1,81 @@
+"""Lightweight i18n support for MeshCore Hub.
+
+Loads JSON translation files and provides a ``t()`` lookup function
+that is shared between the Python (Jinja2) and JavaScript (SPA) sides.
+The same ``en.json`` file is served as a static asset for the client and
+read from disk for server-side template rendering.
+"""
+
+import json
+import logging
+from pathlib import Path
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+_translations: dict[str, Any] = {}
+_locale: str = "en"
+
+# Directory where locale JSON files live (web/static/locales/)
+LOCALES_DIR = Path(__file__).parent.parent / "web" / "static" / "locales"
+
+
+def load_locale(locale: str = "en", locales_dir: Path | None = None) -> None:
+    """Load a locale's translation file into memory.
+
+    Args:
+        locale: Language code (e.g. ``"en"``).
+        locales_dir: Override directory containing ``<locale>.json`` files.
+    """
+    global _translations, _locale
+    directory = locales_dir or LOCALES_DIR
+    path = directory / f"{locale}.json"
+    if not path.exists():
+        logger.warning("Locale file not found: %s – falling back to 'en'", path)
+        path = directory / "en.json"
+    if path.exists():
+        _translations = json.loads(path.read_text(encoding="utf-8"))
+        _locale = locale
+        logger.info("Loaded locale '%s' from %s", locale, path)
+    else:
+        logger.error("No locale files found in %s", directory)
+
+
+def _resolve(key: str) -> Any:
+    """Walk a dot-separated key through the nested translation dict."""
+    value: Any = _translations
+    for part in key.split("."):
+        if isinstance(value, dict):
+            value = value.get(part)
+        else:
+            return None
+    return value
+
+
+def t(key: str, **kwargs: Any) -> str:
+    """Translate a key with optional interpolation.
+
+    Supports ``{{var}}`` placeholders in translation strings.
+
+    Args:
+        key: Dot-separated translation key (e.g. ``"nav.home"``).
+        **kwargs: Interpolation values.
+
+    Returns:
+        Translated string, or the key itself as fallback.
+    """
+    val = _resolve(key)
+
+    if not isinstance(val, str):
+        return key
+
+    # Interpolation: replace {{var}} placeholders
+    for k, v in kwargs.items():
+        val = val.replace("{{" + k + "}}", str(v))
+
+    return val
+
+
+def get_locale() -> str:
+    """Return the currently loaded locale code."""
+    return _locale

src/meshcore_hub/common/models/trace_path.py

@@ -20,7 +20,7 @@ class TracePath(Base, UUIDMixin, TimestampMixin):
         path_len: Path length
         flags: Trace flags
         auth: Authentication data
-        path_hashes: JSON array of node hash identifiers
+        path_hashes: JSON array of hex-encoded node hash identifiers (variable length)
         snr_values: JSON array of SNR values per hop
         hop_count: Total number of hops
         received_at: When received by interface

src/meshcore_hub/common/mqtt.py

@@ -24,6 +24,8 @@ class MQTTConfig:
     keepalive: int = 60
     clean_session: bool = True
     tls: bool = False
+    transport: str = "tcp"
+    ws_path: str = "/mqtt"
 
 
 class TopicBuilder:
@@ -37,6 +39,10 @@ class TopicBuilder:
         """
         self.prefix = prefix
 
+    def _prefix_parts(self) -> list[str]:
+        """Split configured prefix into path segments."""
+        return [part for part in self.prefix.strip("/").split("/") if part]
+
     def event_topic(self, public_key: str, event_name: str) -> str:
         """Build an event topic.
 
@@ -86,10 +92,16 @@ class TopicBuilder:
         Returns:
             Tuple of (public_key, event_name) or None if invalid
         """
-        parts = topic.split("/")
-        if len(parts) >= 4 and parts[0] == self.prefix and parts[2] == "event":
-            public_key = parts[1]
-            event_name = "/".join(parts[3:])
+        parts = [part for part in topic.strip("/").split("/") if part]
+        prefix_parts = self._prefix_parts()
+        prefix_len = len(prefix_parts)
+        if (
+            len(parts) >= prefix_len + 3
+            and parts[:prefix_len] == prefix_parts
+            and parts[prefix_len + 1] == "event"
+        ):
+            public_key = parts[prefix_len]
+            event_name = "/".join(parts[prefix_len + 2 :])
             return (public_key, event_name)
         return None
 
@@ -102,13 +114,39 @@ class TopicBuilder:
         Returns:
             Tuple of (public_key, command_name) or None if invalid
         """
-        parts = topic.split("/")
-        if len(parts) >= 4 and parts[0] == self.prefix and parts[2] == "command":
-            public_key = parts[1]
-            command_name = "/".join(parts[3:])
+        parts = [part for part in topic.strip("/").split("/") if part]
+        prefix_parts = self._prefix_parts()
+        prefix_len = len(prefix_parts)
+        if (
+            len(parts) >= prefix_len + 3
+            and parts[:prefix_len] == prefix_parts
+            and parts[prefix_len + 1] == "command"
+        ):
+            public_key = parts[prefix_len]
+            command_name = "/".join(parts[prefix_len + 2 :])
             return (public_key, command_name)
         return None
 
+    def parse_letsmesh_upload_topic(self, topic: str) -> tuple[str, str] | None:
+        """Parse a LetsMesh upload topic to extract public key and feed type.
+
+        LetsMesh upload topics are expected in this form:
+        <prefix>/<public_key>/(packets|status|internal)
+        """
+        parts = [part for part in topic.strip("/").split("/") if part]
+        prefix_parts = self._prefix_parts()
+        prefix_len = len(prefix_parts)
+
+        if len(parts) != prefix_len + 2 or parts[:prefix_len] != prefix_parts:
+            return None
+
+        public_key = parts[prefix_len]
+        feed_type = parts[prefix_len + 1]
+        if feed_type not in {"packets", "status", "internal"}:
+            return None
+
+        return (public_key, feed_type)
+
 
 MessageHandler = Callable[[str, str, dict[str, Any]], None]
 
@@ -124,14 +162,24 @@ class MQTTClient:
         """
         self.config = config
         self.topic_builder = TopicBuilder(config.prefix)
+        transport = config.transport.lower()
+        if transport not in {"tcp", "websockets"}:
+            raise ValueError(f"Unsupported MQTT transport: {config.transport}")
+
         self._client = mqtt.Client(
             callback_api_version=CallbackAPIVersion.VERSION2,  # type: ignore[call-arg]
             client_id=config.client_id,
             clean_session=config.clean_session,
+            transport=transport,
         )
         self._connected = False
         self._message_handlers: dict[str, list[MessageHandler]] = {}
 
+        # Set WebSocket path when using MQTT over WebSockets.
+        if transport == "websockets":
+            self._client.ws_set_options(path=config.ws_path)
+            logger.debug("MQTT WebSocket transport enabled (path=%s)", config.ws_path)
+
         # Set up TLS if enabled
         if config.tls:
             self._client.tls_set()

src/meshcore_hub/common/schemas/events.py

@@ -28,6 +28,14 @@ class AdvertisementEvent(BaseModel):
         default=None,
         description="Capability/status flags bitmask",
     )
+    lat: Optional[float] = Field(
+        default=None,
+        description="Node latitude when location metadata is available",
+    )
+    lon: Optional[float] = Field(
+        default=None,
+        description="Node longitude when location metadata is available",
+    )
 
 
 class ContactMessageEvent(BaseModel):
@@ -125,7 +133,7 @@ class TraceDataEvent(BaseModel):
     )
     path_hashes: Optional[list[str]] = Field(
         default=None,
-        description="Array of 2-character node hash identifiers",
+        description="Array of hex-encoded node hash identifiers (variable length, e.g. '4a' for single-byte or 'b3fa' for multibyte)",
     )
     snr_values: Optional[list[float]] = Field(
         default=None,

src/meshcore_hub/common/schemas/messages.py

@@ -119,6 +119,9 @@ class AdvertisementRead(BaseModel):
     node_tag_name: Optional[str] = Field(
         default=None, description="Node name from tags"
     )
+    node_tag_description: Optional[str] = Field(
+        default=None, description="Node description from tags"
+    )
     adv_type: Optional[str] = Field(default=None, description="Node type")
     flags: Optional[int] = Field(default=None, description="Capability flags")
     received_at: datetime = Field(..., description="When received")
@@ -152,7 +155,8 @@ class TracePathRead(BaseModel):
     flags: Optional[int] = Field(default=None, description="Trace flags")
     auth: Optional[int] = Field(default=None, description="Auth data")
     path_hashes: Optional[list[str]] = Field(
-        default=None, description="Node hash identifiers"
+        default=None,
+        description="Hex-encoded node hash identifiers (variable length, e.g. '4a' for single-byte or 'b3fa' for multibyte)",
     )
     snr_values: Optional[list[float]] = Field(
         default=None, description="SNR values per hop"

src/meshcore_hub/web/app.py

@@ -2,6 +2,8 @@
 
 import json
 import logging
+import os
+import re
 from contextlib import asynccontextmanager
 from datetime import datetime
 from pathlib import Path
@@ -16,7 +18,10 @@ from fastapi.templating import Jinja2Templates
 from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
 
 from meshcore_hub import __version__
+from meshcore_hub.collector.letsmesh_decoder import LetsMeshPacketDecoder
+from meshcore_hub.common.i18n import load_locale, t
 from meshcore_hub.common.schemas import RadioConfig
+from meshcore_hub.web.middleware import CacheControlMiddleware
 from meshcore_hub.web.pages import PageLoader
 
 logger = logging.getLogger(__name__)
@@ -27,6 +32,60 @@ TEMPLATES_DIR = PACKAGE_DIR / "templates"
 STATIC_DIR = PACKAGE_DIR / "static"
 
 
+def _parse_decoder_key_entries(raw: str | None) -> list[str]:
+    """Parse COLLECTOR_LETSMESH_DECODER_KEYS into key entries."""
+    if not raw:
+        return []
+    return [part.strip() for part in re.split(r"[,\s]+", raw) if part.strip()]
+
+
+def _build_channel_labels() -> dict[str, str]:
+    """Build UI channel labels from built-in + configured decoder keys."""
+    raw_keys = os.getenv("COLLECTOR_LETSMESH_DECODER_KEYS")
+    decoder = LetsMeshPacketDecoder(
+        enabled=False,
+        channel_keys=_parse_decoder_key_entries(raw_keys),
+    )
+    labels = decoder.channel_labels_by_index()
+    return {str(idx): label for idx, label in sorted(labels.items())}
+
+
+def _resolve_logo(media_home: Path) -> tuple[str, bool, Path | None]:
+    """Resolve logo URL and whether light-mode inversion should be applied.
+
+    Returns:
+        tuple of (logo_url, invert_in_light_mode, resolved_path)
+    """
+    custom_logo_candidates = (
+        ("logo-invert.svg", "/media/images/logo-invert.svg", True),
+        ("logo.svg", "/media/images/logo.svg", False),
+    )
+    for filename, url, invert_in_light_mode in custom_logo_candidates:
+        path = media_home / "images" / filename
+        if path.exists():
+            cache_buster = int(path.stat().st_mtime)
+            return f"{url}?v={cache_buster}", invert_in_light_mode, path
+
+    # Default packaged logo is monochrome and needs darkening in light mode.
+    return "/static/img/logo.svg", True, None
+
+
+def _is_authenticated_proxy_request(request: Request) -> bool:
+    """Check whether request is authenticated by an upstream auth proxy.
+
+    Supported patterns:
+    - OAuth2/OIDC proxy headers: X-Forwarded-User, X-Auth-Request-User
+    - Forwarded Basic auth header: Authorization: Basic ...
+    """
+    if request.headers.get("x-forwarded-user"):
+        return True
+    if request.headers.get("x-auth-request-user"):
+        return True
+
+    auth_header = request.headers.get("authorization", "")
+    return auth_header.lower().startswith("basic ")
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     """Application lifespan handler."""
@@ -112,11 +171,20 @@ def _build_config_json(app: FastAPI, request: Request) -> str:
         "version": __version__,
         "timezone": app.state.timezone_abbr,
         "timezone_iana": app.state.timezone,
-        "is_authenticated": bool(request.headers.get("X-Forwarded-User")),
+        "is_authenticated": _is_authenticated_proxy_request(request),
         "default_theme": app.state.web_theme,
+        "locale": app.state.web_locale,
+        "datetime_locale": app.state.web_datetime_locale,
+        "auto_refresh_seconds": app.state.auto_refresh_seconds,
+        "channel_labels": app.state.channel_labels,
+        "logo_invert_light": app.state.logo_invert_light,
     }
 
-    return json.dumps(config)
+    # Escape "</script>" sequences to prevent XSS breakout from the
+    # <script> block where this JSON is embedded via |safe in the
+    # Jinja2 template.  "<\/" is valid JSON per the spec and parsed
+    # correctly by JavaScript's JSON.parse().
+    return json.dumps(config).replace("</", "<\\/")
 
 
 def create_app(
@@ -172,7 +240,36 @@ def create_app(
     )
 
     # Trust proxy headers (X-Forwarded-Proto, X-Forwarded-For) for HTTPS detection
-    app.add_middleware(ProxyHeadersMiddleware, trusted_hosts="*")
+    trusted_hosts_raw = settings.web_trusted_proxy_hosts
+    if trusted_hosts_raw == "*":
+        trusted_hosts: str | list[str] = "*"
+    else:
+        trusted_hosts = [h.strip() for h in trusted_hosts_raw.split(",") if h.strip()]
+    app.add_middleware(ProxyHeadersMiddleware, trusted_hosts=trusted_hosts)
+
+    # Compute effective admin flag (parameter overrides setting)
+    effective_admin = (
+        admin_enabled if admin_enabled is not None else settings.web_admin_enabled
+    )
+
+    # Warn when admin is enabled but proxy trust is wide open
+    if effective_admin and settings.web_trusted_proxy_hosts == "*":
+        logger.warning(
+            "WEB_ADMIN_ENABLED is true but WEB_TRUSTED_PROXY_HOSTS is '*' (trust all). "
+            "Consider restricting to your reverse proxy IP for production deployments."
+        )
+
+    # Add cache control headers based on resource type
+    app.add_middleware(CacheControlMiddleware)
+
+    # Load i18n translations
+    app.state.web_locale = settings.web_locale or "en"
+    app.state.web_datetime_locale = settings.web_datetime_locale or "en-US"
+    load_locale(app.state.web_locale)
+
+    # Auto-refresh interval
+    app.state.auto_refresh_seconds = settings.web_auto_refresh_seconds
+    app.state.channel_labels = _build_channel_labels()
 
     # Store configuration in app state (use args if provided, else settings)
     app.state.web_theme = (
@@ -180,9 +277,7 @@ def create_app(
     )
     app.state.api_url = api_url or settings.api_base_url
     app.state.api_key = api_key or settings.api_key
-    app.state.admin_enabled = (
-        admin_enabled if admin_enabled is not None else settings.web_admin_enabled
-    )
+    app.state.admin_enabled = effective_admin
     app.state.network_name = network_name or settings.network_name
     app.state.network_city = network_city or settings.network_city
     app.state.network_country = network_country or settings.network_country
@@ -227,6 +322,7 @@ def create_app(
     templates = Jinja2Templates(directory=str(TEMPLATES_DIR))
     templates.env.trim_blocks = True
     templates.env.lstrip_blocks = True
+    templates.env.globals["t"] = t
     app.state.templates = templates
 
     # Compute timezone
@@ -244,12 +340,11 @@ def create_app(
 
     # Check for custom logo and store media path
     media_home = Path(settings.effective_media_home)
-    custom_logo_path = media_home / "images" / "logo.svg"
-    if custom_logo_path.exists():
-        app.state.logo_url = "/media/images/logo.svg"
-        logger.info(f"Using custom logo from {custom_logo_path}")
-    else:
-        app.state.logo_url = "/static/img/logo.svg"
+    logo_url, logo_invert_light, logo_path = _resolve_logo(media_home)
+    app.state.logo_url = logo_url
+    app.state.logo_invert_light = logo_invert_light
+    if logo_path is not None:
+        logger.info("Using custom logo from %s", logo_path)
 
     # Mount static files
     if STATIC_DIR.exists():
@@ -295,7 +390,7 @@ def create_app(
         if (
             request.method in ("POST", "PUT", "DELETE", "PATCH")
             and request.app.state.admin_enabled
-            and not request.headers.get("x-forwarded-user")
+            and not _is_authenticated_proxy_request(request)
         ):
             return JSONResponse(
                 {"detail": "Authentication required"},
@@ -641,6 +736,7 @@ def create_app(
                 "features": features,
                 "custom_pages": custom_pages,
                 "logo_url": request.app.state.logo_url,
+                "logo_invert_light": request.app.state.logo_invert_light,
                 "version": __version__,
                 "default_theme": request.app.state.web_theme,
                 "config_json": config_json,

src/meshcore_hub/web/middleware.py

@@ -0,0 +1,85 @@
+"""HTTP caching middleware for the web component."""
+
+from collections.abc import Awaitable, Callable
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+from starlette.types import ASGIApp
+
+
+class CacheControlMiddleware(BaseHTTPMiddleware):
+    """Middleware to set appropriate Cache-Control headers based on resource type."""
+
+    def __init__(self, app: ASGIApp) -> None:
+        """Initialize the middleware.
+
+        Args:
+            app: The ASGI application to wrap.
+        """
+        super().__init__(app)
+
+    async def dispatch(
+        self,
+        request: Request,
+        call_next: Callable[[Request], Awaitable[Response]],
+    ) -> Response:
+        """Process the request and add appropriate caching headers.
+
+        Args:
+            request: The incoming HTTP request.
+            call_next: The next middleware or route handler.
+
+        Returns:
+            The response with cache headers added.
+        """
+        response: Response = await call_next(request)
+
+        # Skip if Cache-Control already set (explicit override)
+        if "cache-control" in response.headers:
+            return response
+
+        path = request.url.path
+        query_params = request.url.query
+
+        # Health endpoints - never cache
+        if path.startswith("/health"):
+            response.headers["cache-control"] = "no-cache, no-store, must-revalidate"
+
+        # Static files with version parameter - long-term cache
+        elif path.startswith("/static/") and "v=" in query_params:
+            response.headers["cache-control"] = "public, max-age=31536000, immutable"
+
+        # Static files without version - short cache as fallback
+        elif path.startswith("/static/"):
+            response.headers["cache-control"] = "public, max-age=3600"
+
+        # Media files with version parameter - long-term cache
+        elif path.startswith("/media/") and "v=" in query_params:
+            response.headers["cache-control"] = "public, max-age=31536000, immutable"
+
+        # Media files without version - short cache (user may update)
+        elif path.startswith("/media/"):
+            response.headers["cache-control"] = "public, max-age=3600"
+
+        # Map data - short cache (5 minutes)
+        elif path == "/map/data":
+            response.headers["cache-control"] = "public, max-age=300"
+
+        # Custom pages - moderate cache (1 hour)
+        elif path.startswith("/spa/pages/"):
+            response.headers["cache-control"] = "public, max-age=3600"
+
+        # SEO files - moderate cache (1 hour)
+        elif path in ("/robots.txt", "/sitemap.xml"):
+            response.headers["cache-control"] = "public, max-age=3600"
+
+        # API proxy - don't add headers (pass through backend)
+        elif path.startswith("/api/"):
+            pass
+
+        # SPA shell HTML (catch-all for client-side routes) - no cache
+        elif response.headers.get("content-type", "").startswith("text/html"):
+            response.headers["cache-control"] = "no-cache, public"
+
+        return response

src/meshcore_hub/web/static/css/app.css

@@ -25,6 +25,7 @@
     --color-messages: oklch(0.75 0.18 180);    /* teal */
     --color-map: oklch(0.8471 0.199 83.87);      /* yellow (matches btn-warning) */
     --color-members: oklch(0.72 0.17 50);      /* orange */
+    --color-neutral: oklch(0.3 0.01 250);     /* subtle dark grey */
 }
 
 /* Light mode: darker section colors for contrast on light backgrounds */
@@ -35,6 +36,7 @@
     --color-messages: oklch(0.55 0.18 180);
     --color-map: oklch(0.58 0.16 45);
     --color-members: oklch(0.55 0.18 25);
+    --color-neutral: oklch(0.85 0.01 250);
 }
 
 /* ==========================================================================
@@ -44,8 +46,8 @@
 /* Spacing between horizontal nav items */
 .menu-horizontal { gap: 0.125rem; }
 
-/* Invert white logos/images to dark for light mode */
-[data-theme="light"] .theme-logo {
+/* Invert monochrome logos to dark for light mode */
+[data-theme="light"] .theme-logo--invert-light {
     filter: brightness(0.15);
 }
 
@@ -90,6 +92,34 @@
     color: #fff !important;
 }
 
+/* ==========================================================================
+   Panel Glow
+   Radial color glow from bottom-right corner.
+   Set --panel-color on the element for a section-tinted glow.
+   ========================================================================== */
+
+.panel-glow {
+    background-image:
+        radial-gradient(
+            ellipse at 80% 80%,
+            color-mix(in oklch, var(--panel-color, transparent) 15%, transparent),
+            transparent 70%
+        );
+}
+
+.panel-glow.panel-glow-tl {
+    background-image:
+        radial-gradient(
+            ellipse at 20% 20%,
+            color-mix(in oklch, var(--panel-color, transparent) 15%, transparent),
+            transparent 70%
+        );
+}
+
+.panel-solid {
+    background-color: color-mix(in oklch, var(--panel-color, transparent) 10%, oklch(var(--b1)));
+}
+
 /* ==========================================================================
    Scrollbar Styling
    ========================================================================== */

src/meshcore_hub/web/static/js/charts.js

@@ -154,7 +154,7 @@ function createActivityChart(canvasId, advertData, messageData) {
     if (advertData && advertData.data && advertData.data.length > 0) {
         if (!labels) labels = formatDateLabels(advertData.data);
         datasets.push({
-            label: 'Advertisements',
+            label: (window.t && window.t('entities.advertisements')) || 'Advertisements',
             data: advertData.data.map(function(d) { return d.count; }),
             borderColor: ChartColors.adverts,
             backgroundColor: ChartColors.advertsFill,
@@ -168,7 +168,7 @@ function createActivityChart(canvasId, advertData, messageData) {
     if (messageData && messageData.data && messageData.data.length > 0) {
         if (!labels) labels = formatDateLabels(messageData.data);
         datasets.push({
-            label: 'Messages',
+            label: (window.t && window.t('entities.messages')) || 'Messages',
             data: messageData.data.map(function(d) { return d.count; }),
             borderColor: ChartColors.messages,
             backgroundColor: ChartColors.messagesFill,
@@ -200,7 +200,7 @@ function initDashboardCharts(nodeData, advertData, messageData) {
         createLineChart(
             'nodeChart',
             nodeData,
-            'Total Nodes',
+            (window.t && window.t('common.total_entity', { entity: t('entities.nodes') })) || 'Total Nodes',
             ChartColors.nodes,
             ChartColors.nodesFill,
             true
@@ -211,7 +211,7 @@ function initDashboardCharts(nodeData, advertData, messageData) {
         createLineChart(
             'advertChart',
             advertData,
-            'Advertisements',
+            (window.t && window.t('entities.advertisements')) || 'Advertisements',
             ChartColors.adverts,
             ChartColors.advertsFill,
             true
@@ -222,7 +222,7 @@ function initDashboardCharts(nodeData, advertData, messageData) {
         createLineChart(
             'messageChart',
             messageData,
-            'Messages',
+            (window.t && window.t('entities.messages')) || 'Messages',
             ChartColors.messages,
             ChartColors.messagesFill,
             true

src/meshcore_hub/web/static/js/spa/app.js

@@ -1,11 +1,13 @@
 /**
  * MeshCore Hub SPA - Main Application Entry Point
  *
- * Initializes the router, registers all page routes, and handles navigation.
+ * Initializes i18n, the router, registers all page routes,
+ * and handles navigation.
  */
 
 import { Router } from './router.js';
 import { getConfig } from './components.js';
+import { loadLocale, t } from './i18n.js';
 
 // Page modules (lazy-loaded)
 const pages = {
@@ -46,10 +48,10 @@ function pageHandler(loader) {
             console.error('Page load error:', e);
             appContainer.innerHTML = `
                 <div class="flex flex-col items-center justify-center py-20">
-                    <h1 class="text-4xl font-bold mb-4">Error</h1>
-                    <p class="text-lg opacity-70 mb-6">Failed to load page</p>
+                    <h1 class="text-4xl font-bold mb-4">${t('common.error')}</h1>
+                    <p class="text-lg opacity-70 mb-6">${t('common.failed_to_load_page')}</p>
                     <p class="text-sm opacity-50 mb-6">${e.message || 'Unknown error'}</p>
-                    <a href="/" class="btn btn-primary">Go Home</a>
+                    <a href="/" class="btn btn-primary">${t('common.go_home')}</a>
                 </div>`;
         }
     };
@@ -124,33 +126,43 @@ function updateNavActiveState(pathname) {
     }
 }
 
+/**
+ * Compose a page title from entity name and network name.
+ * @param {string} entityKey - Translation key for entity (e.g., 'entities.dashboard')
+ * @returns {string}
+ */
+function composePageTitle(entityKey) {
+    const networkName = config.network_name || 'MeshCore Network';
+    const entity = t(entityKey);
+    return `${entity} - ${networkName}`;
+}
+
 /**
  * Update the page title based on the current route.
  * @param {string} pathname
  */
 function updatePageTitle(pathname) {
-    const config = getConfig();
     const networkName = config.network_name || 'MeshCore Network';
     const titles = {
         '/': networkName,
-        '/a': `Admin - ${networkName}`,
-        '/a/': `Admin - ${networkName}`,
-        '/a/node-tags': `Node Tags - Admin - ${networkName}`,
-        '/a/members': `Members - Admin - ${networkName}`,
+        '/a': composePageTitle('entities.admin'),
+        '/a/': composePageTitle('entities.admin'),
+        '/a/node-tags': `${t('entities.tags')} - ${t('entities.admin')} - ${networkName}`,
+        '/a/members': `${t('entities.members')} - ${t('entities.admin')} - ${networkName}`,
     };
 
     // Add feature-dependent titles
-    if (features.dashboard !== false) titles['/dashboard'] = `Dashboard - ${networkName}`;
-    if (features.nodes !== false) titles['/nodes'] = `Nodes - ${networkName}`;
-    if (features.messages !== false) titles['/messages'] = `Messages - ${networkName}`;
-    if (features.advertisements !== false) titles['/advertisements'] = `Advertisements - ${networkName}`;
-    if (features.map !== false) titles['/map'] = `Map - ${networkName}`;
-    if (features.members !== false) titles['/members'] = `Members - ${networkName}`;
+    if (features.dashboard !== false) titles['/dashboard'] = composePageTitle('entities.dashboard');
+    if (features.nodes !== false) titles['/nodes'] = composePageTitle('entities.nodes');
+    if (features.messages !== false) titles['/messages'] = composePageTitle('entities.messages');
+    if (features.advertisements !== false) titles['/advertisements'] = composePageTitle('entities.advertisements');
+    if (features.map !== false) titles['/map'] = composePageTitle('entities.map');
+    if (features.members !== false) titles['/members'] = composePageTitle('entities.members');
 
     if (titles[pathname]) {
         document.title = titles[pathname];
     } else if (pathname.startsWith('/nodes/')) {
-        document.title = `Node Detail - ${networkName}`;
+        document.title = composePageTitle('entities.node_detail');
     } else if (pathname.startsWith('/pages/')) {
         // Custom pages set their own title in the page module
         document.title = networkName;
@@ -165,5 +177,7 @@ router.onNavigate((pathname) => {
     updatePageTitle(pathname);
 });
 
-// Start the router when DOM is ready
+// Load locale then start the router
+const locale = localStorage.getItem('meshcore-locale') || config.locale || 'en';
+await loadLocale(locale);
 router.start();

src/meshcore_hub/web/static/js/spa/auto-refresh.js

@@ -0,0 +1,87 @@
+/**
+ * Auto-refresh utility for list pages.
+ *
+ * Reads `auto_refresh_seconds` from the app config. When the interval is > 0
+ * it sets up a periodic timer that calls the provided `fetchAndRender` callback
+ * and renders a pause/play toggle button into the given container element.
+ */
+
+import { html, litRender, getConfig, t } from './components.js';
+
+/**
+ * Create an auto-refresh controller.
+ *
+ * @param {Object} options
+ * @param {Function} options.fetchAndRender - Async function that fetches data and re-renders the page.
+ * @param {HTMLElement} options.toggleContainer - Element to render the pause/play toggle into.
+ * @returns {{ cleanup: Function }} cleanup function to stop the timer.
+ */
+export function createAutoRefresh({ fetchAndRender, toggleContainer }) {
+    const config = getConfig();
+    const intervalSeconds = config.auto_refresh_seconds || 0;
+
+    if (!intervalSeconds || !toggleContainer) {
+        return { cleanup() {} };
+    }
+
+    let paused = false;
+    let isPending = false;
+    let timerId = null;
+
+    function renderToggle() {
+        const pauseIcon = html`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" class="w-4 h-4"><path d="M5.75 3a.75.75 0 0 0-.75.75v12.5c0 .414.336.75.75.75h1.5a.75.75 0 0 0 .75-.75V3.75A.75.75 0 0 0 7.25 3h-1.5ZM12.75 3a.75.75 0 0 0-.75.75v12.5c0 .414.336.75.75.75h1.5a.75.75 0 0 0 .75-.75V3.75a.75.75 0 0 0-.75-.75h-1.5Z"/></svg>`;
+        const playIcon = html`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" class="w-4 h-4"><path d="M6.3 2.84A1.5 1.5 0 0 0 4 4.11v11.78a1.5 1.5 0 0 0 2.3 1.27l9.344-5.891a1.5 1.5 0 0 0 0-2.538L6.3 2.84Z"/></svg>`;
+
+        const tooltip = paused ? t('auto_refresh.resume') : t('auto_refresh.pause');
+        const icon = paused ? playIcon : pauseIcon;
+
+        litRender(html`
+            <button class="btn btn-ghost btn-xs gap-1 opacity-60 hover:opacity-100"
+                    title=${tooltip}
+                    @click=${onToggle}>
+                ${icon}
+                <span class="text-xs">${intervalSeconds}s</span>
+            </button>
+        `, toggleContainer);
+    }
+
+    function onToggle() {
+        paused = !paused;
+        if (paused) {
+            clearInterval(timerId);
+            timerId = null;
+        } else {
+            startTimer();
+        }
+        renderToggle();
+    }
+
+    async function tick() {
+        if (isPending || paused) return;
+        isPending = true;
+        try {
+            await fetchAndRender();
+        } catch (_e) {
+            // Errors are handled inside fetchAndRender; don't stop the timer.
+        } finally {
+            isPending = false;
+        }
+    }
+
+    function startTimer() {
+        timerId = setInterval(tick, intervalSeconds * 1000);
+    }
+
+    // Initial render and start
+    renderToggle();
+    startTimer();
+
+    return {
+        cleanup() {
+            if (timerId) {
+                clearInterval(timerId);
+                timerId = null;
+            }
+        },
+    };
+}

src/meshcore_hub/web/static/js/spa/components.js

@@ -7,10 +7,12 @@
 import { html, nothing } from 'lit-html';
 import { render } from 'lit-html';
 import { unsafeHTML } from 'lit-html/directives/unsafe-html.js';
+import { t } from './i18n.js';
 
 // Re-export lit-html utilities for page modules
 export { html, nothing, unsafeHTML };
 export { render as litRender } from 'lit-html';
+export { t } from './i18n.js';
 
 /**
  * Get app config from the embedded window object.
@@ -20,6 +22,65 @@ export function getConfig() {
     return window.__APP_CONFIG__ || {};
 }
 
+/**
+ * Build channel label map from app config.
+ * Keys are numeric channel indexes and values are non-empty labels.
+ *
+ * @param {Object} [config]
+ * @returns {Map<number, string>}
+ */
+export function getChannelLabelsMap(config = getConfig()) {
+    return new Map(
+        Object.entries(config.channel_labels || {})
+            .map(([idx, label]) => [parseInt(idx, 10), typeof label === 'string' ? label.trim() : ''])
+            .filter(([idx, label]) => Number.isInteger(idx) && label.length > 0),
+    );
+}
+
+/**
+ * Resolve a channel label from a numeric index.
+ *
+ * @param {number|string} channelIdx
+ * @param {Map<number, string>} [channelLabels]
+ * @returns {string|null}
+ */
+export function resolveChannelLabel(channelIdx, channelLabels = getChannelLabelsMap()) {
+    const parsed = parseInt(String(channelIdx), 10);
+    if (!Number.isInteger(parsed)) return null;
+    return channelLabels.get(parsed) || null;
+}
+
+/**
+ * Parse API datetime strings reliably.
+ * MeshCore API often returns UTC timestamps without an explicit timezone suffix.
+ * In that case, treat them as UTC by appending 'Z' before Date parsing.
+ *
+ * @param {string|null} isoString
+ * @returns {Date|null}
+ */
+export function parseAppDate(isoString) {
+    if (!isoString || typeof isoString !== 'string') return null;
+
+    let value = isoString.trim();
+    if (!value) return null;
+
+    // Normalize "YYYY-MM-DD HH:MM:SS" to ISO separator.
+    if (/^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}/.test(value)) {
+        value = value.replace(/\s+/, 'T');
+    }
+
+    // If no timezone suffix is present, treat as UTC.
+    const hasTimePart = /T\d{2}:\d{2}/.test(value);
+    const hasTimezoneSuffix = /(Z|[+-]\d{2}:\d{2}|[+-]\d{4})$/i.test(value);
+    if (hasTimePart && !hasTimezoneSuffix) {
+        value += 'Z';
+    }
+
+    const parsed = new Date(value);
+    if (isNaN(parsed.getTime())) return null;
+    return parsed;
+}
+
 /**
  * Page color palette - reads from CSS custom properties (defined in app.css :root).
  * Use for inline styles or dynamic coloring in page modules.
@@ -40,15 +101,54 @@ export const pageColors = {
  * @param {string|null} advType
  * @returns {string} Emoji character
  */
+function inferNodeType(value) {
+    const normalized = (value || '').toLowerCase();
+    if (!normalized) return null;
+    if (normalized.includes('room')) return 'room';
+    if (normalized.includes('repeater') || normalized.includes('relay')) return 'repeater';
+    if (normalized.includes('companion') || normalized.includes('observer')) return 'companion';
+    if (normalized.includes('chat')) return 'chat';
+    return null;
+}
+
 export function typeEmoji(advType) {
-    switch ((advType || '').toLowerCase()) {
+    switch (inferNodeType(advType) || (advType || '').toLowerCase()) {
         case 'chat': return '\u{1F4AC}';     // 💬
         case 'repeater': return '\u{1F4E1}';  // 📡
+        case 'companion': return '\u{1F4F1}'; // 📱
         case 'room': return '\u{1FAA7}';      // 🪧
         default: return '\u{1F4CD}';          // 📍
     }
 }
 
+/**
+ * Extract the first emoji from a string.
+ * Uses a regex pattern that matches emoji characters including compound emojis.
+ * @param {string|null} str
+ * @returns {string|null} First emoji found, or null if none
+ */
+export function extractFirstEmoji(str) {
+    if (!str) return null;
+    // Match emoji using Unicode ranges and zero-width joiners
+    const emojiRegex = /[\u{1F300}-\u{1F9FF}\u{2600}-\u{26FF}\u{2700}-\u{27BF}\u{1F000}-\u{1F02F}\u{1F0A0}-\u{1F0FF}\u{1F100}-\u{1F64F}\u{1F680}-\u{1F6FF}\u{1F900}-\u{1F9FF}\u{1FA00}-\u{1FA6F}\u{1FA70}-\u{1FAFF}\u{231A}-\u{231B}\u{23E9}-\u{23FA}\u{25AA}-\u{25AB}\u{25B6}\u{25C0}\u{25FB}-\u{25FE}\u{2B50}\u{2B55}\u{3030}\u{303D}\u{3297}\u{3299}](?:\u{FE0F})?(?:\u{200D}[\u{1F300}-\u{1F9FF}\u{2600}-\u{26FF}\u{2700}-\u{27BF}](?:\u{FE0F})?)*|\u{00A9}|\u{00AE}|\u{203C}|\u{2049}|\u{2122}|\u{2139}|\u{2194}-\u{2199}|\u{21A9}-\u{21AA}|\u{24C2}|\u{2934}-\u{2935}|\u{2B05}-\u{2B07}|\u{2B1B}-\u{2B1C}/u;
+    const match = str.match(emojiRegex);
+    return match ? match[0] : null;
+}
+
+/**
+ * Get the display emoji for a node.
+ * Prefers the first emoji from the node name, falls back to type emoji.
+ * @param {string|null} nodeName - Node's display name
+ * @param {string|null} advType - Advertisement type
+ * @returns {string} Emoji character to display
+ */
+export function getNodeEmoji(nodeName, advType) {
+    const nameEmoji = extractFirstEmoji(nodeName);
+    if (nameEmoji) return nameEmoji;
+    const inferred = inferNodeType(advType) || inferNodeType(nodeName);
+    return typeEmoji(inferred || advType);
+}
+
 /**
  * Format an ISO datetime string to the configured timezone.
  * @param {string|null} isoString
@@ -60,8 +160,9 @@ export function formatDateTime(isoString, options) {
     try {
         const config = getConfig();
         const tz = config.timezone_iana || 'UTC';
-        const date = new Date(isoString);
-        if (isNaN(date.getTime())) return '-';
+        const locale = config.datetime_locale || 'en-US';
+        const date = parseAppDate(isoString);
+        if (!date) return '-';
         const opts = options || {
             timeZone: tz,
             year: 'numeric', month: '2-digit', day: '2-digit',
@@ -69,7 +170,7 @@ export function formatDateTime(isoString, options) {
             hour12: false,
         };
         if (!opts.timeZone) opts.timeZone = tz;
-        return date.toLocaleString('en-GB', opts);
+        return date.toLocaleString(locale, opts);
     } catch {
         return isoString ? isoString.slice(0, 19).replace('T', ' ') : '-';
     }
@@ -85,9 +186,10 @@ export function formatDateTimeShort(isoString) {
     try {
         const config = getConfig();
         const tz = config.timezone_iana || 'UTC';
-        const date = new Date(isoString);
-        if (isNaN(date.getTime())) return '-';
-        return date.toLocaleString('en-GB', {
+        const locale = config.datetime_locale || 'en-US';
+        const date = parseAppDate(isoString);
+        if (!date) return '-';
+        return date.toLocaleString(locale, {
             timeZone: tz,
             year: 'numeric', month: '2-digit', day: '2-digit',
             hour: '2-digit', minute: '2-digit',
@@ -105,18 +207,18 @@ export function formatDateTimeShort(isoString) {
  */
 export function formatRelativeTime(isoString) {
     if (!isoString) return '';
-    const date = new Date(isoString);
-    if (isNaN(date.getTime())) return '';
+    const date = parseAppDate(isoString);
+    if (!date) return '';
     const now = new Date();
     const diffMs = now - date;
     const diffSec = Math.floor(diffMs / 1000);
     const diffMin = Math.floor(diffSec / 60);
     const diffHour = Math.floor(diffMin / 60);
     const diffDay = Math.floor(diffHour / 24);
-    if (diffDay > 0) return `${diffDay}d ago`;
-    if (diffHour > 0) return `${diffHour}h ago`;
-    if (diffMin > 0) return `${diffMin}m ago`;
-    return '<1m ago';
+    if (diffDay > 0) return t('time.days_ago', { count: diffDay });
+    if (diffHour > 0) return t('time.hours_ago', { count: diffHour });
+    if (diffMin > 0) return t('time.minutes_ago', { count: diffMin });
+    return t('time.less_than_minute');
 }
 
 /**
@@ -144,8 +246,97 @@ export function escapeHtml(str) {
     return div.innerHTML;
 }
 
+/**
+ * Copy text to clipboard with visual feedback.
+ * Updates the target element to show "Copied!" temporarily.
+ * Falls back to execCommand for browsers without Clipboard API.
+ * @param {Event} e - Click event
+ * @param {string} text - Text to copy to clipboard
+ */
+export function copyToClipboard(e, text) {
+    e.preventDefault();
+    e.stopPropagation();
+
+    // Capture target element synchronously before async operations
+    const targetElement = e.currentTarget;
+
+    const showSuccess = (target) => {
+        const originalText = target.textContent;
+        target.textContent = 'Copied!';
+        target.classList.add('text-success');
+        setTimeout(() => {
+            target.textContent = originalText;
+            target.classList.remove('text-success');
+        }, 1500);
+    };
+
+    // Try modern Clipboard API first
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+        navigator.clipboard.writeText(text).then(() => {
+            showSuccess(targetElement);
+        }).catch(err => {
+            console.error('Clipboard API failed:', err);
+            fallbackCopy(text, targetElement);
+        });
+    } else {
+        // Fallback for older browsers or non-secure contexts
+        fallbackCopy(text, targetElement);
+    }
+
+    function fallbackCopy(text, target) {
+        const textArea = document.createElement('textarea');
+        textArea.value = text;
+        textArea.style.position = 'fixed';
+        textArea.style.left = '-999999px';
+        textArea.style.top = '-999999px';
+        document.body.appendChild(textArea);
+        textArea.focus();
+        textArea.select();
+        try {
+            document.execCommand('copy');
+            showSuccess(target);
+        } catch (err) {
+            console.error('Fallback copy failed:', err);
+        }
+        document.body.removeChild(textArea);
+    }
+}
+
 // --- UI Components (return lit-html TemplateResult) ---
 
+/**
+ * Render a node display with emoji, name, and optional description.
+ * Used for consistent node representation across lists (nodes, advertisements, messages, etc.).
+ *
+ * @param {Object} options - Node display options
+ * @param {string|null} options.name - Node display name (from tag or advertised name)
+ * @param {string|null} options.description - Node description from tags
+ * @param {string} options.publicKey - Node public key (for fallback display)
+ * @param {string|null} options.advType - Advertisement type (chat, repeater, room)
+ * @param {string} [options.size='base'] - Size variant: 'sm' (small lists) or 'base' (normal)
+ * @returns {TemplateResult} lit-html template
+ */
+export function renderNodeDisplay({ name, description, publicKey, advType, size = 'base' }) {
+    const displayName = name || null;
+    const emoji = getNodeEmoji(name, advType);
+    const emojiSize = size === 'sm' ? 'text-lg' : 'text-lg';
+    const nameSize = size === 'sm' ? 'text-sm' : 'text-base';
+    const descSize = size === 'sm' ? 'text-xs' : 'text-xs';
+
+    const nameBlock = displayName
+        ? html`<div class="font-medium ${nameSize} truncate">${displayName}</div>
+               ${description ? html`<div class="${descSize} opacity-70 truncate">${description}</div>` : nothing}`
+        : html`<div class="font-mono ${nameSize} truncate">${publicKey.slice(0, 16)}...</div>`;
+
+    return html`
+        <div class="flex items-center gap-2 min-w-0">
+            <span class="${emojiSize} flex-shrink-0" title=${advType || t('node_types.unknown')}>${emoji}</span>
+            <div class="min-w-0">
+                ${nameBlock}
+            </div>
+        </div>`;
+}
+
 /**
  * Render a loading spinner.
  * @returns {TemplateResult}
@@ -226,12 +417,12 @@ export function pagination(page, totalPages, basePath, params = {}) {
 
     return html`<div class="flex justify-center mt-6"><div class="join">
         ${page > 1
-            ? html`<a href=${pageUrl(page - 1)} class="join-item btn btn-sm">Previous</a>`
-            : html`<button class="join-item btn btn-sm btn-disabled" disabled>Previous</button>`}
+            ? html`<a href=${pageUrl(page - 1)} class="join-item btn btn-sm">${t('common.previous')}</a>`
+            : html`<button class="join-item btn btn-sm btn-disabled" disabled>${t('common.previous')}</button>`}
         ${pageNumbers}
         ${page < totalPages
-            ? html`<a href=${pageUrl(page + 1)} class="join-item btn btn-sm">Next</a>`
-            : html`<button class="join-item btn btn-sm btn-disabled" disabled>Next</button>`}
+            ? html`<a href=${pageUrl(page + 1)} class="join-item btn btn-sm">${t('common.next')}</a>`
+            : html`<button class="join-item btn btn-sm btn-disabled" disabled>${t('common.next')}</button>`}
     </div></div>`;
 }
 

src/meshcore_hub/web/static/js/spa/i18n.js

@@ -0,0 +1,76 @@
+/**
+ * MeshCore Hub SPA - Lightweight i18n Module
+ *
+ * Loads a JSON translation file and provides a t() lookup function.
+ * Shares the same locale JSON files with the Python/Jinja2 server side.
+ *
+ * Usage:
+ *   import { t, loadLocale } from './i18n.js';
+ *   await loadLocale('en');
+ *   t('entities.home');                        // "Home"
+ *   t('common.total', { count: 42 });     // "42 total"
+ */
+
+let _translations = {};
+let _locale = 'en';
+
+/**
+ * Load a locale JSON file from the server.
+ * @param {string} locale - Language code (e.g. 'en')
+ */
+export async function loadLocale(locale) {
+    try {
+        const res = await fetch(`/static/locales/${locale}.json`);
+        if (res.ok) {
+            _translations = await res.json();
+            _locale = locale;
+        } else {
+            console.warn(`Failed to load locale '${locale}', status ${res.status}`);
+        }
+    } catch (e) {
+        console.warn(`Failed to load locale '${locale}':`, e);
+    }
+}
+
+/**
+ * Resolve a dot-separated key in the translations object.
+ * @param {string} key
+ * @returns {*}
+ */
+function resolve(key) {
+    return key.split('.').reduce(
+        (obj, k) => (obj && typeof obj === 'object' ? obj[k] : undefined),
+        _translations,
+    );
+}
+
+/**
+ * Translate a key with optional {{var}} interpolation.
+ * Falls back to the key itself if not found.
+ * @param {string} key - Dot-separated translation key
+ * @param {Object} [params={}] - Interpolation values
+ * @returns {string}
+ */
+export function t(key, params = {}) {
+    let val = resolve(key);
+
+    if (typeof val !== 'string') return key;
+
+    // Replace {{var}} placeholders
+    if (Object.keys(params).length > 0) {
+        val = val.replace(/\{\{(\w+)\}\}/g, (_, k) => (k in params ? String(params[k]) : ''));
+    }
+
+    return val;
+}
+
+/**
+ * Get the currently loaded locale code.
+ * @returns {string}
+ */
+export function getLocale() {
+    return _locale;
+}
+
+// Also expose t() globally for non-module scripts (e.g. charts.js)
+window.t = t;

src/meshcore_hub/web/static/js/spa/pages/admin/index.js

@@ -1,4 +1,4 @@
-import { html, litRender, getConfig, errorAlert } from '../../components.js';
+import { html, litRender, unsafeHTML, getConfig, errorAlert, t } from '../../components.js';
 import { iconLock, iconUsers, iconTag } from '../../icons.js';
 
 export async function render(container, params, router) {
@@ -9,10 +9,10 @@ export async function render(container, params, router) {
             litRender(html`
 <div class="flex flex-col items-center justify-center py-20">
     ${iconLock('h-16 w-16 opacity-30 mb-4')}
-    <h1 class="text-3xl font-bold mb-2">Access Denied</h1>
-    <p class="opacity-70">The admin interface is not enabled.</p>
-    <p class="text-sm opacity-50 mt-2">Set <code>WEB_ADMIN_ENABLED=true</code> to enable admin features.</p>
-    <a href="/" class="btn btn-primary mt-6">Go Home</a>
+    <h1 class="text-3xl font-bold mb-2">${t('admin.access_denied')}</h1>
+    <p class="opacity-70">${t('admin.admin_not_enabled')}</p>
+    <p class="text-sm opacity-50 mt-2">${unsafeHTML(t('admin.admin_enable_hint'))}</p>
+    <a href="/" class="btn btn-primary mt-6">${t('common.go_home')}</a>
 </div>`, container);
             return;
         }
@@ -21,9 +21,9 @@ export async function render(container, params, router) {
             litRender(html`
 <div class="flex flex-col items-center justify-center py-20">
     ${iconLock('h-16 w-16 opacity-30 mb-4')}
-    <h1 class="text-3xl font-bold mb-2">Authentication Required</h1>
-    <p class="opacity-70">You must sign in to access the admin interface.</p>
-    <a href="/oauth2/start?rd=${encodeURIComponent(window.location.pathname)}" class="btn btn-primary mt-6">Sign In</a>
+    <h1 class="text-3xl font-bold mb-2">${t('admin.auth_required')}</h1>
+    <p class="opacity-70">${t('admin.auth_required_description')}</p>
+    <a href="/oauth2/start?rd=${encodeURIComponent(window.location.pathname)}" class="btn btn-primary mt-6">${t('common.sign_in')}</a>
 </div>`, container);
             return;
         }
@@ -31,20 +31,20 @@ export async function render(container, params, router) {
         litRender(html`
 <div class="flex items-center justify-between mb-4">
     <div>
-        <h1 class="text-3xl font-bold">Admin</h1>
+        <h1 class="text-3xl font-bold">${t('entities.admin')}</h1>
         <div class="text-sm breadcrumbs">
             <ul>
-                <li><a href="/">Home</a></li>
-                <li>Admin</li>
+                <li><a href="/">${t('entities.home')}</a></li>
+                <li>${t('entities.admin')}</li>
             </ul>
         </div>
     </div>
-    <a href="/oauth2/sign_out" target="_blank" class="btn btn-outline btn-sm">Sign Out</a>
+    <a href="/oauth2/sign_out" target="_blank" class="btn btn-outline btn-sm">${t('common.sign_out')}</a>
 </div>
 
 <div class="flex flex-wrap items-center gap-4 text-sm opacity-70 mb-6">
     <span class="flex items-center gap-1.5">
-        Welcome to the admin panel.
+        ${t('admin.welcome')}
     </span>
 </div>
 
@@ -53,23 +53,23 @@ export async function render(container, params, router) {
         <div class="card-body">
             <h2 class="card-title">
                 ${iconUsers('h-6 w-6')}
-                Members
+                ${t('entities.members')}
             </h2>
-            <p>Manage network members and operators.</p>
+            <p>${t('admin.members_description')}</p>
         </div>
     </a>
     <a href="/a/node-tags" class="card bg-base-100 shadow-xl hover:shadow-2xl transition-shadow">
         <div class="card-body">
             <h2 class="card-title">
                 ${iconTag('h-6 w-6')}
-                Node Tags
+                ${t('entities.tags')}
             </h2>
-            <p>Manage custom tags and metadata for network nodes.</p>
+            <p>${t('admin.tags_description')}</p>
         </div>
     </a>
 </div>`, container);
 
     } catch (e) {
-        litRender(errorAlert(e.message || 'Failed to load admin page'), container);
+        litRender(errorAlert(e.message || t('common.failed_to_load_page')), container);
     }
 }

src/meshcore_hub/web/static/js/spa/pages/admin/members.js

@@ -1,7 +1,7 @@
 import { apiGet, apiPost, apiPut, apiDelete } from '../../api.js';
 import {
     html, litRender, nothing,
-    getConfig, errorAlert, successAlert,
+    getConfig, errorAlert, successAlert, t, escapeHtml,
 } from '../../components.js';
 import { iconLock } from '../../icons.js';
 
@@ -13,9 +13,9 @@ export async function render(container, params, router) {
             litRender(html`
 <div class="flex flex-col items-center justify-center py-20">
     ${iconLock('h-16 w-16 opacity-30 mb-4')}
-    <h1 class="text-3xl font-bold mb-2">Access Denied</h1>
-    <p class="opacity-70">The admin interface is not enabled.</p>
-    <a href="/" class="btn btn-primary mt-6">Go Home</a>
+    <h1 class="text-3xl font-bold mb-2">${t('admin.access_denied')}</h1>
+    <p class="opacity-70">${t('admin.admin_not_enabled')}</p>
+    <a href="/" class="btn btn-primary mt-6">${t('common.go_home')}</a>
 </div>`, container);
             return;
         }
@@ -24,9 +24,9 @@ export async function render(container, params, router) {
             litRender(html`
 <div class="flex flex-col items-center justify-center py-20">
     ${iconLock('h-16 w-16 opacity-30 mb-4')}
-    <h1 class="text-3xl font-bold mb-2">Authentication Required</h1>
-    <p class="opacity-70">You must sign in to access the admin interface.</p>
-    <a href="/oauth2/start?rd=${encodeURIComponent(window.location.pathname)}" class="btn btn-primary mt-6">Sign In</a>
+    <h1 class="text-3xl font-bold mb-2">${t('admin.auth_required')}</h1>
+    <p class="opacity-70">${t('admin.auth_required_description')}</p>
+    <a href="/oauth2/start?rd=${encodeURIComponent(window.location.pathname)}" class="btn btn-primary mt-6">${t('common.sign_in')}</a>
 </div>`, container);
             return;
         }
@@ -45,11 +45,11 @@ export async function render(container, params, router) {
                 <table class="table table-zebra">
                     <thead>
                         <tr>
-                            <th>Member ID</th>
-                            <th>Name</th>
-                            <th>Callsign</th>
-                            <th>Contact</th>
-                            <th class="w-32">Actions</th>
+                            <th>${t('admin_members.member_id')}</th>
+                            <th>${t('common.name')}</th>
+                            <th>${t('common.callsign')}</th>
+                            <th>${t('common.contact')}</th>
+                            <th class="w-32">${t('common.actions')}</th>
                         </tr>
                     </thead>
                     <tbody>${members.map(m => html`
@@ -69,8 +69,8 @@ export async function render(container, params, router) {
                             <td class="max-w-xs truncate" title=${m.contact || ''}>${m.contact || '-'}</td>
                             <td>
                                 <div class="flex gap-1">
-                                    <button class="btn btn-ghost btn-xs btn-edit">Edit</button>
-                                    <button class="btn btn-ghost btn-xs text-error btn-delete">Delete</button>
+                                    <button class="btn btn-ghost btn-xs btn-edit">${t('common.edit')}</button>
+                                    <button class="btn btn-ghost btn-xs text-error btn-delete">${t('common.delete')}</button>
                                 </div>
                             </td>
                         </tr>`)}</tbody>
@@ -78,23 +78,23 @@ export async function render(container, params, router) {
             </div>`
             : html`
             <div class="text-center py-8 text-base-content/60">
-                <p>No members configured yet.</p>
-                <p class="text-sm mt-2">Click "Add Member" to create the first member.</p>
+                <p>${t('common.no_entity_yet', { entity: t('entities.members').toLowerCase() })}</p>
+                <p class="text-sm mt-2">${t('admin_members.empty_state_hint')}</p>
             </div>`;
 
         litRender(html`
 <div class="flex items-center justify-between mb-6">
     <div>
-        <h1 class="text-3xl font-bold">Members</h1>
+        <h1 class="text-3xl font-bold">${t('entities.members')}</h1>
         <div class="text-sm breadcrumbs">
             <ul>
-                <li><a href="/">Home</a></li>
-                <li><a href="/a/">Admin</a></li>
-                <li>Members</li>
+                <li><a href="/">${t('entities.home')}</a></li>
+                <li><a href="/a/">${t('entities.admin')}</a></li>
+                <li>${t('entities.members')}</li>
             </ul>
         </div>
     </div>
-    <a href="/oauth2/sign_out" target="_blank" class="btn btn-outline btn-sm">Sign Out</a>
+    <a href="/oauth2/sign_out" target="_blank" class="btn btn-outline btn-sm">${t('common.sign_out')}</a>
 </div>
 
 ${flashHtml}
@@ -102,8 +102,8 @@ ${flashHtml}
 <div class="card bg-base-100 shadow-xl">
     <div class="card-body">
         <div class="flex justify-between items-center">
-            <h2 class="card-title">Network Members (${members.length})</h2>
-            <button id="btn-add-member" class="btn btn-primary btn-sm">Add Member</button>
+            <h2 class="card-title">${t('admin_members.network_members', { count: members.length })}</h2>
+            <button id="btn-add-member" class="btn btn-primary btn-sm">${t('common.add_entity', { entity: t('entities.member') })}</button>
         </div>
         ${tableHtml}
     </div>
@@ -111,62 +111,62 @@ ${flashHtml}
 
 <dialog id="addModal" class="modal">
     <div class="modal-box w-11/12 max-w-2xl">
-        <h3 class="font-bold text-lg">Add New Member</h3>
+        <h3 class="font-bold text-lg">${t('common.add_new_entity', { entity: t('entities.member') })}</h3>
         <form id="add-member-form" class="py-4">
             <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
                 <div class="form-control">
                     <label class="label">
-                        <span class="label-text">Member ID <span class="text-error">*</span></span>
+                        <span class="label-text">${t('admin_members.member_id')} <span class="text-error">*</span></span>
                     </label>
                     <input type="text" name="member_id" class="input input-bordered"
                            placeholder="walshie86" required maxlength="50"
                            pattern="[a-zA-Z0-9_]+"
                            title="Letters, numbers, and underscores only">
                     <label class="label">
-                        <span class="label-text-alt">Unique identifier (letters, numbers, underscore)</span>
+                        <span class="label-text-alt">${t('admin_members.member_id_hint')}</span>
                     </label>
                 </div>
                 <div class="form-control">
                     <label class="label">
-                        <span class="label-text">Name <span class="text-error">*</span></span>
+                        <span class="label-text">${t('common.name')} <span class="text-error">*</span></span>
                     </label>
                     <input type="text" name="name" class="input input-bordered"
                            placeholder="John Smith" required maxlength="255">
                 </div>
                 <div class="form-control">
-                    <label class="label"><span class="label-text">Callsign</span></label>
+                    <label class="label"><span class="label-text">${t('common.callsign')}</span></label>
                     <input type="text" name="callsign" class="input input-bordered"
                            placeholder="VK4ABC" maxlength="20">
                 </div>
                 <div class="form-control">
-                    <label class="label"><span class="label-text">Contact</span></label>
+                    <label class="label"><span class="label-text">${t('common.contact')}</span></label>
                     <input type="text" name="contact" class="input input-bordered"
                            placeholder="john@example.com or phone number" maxlength="255">
                 </div>
                 <div class="form-control md:col-span-2">
-                    <label class="label"><span class="label-text">Description</span></label>
+                    <label class="label"><span class="label-text">${t('common.description')}</span></label>
                     <textarea name="description" rows="3" class="textarea textarea-bordered"
                               placeholder="Brief description of member's role and responsibilities..."></textarea>
                 </div>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="addCancel">Cancel</button>
-                <button type="submit" class="btn btn-primary">Add Member</button>
+                <button type="button" class="btn" id="addCancel">${t('common.cancel')}</button>
+                <button type="submit" class="btn btn-primary">${t('common.add_entity', { entity: t('entities.member') })}</button>
             </div>
         </form>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>
 
 <dialog id="editModal" class="modal">
     <div class="modal-box w-11/12 max-w-2xl">
-        <h3 class="font-bold text-lg">Edit Member</h3>
+        <h3 class="font-bold text-lg">${t('common.edit_entity', { entity: t('entities.member') })}</h3>
         <form id="edit-member-form" class="py-4">
             <input type="hidden" name="id" id="edit_id">
             <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
                 <div class="form-control">
                     <label class="label">
-                        <span class="label-text">Member ID <span class="text-error">*</span></span>
+                        <span class="label-text">${t('admin_members.member_id')} <span class="text-error">*</span></span>
                     </label>
                     <input type="text" name="member_id" id="edit_member_id" class="input input-bordered"
                            required maxlength="50" pattern="[a-zA-Z0-9_]+"
@@ -174,52 +174,52 @@ ${flashHtml}
                 </div>
                 <div class="form-control">
                     <label class="label">
-                        <span class="label-text">Name <span class="text-error">*</span></span>
+                        <span class="label-text">${t('common.name')} <span class="text-error">*</span></span>
                     </label>
                     <input type="text" name="name" id="edit_name" class="input input-bordered"
                            required maxlength="255">
                 </div>
                 <div class="form-control">
-                    <label class="label"><span class="label-text">Callsign</span></label>
+                    <label class="label"><span class="label-text">${t('common.callsign')}</span></label>
                     <input type="text" name="callsign" id="edit_callsign" class="input input-bordered"
                            maxlength="20">
                 </div>
                 <div class="form-control">
-                    <label class="label"><span class="label-text">Contact</span></label>
+                    <label class="label"><span class="label-text">${t('common.contact')}</span></label>
                     <input type="text" name="contact" id="edit_contact" class="input input-bordered"
                            maxlength="255">
                 </div>
                 <div class="form-control md:col-span-2">
-                    <label class="label"><span class="label-text">Description</span></label>
+                    <label class="label"><span class="label-text">${t('common.description')}</span></label>
                     <textarea name="description" id="edit_description" rows="3"
                               class="textarea textarea-bordered"></textarea>
                 </div>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="editCancel">Cancel</button>
-                <button type="submit" class="btn btn-primary">Save Changes</button>
+                <button type="button" class="btn" id="editCancel">${t('common.cancel')}</button>
+                <button type="submit" class="btn btn-primary">${t('common.save_changes')}</button>
             </div>
         </form>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>
 
 <dialog id="deleteModal" class="modal">
     <div class="modal-box">
-        <h3 class="font-bold text-lg">Delete Member</h3>
+        <h3 class="font-bold text-lg">${t('common.delete_entity', { entity: t('entities.member') })}</h3>
         <div class="py-4">
-            <p class="py-4">Are you sure you want to delete member <strong id="delete_member_name"></strong>?</p>
+            <p class="py-4" id="delete_confirm_message"></p>
             <div class="alert alert-error mb-4">
                 <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-                <span>This action cannot be undone.</span>
+                <span>${t('common.cannot_be_undone')}</span>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="deleteCancel">Cancel</button>
-                <button type="button" class="btn btn-error" id="deleteConfirm">Delete</button>
+                <button type="button" class="btn" id="deleteCancel">${t('common.cancel')}</button>
+                <button type="button" class="btn btn-error" id="deleteConfirm">${t('common.delete')}</button>
             </div>
         </div>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>`, container);
 
         let activeDeleteId = '';
@@ -249,7 +249,7 @@ ${flashHtml}
             try {
                 await apiPost('/api/v1/members', body);
                 container.querySelector('#addModal').close();
-                router.navigate('/a/members?message=' + encodeURIComponent('Member added successfully'));
+                router.navigate('/a/members?message=' + encodeURIComponent(t('common.entity_added_success', { entity: t('entities.member') })));
             } catch (err) {
                 container.querySelector('#addModal').close();
                 router.navigate('/a/members?error=' + encodeURIComponent(err.message));
@@ -289,7 +289,7 @@ ${flashHtml}
             try {
                 await apiPut('/api/v1/members/' + encodeURIComponent(id), body);
                 container.querySelector('#editModal').close();
-                router.navigate('/a/members?message=' + encodeURIComponent('Member updated successfully'));
+                router.navigate('/a/members?message=' + encodeURIComponent(t('common.entity_updated_success', { entity: t('entities.member') })));
             } catch (err) {
                 container.querySelector('#editModal').close();
                 router.navigate('/a/members?error=' + encodeURIComponent(err.message));
@@ -301,7 +301,12 @@ ${flashHtml}
             btn.addEventListener('click', () => {
                 const row = btn.closest('tr');
                 activeDeleteId = row.dataset.memberId;
-                container.querySelector('#delete_member_name').textContent = row.dataset.memberName;
+                const memberName = row.dataset.memberName;
+                const confirmMsg = t('common.delete_entity_confirm', {
+                    entity: t('entities.member').toLowerCase(),
+                    name: escapeHtml(memberName)
+                });
+                container.querySelector('#delete_confirm_message').innerHTML = confirmMsg;
                 container.querySelector('#deleteModal').showModal();
             });
         });
@@ -314,7 +319,7 @@ ${flashHtml}
             try {
                 await apiDelete('/api/v1/members/' + encodeURIComponent(activeDeleteId));
                 container.querySelector('#deleteModal').close();
-                router.navigate('/a/members?message=' + encodeURIComponent('Member deleted successfully'));
+                router.navigate('/a/members?message=' + encodeURIComponent(t('common.entity_deleted_success', { entity: t('entities.member') })));
             } catch (err) {
                 container.querySelector('#deleteModal').close();
                 router.navigate('/a/members?error=' + encodeURIComponent(err.message));
@@ -322,6 +327,6 @@ ${flashHtml}
         });
 
     } catch (e) {
-        litRender(errorAlert(e.message || 'Failed to load members'), container);
+        litRender(errorAlert(e.message || t('common.failed_to_load_page')), container);
     }
 }

src/meshcore_hub/web/static/js/spa/pages/admin/node-tags.js

@@ -1,8 +1,8 @@
 import { apiGet, apiPost, apiPut, apiDelete } from '../../api.js';
 import {
-    html, litRender, nothing,
+    html, litRender, nothing, unsafeHTML,
     getConfig, typeEmoji, formatDateTimeShort, errorAlert,
-    successAlert, truncateKey,
+    successAlert, truncateKey, t, escapeHtml,
 } from '../../components.js';
 import { iconTag, iconLock } from '../../icons.js';
 
@@ -14,9 +14,9 @@ export async function render(container, params, router) {
             litRender(html`
 <div class="flex flex-col items-center justify-center py-20">
     ${iconLock('h-16 w-16 opacity-30 mb-4')}
-    <h1 class="text-3xl font-bold mb-2">Access Denied</h1>
-    <p class="opacity-70">The admin interface is not enabled.</p>
-    <a href="/" class="btn btn-primary mt-6">Go Home</a>
+    <h1 class="text-3xl font-bold mb-2">${t('admin.access_denied')}</h1>
+    <p class="opacity-70">${t('admin.admin_not_enabled')}</p>
+    <a href="/" class="btn btn-primary mt-6">${t('common.go_home')}</a>
 </div>`, container);
             return;
         }
@@ -25,9 +25,9 @@ export async function render(container, params, router) {
             litRender(html`
 <div class="flex flex-col items-center justify-center py-20">
     ${iconLock('h-16 w-16 opacity-30 mb-4')}
-    <h1 class="text-3xl font-bold mb-2">Authentication Required</h1>
-    <p class="opacity-70">You must sign in to access the admin interface.</p>
-    <a href="/oauth2/start?rd=${encodeURIComponent(window.location.pathname)}" class="btn btn-primary mt-6">Sign In</a>
+    <h1 class="text-3xl font-bold mb-2">${t('admin.auth_required')}</h1>
+    <p class="opacity-70">${t('admin.auth_required_description')}</p>
+    <a href="/oauth2/start?rd=${encodeURIComponent(window.location.pathname)}" class="btn btn-primary mt-6">${t('common.sign_in')}</a>
 </div>`, container);
             return;
         }
@@ -57,7 +57,7 @@ export async function render(container, params, router) {
 
         if (selectedPublicKey && selectedNode) {
             const nodeEmoji = typeEmoji(selectedNode.adv_type);
-            const nodeName = selectedNode.name || 'Unnamed Node';
+            const nodeName = selectedNode.name || t('common.unnamed_node');
             const otherNodes = allNodes.filter(n => n.public_key !== selectedPublicKey);
 
             const tagsTableHtml = tags.length > 0
@@ -66,11 +66,11 @@ export async function render(container, params, router) {
                     <table class="table table-zebra">
                         <thead>
                             <tr>
-                                <th>Key</th>
-                                <th>Value</th>
-                                <th>Type</th>
-                                <th>Updated</th>
-                                <th class="w-48">Actions</th>
+                                <th>${t('common.key')}</th>
+                                <th>${t('common.value')}</th>
+                                <th>${t('common.type')}</th>
+                                <th>${t('common.updated')}</th>
+                                <th class="w-48">${t('common.actions')}</th>
                             </tr>
                         </thead>
                         <tbody>${tags.map(tag => html`
@@ -83,9 +83,9 @@ export async function render(container, params, router) {
                                 <td class="text-sm opacity-70">${formatDateTimeShort(tag.updated_at)}</td>
                                 <td>
                                     <div class="flex gap-1">
-                                        <button class="btn btn-ghost btn-xs btn-edit">Edit</button>
-                                        <button class="btn btn-ghost btn-xs btn-move">Move</button>
-                                        <button class="btn btn-ghost btn-xs text-error btn-delete">Delete</button>
+                                        <button class="btn btn-ghost btn-xs btn-edit">${t('common.edit')}</button>
+                                        <button class="btn btn-ghost btn-xs btn-move">${t('common.move')}</button>
+                                        <button class="btn btn-ghost btn-xs text-error btn-delete">${t('common.delete')}</button>
                                     </div>
                                 </td>
                             </tr>`)}</tbody>
@@ -93,14 +93,14 @@ export async function render(container, params, router) {
                 </div>`
                 : html`
                 <div class="text-center py-8 text-base-content/60">
-                    <p>No tags found for this node.</p>
-                    <p class="text-sm mt-2">Add a new tag below.</p>
+                    <p>${t('common.no_entity_found', { entity: t('entities.tags').toLowerCase() }) + ' ' + t('admin_node_tags.for_this_node')}</p>
+                    <p class="text-sm mt-2">${t('admin_node_tags.empty_state_hint')}</p>
                 </div>`;
 
             const bulkButtons = tags.length > 0
                 ? html`
-                <button id="btn-copy-all" class="btn btn-outline btn-sm">Copy All</button>
-                <button id="btn-delete-all" class="btn btn-outline btn-error btn-sm">Delete All</button>`
+                <button id="btn-copy-all" class="btn btn-outline btn-sm">${t('admin_node_tags.copy_all')}</button>
+                <button id="btn-delete-all" class="btn btn-outline btn-error btn-sm">${t('admin_node_tags.delete_all')}</button>`
                 : nothing;
 
             contentHtml = html`
@@ -116,7 +116,7 @@ export async function render(container, params, router) {
             </div>
             <div class="flex gap-2">
                 ${bulkButtons}
-                <a href="/nodes/${encodeURIComponent(selectedPublicKey)}" class="btn btn-ghost btn-sm">View Node</a>
+                <a href="/nodes/${encodeURIComponent(selectedPublicKey)}" class="btn btn-ghost btn-sm">${t('common.view_entity', { entity: t('entities.node') })}</a>
             </div>
         </div>
     </div>
@@ -124,25 +124,25 @@ export async function render(container, params, router) {
 
 <div class="card bg-base-100 shadow-xl mb-6">
     <div class="card-body">
-        <h2 class="card-title">Tags (${tags.length})</h2>
+        <h2 class="card-title">${t('entities.tags')} (${tags.length})</h2>
         ${tagsTableHtml}
     </div>
 </div>
 
 <div class="card bg-base-100 shadow-xl">
     <div class="card-body">
-        <h2 class="card-title">Add New Tag</h2>
+        <h2 class="card-title">${t('common.add_new_entity', { entity: t('entities.tag') })}</h2>
         <form id="add-tag-form" class="grid grid-cols-1 md:grid-cols-4 gap-4">
             <div class="form-control">
-                <label class="label"><span class="label-text">Key</span></label>
+                <label class="label"><span class="label-text">${t('common.key')}</span></label>
                 <input type="text" name="key" class="input input-bordered" placeholder="tag_name" required maxlength="100">
             </div>
             <div class="form-control">
-                <label class="label"><span class="label-text">Value</span></label>
+                <label class="label"><span class="label-text">${t('common.value')}</span></label>
                 <input type="text" name="value" class="input input-bordered" placeholder="tag value">
             </div>
             <div class="form-control">
-                <label class="label"><span class="label-text">Type</span></label>
+                <label class="label"><span class="label-text">${t('common.type')}</span></label>
                 <select name="value_type" class="select select-bordered">
                     <option value="string">string</option>
                     <option value="number">number</option>
@@ -151,7 +151,7 @@ export async function render(container, params, router) {
             </div>
             <div class="form-control">
                 <label class="label"><span class="label-text">&nbsp;</span></label>
-                <button type="submit" class="btn btn-primary">Add Tag</button>
+                <button type="submit" class="btn btn-primary">${t('common.add_entity', { entity: t('entities.tag') })}</button>
             </div>
         </form>
     </div>
@@ -159,18 +159,18 @@ export async function render(container, params, router) {
 
 <dialog id="editModal" class="modal">
     <div class="modal-box">
-        <h3 class="font-bold text-lg">Edit Tag</h3>
+        <h3 class="font-bold text-lg">${t('common.edit_entity', { entity: t('entities.tag') })}</h3>
         <form id="edit-tag-form" class="py-4">
             <div class="form-control mb-4">
-                <label class="label"><span class="label-text">Key</span></label>
+                <label class="label"><span class="label-text">${t('common.key')}</span></label>
                 <input type="text" id="editKeyDisplay" class="input input-bordered" disabled>
             </div>
             <div class="form-control mb-4">
-                <label class="label"><span class="label-text">Value</span></label>
+                <label class="label"><span class="label-text">${t('common.value')}</span></label>
                 <input type="text" id="editValue" class="input input-bordered">
             </div>
             <div class="form-control mb-4">
-                <label class="label"><span class="label-text">Type</span></label>
+                <label class="label"><span class="label-text">${t('common.type')}</span></label>
                 <select id="editValueType" class="select select-bordered w-full">
                     <option value="string">string</option>
                     <option value="number">number</option>
@@ -178,28 +178,28 @@ export async function render(container, params, router) {
                 </select>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="editCancel">Cancel</button>
-                <button type="submit" class="btn btn-primary">Save Changes</button>
+                <button type="button" class="btn" id="editCancel">${t('common.cancel')}</button>
+                <button type="submit" class="btn btn-primary">${t('common.save_changes')}</button>
             </div>
         </form>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>
 
 <dialog id="moveModal" class="modal">
     <div class="modal-box">
-        <h3 class="font-bold text-lg">Move Tag to Another Node</h3>
+        <h3 class="font-bold text-lg">${t('common.move_entity_to_another_node', { entity: t('entities.tag') })}</h3>
         <form id="move-tag-form" class="py-4">
             <div class="form-control mb-4">
-                <label class="label"><span class="label-text">Tag Key</span></label>
+                <label class="label"><span class="label-text">${t('admin_node_tags.tag_key')}</span></label>
                 <input type="text" id="moveKeyDisplay" class="input input-bordered" disabled>
             </div>
             <div class="form-control mb-4">
-                <label class="label"><span class="label-text">Destination Node</span></label>
+                <label class="label"><span class="label-text">${t('admin_node_tags.destination_node')}</span></label>
                 <select id="moveDestination" class="select select-bordered w-full" required>
-                    <option value="">-- Select destination node --</option>
+                    <option value="">${t('map.select_destination_node')}</option>
                     ${otherNodes.map(n => {
-                        const name = n.name || 'Unnamed';
+                        const name = n.name || t('common.unnamed');
                         const keyPreview = n.public_key.slice(0, 8) + '...' + n.public_key.slice(-4);
                         return html`<option value=${n.public_key}>${name} (${keyPreview})</option>`;
                     })}
@@ -207,46 +207,47 @@ export async function render(container, params, router) {
             </div>
             <div class="alert alert-warning mb-4">
                 <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-                <span>This will move the tag from the current node to the destination node.</span>
+                <span>${t('admin_node_tags.move_warning')}</span>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="moveCancel">Cancel</button>
-                <button type="submit" class="btn btn-warning">Move Tag</button>
+                <button type="button" class="btn" id="moveCancel">${t('common.cancel')}</button>
+                <button type="submit" class="btn btn-warning">${t('common.move_entity', { entity: t('entities.tag') })}</button>
             </div>
         </form>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>
 
 <dialog id="deleteModal" class="modal">
     <div class="modal-box">
-        <h3 class="font-bold text-lg">Delete Tag</h3>
+        <h3 class="font-bold text-lg">${t('common.delete_entity', { entity: t('entities.tag') })}</h3>
         <div class="py-4">
-            <p class="py-4">Are you sure you want to delete the tag "<span id="deleteKeyDisplay" class="font-mono font-semibold"></span>"?</p>
+            <p class="py-4" id="delete_tag_confirm_message"></p>
             <div class="alert alert-error mb-4">
                 <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-                <span>This action cannot be undone.</span>
+                <span>${t('common.cannot_be_undone')}</span>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="deleteCancel">Cancel</button>
-                <button type="button" class="btn btn-error" id="deleteConfirm">Delete</button>
+                <button type="button" class="btn" id="deleteCancel">${t('common.cancel')}</button>
+                <button type="button" class="btn btn-error" id="deleteConfirm">${t('common.delete')}</button>
             </div>
         </div>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>
 
 <dialog id="copyAllModal" class="modal">
     <div class="modal-box">
-        <h3 class="font-bold text-lg">Copy All Tags to Another Node</h3>
+        <h3 class="font-bold text-lg">${t('common.copy_all_entity_to_another_node', { entity: t('entities.tags') })}</h3>
         <form id="copy-all-form" class="py-4">
-            <p class="mb-4">Copy all ${tags.length} tag(s) from <strong>${nodeName}</strong> to another node.</p>
+            <!-- unsafeHTML needed for translation HTML tags; nodeName is pre-escaped -->
+            <p class="mb-4">${unsafeHTML(t('common.copy_all_entity_description', { count: tags.length, entity: t('entities.tags').toLowerCase(), name: escapeHtml(nodeName) }))}</p>
             <div class="form-control mb-4">
-                <label class="label"><span class="label-text">Destination Node</span></label>
+                <label class="label"><span class="label-text">${t('admin_node_tags.destination_node')}</span></label>
                 <select id="copyAllDestination" class="select select-bordered w-full" required>
-                    <option value="">-- Select destination node --</option>
+                    <option value="">${t('map.select_destination_node')}</option>
                     ${otherNodes.map(n => {
-                        const name = n.name || 'Unnamed';
+                        const name = n.name || t('common.unnamed');
                         const keyPreview = n.public_key.slice(0, 8) + '...' + n.public_key.slice(-4);
                         return html`<option value=${n.public_key}>${name} (${keyPreview})</option>`;
                     })}
@@ -254,33 +255,34 @@ export async function render(container, params, router) {
             </div>
             <div class="alert alert-info mb-4">
                 <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" /></svg>
-                <span>Tags that already exist on the destination node will be skipped. Original tags remain on this node.</span>
+                <span>${t('admin_node_tags.copy_all_info')}</span>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="copyAllCancel">Cancel</button>
-                <button type="submit" class="btn btn-primary">Copy Tags</button>
+                <button type="button" class="btn" id="copyAllCancel">${t('common.cancel')}</button>
+                <button type="submit" class="btn btn-primary">${t('common.copy_entity', { entity: t('entities.tags') })}</button>
             </div>
         </form>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>
 
 <dialog id="deleteAllModal" class="modal">
     <div class="modal-box">
-        <h3 class="font-bold text-lg">Delete All Tags</h3>
+        <h3 class="font-bold text-lg">${t('common.delete_all_entity', { entity: t('entities.tags') })}</h3>
         <div class="py-4">
-            <p class="mb-4">Are you sure you want to delete all ${tags.length} tag(s) from <strong>${nodeName}</strong>?</p>
+            <!-- unsafeHTML needed for translation HTML tags; nodeName is pre-escaped -->
+            <p class="mb-4">${unsafeHTML(t('common.delete_all_entity_confirm', { count: tags.length, entity: t('entities.tags').toLowerCase(), name: escapeHtml(nodeName) }))}</p>
             <div class="alert alert-error mb-4">
                 <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-                <span>This action cannot be undone. All tags will be permanently deleted.</span>
+                <span>${t('admin_node_tags.delete_all_warning')}</span>
             </div>
             <div class="modal-action">
-                <button type="button" class="btn" id="deleteAllCancel">Cancel</button>
-                <button type="button" class="btn btn-error" id="deleteAllConfirm">Delete All Tags</button>
+                <button type="button" class="btn" id="deleteAllCancel">${t('common.cancel')}</button>
+                <button type="button" class="btn btn-error" id="deleteAllConfirm">${t('common.delete_all_entity', { entity: t('entities.tags') })}</button>
             </div>
         </div>
     </div>
-    <form method="dialog" class="modal-backdrop"><button>close</button></form>
+    <form method="dialog" class="modal-backdrop"><button>${t('common.close')}</button></form>
 </dialog>`;
         } else if (selectedPublicKey && !selectedNode) {
             contentHtml = html`
@@ -293,8 +295,8 @@ export async function render(container, params, router) {
 <div class="card bg-base-100 shadow-xl">
     <div class="card-body text-center py-12">
         ${iconTag('h-16 w-16 mx-auto mb-4 opacity-30')}
-        <h2 class="text-xl font-semibold mb-2">Select a Node</h2>
-        <p class="opacity-70">Choose a node from the dropdown above to view and manage its tags.</p>
+        <h2 class="text-xl font-semibold mb-2">${t('admin_node_tags.select_a_node')}</h2>
+        <p class="opacity-70">${t('admin_node_tags.select_a_node_description')}</p>
     </div>
 </div>`;
         }
@@ -302,36 +304,36 @@ export async function render(container, params, router) {
         litRender(html`
 <div class="flex items-center justify-between mb-6">
     <div>
-        <h1 class="text-3xl font-bold">Node Tags</h1>
+        <h1 class="text-3xl font-bold">${t('entities.tags')}</h1>
         <div class="text-sm breadcrumbs">
             <ul>
-                <li><a href="/">Home</a></li>
-                <li><a href="/a/">Admin</a></li>
-                <li>Node Tags</li>
+                <li><a href="/">${t('entities.home')}</a></li>
+                <li><a href="/a/">${t('entities.admin')}</a></li>
+                <li>${t('entities.tags')}</li>
             </ul>
         </div>
     </div>
-    <a href="/oauth2/sign_out" target="_blank" class="btn btn-outline btn-sm">Sign Out</a>
+    <a href="/oauth2/sign_out" target="_blank" class="btn btn-outline btn-sm">${t('common.sign_out')}</a>
 </div>
 
 ${flashHtml}
 
 <div class="card bg-base-100 shadow-xl mb-6">
     <div class="card-body">
-        <h2 class="card-title">Select Node</h2>
+        <h2 class="card-title">${t('admin_node_tags.select_node')}</h2>
         <div class="flex gap-4 items-end">
             <div class="form-control flex-1">
-                <label class="label"><span class="label-text">Node</span></label>
+                <label class="label"><span class="label-text">${t('entities.node')}</span></label>
                 <select id="node-selector" class="select select-bordered w-full">
-                    <option value="">-- Select a node --</option>
+                    <option value="">${t('admin_node_tags.select_node_placeholder')}</option>
                     ${allNodes.map(n => {
-                        const name = n.name || 'Unnamed';
+                        const name = n.name || t('common.unnamed');
                         const keyPreview = n.public_key.slice(0, 8) + '...' + n.public_key.slice(-4);
                         return html`<option value=${n.public_key} ?selected=${n.public_key === selectedPublicKey}>${name} (${keyPreview})</option>`;
                     })}
                 </select>
             </div>
-            <button id="load-tags-btn" class="btn btn-primary">Load Tags</button>
+            <button id="load-tags-btn" class="btn btn-primary">${t('admin_node_tags.load_tags')}</button>
         </div>
     </div>
 </div>
@@ -371,7 +373,7 @@ ${contentHtml}`, container);
                     await apiPost('/api/v1/nodes/' + encodeURIComponent(selectedPublicKey) + '/tags', {
                         key, value, value_type,
                     });
-                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent('Tag added successfully'));
+                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent(t('common.entity_added_success', { entity: t('entities.tag') })));
                 } catch (err) {
                     router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&error=' + encodeURIComponent(err.message));
                 }
@@ -403,7 +405,7 @@ ${contentHtml}`, container);
                         value, value_type,
                     });
                     container.querySelector('#editModal').close();
-                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent('Tag updated successfully'));
+                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent(t('common.entity_updated_success', { entity: t('entities.tag') })));
                 } catch (err) {
                     container.querySelector('#editModal').close();
                     router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&error=' + encodeURIComponent(err.message));
@@ -435,7 +437,7 @@ ${contentHtml}`, container);
                         new_public_key: newPublicKey,
                     });
                     container.querySelector('#moveModal').close();
-                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent('Tag moved successfully'));
+                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent(t('common.entity_moved_success', { entity: t('entities.tag') })));
                 } catch (err) {
                     container.querySelector('#moveModal').close();
                     router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&error=' + encodeURIComponent(err.message));
@@ -447,7 +449,11 @@ ${contentHtml}`, container);
                 btn.addEventListener('click', () => {
                     const row = btn.closest('tr');
                     activeTagKey = row.dataset.tagKey;
-                    container.querySelector('#deleteKeyDisplay').textContent = activeTagKey;
+                    const confirmMsg = t('common.delete_entity_confirm', {
+                        entity: t('entities.tag').toLowerCase(),
+                        name: `"<span class="font-mono font-semibold">${escapeHtml(activeTagKey)}</span>"`
+                    });
+                    container.querySelector('#delete_tag_confirm_message').innerHTML = confirmMsg;
                     container.querySelector('#deleteModal').showModal();
                 });
             });
@@ -460,7 +466,7 @@ ${contentHtml}`, container);
                 try {
                     await apiDelete('/api/v1/nodes/' + encodeURIComponent(selectedPublicKey) + '/tags/' + encodeURIComponent(activeTagKey));
                     container.querySelector('#deleteModal').close();
-                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent('Tag deleted successfully'));
+                    router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent(t('common.entity_deleted_success', { entity: t('entities.tag') })));
                 } catch (err) {
                     container.querySelector('#deleteModal').close();
                     router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&error=' + encodeURIComponent(err.message));
@@ -487,7 +493,7 @@ ${contentHtml}`, container);
                     try {
                         const result = await apiPost('/api/v1/nodes/' + encodeURIComponent(selectedPublicKey) + '/tags/copy-to/' + encodeURIComponent(destKey));
                         container.querySelector('#copyAllModal').close();
-                        const msg = `Copied ${result.copied} tag(s), skipped ${result.skipped}`;
+                        const msg = t('admin_node_tags.copied_entities', { copied: result.copied, skipped: result.skipped });
                         router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent(msg));
                     } catch (err) {
                         container.querySelector('#copyAllModal').close();
@@ -511,7 +517,7 @@ ${contentHtml}`, container);
                     try {
                         await apiDelete('/api/v1/nodes/' + encodeURIComponent(selectedPublicKey) + '/tags');
                         container.querySelector('#deleteAllModal').close();
-                        router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent('All tags deleted successfully'));
+                        router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&message=' + encodeURIComponent(t('common.all_entity_deleted_success', { entity: t('entities.tags').toLowerCase() })));
                     } catch (err) {
                         container.querySelector('#deleteAllModal').close();
                         router.navigate('/a/node-tags?public_key=' + encodeURIComponent(selectedPublicKey) + '&error=' + encodeURIComponent(err.message));
@@ -521,6 +527,6 @@ ${contentHtml}`, container);
         }
 
     } catch (e) {
-        litRender(errorAlert(e.message || 'Failed to load node tags'), container);
+        litRender(errorAlert(e.message || t('common.failed_to_load_page')), container);
     }
 }

src/meshcore_hub/web/static/js/spa/pages/advertisements.js

@@ -1,10 +1,11 @@
 import { apiGet } from '../api.js';
 import {
-    html, litRender, nothing,
-    getConfig, typeEmoji, formatDateTime, formatDateTimeShort,
+    html, litRender, nothing, t,
+    getConfig, formatDateTime, formatDateTimeShort,
     truncateKey, errorAlert,
-    pagination, createFilterHandler, autoSubmit, submitOnEnter
+    pagination, createFilterHandler, autoSubmit, submitOnEnter, copyToClipboard, renderNodeDisplay
 } from '../components.js';
+import { createAutoRefresh } from '../auto-refresh.js';
 
 export async function render(container, params, router) {
     const query = params.query || {};
@@ -16,6 +17,8 @@ export async function render(container, params, router) {
     const offset = (page - 1) * limit;
 
     const config = getConfig();
+    const features = config.features || {};
+    const showMembers = features.members !== false;
     const tz = config.timezone || '';
     const tzBadge = tz && tz !== 'UTC' ? html`<span class="text-sm opacity-60">${tz}</span>` : nothing;
     const navigate = (url) => router.navigate(url);
@@ -23,10 +26,11 @@ export async function render(container, params, router) {
     function renderPage(content, { total = null } = {}) {
         litRender(html`
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Advertisements</h1>
+    <h1 class="text-3xl font-bold">${t('entities.advertisements')}</h1>
     <div class="flex items-center gap-2">
+        <span id="auto-refresh-toggle"></span>
         ${tzBadge}
-        ${total !== null ? html`<span class="badge badge-lg">${total} total</span>` : nothing}
+        ${total !== null ? html`<span class="badge badge-lg">${t('common.total', { count: total })}</span>` : nothing}
     </div>
 </div>
 ${content}`, container);
@@ -35,145 +39,154 @@ ${content}`, container);
     // Render page header immediately (old content stays visible until data loads)
     renderPage(nothing);
 
-    try {
-        const [data, nodesData, membersData] = await Promise.all([
-            apiGet('/api/v1/advertisements', { limit, offset, search, public_key, member_id }),
-            apiGet('/api/v1/nodes', { limit: 500 }),
-            apiGet('/api/v1/members', { limit: 100 }),
-        ]);
+    async function fetchAndRenderData() {
+        try {
+            const requests = [
+                apiGet('/api/v1/advertisements', { limit, offset, search, public_key, member_id }),
+                apiGet('/api/v1/nodes', { limit: 500 }),
+            ];
+            if (showMembers) {
+                requests.push(apiGet('/api/v1/members', { limit: 100 }));
+            }
 
-        const advertisements = data.items || [];
-        const total = data.total || 0;
-        const totalPages = Math.ceil(total / limit);
-        const allNodes = nodesData.items || [];
-        const members = membersData.items || [];
+            const results = await Promise.all(requests);
+            const data = results[0];
+            const nodesData = results[1];
+            const membersData = showMembers ? results[2] : null;
 
-        const sortedNodes = allNodes.map(n => {
-            const tagName = n.tags?.find(t => t.key === 'name')?.value;
-            return { ...n, _sortName: (tagName || n.name || '').toLowerCase(), _displayName: tagName || n.name || n.public_key.slice(0, 12) + '...' };
-        }).sort((a, b) => a._sortName.localeCompare(b._sortName));
+            const advertisements = data.items || [];
+            const total = data.total || 0;
+            const totalPages = Math.ceil(total / limit);
+            const allNodes = nodesData.items || [];
+            const members = membersData?.items || [];
 
-        const nodesFilter = sortedNodes.length > 0
-            ? html`
-            <div class="form-control">
-                <label class="label py-1">
-                    <span class="label-text">Node</span>
-                </label>
-                <select name="public_key" class="select select-bordered select-sm" @change=${autoSubmit}>
-                    <option value="">All Nodes</option>
-                    ${sortedNodes.map(n => html`<option value=${n.public_key} ?selected=${public_key === n.public_key}>${n._displayName}</option>`)}
-                </select>
-            </div>`
-            : nothing;
+            const sortedNodes = allNodes.map(n => {
+                const tagName = n.tags?.find(t => t.key === 'name')?.value;
+                return { ...n, _sortName: (tagName || n.name || '').toLowerCase(), _displayName: tagName || n.name || n.public_key.slice(0, 12) + '...' };
+            }).sort((a, b) => a._sortName.localeCompare(b._sortName));
 
-        const membersFilter = members.length > 0
-            ? html`
-            <div class="form-control">
-                <label class="label py-1">
-                    <span class="label-text">Member</span>
-                </label>
-                <select name="member_id" class="select select-bordered select-sm" @change=${autoSubmit}>
-                    <option value="">All Members</option>
-                    ${members.map(m => html`<option value=${m.member_id} ?selected=${member_id === m.member_id}>${m.name}${m.callsign ? ` (${m.callsign})` : ''}</option>`)}
-                </select>
-            </div>`
-            : nothing;
+            const nodesFilter = sortedNodes.length > 0
+                ? html`
+                <div class="form-control">
+                    <label class="label py-1">
+                        <span class="label-text">${t('entities.node')}</span>
+                    </label>
+                    <select name="public_key" class="select select-bordered select-sm" @change=${autoSubmit}>
+                        <option value="">${t('common.all_entity', { entity: t('entities.nodes') })}</option>
+                        ${sortedNodes.map(n => html`<option value=${n.public_key} ?selected=${public_key === n.public_key}>${n._displayName}</option>`)}
+                    </select>
+                </div>`
+                : nothing;
 
-        const mobileCards = advertisements.length === 0
-            ? html`<div class="text-center py-8 opacity-70">No advertisements found.</div>`
-            : advertisements.map(ad => {
-                const emoji = typeEmoji(ad.adv_type);
-                const adName = ad.node_tag_name || ad.node_name || ad.name;
-                const nameBlock = adName
-                    ? html`<div class="font-medium text-sm truncate">${adName}</div>
-                           <div class="text-xs font-mono opacity-60 truncate">${ad.public_key.slice(0, 16)}...</div>`
-                    : html`<div class="font-mono text-sm truncate">${ad.public_key.slice(0, 16)}...</div>`;
-                let receiversBlock = nothing;
-                if (ad.receivers && ad.receivers.length >= 1) {
-                    receiversBlock = html`<div class="flex gap-0.5 justify-end mt-1">
-                        ${ad.receivers.map(recv => {
-                            const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
-                            return html`<span class="text-sm" title=${recvName}>\u{1F4E1}</span>`;
-                        })}
-                    </div>`;
-                } else if (ad.received_by) {
-                    const recvTitle = ad.receiver_tag_name || ad.receiver_name || truncateKey(ad.received_by, 12);
-                    receiversBlock = html`<span class="text-sm" title=${recvTitle}>\u{1F4E1}</span>`;
-                }
-                return html`<a href="/nodes/${ad.public_key}" class="card bg-base-100 shadow-sm block">
-        <div class="card-body p-3">
-            <div class="flex items-center justify-between gap-2">
-                <div class="flex items-center gap-2 min-w-0">
-                    <span class="text-lg flex-shrink-0" title=${ad.adv_type || 'Unknown'}>${emoji}</span>
-                    <div class="min-w-0">
-                        ${nameBlock}
+            const membersFilter = (showMembers && members.length > 0)
+                ? html`
+                <div class="form-control">
+                    <label class="label py-1">
+                        <span class="label-text">${t('entities.member')}</span>
+                    </label>
+                    <select name="member_id" class="select select-bordered select-sm" @change=${autoSubmit}>
+                        <option value="">${t('common.all_entity', { entity: t('entities.members') })}</option>
+                        ${members.map(m => html`<option value=${m.member_id} ?selected=${member_id === m.member_id}>${m.name}${m.callsign ? ` (${m.callsign})` : ''}</option>`)}
+                    </select>
+                </div>`
+                : nothing;
+
+            const mobileCards = advertisements.length === 0
+                ? html`<div class="text-center py-8 opacity-70">${t('common.no_entity_found', { entity: t('entities.advertisements').toLowerCase() })}</div>`
+                : advertisements.map(ad => {
+                    const adName = ad.node_tag_name || ad.node_name || ad.name;
+                    const adDescription = ad.node_tag_description;
+                    let receiversBlock = nothing;
+                    if (ad.receivers && ad.receivers.length >= 1) {
+                        receiversBlock = html`<div class="flex gap-0.5 justify-end mt-1">
+                            ${ad.receivers.map(recv => {
+                                const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
+                                return html`<span class="text-sm" title=${recvName}>\u{1F4E1}</span>`;
+                            })}
+                        </div>`;
+                    } else if (ad.received_by) {
+                        const recvTitle = ad.receiver_tag_name || ad.receiver_name || truncateKey(ad.received_by, 12);
+                        receiversBlock = html`<span class="text-sm" title=${recvTitle}>\u{1F4E1}</span>`;
+                    }
+                    return html`<a href="/nodes/${ad.public_key}" class="card bg-base-100 shadow-sm block">
+            <div class="card-body p-3">
+                <div class="flex items-center justify-between gap-2">
+                    ${renderNodeDisplay({
+                        name: adName,
+                        description: adDescription,
+                        publicKey: ad.public_key,
+                        advType: ad.adv_type,
+                        size: 'sm'
+                    })}
+                    <div class="text-right flex-shrink-0">
+                        <div class="text-xs opacity-60">${formatDateTimeShort(ad.received_at)}</div>
+                        ${receiversBlock}
                     </div>
                 </div>
-                <div class="text-right flex-shrink-0">
-                    <div class="text-xs opacity-60">${formatDateTimeShort(ad.received_at)}</div>
-                    ${receiversBlock}
-                </div>
             </div>
-        </div>
-    </a>`;
+        </a>`;
+                });
+
+            const tableRows = advertisements.length === 0
+                ? html`<tr><td colspan="4" class="text-center py-8 opacity-70">${t('common.no_entity_found', { entity: t('entities.advertisements').toLowerCase() })}</td></tr>`
+                : advertisements.map(ad => {
+                    const adName = ad.node_tag_name || ad.node_name || ad.name;
+                    const adDescription = ad.node_tag_description;
+                    let receiversBlock;
+                    if (ad.receivers && ad.receivers.length >= 1) {
+                        receiversBlock = html`<div class="flex gap-1">
+                            ${ad.receivers.map(recv => {
+                                const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
+                                return html`<a href="/nodes/${recv.public_key}" class="text-lg hover:opacity-70" title=${recvName}>\u{1F4E1}</a>`;
+                            })}
+                        </div>`;
+                    } else if (ad.received_by) {
+                        const recvTitle = ad.receiver_tag_name || ad.receiver_name || truncateKey(ad.received_by, 12);
+                        receiversBlock = html`<a href="/nodes/${ad.received_by}" class="text-lg hover:opacity-70" title=${recvTitle}>\u{1F4E1}</a>`;
+                    } else {
+                        receiversBlock = html`<span class="opacity-50">-</span>`;
+                    }
+                    return html`<tr class="hover">
+                    <td>
+                        <a href="/nodes/${ad.public_key}" class="link link-hover">
+                            ${renderNodeDisplay({
+                                name: adName,
+                                description: adDescription,
+                                publicKey: ad.public_key,
+                                advType: ad.adv_type,
+                                size: 'base'
+                            })}
+                        </a>
+                    </td>
+                    <td>
+                        <code class="font-mono text-xs cursor-pointer hover:bg-base-200 px-1 py-0.5 rounded select-all"
+                              @click=${(e) => copyToClipboard(e, ad.public_key)}
+                              title="Click to copy">${ad.public_key}</code>
+                    </td>
+                    <td class="text-sm whitespace-nowrap">${formatDateTime(ad.received_at)}</td>
+                    <td>${receiversBlock}</td>
+                </tr>`;
+                });
+
+            const paginationBlock = pagination(page, totalPages, '/advertisements', {
+                search, public_key, member_id, limit,
             });
 
-        const tableRows = advertisements.length === 0
-            ? html`<tr><td colspan="3" class="text-center py-8 opacity-70">No advertisements found.</td></tr>`
-            : advertisements.map(ad => {
-                const emoji = typeEmoji(ad.adv_type);
-                const adName = ad.node_tag_name || ad.node_name || ad.name;
-                const nameBlock = adName
-                    ? html`<div class="font-medium">${adName}</div>
-                           <div class="text-xs font-mono opacity-70">${ad.public_key.slice(0, 16)}...</div>`
-                    : html`<span class="font-mono text-sm">${ad.public_key.slice(0, 16)}...</span>`;
-                let receiversBlock;
-                if (ad.receivers && ad.receivers.length >= 1) {
-                    receiversBlock = html`<div class="flex gap-1">
-                        ${ad.receivers.map(recv => {
-                            const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
-                            return html`<a href="/nodes/${recv.public_key}" class="text-lg hover:opacity-70" title=${recvName}>\u{1F4E1}</a>`;
-                        })}
-                    </div>`;
-                } else if (ad.received_by) {
-                    const recvTitle = ad.receiver_tag_name || ad.receiver_name || truncateKey(ad.received_by, 12);
-                    receiversBlock = html`<a href="/nodes/${ad.received_by}" class="text-lg hover:opacity-70" title=${recvTitle}>\u{1F4E1}</a>`;
-                } else {
-                    receiversBlock = html`<span class="opacity-50">-</span>`;
-                }
-                return html`<tr class="hover">
-                <td>
-                    <a href="/nodes/${ad.public_key}" class="link link-hover flex items-center gap-2">
-                        <span class="text-lg" title=${ad.adv_type || 'Unknown'}>${emoji}</span>
-                        <div>
-                            ${nameBlock}
-                        </div>
-                    </a>
-                </td>
-                <td class="text-sm whitespace-nowrap">${formatDateTime(ad.received_at)}</td>
-                <td>${receiversBlock}</td>
-            </tr>`;
-            });
-
-        const paginationBlock = pagination(page, totalPages, '/advertisements', {
-            search, public_key, member_id, limit,
-        });
-
-        renderPage(html`
-<div class="card bg-base-100 shadow mb-6">
+            renderPage(html`
+<div class="card shadow mb-6 panel-solid" style="--panel-color: var(--color-neutral)">
     <div class="card-body py-4">
         <form method="GET" action="/advertisements" class="flex gap-4 flex-wrap items-end" @submit=${createFilterHandler('/advertisements', navigate)}>
             <div class="form-control">
                 <label class="label py-1">
-                    <span class="label-text">Search</span>
+                    <span class="label-text">${t('common.search')}</span>
                 </label>
-                <input type="text" name="search" .value=${search} placeholder="Search by name, ID, or public key..." class="input input-bordered input-sm w-80" @keydown=${submitOnEnter} />
+                <input type="text" name="search" .value=${search} placeholder="${t('common.search_placeholder')}" class="input input-bordered input-sm w-80" @keydown=${submitOnEnter} />
             </div>
             ${nodesFilter}
             ${membersFilter}
             <div class="flex gap-2 w-full sm:w-auto">
-                <button type="submit" class="btn btn-primary btn-sm">Filter</button>
-                <a href="/advertisements" class="btn btn-ghost btn-sm">Clear</a>
+                <button type="submit" class="btn btn-primary btn-sm">${t('common.filter')}</button>
+                <a href="/advertisements" class="btn btn-ghost btn-sm">${t('common.clear')}</a>
             </div>
         </form>
     </div>
@@ -187,9 +200,10 @@ ${content}`, container);
     <table class="table table-zebra">
         <thead>
             <tr>
-                <th>Node</th>
-                <th>Time</th>
-                <th>Receivers</th>
+                <th>${t('entities.node')}</th>
+                <th>${t('common.public_key')}</th>
+                <th>${t('common.time')}</th>
+                <th>${t('common.receivers')}</th>
             </tr>
         </thead>
         <tbody>
@@ -200,7 +214,17 @@ ${content}`, container);
 
 ${paginationBlock}`, { total });
 
-    } catch (e) {
-        renderPage(errorAlert(e.message));
+        } catch (e) {
+            renderPage(errorAlert(e.message));
+        }
     }
+
+    await fetchAndRenderData();
+
+    const toggleEl = container.querySelector('#auto-refresh-toggle');
+    const { cleanup } = createAutoRefresh({
+        fetchAndRender: fetchAndRenderData,
+        toggleContainer: toggleEl,
+    });
+    return cleanup;
 }

src/meshcore_hub/web/static/js/spa/pages/custom-page.js

@@ -1,5 +1,5 @@
 import { apiGet } from '../api.js';
-import { html, litRender, unsafeHTML, getConfig, errorAlert } from '../components.js';
+import { html, litRender, unsafeHTML, getConfig, errorAlert, t } from '../components.js';
 
 export async function render(container, params, router) {
     try {
@@ -20,9 +20,9 @@ export async function render(container, params, router) {
 
     } catch (e) {
         if (e.message && e.message.includes('404')) {
-            litRender(errorAlert('Page not found'), container);
+            litRender(errorAlert(t('common.page_not_found')), container);
         } else {
-            litRender(errorAlert(e.message || 'Failed to load page'), container);
+            litRender(errorAlert(e.message || t('custom_page.failed_to_load')), container);
         }
     }
 }

src/meshcore_hub/web/static/js/spa/pages/dashboard.js

@@ -1,51 +1,40 @@
 import { apiGet } from '../api.js';
 import {
     html, litRender, nothing,
-    getConfig, typeEmoji, errorAlert, pageColors,
+    getConfig, getChannelLabelsMap, resolveChannelLabel,
+    typeEmoji, errorAlert, pageColors, t, formatDateTime,
 } from '../components.js';
 import {
     iconNodes, iconAdvertisements, iconMessages, iconChannel,
 } from '../icons.js';
 
-function formatTimeOnly(isoString) {
-    if (!isoString) return '-';
-    try {
-        const config = getConfig();
-        const tz = config.timezone_iana || 'UTC';
-        const date = new Date(isoString);
-        if (isNaN(date.getTime())) return '-';
-        return date.toLocaleString('en-GB', {
-            timeZone: tz,
-            hour: '2-digit', minute: '2-digit', second: '2-digit',
-            hour12: false,
-        });
-    } catch {
-        return '-';
+function channelLabel(channel, channelLabels) {
+    const idx = parseInt(String(channel), 10);
+    if (Number.isInteger(idx)) {
+        return resolveChannelLabel(idx, channelLabels) || `Ch ${idx}`;
     }
+    return String(channel);
+}
+
+function formatTimeOnly(isoString) {
+    return formatDateTime(isoString, {
+        hour: '2-digit', minute: '2-digit', second: '2-digit',
+        hour12: false,
+    });
 }
 
 function formatTimeShort(isoString) {
-    if (!isoString) return '-';
-    try {
-        const config = getConfig();
-        const tz = config.timezone_iana || 'UTC';
-        const date = new Date(isoString);
-        if (isNaN(date.getTime())) return '-';
-        return date.toLocaleString('en-GB', {
-            timeZone: tz,
-            hour: '2-digit', minute: '2-digit',
-            hour12: false,
-        });
-    } catch {
-        return '-';
-    }
+    return formatDateTime(isoString, {
+        hour: '2-digit', minute: '2-digit',
+        hour12: false,
+    });
 }
 
 function renderRecentAds(ads) {
     if (!ads || ads.length === 0) {
-        return html`<p class="text-sm opacity-70">No advertisements recorded yet.</p>`;
+        return html`<p class="text-sm opacity-70">${t('common.no_entity_yet', { entity: t('entities.advertisements').toLowerCase() })}</p>`;
     }
-    const rows = ads.map(ad => {
+    const rows = ads.slice(0, 5).map(ad => {
         const friendlyName = ad.tag_name || ad.name;
         const displayName = friendlyName || (ad.public_key.slice(0, 12) + '...');
         const keyLine = friendlyName
@@ -67,9 +56,9 @@ function renderRecentAds(ads) {
         <table class="table table-compact w-full">
             <thead>
                 <tr>
-                    <th>Node</th>
-                    <th>Type</th>
-                    <th class="text-right">Received</th>
+                    <th>${t('entities.node')}</th>
+                    <th>${t('common.type')}</th>
+                    <th class="text-right">${t('common.received')}</th>
                 </tr>
             </thead>
             <tbody>${rows}</tbody>
@@ -77,10 +66,11 @@ function renderRecentAds(ads) {
     </div>`;
 }
 
-function renderChannelMessages(channelMessages) {
+function renderChannelMessages(channelMessages, channelLabels) {
     if (!channelMessages || Object.keys(channelMessages).length === 0) return nothing;
 
     const channels = Object.entries(channelMessages).map(([channel, messages]) => {
+        const label = channelLabel(channel, channelLabels);
         const msgLines = messages.map(msg => html`
             <div class="text-sm">
                 <span class="text-xs opacity-50">${formatTimeShort(msg.received_at)}</span>
@@ -89,8 +79,7 @@ function renderChannelMessages(channelMessages) {
 
         return html`<div>
             <h3 class="font-semibold text-sm mb-2 flex items-center gap-2">
-                <span class="badge badge-info badge-sm">CH${String(channel)}</span>
-                Channel ${String(channel)}
+                <span class="badge badge-info badge-sm">${label}</span>
             </h3>
             <div class="space-y-1 pl-2 border-l-2 border-base-300">
                 ${msgLines}
@@ -98,11 +87,11 @@ function renderChannelMessages(channelMessages) {
         </div>`;
     });
 
-    return html`<div class="card bg-base-100 shadow-xl">
+    return html`<div class="card bg-base-100 shadow-xl panel-glow" style="--panel-color: var(--color-neutral)">
         <div class="card-body">
             <h2 class="card-title">
                 ${iconChannel('h-6 w-6')}
-                Recent Channel Messages
+                ${t('dashboard.recent_channel_messages')}
             </h2>
             <div class="space-y-4">
                 ${channels}
@@ -120,6 +109,7 @@ function gridCols(count) {
 export async function render(container, params, router) {
     try {
         const config = getConfig();
+        const channelLabels = getChannelLabelsMap(config);
         const features = config.features || {};
         const showNodes = features.nodes !== false;
         const showAdverts = features.advertisements !== false;
@@ -142,51 +132,51 @@ export async function render(container, params, router) {
 
         litRender(html`
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Dashboard</h1>
+    <h1 class="text-3xl font-bold">${t('entities.dashboard')}</h1>
 </div>
 
 ${topCount > 0 ? html`
 <div class="grid grid-cols-1 ${topGrid} gap-6 mb-6">
     ${showNodes ? html`
-    <div class="stat bg-base-100 rounded-box shadow">
+    <div class="stat bg-base-100 rounded-box shadow-xl panel-glow" style="--panel-color: ${pageColors.nodes}">
         <div class="stat-figure" style="color: ${pageColors.nodes}">
             ${iconNodes('h-8 w-8')}
         </div>
-        <div class="stat-title">Total Nodes</div>
+        <div class="stat-title">${t('common.total_entity', { entity: t('entities.nodes') })}</div>
         <div class="stat-value" style="color: ${pageColors.nodes}">${stats.total_nodes}</div>
-        <div class="stat-desc">All discovered nodes</div>
+        <div class="stat-desc">${t('dashboard.all_discovered_nodes')}</div>
     </div>` : nothing}
 
     ${showAdverts ? html`
-    <div class="stat bg-base-100 rounded-box shadow">
+    <div class="stat bg-base-100 rounded-box shadow-xl panel-glow" style="--panel-color: ${pageColors.adverts}">
         <div class="stat-figure" style="color: ${pageColors.adverts}">
             ${iconAdvertisements('h-8 w-8')}
         </div>
-        <div class="stat-title">Advertisements</div>
+        <div class="stat-title">${t('entities.advertisements')}</div>
         <div class="stat-value" style="color: ${pageColors.adverts}">${stats.advertisements_7d}</div>
-        <div class="stat-desc">Last 7 days</div>
+        <div class="stat-desc">${t('time.last_7_days')}</div>
     </div>` : nothing}
 
     ${showMessages ? html`
-    <div class="stat bg-base-100 rounded-box shadow">
+    <div class="stat bg-base-100 rounded-box shadow-xl panel-glow" style="--panel-color: ${pageColors.messages}">
         <div class="stat-figure" style="color: ${pageColors.messages}">
             ${iconMessages('h-8 w-8')}
         </div>
-        <div class="stat-title">Messages</div>
+        <div class="stat-title">${t('entities.messages')}</div>
         <div class="stat-value" style="color: ${pageColors.messages}">${stats.messages_7d}</div>
-        <div class="stat-desc">Last 7 days</div>
+        <div class="stat-desc">${t('time.last_7_days')}</div>
     </div>` : nothing}
 </div>
 
 <div class="grid grid-cols-1 ${topGrid} gap-6 mb-8">
     ${showNodes ? html`
-    <div class="card bg-base-100 shadow-xl">
+    <div class="card bg-base-100 shadow-xl panel-glow" style="--panel-color: var(--color-neutral)">
         <div class="card-body">
             <h2 class="card-title text-base">
                 ${iconNodes('h-5 w-5')}
-                Total Nodes
+                ${t('common.total_entity', { entity: t('entities.nodes') })}
             </h2>
-            <p class="text-xs opacity-70">Over time (last 7 days)</p>
+            <p class="text-xs opacity-70">${t('time.over_time_last_7_days')}</p>
             <div class="h-32">
                 <canvas id="nodeChart"></canvas>
             </div>
@@ -194,13 +184,13 @@ ${topCount > 0 ? html`
     </div>` : nothing}
 
     ${showAdverts ? html`
-    <div class="card bg-base-100 shadow-xl">
+    <div class="card bg-base-100 shadow-xl panel-glow" style="--panel-color: var(--color-neutral)">
         <div class="card-body">
             <h2 class="card-title text-base">
                 ${iconAdvertisements('h-5 w-5')}
-                Advertisements
+                ${t('entities.advertisements')}
             </h2>
-            <p class="text-xs opacity-70">Per day (last 7 days)</p>
+            <p class="text-xs opacity-70">${t('time.per_day_last_7_days')}</p>
             <div class="h-32">
                 <canvas id="advertChart"></canvas>
             </div>
@@ -208,13 +198,13 @@ ${topCount > 0 ? html`
     </div>` : nothing}
 
     ${showMessages ? html`
-    <div class="card bg-base-100 shadow-xl">
+    <div class="card bg-base-100 shadow-xl panel-glow" style="--panel-color: var(--color-neutral)">
         <div class="card-body">
             <h2 class="card-title text-base">
                 ${iconMessages('h-5 w-5')}
-                Messages
+                ${t('entities.messages')}
             </h2>
-            <p class="text-xs opacity-70">Per day (last 7 days)</p>
+            <p class="text-xs opacity-70">${t('time.per_day_last_7_days')}</p>
             <div class="h-32">
                 <canvas id="messageChart"></canvas>
             </div>
@@ -225,17 +215,17 @@ ${topCount > 0 ? html`
 ${bottomCount > 0 ? html`
 <div class="grid grid-cols-1 ${bottomGrid} gap-6">
     ${showAdverts ? html`
-    <div class="card bg-base-100 shadow-xl">
+    <div class="card bg-base-100 shadow-xl panel-glow" style="--panel-color: var(--color-neutral)">
         <div class="card-body">
             <h2 class="card-title">
                 ${iconAdvertisements('h-6 w-6')}
-                Recent Advertisements
+                ${t('common.recent_entity', { entity: t('entities.advertisements') })}
             </h2>
             ${renderRecentAds(stats.recent_advertisements)}
         </div>
     </div>` : nothing}
 
-    ${showMessages ? renderChannelMessages(stats.channel_messages) : nothing}
+    ${showMessages ? renderChannelMessages(stats.channel_messages, channelLabels) : nothing}
 </div>` : nothing}`, container);
 
         window.initDashboardCharts(
@@ -256,6 +246,6 @@ ${bottomCount > 0 ? html`
         };
 
     } catch (e) {
-        litRender(errorAlert(e.message || 'Failed to load dashboard'), container);
+        litRender(errorAlert(e.message || t('common.failed_to_load_page')), container);
     }
 }

src/meshcore_hub/web/static/js/spa/pages/home.js

@@ -1,7 +1,7 @@
 import { apiGet } from '../api.js';
 import {
     html, litRender, nothing,
-    getConfig, errorAlert, pageColors,
+    getConfig, errorAlert, pageColors, t,
 } from '../components.js';
 import {
     iconDashboard, iconNodes, iconAdvertisements, iconMessages, iconMap,
@@ -11,12 +11,12 @@ import {
 function renderRadioConfig(rc) {
     if (!rc) return nothing;
     const fields = [
-        ['Profile', rc.profile],
-        ['Frequency', rc.frequency],
-        ['Bandwidth', rc.bandwidth],
-        ['Spreading Factor', rc.spreading_factor],
-        ['Coding Rate', rc.coding_rate],
-        ['TX Power', rc.tx_power],
+        [t('links.profile'), rc.profile],
+        [t('home.frequency'), rc.frequency],
+        [t('home.bandwidth'), rc.bandwidth],
+        [t('home.spreading_factor'), rc.spreading_factor],
+        [t('home.coding_rate'), rc.coding_rate],
+        [t('home.tx_power'), rc.tx_power],
     ];
     return fields
         .filter(([, v]) => v)
@@ -33,6 +33,7 @@ export async function render(container, params, router) {
         const features = config.features || {};
         const networkName = config.network_name || 'MeshCore Network';
         const logoUrl = config.logo_url || '/static/img/logo.svg';
+        const logoInvertLight = config.logo_invert_light !== false;
         const customPages = config.custom_pages || [];
         const rc = config.network_radio_config;
 
@@ -49,8 +50,7 @@ export async function render(container, params, router) {
         const welcomeText = config.network_welcome_text
             ? html`<p class="py-4 max-w-[70%]">${config.network_welcome_text}</p>`
             : html`<p class="py-4 max-w-[70%]">
-                Welcome to the ${networkName} mesh network dashboard.
-                Monitor network activity, view connected nodes, and explore message history.
+                ${t('home.welcome_default', { network_name: networkName })}
             </p>`;
 
         const customPageButtons = features.pages !== false
@@ -67,10 +67,10 @@ export async function render(container, params, router) {
         const showActivityChart = showAdvertSeries || showMessageSeries;
 
         litRender(html`
-<div class="${showStats ? 'grid grid-cols-1 lg:grid-cols-3 gap-6' : ''} bg-base-100 rounded-box p-6">
+<div class="${showStats ? 'grid grid-cols-1 lg:grid-cols-3 gap-6' : ''} bg-base-100 rounded-box shadow-xl p-6">
     <div class="${showStats ? 'lg:col-span-2' : ''} flex flex-col items-center text-center">
         <div class="flex flex-col sm:flex-row items-center gap-4 sm:gap-8 mb-4">
-            <img src="${logoUrl}" alt="${networkName}" class="theme-logo h-24 w-24 sm:h-36 sm:w-36" />
+            <img src="${logoUrl}" alt="${networkName}" class="theme-logo ${logoInvertLight ? 'theme-logo--invert-light' : ''} h-24 w-24 sm:h-36 sm:w-36" />
             <div class="flex flex-col justify-center">
                 <h1 class="hero-title text-3xl sm:text-5xl lg:text-6xl font-black tracking-tight">${networkName}</h1>
                 ${cityCountry}
@@ -82,27 +82,27 @@ export async function render(container, params, router) {
             ${features.dashboard !== false ? html`
             <a href="/dashboard" class="btn btn-outline btn-info">
                 ${iconDashboard('h-5 w-5 mr-2')}
-                Dashboard
+                ${t('entities.dashboard')}
             </a>` : nothing}
             ${features.nodes !== false ? html`
             <a href="/nodes" class="btn btn-outline btn-primary">
                 ${iconNodes('h-5 w-5 mr-2')}
-                Nodes
+                ${t('entities.nodes')}
             </a>` : nothing}
             ${features.advertisements !== false ? html`
             <a href="/advertisements" class="btn btn-outline btn-secondary">
                 ${iconAdvertisements('h-5 w-5 mr-2')}
-                Adverts
+                ${t('entities.advertisements')}
             </a>` : nothing}
             ${features.messages !== false ? html`
             <a href="/messages" class="btn btn-outline btn-accent">
                 ${iconMessages('h-5 w-5 mr-2')}
-                Messages
+                ${t('entities.messages')}
             </a>` : nothing}
             ${features.map !== false ? html`
             <a href="/map" class="btn btn-outline btn-warning">
                 ${iconMap('h-5 w-5 mr-2')}
-                Map
+                ${t('entities.map')}
             </a>` : nothing}
             ${customPageButtons}
         </div>
@@ -111,33 +111,33 @@ export async function render(container, params, router) {
     ${showStats ? html`
     <div class="flex flex-col gap-4">
         ${features.nodes !== false ? html`
-        <div class="stat bg-base-200 rounded-box">
+        <div class="stat bg-base-200 rounded-box shadow panel-glow" style="--panel-color: ${pageColors.nodes}">
             <div class="stat-figure" style="color: ${pageColors.nodes}">
                 ${iconNodes('h-8 w-8')}
             </div>
-            <div class="stat-title">Total Nodes</div>
+            <div class="stat-title">${t('common.total_entity', { entity: t('entities.nodes') })}</div>
             <div class="stat-value" style="color: ${pageColors.nodes}">${stats.total_nodes}</div>
-            <div class="stat-desc">All discovered nodes</div>
+            <div class="stat-desc">${t('home.all_discovered_nodes')}</div>
         </div>` : nothing}
 
         ${features.advertisements !== false ? html`
-        <div class="stat bg-base-200 rounded-box">
+        <div class="stat bg-base-200 rounded-box shadow panel-glow" style="--panel-color: ${pageColors.adverts}">
             <div class="stat-figure" style="color: ${pageColors.adverts}">
                 ${iconAdvertisements('h-8 w-8')}
             </div>
-            <div class="stat-title">Advertisements</div>
+            <div class="stat-title">${t('entities.advertisements')}</div>
             <div class="stat-value" style="color: ${pageColors.adverts}">${stats.advertisements_7d}</div>
-            <div class="stat-desc">Last 7 days</div>
+            <div class="stat-desc">${t('time.last_7_days')}</div>
         </div>` : nothing}
 
         ${features.messages !== false ? html`
-        <div class="stat bg-base-200 rounded-box">
+        <div class="stat bg-base-200 rounded-box shadow panel-glow" style="--panel-color: ${pageColors.messages}">
             <div class="stat-figure" style="color: ${pageColors.messages}">
                 ${iconMessages('h-8 w-8')}
             </div>
-            <div class="stat-title">Messages</div>
+            <div class="stat-title">${t('entities.messages')}</div>
             <div class="stat-value" style="color: ${pageColors.messages}">${stats.messages_7d}</div>
-            <div class="stat-desc">Last 7 days</div>
+            <div class="stat-desc">${t('time.last_7_days')}</div>
         </div>` : nothing}
     </div>` : nothing}
 </div>
@@ -147,7 +147,7 @@ export async function render(container, params, router) {
         <div class="card-body">
             <h2 class="card-title">
                 ${iconInfo('h-6 w-6')}
-                Network Info
+                ${t('home.network_info')}
             </h2>
             <div class="space-y-2">
                 ${renderRadioConfig(rc)}
@@ -157,19 +157,19 @@ export async function render(container, params, router) {
 
     <div class="card bg-base-100 shadow-xl">
         <div class="card-body flex flex-col items-center justify-center">
-            <p class="text-sm opacity-70 mb-4 text-center">Our local off-grid mesh network is made possible by</p>
+            <p class="text-sm opacity-70 mb-4 text-center">${t('home.meshcore_attribution')}</p>
             <a href="https://meshcore.co.uk/" target="_blank" rel="noopener noreferrer" class="hover:opacity-80 transition-opacity">
-                <img src="/static/img/meshcore.svg" alt="MeshCore" class="theme-logo h-8" />
+                <img src="/static/img/meshcore.svg" alt="MeshCore" class="theme-logo theme-logo--invert-light h-8" />
             </a>
             <p class="text-xs opacity-50 mt-4 text-center">Connecting people and things, without using the internet</p>
             <div class="flex gap-2 mt-4">
                 <a href="https://meshcore.co.uk/" target="_blank" rel="noopener noreferrer" class="btn btn-outline btn-sm">
                     ${iconGlobe('h-4 w-4 mr-1')}
-                    Website
+                    ${t('links.website')}
                 </a>
                 <a href="https://github.com/meshcore-dev/MeshCore" target="_blank" rel="noopener noreferrer" class="btn btn-outline btn-sm">
                     ${iconGithub('h-4 w-4 mr-1')}
-                    GitHub
+                    ${t('links.github')}
                 </a>
             </div>
         </div>
@@ -180,9 +180,9 @@ export async function render(container, params, router) {
         <div class="card-body">
             <h2 class="card-title">
                 ${iconChart('h-6 w-6')}
-                Network Activity
+                ${t('home.network_activity')}
             </h2>
-            <p class="text-sm opacity-70 mb-2">Activity per day (last 7 days)</p>
+            <p class="text-sm opacity-70 mb-2">${t('time.activity_per_day_last_7_days')}</p>
             <div class="h-48">
                 <canvas id="activityChart"></canvas>
             </div>
@@ -204,6 +204,6 @@ export async function render(container, params, router) {
         };
 
     } catch (e) {
-        litRender(errorAlert(e.message || 'Failed to load home page'), container);
+        litRender(errorAlert(e.message || t('common.failed_to_load_page')), container);
     }
 }

src/meshcore_hub/web/static/js/spa/pages/map.js

@@ -1,6 +1,6 @@
 import { apiGet } from '../api.js';
 import {
-    html, litRender, nothing,
+    html, litRender, nothing, t,
     typeEmoji, formatRelativeTime, escapeHtml, errorAlert,
     timezoneIndicator,
 } from '../components.js';
@@ -37,10 +37,10 @@ function normalizeType(type) {
 
 function getTypeDisplay(node) {
     const type = normalizeType(node.adv_type);
-    if (type === 'chat') return 'Chat';
-    if (type === 'repeater') return 'Repeater';
-    if (type === 'room') return 'Room';
-    return type ? type.charAt(0).toUpperCase() + type.slice(1) : 'Unknown';
+    if (type === 'chat') return (window.t && window.t('node_types.chat')) || 'Chat';
+    if (type === 'repeater') return (window.t && window.t('node_types.repeater')) || 'Repeater';
+    if (type === 'room') return (window.t && window.t('node_types.room')) || 'Room';
+    return type ? type.charAt(0).toUpperCase() + type.slice(1) : (window.t && window.t('node_types.unknown')) || 'Unknown';
 }
 
 // Leaflet DivIcon requires plain HTML strings, so keep escapeHtml here
@@ -72,12 +72,12 @@ function createPopupContent(node) {
         const ownerDisplay = node.owner.callsign
             ? escapeHtml(node.owner.name) + ' (' + escapeHtml(node.owner.callsign) + ')'
             : escapeHtml(node.owner.name);
-        ownerHtml = '<p><span class="opacity-70">Owner:</span> ' + ownerDisplay + '</p>';
+        ownerHtml = '<p><span class="opacity-70">' + ((window.t && window.t('map.owner')) || 'Owner:') + '</span> ' + ownerDisplay + '</p>';
     }
 
     let roleHtml = '';
     if (node.role) {
-        roleHtml = '<p><span class="opacity-70">Role:</span> <span class="badge badge-xs badge-ghost">' + escapeHtml(node.role) + '</span></p>';
+        roleHtml = '<p><span class="opacity-70">' + ((window.t && window.t('map.role')) || 'Role:') + '</span> <span class="badge badge-xs badge-ghost">' + escapeHtml(node.role) + '</span></p>';
     }
 
     const typeDisplay = getTypeDisplay(node);
@@ -87,25 +87,32 @@ function createPopupContent(node) {
     if (typeof node.is_infra !== 'undefined') {
         const dotColor = node.is_infra ? '#ef4444' : '#3b82f6';
         const borderColor = node.is_infra ? '#b91c1c' : '#1e40af';
-        const title = node.is_infra ? 'Infrastructure' : 'Public';
+        const title = node.is_infra ? ((window.t && window.t('map.infrastructure')) || 'Infrastructure') : ((window.t && window.t('map.public')) || 'Public');
         infraIndicatorHtml = ' <span style="display: inline-block; width: 10px; height: 10px; background: ' + dotColor + '; border: 2px solid ' + borderColor + '; border-radius: 50%; vertical-align: middle;" title="' + title + '"></span>';
     }
 
+    const lastSeenLabel = (window.t && window.t('common.last_seen_label')) || 'Last seen:';
     const lastSeenHtml = node.last_seen
-        ? '<p><span class="opacity-70">Last seen:</span> ' + node.last_seen.substring(0, 19).replace('T', ' ') + '</p>'
+        ? '<p><span class="opacity-70">' + lastSeenLabel + '</span> ' + node.last_seen.substring(0, 19).replace('T', ' ') + '</p>'
         : '';
 
+    const typeLabel = (window.t && window.t('common.type')) || 'Type:';
+    const keyLabel = (window.t && window.t('common.key')) || 'Key:';
+    const locationLabel = (window.t && window.t('common.location')) || 'Location:';
+    const unknownLabel = (window.t && window.t('node_types.unknown')) || 'Unknown';
+    const viewDetailsLabel = (window.t && window.t('common.view_details')) || 'View Details';
+
     return '<div class="p-2">' +
-        '<h3 class="font-bold text-lg mb-2">' + nodeTypeEmoji + ' ' + escapeHtml(node.name || 'Unknown') + infraIndicatorHtml + '</h3>' +
+        '<h3 class="font-bold text-lg mb-2">' + nodeTypeEmoji + ' ' + escapeHtml(node.name || unknownLabel) + infraIndicatorHtml + '</h3>' +
         '<div class="space-y-1 text-sm">' +
-        '<p><span class="opacity-70">Type:</span> ' + escapeHtml(typeDisplay) + '</p>' +
+        '<p><span class="opacity-70">' + typeLabel + '</span> ' + escapeHtml(typeDisplay) + '</p>' +
         roleHtml +
         ownerHtml +
-        '<p><span class="opacity-70">Key:</span> <code class="text-xs">' + escapeHtml(node.public_key.substring(0, 16)) + '...</code></p>' +
-        '<p><span class="opacity-70">Location:</span> ' + node.lat.toFixed(4) + ', ' + node.lon.toFixed(4) + '</p>' +
+        '<p><span class="opacity-70">' + keyLabel + '</span> <code class="text-xs">' + escapeHtml(node.public_key.substring(0, 16)) + '...</code></p>' +
+        '<p><span class="opacity-70">' + locationLabel + '</span> ' + node.lat.toFixed(4) + ', ' + node.lon.toFixed(4) + '</p>' +
         lastSeenHtml +
         '</div>' +
-        '<a href="/nodes/' + encodeURIComponent(node.public_key) + '" class="btn btn-outline btn-xs mt-3">View Details</a>' +
+        '<a href="/nodes/' + encodeURIComponent(node.public_key) + '" class="btn btn-outline btn-xs mt-3">' + viewDetailsLabel + '</a>' +
         '</div>';
 }
 
@@ -166,43 +173,43 @@ export async function render(container, params, router) {
 
         litRender(html`
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Map</h1>
+    <h1 class="text-3xl font-bold">${t('entities.map')}</h1>
     <div class="flex items-center gap-2">
         ${timezoneIndicator()}
-        <span id="node-count" class="badge badge-lg">Loading...</span>
+        <span id="node-count" class="badge badge-lg">${t('common.loading')}</span>
         <span id="filtered-count" class="badge badge-lg badge-ghost hidden"></span>
     </div>
 </div>
 
-<div class="card bg-base-100 shadow mb-6">
+<div class="card shadow mb-6 panel-solid" style="--panel-color: var(--color-neutral)">
     <div class="card-body py-4">
         <div class="flex gap-4 flex-wrap items-end">
             <div class="form-control">
                 <label class="label py-1">
-                    <span class="label-text">Show</span>
+                    <span class="label-text">${t('common.show')}</span>
                 </label>
                 <select id="filter-category" class="select select-bordered select-sm" @change=${applyFilters}>
-                    <option value="">All Nodes</option>
-                    <option value="infra">Infrastructure Only</option>
+                    <option value="">${t('common.all_entity', { entity: t('entities.nodes') })}</option>
+                    <option value="infra">${t('map.infrastructure_only')}</option>
                 </select>
             </div>
             <div class="form-control">
                 <label class="label py-1">
-                    <span class="label-text">Node Type</span>
+                    <span class="label-text">${t('common.node_type')}</span>
                 </label>
                 <select id="filter-type" class="select select-bordered select-sm" @change=${applyFilters}>
-                    <option value="">All Types</option>
-                    <option value="chat">Chat</option>
-                    <option value="repeater">Repeater</option>
-                    <option value="room">Room</option>
+                    <option value="">${t('common.all_types')}</option>
+                    <option value="chat">${t('node_types.chat')}</option>
+                    <option value="repeater">${t('node_types.repeater')}</option>
+                    <option value="room">${t('node_types.room')}</option>
                 </select>
             </div>
             <div class="form-control">
                 <label class="label py-1">
-                    <span class="label-text">Member</span>
+                    <span class="label-text">${t('entities.member')}</span>
                 </label>
                 <select id="filter-member" class="select select-bordered select-sm" @change=${applyFilters}>
-                    <option value="">All Members</option>
+                    <option value="">${t('common.all_entity', { entity: t('entities.members') })}</option>
                     ${sortedMembers
                         .filter(m => m.member_id)
                         .map(m => {
@@ -215,11 +222,11 @@ export async function render(container, params, router) {
             </div>
             <div class="form-control">
                 <label class="label cursor-pointer gap-2 py-1">
-                    <span class="label-text">Show Labels</span>
+                    <span class="label-text">${t('map.show_labels')}</span>
                     <input type="checkbox" id="show-labels" class="checkbox checkbox-sm" @change=${updateLabelVisibility}>
                 </label>
             </div>
-            <button id="clear-filters" class="btn btn-ghost btn-sm" @click=${clearFiltersHandler}>Clear Filters</button>
+            <button id="clear-filters" class="btn btn-ghost btn-sm" @click=${clearFiltersHandler}>${t('common.clear_filters')}</button>
         </div>
     </div>
 </div>
@@ -231,19 +238,19 @@ export async function render(container, params, router) {
 </div>
 
 <div class="mt-4 flex flex-wrap gap-4 items-center text-sm">
-    <span class="opacity-70">Legend:</span>
+    <span class="opacity-70">${t('map.legend')}</span>
     <div class="flex items-center gap-1">
         <div style="width: 10px; height: 10px; background: #ef4444; border: 2px solid #b91c1c; border-radius: 50%;"></div>
-        <span>Infrastructure</span>
+        <span>${t('map.infrastructure')}</span>
     </div>
     <div class="flex items-center gap-1">
         <div style="width: 10px; height: 10px; background: #3b82f6; border: 2px solid #1e40af; border-radius: 50%;"></div>
-        <span>Public</span>
+        <span>${t('map.public')}</span>
     </div>
 </div>
 
 <div class="mt-2 text-sm opacity-70">
-    <p>Nodes are placed on the map based on GPS coordinates from node reports or manual tags.</p>
+    <p>${t('map.gps_description')}</p>
 </div>`, container);
 
         const mapEl = container.querySelector('#spa-map');
@@ -285,11 +292,11 @@ export async function render(container, params, router) {
             const filteredEl = container.querySelector('#filtered-count');
 
             if (filteredNodes.length === allNodes.length) {
-                countEl.textContent = allNodes.length + ' nodes on map';
+                countEl.textContent = t('map.nodes_on_map', { count: allNodes.length });
                 filteredEl.classList.add('hidden');
             } else {
-                countEl.textContent = allNodes.length + ' total';
-                filteredEl.textContent = filteredNodes.length + ' shown';
+                countEl.textContent = t('common.total', { count: allNodes.length });
+                filteredEl.textContent = t('common.shown', { count: filteredNodes.length });
                 filteredEl.classList.remove('hidden');
             }
 
@@ -302,12 +309,12 @@ export async function render(container, params, router) {
         }
 
         if (debug.total_nodes === 0) {
-            container.querySelector('#node-count').textContent = 'No nodes in database';
+            container.querySelector('#node-count').textContent = t('common.no_entity_in_database', { entity: t('entities.nodes').toLowerCase() });
             return () => map.remove();
         }
 
         if (debug.nodes_with_coords === 0) {
-            container.querySelector('#node-count').textContent = debug.total_nodes + ' nodes (none have coordinates)';
+            container.querySelector('#node-count').textContent = t('map.nodes_none_have_coordinates', { count: debug.total_nodes });
             return () => map.remove();
         }
 
@@ -328,6 +335,6 @@ export async function render(container, params, router) {
         return () => map.remove();
 
     } catch (e) {
-        litRender(errorAlert(e.message || 'Failed to load map'), container);
+        litRender(errorAlert(e.message || t('common.failed_to_load_page')), container);
     }
 }

src/meshcore_hub/web/static/js/spa/pages/members.js

@@ -1,6 +1,6 @@
 import { apiGet } from '../api.js';
 import {
-    html, litRender, nothing,
+    html, litRender, nothing, t, unsafeHTML,
     formatRelativeTime, formatDateTime, errorAlert,
 } from '../components.js';
 import { iconInfo } from '../icons.js';
@@ -61,7 +61,7 @@ function renderMemberCard(member, nodes) {
         : nothing;
 
     const contactBlock = member.contact
-        ? html`<p class="text-sm mt-2"><span class="opacity-70">Contact:</span> ${member.contact}</p>`
+        ? html`<p class="text-sm mt-2"><span class="opacity-70">${t('common.contact')}:</span> ${member.contact}</p>`
         : nothing;
 
     return html`<div class="card bg-base-100 shadow-xl">
@@ -85,22 +85,22 @@ export async function render(container, params, router) {
         if (members.length === 0) {
             litRender(html`
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Members</h1>
-    <span class="badge badge-lg">0 members</span>
+    <h1 class="text-3xl font-bold">${t('entities.members')}</h1>
+    <span class="badge badge-lg">${t('common.count_entity', { count: 0, entity: t('entities.members').toLowerCase() })}</span>
 </div>
 
 <div class="alert alert-info">
     ${iconInfo('stroke-current shrink-0 h-6 w-6')}
     <div>
-        <h3 class="font-bold">No members configured</h3>
-        <p class="text-sm">To display network members, create a members.yaml file in your seed directory.</p>
+        <h3 class="font-bold">${t('common.no_entity_configured', { entity: t('entities.members').toLowerCase() })}</h3>
+        <p class="text-sm">${t('members.empty_state_description')}</p>
     </div>
 </div>
 
 <div class="mt-6 card bg-base-100 shadow-xl">
     <div class="card-body">
-        <h2 class="card-title">Members File Format</h2>
-        <p class="mb-4">Create a YAML file at <code>$SEED_HOME/members.yaml</code> with the following structure:</p>
+        <h2 class="card-title">${t('members.members_file_format')}</h2>
+        <p class="mb-4">${unsafeHTML(t('members.members_file_description'))}</p>
         <pre class="bg-base-200 p-4 rounded-box text-sm overflow-x-auto"><code>members:
   - member_id: johndoe
     name: John Doe
@@ -113,8 +113,7 @@ export async function render(container, params, router) {
     role: Member
     description: Regular user in the downtown area.</code></pre>
         <p class="mt-4 text-sm opacity-70">
-            Run <code>meshcore-hub collector seed</code> to import members.<br/>
-            To associate nodes with members, add a <code>member_id</code> tag to nodes in <code>node_tags.yaml</code>.
+            ${unsafeHTML(t('members.members_import_instructions'))}
         </p>
     </div>
 </div>`, container);
@@ -139,8 +138,8 @@ export async function render(container, params, router) {
 
         litRender(html`
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Members</h1>
-    <span class="badge badge-lg">${members.length} members</span>
+    <h1 class="text-3xl font-bold">${t('entities.members')}</h1>
+    <span class="badge badge-lg">${t('common.count_entity', { count: members.length, entity: t('entities.members').toLowerCase() })}</span>
 </div>
 
 <div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6 items-start">
@@ -148,6 +147,6 @@ export async function render(container, params, router) {
 </div>`, container);
 
     } catch (e) {
-        litRender(errorAlert(e.message || 'Failed to load members'), container);
+        litRender(errorAlert(e.message || t('common.failed_to_load_page')), container);
     }
 }

src/meshcore_hub/web/static/js/spa/pages/messages.js

@@ -1,11 +1,13 @@
 import { apiGet } from '../api.js';
 import {
-    html, litRender, nothing,
+    html, litRender, nothing, t,
     getConfig, formatDateTime, formatDateTimeShort,
+    getChannelLabelsMap, resolveChannelLabel,
     truncateKey, errorAlert,
     pagination, timezoneIndicator,
     createFilterHandler, autoSubmit, submitOnEnter
 } from '../components.js';
+import { createAutoRefresh } from '../auto-refresh.js';
 
 export async function render(container, params, router) {
     const query = params.query || {};
@@ -15,17 +17,164 @@ export async function render(container, params, router) {
     const offset = (page - 1) * limit;
 
     const config = getConfig();
+    const channelLabels = getChannelLabelsMap(config);
     const tz = config.timezone || '';
     const tzBadge = tz && tz !== 'UTC' ? html`<span class="text-sm opacity-60">${tz}</span>` : nothing;
     const navigate = (url) => router.navigate(url);
 
+    function channelInfo(msg) {
+        if (msg.message_type !== 'channel') {
+            return { label: null, text: msg.text || '-' };
+        }
+        const rawText = msg.text || '';
+        const match = rawText.match(/^\[([^\]]+)\]\s+([\s\S]*)$/);
+        if (msg.channel_idx !== null && msg.channel_idx !== undefined) {
+            const knownLabel = resolveChannelLabel(msg.channel_idx, channelLabels);
+            if (knownLabel) {
+                return {
+                    label: knownLabel,
+                    text: match ? (match[2] || '-') : (rawText || '-'),
+                };
+            }
+        }
+        if (msg.channel_name) {
+            return { label: msg.channel_name, text: msg.text || '-' };
+        }
+        if (match) {
+            return {
+                label: match[1],
+                text: match[2] || '-',
+            };
+        }
+        if (msg.channel_idx !== null && msg.channel_idx !== undefined) {
+            const knownLabel = resolveChannelLabel(msg.channel_idx, channelLabels);
+            return { label: knownLabel || `Ch ${msg.channel_idx}`, text: rawText || '-' };
+        }
+        return { label: t('messages.type_channel'), text: rawText || '-' };
+    }
+
+    function senderBlock(msg, emphasize = false) {
+        const senderName = msg.sender_tag_name || msg.sender_name;
+        if (senderName) {
+            return emphasize
+                ? html`<span class="font-medium">${senderName}</span>`
+                : html`${senderName}`;
+        }
+        const prefix = (msg.pubkey_prefix || '').slice(0, 12);
+        if (prefix) {
+            return html`<span class="font-mono text-xs">${prefix}</span>`;
+        }
+        return html`<span class="opacity-50">-</span>`;
+    }
+
+    function parseSenderFromText(text) {
+        if (!text || typeof text !== 'string') {
+            return { sender: null, text: text || '-' };
+        }
+        const patterns = [
+            /^\s*ack\s+@\[(.+?)\]\s*:\s*([\s\S]+)$/i,
+            /^\s*@\[(.+?)\]\s*:\s*([\s\S]+)$/i,
+            /^\s*ack\s+([^:|\n]{1,80})\s*:\s*([\s\S]+)$/i,
+        ];
+        for (const pattern of patterns) {
+            const match = text.match(pattern);
+            if (!match) continue;
+            const sender = (match[1] || '').trim();
+            const remaining = (match[2] || '').trim();
+            if (!sender) continue;
+            return {
+                sender,
+                text: remaining || text,
+            };
+        }
+        return { sender: null, text };
+    }
+
+    function messageTextWithSender(msg, text) {
+        const parsed = parseSenderFromText(text || '-');
+        const explicitSender = msg.sender_tag_name || msg.sender_name || (msg.pubkey_prefix || '').slice(0, 12) || null;
+        const sender = explicitSender || parsed.sender;
+        const body = (parsed.text || text || '-').trim() || '-';
+        if (!sender) {
+            return body;
+        }
+        if (body.toLowerCase().startsWith(`${sender.toLowerCase()}:`)) {
+            return body;
+        }
+        return `${sender}: ${body}`;
+    }
+
+    function dedupeBySignature(items) {
+        const deduped = [];
+        const bySignature = new Map();
+
+        for (const msg of items) {
+            const signature = typeof msg.signature === 'string' ? msg.signature.trim().toUpperCase() : '';
+            const canDedupe = msg.message_type === 'channel' && signature.length >= 8;
+            if (!canDedupe) {
+                deduped.push(msg);
+                continue;
+            }
+
+            const existing = bySignature.get(signature);
+            if (!existing) {
+                const clone = {
+                    ...msg,
+                    receivers: [...(msg.receivers || [])],
+                };
+                bySignature.set(signature, clone);
+                deduped.push(clone);
+                continue;
+            }
+
+            const combined = [...(existing.receivers || []), ...(msg.receivers || [])];
+            const seenReceivers = new Set();
+            existing.receivers = combined.filter((recv) => {
+                const key = recv?.public_key || recv?.node_id || `${recv?.received_at || ''}:${recv?.snr || ''}`;
+                if (seenReceivers.has(key)) return false;
+                seenReceivers.add(key);
+                return true;
+            });
+
+            if (!existing.received_by && msg.received_by) existing.received_by = msg.received_by;
+            if (!existing.receiver_name && msg.receiver_name) existing.receiver_name = msg.receiver_name;
+            if (!existing.receiver_tag_name && msg.receiver_tag_name) existing.receiver_tag_name = msg.receiver_tag_name;
+            if (!existing.pubkey_prefix && msg.pubkey_prefix) existing.pubkey_prefix = msg.pubkey_prefix;
+            if (!existing.sender_name && msg.sender_name) existing.sender_name = msg.sender_name;
+            if (!existing.sender_tag_name && msg.sender_tag_name) existing.sender_tag_name = msg.sender_tag_name;
+            if (!existing.channel_name && msg.channel_name) existing.channel_name = msg.channel_name;
+            if (
+                existing.channel_name === 'Public'
+                && msg.channel_name
+                && msg.channel_name !== 'Public'
+            ) {
+                existing.channel_name = msg.channel_name;
+            }
+            if (existing.channel_idx === null || existing.channel_idx === undefined) {
+                if (msg.channel_idx !== null && msg.channel_idx !== undefined) {
+                    existing.channel_idx = msg.channel_idx;
+                }
+            } else if (
+                existing.channel_idx === 17
+                && msg.channel_idx !== null
+                && msg.channel_idx !== undefined
+                && msg.channel_idx !== 17
+            ) {
+                existing.channel_idx = msg.channel_idx;
+            }
+        }
+
+        return deduped;
+    }
+
     function renderPage(content, { total = null } = {}) {
         litRender(html`
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Messages</h1>
+    <h1 class="text-3xl font-bold">${t('entities.messages')}</h1>
     <div class="flex items-center gap-2">
+        <span id="auto-refresh-toggle"></span>
         ${tzBadge}
-        ${total !== null ? html`<span class="badge badge-lg">${total} total</span>` : nothing}
+        ${total !== null ? html`<span class="badge badge-lg">${t('common.total', { count: total })}</span>` : nothing}
     </div>
 </div>
 ${content}`, container);
@@ -34,127 +183,120 @@ ${content}`, container);
     // Render page header immediately (old content stays visible until data loads)
     renderPage(nothing);
 
-    try {
-        const data = await apiGet('/api/v1/messages', { limit, offset, message_type });
-        const messages = data.items || [];
-        const total = data.total || 0;
-        const totalPages = Math.ceil(total / limit);
+    async function fetchAndRenderData() {
+        try {
+            const data = await apiGet('/api/v1/messages', { limit, offset, message_type });
+            const messages = dedupeBySignature(data.items || []);
+            const total = data.total || 0;
+            const totalPages = Math.ceil(total / limit);
 
-        const mobileCards = messages.length === 0
-            ? html`<div class="text-center py-8 opacity-70">No messages found.</div>`
-            : messages.map(msg => {
-                const isChannel = msg.message_type === 'channel';
-                const typeIcon = isChannel ? '\u{1F4FB}' : '\u{1F464}';
-                const typeTitle = isChannel ? 'Channel' : 'Contact';
-                let senderBlock;
-                if (isChannel) {
-                    senderBlock = html`<span class="opacity-60">Public</span>`;
-                } else {
-                    const senderName = msg.sender_tag_name || msg.sender_name;
-                    if (senderName) {
-                        senderBlock = senderName;
-                    } else {
-                        senderBlock = html`<span class="font-mono text-xs">${(msg.pubkey_prefix || '-').slice(0, 12)}</span>`;
+            const mobileCards = messages.length === 0
+                ? html`<div class="text-center py-8 opacity-70">${t('common.no_entity_found', { entity: t('entities.messages').toLowerCase() })}</div>`
+                : messages.map(msg => {
+                    const isChannel = msg.message_type === 'channel';
+                    const typeIcon = isChannel ? '\u{1F4FB}' : '\u{1F464}';
+                    const typeTitle = isChannel ? t('messages.type_channel') : t('messages.type_contact');
+                    const chInfo = channelInfo(msg);
+                    const sender = senderBlock(msg);
+                    const displayMessage = messageTextWithSender(msg, chInfo.text);
+                    const fromPrimary = isChannel
+                        ? html`<span class="font-medium">${chInfo.label || t('messages.type_channel')}</span>`
+                        : sender;
+                    let receiversBlock = nothing;
+                    if (msg.receivers && msg.receivers.length >= 1) {
+                        receiversBlock = html`<div class="flex gap-0.5">
+                            ${msg.receivers.map(recv => {
+                                const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
+                                return html`<a href="/nodes/${recv.public_key}" class="text-sm hover:opacity-70" title=${recvName}>\u{1F4E1}</a>`;
+                            })}
+                        </div>`;
+                    } else if (msg.received_by) {
+                        const recvTitle = msg.receiver_tag_name || msg.receiver_name || truncateKey(msg.received_by, 12);
+                        receiversBlock = html`<a href="/nodes/${msg.received_by}" class="text-sm hover:opacity-70" title=${recvTitle}>\u{1F4E1}</a>`;
                     }
-                }
-                let receiversBlock = nothing;
-                if (msg.receivers && msg.receivers.length >= 1) {
-                    receiversBlock = html`<div class="flex gap-0.5">
-                        ${msg.receivers.map(recv => {
-                            const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
-                            return html`<a href="/nodes/${recv.public_key}" class="text-sm hover:opacity-70" title=${recvName}>\u{1F4E1}</a>`;
-                        })}
-                    </div>`;
-                } else if (msg.received_by) {
-                    const recvTitle = msg.receiver_tag_name || msg.receiver_name || truncateKey(msg.received_by, 12);
-                    receiversBlock = html`<a href="/nodes/${msg.received_by}" class="text-sm hover:opacity-70" title=${recvTitle}>\u{1F4E1}</a>`;
-                }
-                return html`<div class="card bg-base-100 shadow-sm">
-        <div class="card-body p-3">
-            <div class="flex items-start justify-between gap-2">
-                <div class="flex items-center gap-2 min-w-0">
-                    <span class="text-lg flex-shrink-0" title=${typeTitle}>
-                        ${typeIcon}
-                    </span>
-                    <div class="min-w-0">
-                        <div class="font-medium text-sm truncate">
-                            ${senderBlock}
-                        </div>
-                        <div class="text-xs opacity-60">
-                            ${formatDateTimeShort(msg.received_at)}
+                    return html`<div class="card bg-base-100 shadow-sm">
+            <div class="card-body p-3">
+                <div class="flex items-start justify-between gap-2">
+                    <div class="flex items-center gap-2 min-w-0">
+                        <span class="text-lg flex-shrink-0" title=${typeTitle}>
+                            ${typeIcon}
+                        </span>
+                        <div class="min-w-0">
+                            <div class="font-medium text-sm truncate">
+                                ${fromPrimary}
+                            </div>
+                            <div class="text-xs opacity-60">
+                                ${formatDateTimeShort(msg.received_at)}
+                            </div>
                         </div>
                     </div>
+                    <div class="flex items-center gap-2 flex-shrink-0">
+                        ${receiversBlock}
+                    </div>
                 </div>
-                <div class="flex items-center gap-2 flex-shrink-0">
-                    ${receiversBlock}
-                </div>
+                <p class="text-sm mt-2 break-words whitespace-pre-wrap">${displayMessage}</p>
             </div>
-            <p class="text-sm mt-2 break-words whitespace-pre-wrap">${msg.text || '-'}</p>
-        </div>
-    </div>`;
-            });
+        </div>`;
+                });
 
-        const tableRows = messages.length === 0
-            ? html`<tr><td colspan="5" class="text-center py-8 opacity-70">No messages found.</td></tr>`
-            : messages.map(msg => {
-                const isChannel = msg.message_type === 'channel';
-                const typeIcon = isChannel ? '\u{1F4FB}' : '\u{1F464}';
-                const typeTitle = isChannel ? 'Channel' : 'Contact';
-                let senderBlock;
-                if (isChannel) {
-                    senderBlock = html`<span class="opacity-60">Public</span>`;
-                } else {
-                    const senderName = msg.sender_tag_name || msg.sender_name;
-                    if (senderName) {
-                        senderBlock = html`<span class="font-medium">${senderName}</span>`;
+            const tableRows = messages.length === 0
+                ? html`<tr><td colspan="5" class="text-center py-8 opacity-70">${t('common.no_entity_found', { entity: t('entities.messages').toLowerCase() })}</td></tr>`
+                : messages.map(msg => {
+                    const isChannel = msg.message_type === 'channel';
+                    const typeIcon = isChannel ? '\u{1F4FB}' : '\u{1F464}';
+                    const typeTitle = isChannel ? t('messages.type_channel') : t('messages.type_contact');
+                    const chInfo = channelInfo(msg);
+                    const sender = senderBlock(msg, true);
+                    const displayMessage = messageTextWithSender(msg, chInfo.text);
+                    const fromPrimary = isChannel
+                        ? html`<span class="font-medium">${chInfo.label || t('messages.type_channel')}</span>`
+                        : sender;
+                    let receiversBlock;
+                    if (msg.receivers && msg.receivers.length >= 1) {
+                        receiversBlock = html`<div class="flex gap-1">
+                            ${msg.receivers.map(recv => {
+                                const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
+                                return html`<a href="/nodes/${recv.public_key}" class="text-lg hover:opacity-70" title=${recvName}>\u{1F4E1}</a>`;
+                            })}
+                        </div>`;
+                    } else if (msg.received_by) {
+                        const recvTitle = msg.receiver_tag_name || msg.receiver_name || truncateKey(msg.received_by, 12);
+                        receiversBlock = html`<a href="/nodes/${msg.received_by}" class="text-lg hover:opacity-70" title=${recvTitle}>\u{1F4E1}</a>`;
                     } else {
-                        senderBlock = html`<span class="font-mono text-xs">${(msg.pubkey_prefix || '-').slice(0, 12)}</span>`;
+                        receiversBlock = html`<span class="opacity-50">-</span>`;
                     }
-                }
-                let receiversBlock;
-                if (msg.receivers && msg.receivers.length >= 1) {
-                    receiversBlock = html`<div class="flex gap-1">
-                        ${msg.receivers.map(recv => {
-                            const recvName = recv.tag_name || recv.name || truncateKey(recv.public_key, 12);
-                            return html`<a href="/nodes/${recv.public_key}" class="text-lg hover:opacity-70" title=${recvName}>\u{1F4E1}</a>`;
-                        })}
-                    </div>`;
-                } else if (msg.received_by) {
-                    const recvTitle = msg.receiver_tag_name || msg.receiver_name || truncateKey(msg.received_by, 12);
-                    receiversBlock = html`<a href="/nodes/${msg.received_by}" class="text-lg hover:opacity-70" title=${recvTitle}>\u{1F4E1}</a>`;
-                } else {
-                    receiversBlock = html`<span class="opacity-50">-</span>`;
-                }
-                return html`<tr class="hover align-top">
-                <td class="text-lg" title=${typeTitle}>${typeIcon}</td>
-                <td class="text-sm whitespace-nowrap">${formatDateTime(msg.received_at)}</td>
-                <td class="text-sm whitespace-nowrap">${senderBlock}</td>
-                <td class="break-words max-w-md" style="white-space: pre-wrap;">${msg.text || '-'}</td>
-                <td>${receiversBlock}</td>
-            </tr>`;
+                    return html`<tr class="hover align-top">
+                    <td class="text-lg" title=${typeTitle}>${typeIcon}</td>
+                    <td class="text-sm whitespace-nowrap">${formatDateTime(msg.received_at)}</td>
+                    <td class="text-sm whitespace-nowrap">
+                        <div>${fromPrimary}</div>
+                    </td>
+                    <td class="break-words max-w-md" style="white-space: pre-wrap;">${displayMessage}</td>
+                    <td>${receiversBlock}</td>
+                </tr>`;
+                });
+
+            const paginationBlock = pagination(page, totalPages, '/messages', {
+                message_type, limit,
             });
 
-        const paginationBlock = pagination(page, totalPages, '/messages', {
-            message_type, limit,
-        });
-
-        renderPage(html`
-<div class="card bg-base-100 shadow mb-6">
+            renderPage(html`
+<div class="card shadow mb-6 panel-solid" style="--panel-color: var(--color-neutral)">
     <div class="card-body py-4">
         <form method="GET" action="/messages" class="flex gap-4 flex-wrap items-end" @submit=${createFilterHandler('/messages', navigate)}>
             <div class="form-control">
                 <label class="label py-1">
-                    <span class="label-text">Type</span>
+                    <span class="label-text">${t('common.type')}</span>
                 </label>
                 <select name="message_type" class="select select-bordered select-sm" @change=${autoSubmit}>
-                    <option value="">All Types</option>
-                    <option value="contact" ?selected=${message_type === 'contact'}>Direct</option>
-                    <option value="channel" ?selected=${message_type === 'channel'}>Channel</option>
+                    <option value="">${t('common.all_types')}</option>
+                    <option value="contact" ?selected=${message_type === 'contact'}>${t('messages.type_direct')}</option>
+                    <option value="channel" ?selected=${message_type === 'channel'}>${t('messages.type_channel')}</option>
                 </select>
             </div>
             <div class="flex gap-2 w-full sm:w-auto">
-                <button type="submit" class="btn btn-primary btn-sm">Filter</button>
-                <a href="/messages" class="btn btn-ghost btn-sm">Clear</a>
+                <button type="submit" class="btn btn-primary btn-sm">${t('common.filter')}</button>
+                <a href="/messages" class="btn btn-ghost btn-sm">${t('common.clear')}</a>
             </div>
         </form>
     </div>
@@ -168,11 +310,11 @@ ${content}`, container);
     <table class="table table-zebra">
         <thead>
             <tr>
-                <th>Type</th>
-                <th>Time</th>
-                <th>From</th>
-                <th>Message</th>
-                <th>Receivers</th>
+                <th>${t('common.type')}</th>
+                <th>${t('common.time')}</th>
+                <th>${t('common.from')}</th>
+                <th>${t('entities.message')}</th>
+                <th>${t('common.receivers')}</th>
             </tr>
         </thead>
         <tbody>
@@ -183,7 +325,17 @@ ${content}`, container);
 
 ${paginationBlock}`, { total });
 
-    } catch (e) {
-        renderPage(errorAlert(e.message));
+        } catch (e) {
+            renderPage(errorAlert(e.message));
+        }
     }
+
+    await fetchAndRenderData();
+
+    const toggleEl = container.querySelector('#auto-refresh-toggle');
+    const { cleanup } = createAutoRefresh({
+        fetchAndRender: fetchAndRenderData,
+        toggleContainer: toggleEl,
+    });
+    return cleanup;
 }

src/meshcore_hub/web/static/js/spa/pages/node-detail.js

@@ -2,7 +2,7 @@ import { apiGet } from '../api.js';
 import {
     html, litRender, nothing,
     getConfig, typeEmoji, formatDateTime,
-    truncateKey, errorAlert,
+    truncateKey, errorAlert, copyToClipboard, t,
 } from '../components.js';
 import { iconError } from '../icons.js';
 
@@ -30,7 +30,8 @@ export async function render(container, params, router) {
 
         const config = getConfig();
         const tagName = node.tags?.find(t => t.key === 'name')?.value;
-        const displayName = tagName || node.name || 'Unnamed Node';
+        const tagDescription = node.tags?.find(t => t.key === 'description')?.value;
+        const displayName = tagName || node.name || t('common.unnamed_node');
         const emoji = typeEmoji(node.adv_type);
 
         let lat = node.lat;
@@ -57,12 +58,12 @@ export async function render(container, params, router) {
 <div class="card bg-base-100 shadow-xl mb-6">
     <div class="card-body flex-row items-center gap-4">
         <div id="qr-code" class="bg-white p-1 rounded"></div>
-        <p class="text-sm opacity-70">Scan to add as contact</p>
+        <p class="text-sm opacity-70">${t('nodes.scan_to_add')}</p>
     </div>
 </div>`;
 
         const coordsHtml = hasCoords
-            ? html`<div><span class="opacity-70">Location:</span> ${lat}, ${lon}</div>`
+            ? html`<div><span class="opacity-70">${t('common.location')}:</span> ${lat}, ${lon}</div>`
             : nothing;
 
         const adsTableHtml = advertisements.length > 0
@@ -70,9 +71,9 @@ export async function render(container, params, router) {
                 <table class="table table-compact w-full">
                     <thead>
                         <tr>
-                            <th>Time</th>
-                            <th>Type</th>
-                            <th>Received By</th>
+                            <th>${t('common.time')}</th>
+                            <th>${t('common.type')}</th>
+                            <th>${t('common.received_by')}</th>
                         </tr>
                     </thead>
                     <tbody>
@@ -101,7 +102,7 @@ export async function render(container, params, router) {
                     </tbody>
                 </table>
             </div>`
-            : html`<p class="opacity-70">No advertisements recorded.</p>`;
+            : html`<p class="opacity-70">${t('common.no_entity_recorded', { entity: t('entities.advertisements').toLowerCase() })}</p>`;
 
         const tags = node.tags || [];
         const tagsTableHtml = tags.length > 0
@@ -109,9 +110,9 @@ export async function render(container, params, router) {
                 <table class="table table-compact w-full">
                     <thead>
                         <tr>
-                            <th>Key</th>
-                            <th>Value</th>
-                            <th>Type</th>
+                            <th>${t('common.key')}</th>
+                            <th>${t('common.value')}</th>
+                            <th>${t('common.type')}</th>
                         </tr>
                     </thead>
                     <tbody>
@@ -123,39 +124,44 @@ export async function render(container, params, router) {
                     </tbody>
                 </table>
             </div>`
-            : html`<p class="opacity-70">No tags defined.</p>`;
+            : html`<p class="opacity-70">${t('common.no_entity_defined', { entity: t('entities.tags').toLowerCase() })}</p>`;
 
         const adminTagsHtml = (config.admin_enabled && config.is_authenticated)
             ? html`<div class="mt-3">
-                <a href="/a/node-tags?public_key=${node.public_key}" class="btn btn-sm btn-outline">${tags.length > 0 ? 'Edit Tags' : 'Add Tags'}</a>
+                <a href="/a/node-tags?public_key=${node.public_key}" class="btn btn-sm btn-outline">${tags.length > 0 ? t('common.edit_entity', { entity: t('entities.tags') }) : t('common.add_entity', { entity: t('entities.tags') })}</a>
             </div>`
             : nothing;
 
         litRender(html`
 <div class="breadcrumbs text-sm mb-4">
     <ul>
-        <li><a href="/">Home</a></li>
-        <li><a href="/nodes">Nodes</a></li>
+        <li><a href="/">${t('entities.home')}</a></li>
+        <li><a href="/nodes">${t('entities.nodes')}</a></li>
         <li>${tagName || node.name || node.public_key.slice(0, 12) + '...'}</li>
     </ul>
 </div>
 
-<h1 class="text-3xl font-bold mb-6">
-    <span title=${node.adv_type || 'Unknown'}>${emoji}</span>
-    ${displayName}
-</h1>
+<div class="flex items-start gap-4 mb-6">
+    <span class="text-6xl flex-shrink-0" title=${node.adv_type || t('node_types.unknown')}>${emoji}</span>
+    <div class="flex-1 min-w-0">
+        <h1 class="text-3xl font-bold">${displayName}</h1>
+        ${tagDescription ? html`<p class="text-base-content/70 mt-2">${tagDescription}</p>` : nothing}
+    </div>
+</div>
 
 ${heroHtml}
 
 <div class="card bg-base-100 shadow-xl mb-6">
     <div class="card-body">
         <div>
-            <h3 class="font-semibold opacity-70 mb-2">Public Key</h3>
-            <code class="text-sm bg-base-200 p-2 rounded block break-all">${node.public_key}</code>
+            <h3 class="font-semibold opacity-70 mb-2">${t('common.public_key')}</h3>
+            <code class="text-sm bg-base-200 p-2 rounded block break-all cursor-pointer hover:bg-base-300 select-all"
+                  @click=${(e) => copyToClipboard(e, node.public_key)}
+                  title="Click to copy">${node.public_key}</code>
         </div>
         <div class="flex flex-wrap gap-x-8 gap-y-2 mt-4 text-sm">
-            <div><span class="opacity-70">First seen:</span> ${formatDateTime(node.first_seen)}</div>
-            <div><span class="opacity-70">Last seen:</span> ${formatDateTime(node.last_seen)}</div>
+            <div><span class="opacity-70">${t('common.first_seen_label')}</span> ${formatDateTime(node.first_seen)}</div>
+            <div><span class="opacity-70">${t('common.last_seen_label')}</span> ${formatDateTime(node.last_seen)}</div>
             ${coordsHtml}
         </div>
     </div>
@@ -164,14 +170,14 @@ ${heroHtml}
 <div class="grid grid-cols-1 lg:grid-cols-2 gap-6">
     <div class="card bg-base-100 shadow-xl">
         <div class="card-body">
-            <h2 class="card-title">Recent Advertisements</h2>
+            <h2 class="card-title">${t('common.recent_entity', { entity: t('entities.advertisements') })}</h2>
             ${adsTableHtml}
         </div>
     </div>
 
     <div class="card bg-base-100 shadow-xl">
         <div class="card-body">
-            <h2 class="card-title">Tags</h2>
+            <h2 class="card-title">${t('entities.tags')}</h2>
             ${tagsTableHtml}
             ${adminTagsHtml}
         </div>
@@ -203,7 +209,7 @@ ${heroHtml}
         const initQr = () => {
             const qrEl = document.getElementById('qr-code');
             if (!qrEl || typeof QRCode === 'undefined') return false;
-            const typeMap = { chat: 1, repeater: 2, room: 3, sensor: 4 };
+            const typeMap = { chat: 1, repeater: 2, room: 3, companion: 1, sensor: 4 };
             const typeNum = typeMap[(node.adv_type || '').toLowerCase()] || 1;
             const url = 'meshcore://contact/add?name=' + encodeURIComponent(displayName) + '&public_key=' + node.public_key + '&type=' + typeNum;
             new QRCode(qrEl, {
@@ -237,14 +243,14 @@ function renderNotFound(publicKey) {
     return html`
 <div class="breadcrumbs text-sm mb-4">
     <ul>
-        <li><a href="/">Home</a></li>
-        <li><a href="/nodes">Nodes</a></li>
-        <li>Not Found</li>
+        <li><a href="/">${t('entities.home')}</a></li>
+        <li><a href="/nodes">${t('entities.nodes')}</a></li>
+        <li>${t('common.page_not_found')}</li>
     </ul>
 </div>
 <div class="alert alert-error">
     ${iconError('stroke-current shrink-0 h-6 w-6')}
-    <span>Node not found: ${publicKey}</span>
+    <span>${t('common.entity_not_found_details', { entity: t('entities.node'), details: publicKey })}</span>
 </div>
-<a href="/nodes" class="btn btn-primary mt-4">Back to Nodes</a>`;
+<a href="/nodes" class="btn btn-primary mt-4">${t('common.view_entity', { entity: t('entities.nodes') })}</a>`;
 }

src/meshcore_hub/web/static/js/spa/pages/nodes.js

@@ -1,11 +1,12 @@
 import { apiGet } from '../api.js';
 import {
     html, litRender, nothing,
-    getConfig, typeEmoji, formatDateTime, formatDateTimeShort,
+    getConfig, formatDateTime, formatDateTimeShort,
     truncateKey, errorAlert,
     pagination, timezoneIndicator,
-    createFilterHandler, autoSubmit, submitOnEnter
+    createFilterHandler, autoSubmit, submitOnEnter, copyToClipboard, renderNodeDisplay, t
 } from '../components.js';
+import { createAutoRefresh } from '../auto-refresh.js';
 
 export async function render(container, params, router) {
     const query = params.query || {};
@@ -17,6 +18,8 @@ export async function render(container, params, router) {
     const offset = (page - 1) * limit;
 
     const config = getConfig();
+    const features = config.features || {};
+    const showMembers = features.members !== false;
     const tz = config.timezone || '';
     const tzBadge = tz && tz !== 'UTC' ? html`<span class="text-sm opacity-60">${tz}</span>` : nothing;
     const navigate = (url) => router.navigate(url);
@@ -24,10 +27,11 @@ export async function render(container, params, router) {
     function renderPage(content, { total = null } = {}) {
         litRender(html`
 <div class="flex items-center justify-between mb-6">
-    <h1 class="text-3xl font-bold">Nodes</h1>
+    <h1 class="text-3xl font-bold">${t('entities.nodes')}</h1>
     <div class="flex items-center gap-2">
+        <span id="auto-refresh-toggle"></span>
         ${tzBadge}
-        ${total !== null ? html`<span class="badge badge-lg">${total} total</span>` : nothing}
+        ${total !== null ? html`<span class="badge badge-lg">${t('common.total', { count: total })}</span>` : nothing}
     </div>
 </div>
 ${content}`, container);
@@ -36,127 +40,133 @@ ${content}`, container);
     // Render page header immediately (old content stays visible until data loads)
     renderPage(nothing);
 
-    try {
-        const [data, membersData] = await Promise.all([
-            apiGet('/api/v1/nodes', { limit, offset, search, adv_type, member_id }),
-            apiGet('/api/v1/members', { limit: 100 }),
-        ]);
+    async function fetchAndRenderData() {
+        try {
+            const requests = [
+                apiGet('/api/v1/nodes', { limit, offset, search, adv_type, member_id }),
+            ];
+            if (showMembers) {
+                requests.push(apiGet('/api/v1/members', { limit: 100 }));
+            }
 
-        const nodes = data.items || [];
-        const total = data.total || 0;
-        const totalPages = Math.ceil(total / limit);
-        const members = membersData.items || [];
+            const results = await Promise.all(requests);
+            const data = results[0];
+            const membersData = showMembers ? results[1] : null;
 
-        const membersFilter = members.length > 0
-            ? html`
-            <div class="form-control">
-                <label class="label py-1">
-                    <span class="label-text">Member</span>
-                </label>
-                <select name="member_id" class="select select-bordered select-sm" @change=${autoSubmit}>
-                    <option value="">All Members</option>
-                    ${members.map(m => html`<option value=${m.member_id} ?selected=${member_id === m.member_id}>${m.name}${m.callsign ? ` (${m.callsign})` : ''}</option>`)}
-                </select>
-            </div>`
-            : nothing;
+            const nodes = data.items || [];
+            const total = data.total || 0;
+            const totalPages = Math.ceil(total / limit);
+            const members = membersData?.items || [];
 
-        const mobileCards = nodes.length === 0
-            ? html`<div class="text-center py-8 opacity-70">No nodes found.</div>`
-            : nodes.map(node => {
-                const tagName = node.tags?.find(t => t.key === 'name')?.value;
-                const displayName = tagName || node.name;
-                const emoji = typeEmoji(node.adv_type);
-                const nameBlock = displayName
-                    ? html`<div class="font-medium text-sm truncate">${displayName}</div>
-                           <div class="text-xs font-mono opacity-60 truncate">${node.public_key.slice(0, 16)}...</div>`
-                    : html`<div class="font-mono text-sm truncate">${node.public_key.slice(0, 16)}...</div>`;
-                const lastSeen = node.last_seen ? formatDateTimeShort(node.last_seen) : '-';
-                const tags = node.tags || [];
-                const tagsBlock = tags.length > 0
-                    ? html`<div class="flex gap-1 justify-end mt-1">
-                        ${tags.slice(0, 2).map(t => html`<span class="badge badge-ghost badge-xs">${t.key}</span>`)}
-                        ${tags.length > 2 ? html`<span class="badge badge-ghost badge-xs">+${tags.length - 2}</span>` : nothing}
-                    </div>`
-                    : nothing;
-                return html`<a href="/nodes/${node.public_key}" class="card bg-base-100 shadow-sm block">
-        <div class="card-body p-3">
-            <div class="flex items-center justify-between gap-2">
-                <div class="flex items-center gap-2 min-w-0">
-                    <span class="text-lg flex-shrink-0" title=${node.adv_type || 'Unknown'}>${emoji}</span>
-                    <div class="min-w-0">
-                        ${nameBlock}
+            const membersFilter = (showMembers && members.length > 0)
+                ? html`
+                <div class="form-control">
+                    <label class="label py-1">
+                        <span class="label-text">${t('entities.member')}</span>
+                    </label>
+                    <select name="member_id" class="select select-bordered select-sm" @change=${autoSubmit}>
+                        <option value="">${t('common.all_entity', { entity: t('entities.members') })}</option>
+                        ${members.map(m => html`<option value=${m.member_id} ?selected=${member_id === m.member_id}>${m.name}${m.callsign ? ` (${m.callsign})` : ''}</option>`)}
+                    </select>
+                </div>`
+                : nothing;
+
+            const mobileCards = nodes.length === 0
+                ? html`<div class="text-center py-8 opacity-70">${t('common.no_entity_found', { entity: t('entities.nodes').toLowerCase() })}</div>`
+                : nodes.map(node => {
+                    const tagName = node.tags?.find(tag => tag.key === 'name')?.value;
+                    const tagDescription = node.tags?.find(tag => tag.key === 'description')?.value;
+                    const displayName = tagName || node.name;
+                    const lastSeen = node.last_seen ? formatDateTimeShort(node.last_seen) : '-';
+                    const memberIdTag = showMembers ? node.tags?.find(tag => tag.key === 'member_id')?.value : null;
+                    const member = memberIdTag ? members.find(m => m.member_id === memberIdTag) : null;
+                    const memberBlock = (showMembers && member)
+                        ? html`<div class="text-xs opacity-60">${member.name}</div>`
+                        : nothing;
+                    return html`<a href="/nodes/${node.public_key}" class="card bg-base-100 shadow-sm block">
+            <div class="card-body p-3">
+                <div class="flex items-center justify-between gap-2">
+                    ${renderNodeDisplay({
+                        name: displayName,
+                        description: tagDescription,
+                        publicKey: node.public_key,
+                        advType: node.adv_type,
+                        size: 'sm'
+                    })}
+                    <div class="text-right flex-shrink-0">
+                        <div class="text-xs opacity-60">${lastSeen}</div>
+                        ${memberBlock}
                     </div>
                 </div>
-                <div class="text-right flex-shrink-0">
-                    <div class="text-xs opacity-60">${lastSeen}</div>
-                    ${tagsBlock}
-                </div>
             </div>
-        </div>
-    </a>`;
+        </a>`;
+                });
+
+            const tableColspan = showMembers ? 4 : 3;
+            const tableRows = nodes.length === 0
+                ? html`<tr><td colspan="${tableColspan}" class="text-center py-8 opacity-70">${t('common.no_entity_found', { entity: t('entities.nodes').toLowerCase() })}</td></tr>`
+                : nodes.map(node => {
+                    const tagName = node.tags?.find(tag => tag.key === 'name')?.value;
+                    const tagDescription = node.tags?.find(tag => tag.key === 'description')?.value;
+                    const displayName = tagName || node.name;
+                    const lastSeen = node.last_seen ? formatDateTime(node.last_seen) : '-';
+                    const memberIdTag = showMembers ? node.tags?.find(tag => tag.key === 'member_id')?.value : null;
+                    const member = memberIdTag ? members.find(m => m.member_id === memberIdTag) : null;
+                    const memberBlock = member
+                        ? html`${member.name}${member.callsign ? html` <span class="opacity-60">(${member.callsign})</span>` : nothing}`
+                        : html`<span class="opacity-50">-</span>`;
+                    return html`<tr class="hover">
+                    <td>
+                        <a href="/nodes/${node.public_key}" class="link link-hover">
+                            ${renderNodeDisplay({
+                                name: displayName,
+                                description: tagDescription,
+                                publicKey: node.public_key,
+                                advType: node.adv_type,
+                                size: 'base'
+                            })}
+                        </a>
+                    </td>
+                    <td>
+                        <code class="font-mono text-xs cursor-pointer hover:bg-base-200 px-1 py-0.5 rounded select-all"
+                              @click=${(e) => copyToClipboard(e, node.public_key)}
+                              title="Click to copy">${node.public_key}</code>
+                    </td>
+                    <td class="text-sm whitespace-nowrap">${lastSeen}</td>
+                    ${showMembers ? html`<td class="text-sm">${memberBlock}</td>` : nothing}
+                </tr>`;
+                });
+
+            const paginationBlock = pagination(page, totalPages, '/nodes', {
+                search, adv_type, member_id, limit,
             });
 
-        const tableRows = nodes.length === 0
-            ? html`<tr><td colspan="3" class="text-center py-8 opacity-70">No nodes found.</td></tr>`
-            : nodes.map(node => {
-                const tagName = node.tags?.find(t => t.key === 'name')?.value;
-                const displayName = tagName || node.name;
-                const emoji = typeEmoji(node.adv_type);
-                const nameBlock = displayName
-                    ? html`<div class="font-medium">${displayName}</div>
-                           <div class="text-xs font-mono opacity-70">${node.public_key.slice(0, 16)}...</div>`
-                    : html`<span class="font-mono text-sm">${node.public_key.slice(0, 16)}...</span>`;
-                const lastSeen = node.last_seen ? formatDateTime(node.last_seen) : '-';
-                const tags = node.tags || [];
-                const tagsBlock = tags.length > 0
-                    ? html`<div class="flex gap-1 flex-wrap">
-                        ${tags.slice(0, 3).map(t => html`<span class="badge badge-ghost badge-xs">${t.key}</span>`)}
-                        ${tags.length > 3 ? html`<span class="badge badge-ghost badge-xs">+${tags.length - 3}</span>` : nothing}
-                    </div>`
-                    : html`<span class="opacity-50">-</span>`;
-                return html`<tr class="hover">
-                <td>
-                    <a href="/nodes/${node.public_key}" class="link link-hover flex items-center gap-2">
-                        <span class="text-lg" title=${node.adv_type || 'Unknown'}>${emoji}</span>
-                        <div>
-                            ${nameBlock}
-                        </div>
-                    </a>
-                </td>
-                <td class="text-sm whitespace-nowrap">${lastSeen}</td>
-                <td>${tagsBlock}</td>
-            </tr>`;
-            });
-
-        const paginationBlock = pagination(page, totalPages, '/nodes', {
-            search, adv_type, member_id, limit,
-        });
-
-        renderPage(html`
-<div class="card bg-base-100 shadow mb-6">
+            renderPage(html`
+<div class="card shadow mb-6 panel-solid" style="--panel-color: var(--color-neutral)">
     <div class="card-body py-4">
         <form method="GET" action="/nodes" class="flex gap-4 flex-wrap items-end" @submit=${createFilterHandler('/nodes', navigate)}>
             <div class="form-control">
                 <label class="label py-1">
-                    <span class="label-text">Search</span>
+                    <span class="label-text">${t('common.search')}</span>
                 </label>
-                <input type="text" name="search" .value=${search} placeholder="Search by name, ID, or public key..." class="input input-bordered input-sm w-80" @keydown=${submitOnEnter} />
+                <input type="text" name="search" .value=${search} placeholder="${t('common.search_placeholder')}" class="input input-bordered input-sm w-80" @keydown=${submitOnEnter} />
             </div>
             <div class="form-control">
                 <label class="label py-1">
-                    <span class="label-text">Type</span>
+                    <span class="label-text">${t('common.type')}</span>
                 </label>
                 <select name="adv_type" class="select select-bordered select-sm" @change=${autoSubmit}>
-                    <option value="">All Types</option>
-                    <option value="chat" ?selected=${adv_type === 'chat'}>Chat</option>
-                    <option value="repeater" ?selected=${adv_type === 'repeater'}>Repeater</option>
-                    <option value="room" ?selected=${adv_type === 'room'}>Room</option>
+                    <option value="">${t('common.all_types')}</option>
+                    <option value="chat" ?selected=${adv_type === 'chat'}>${t('node_types.chat')}</option>
+                    <option value="repeater" ?selected=${adv_type === 'repeater'}>${t('node_types.repeater')}</option>
+                    <option value="companion" ?selected=${adv_type === 'companion'}>${t('node_types.companion')}</option>
+                    <option value="room" ?selected=${adv_type === 'room'}>${t('node_types.room')}</option>
                 </select>
             </div>
             ${membersFilter}
             <div class="flex gap-2 w-full sm:w-auto">
-                <button type="submit" class="btn btn-primary btn-sm">Filter</button>
-                <a href="/nodes" class="btn btn-ghost btn-sm">Clear</a>
+                <button type="submit" class="btn btn-primary btn-sm">${t('common.filter')}</button>
+                <a href="/nodes" class="btn btn-ghost btn-sm">${t('common.clear')}</a>
             </div>
         </form>
     </div>
@@ -170,9 +180,10 @@ ${content}`, container);
     <table class="table table-zebra">
         <thead>
             <tr>
-                <th>Node</th>
-                <th>Last Seen</th>
-                <th>Tags</th>
+                <th>${t('entities.node')}</th>
+                <th>${t('common.public_key')}</th>
+                <th>${t('common.last_seen')}</th>
+                ${showMembers ? html`<th>${t('entities.member')}</th>` : nothing}
             </tr>
         </thead>
         <tbody>
@@ -183,7 +194,17 @@ ${content}`, container);
 
 ${paginationBlock}`, { total });
 
-    } catch (e) {
-        renderPage(errorAlert(e.message));
+        } catch (e) {
+            renderPage(errorAlert(e.message));
+        }
     }
+
+    await fetchAndRenderData();
+
+    const toggleEl = container.querySelector('#auto-refresh-toggle');
+    const { cleanup } = createAutoRefresh({
+        fetchAndRender: fetchAndRenderData,
+        toggleContainer: toggleEl,
+    });
+    return cleanup;
 }

src/meshcore_hub/web/static/js/spa/pages/not-found.js

@@ -1,4 +1,4 @@
-import { html, litRender } from '../components.js';
+import { html, litRender, t } from '../components.js';
 import { iconHome, iconNodes } from '../icons.js';
 
 export async function render(container, params, router) {
@@ -7,18 +7,18 @@ export async function render(container, params, router) {
     <div class="hero-content text-center">
         <div class="max-w-md">
             <div class="text-9xl font-bold text-primary opacity-20">404</div>
-            <h1 class="text-4xl font-bold -mt-8">Page Not Found</h1>
+            <h1 class="text-4xl font-bold -mt-8">${t('common.page_not_found')}</h1>
             <p class="py-6 text-base-content/70">
-                The page you're looking for doesn't exist or has been moved.
+                ${t('not_found.description')}
             </p>
             <div class="flex gap-4 justify-center">
                 <a href="/" class="btn btn-primary">
                     ${iconHome('h-5 w-5 mr-2')}
-                    Go Home
+                    ${t('common.go_home')}
                 </a>
                 <a href="/nodes" class="btn btn-outline">
                     ${iconNodes('h-5 w-5 mr-2')}
-                    Browse Nodes
+                    ${t('common.view_entity', { entity: t('entities.nodes') })}
                 </a>
             </div>
         </div>

src/meshcore_hub/web/static/locales/en.json

@@ -0,0 +1,217 @@
+{
+    "entities": {
+        "home": "Home",
+        "dashboard": "Dashboard",
+        "nodes": "Nodes",
+        "node": "Node",
+        "node_detail": "Node Detail",
+        "advertisements": "Advertisements",
+        "advertisement": "Advertisement",
+        "messages": "Messages",
+        "message": "Message",
+        "map": "Map",
+        "members": "Members",
+        "member": "Member",
+        "admin": "Admin",
+        "tags": "Tags",
+        "tag": "Tag"
+    },
+    "common": {
+        "filter": "Filter",
+        "clear": "Clear",
+        "clear_filters": "Clear Filters",
+        "search": "Search",
+        "cancel": "Cancel",
+        "delete": "Delete",
+        "edit": "Edit",
+        "move": "Move",
+        "save": "Save",
+        "save_changes": "Save Changes",
+        "add": "Add",
+        "add_entity": "Add {{entity}}",
+        "add_new_entity": "Add New {{entity}}",
+        "edit_entity": "Edit {{entity}}",
+        "delete_entity": "Delete {{entity}}",
+        "delete_all_entity": "Delete All {{entity}}",
+        "move_entity": "Move {{entity}}",
+        "move_entity_to_another_node": "Move {{entity}} to Another Node",
+        "copy_entity": "Copy {{entity}}",
+        "copy_all_entity_to_another_node": "Copy All {{entity}} to Another Node",
+        "view_entity": "View {{entity}}",
+        "recent_entity": "Recent {{entity}}",
+        "total_entity": "Total {{entity}}",
+        "all_entity": "All {{entity}}",
+        "no_entity_found": "No {{entity}} found",
+        "no_entity_recorded": "No {{entity}} recorded",
+        "no_entity_defined": "No {{entity}} defined",
+        "no_entity_in_database": "No {{entity}} in database",
+        "no_entity_configured": "No {{entity}} configured",
+        "no_entity_yet": "No {{entity}} yet",
+        "entity_not_found_details": "{{entity}} not found: {{details}}",
+        "page_not_found": "Page not found",
+        "delete_entity_confirm": "Are you sure you want to delete {{entity}} <strong>{{name}}</strong>?",
+        "delete_all_entity_confirm": "Are you sure you want to delete all {{count}} {{entity}} from <strong>{{name}}</strong>?",
+        "cannot_be_undone": "This action cannot be undone.",
+        "entity_added_success": "{{entity}} added successfully",
+        "entity_updated_success": "{{entity}} updated successfully",
+        "entity_deleted_success": "{{entity}} deleted successfully",
+        "entity_moved_success": "{{entity}} moved successfully",
+        "all_entity_deleted_success": "All {{entity}} deleted successfully",
+        "copy_all_entity_description": "Copy all {{count}} {{entity}} from <strong>{{name}}</strong> to another node.",
+        "previous": "Previous",
+        "next": "Next",
+        "go_home": "Go Home",
+        "loading": "Loading...",
+        "error": "Error",
+        "failed_to_load_page": "Failed to load page",
+        "total": "{{count}} total",
+        "shown": "{{count}} shown",
+        "count_entity": "{{count}} {{entity}}",
+        "type": "Type",
+        "name": "Name",
+        "key": "Key",
+        "value": "Value",
+        "time": "Time",
+        "actions": "Actions",
+        "updated": "Updated",
+        "sign_in": "Sign In",
+        "sign_out": "Sign Out",
+        "view_details": "View Details",
+        "all_types": "All Types",
+        "node_type": "Node Type",
+        "show": "Show",
+        "search_placeholder": "Search by name, ID, or public key...",
+        "contact": "Contact",
+        "description": "Description",
+        "callsign": "Callsign",
+        "tags": "Tags",
+        "last_seen": "Last Seen",
+        "first_seen_label": "First seen:",
+        "last_seen_label": "Last seen:",
+        "location": "Location",
+        "public_key": "Public Key",
+        "received": "Received",
+        "received_by": "Received By",
+        "receivers": "Receivers",
+        "from": "From",
+        "close": "close",
+        "unnamed": "Unnamed",
+        "unnamed_node": "Unnamed Node"
+    },
+    "links": {
+        "website": "Website",
+        "github": "GitHub",
+        "discord": "Discord",
+        "youtube": "YouTube",
+        "profile": "Profile"
+    },
+    "auto_refresh": {
+        "pause": "Pause auto-refresh",
+        "resume": "Resume auto-refresh"
+    },
+    "time": {
+        "days_ago": "{{count}}d ago",
+        "hours_ago": "{{count}}h ago",
+        "minutes_ago": "{{count}}m ago",
+        "less_than_minute": "<1m ago",
+        "last_7_days": "Last 7 days",
+        "per_day_last_7_days": "Per day (last 7 days)",
+        "over_time_last_7_days": "Over time (last 7 days)",
+        "activity_per_day_last_7_days": "Activity per day (last 7 days)"
+    },
+    "node_types": {
+        "chat": "Chat",
+        "repeater": "Repeater",
+        "companion": "Companion",
+        "room": "Room Server",
+        "unknown": "Unknown"
+    },
+    "home": {
+        "welcome_default": "Welcome to the {{network_name}} mesh network dashboard. Monitor network activity, view connected nodes, and explore message history.",
+        "all_discovered_nodes": "All discovered nodes",
+        "network_info": "Network Info",
+        "network_activity": "Network Activity",
+        "meshcore_attribution": "Our local off-grid mesh network is made possible by",
+        "frequency": "Frequency",
+        "bandwidth": "Bandwidth",
+        "spreading_factor": "Spreading Factor",
+        "coding_rate": "Coding Rate",
+        "tx_power": "TX Power"
+    },
+    "dashboard": {
+        "all_discovered_nodes": "All discovered nodes",
+        "recent_channel_messages": "Recent Channel Messages",
+        "channel": "Channel {{number}}"
+    },
+    "nodes": {
+        "scan_to_add": "Scan to add as contact"
+    },
+    "advertisements": {},
+    "messages": {
+        "type_direct": "Direct",
+        "type_channel": "Channel",
+        "type_contact": "Contact",
+        "type_public": "Public"
+    },
+    "map": {
+        "show_labels": "Show Labels",
+        "infrastructure_only": "Infrastructure Only",
+        "legend": "Legend:",
+        "infrastructure": "Infrastructure",
+        "public": "Public",
+        "nodes_on_map": "{{count}} nodes on map",
+        "nodes_none_have_coordinates": "{{count}} nodes (none have coordinates)",
+        "gps_description": "Nodes are placed on the map based on GPS coordinates from node reports or manual tags.",
+        "owner": "Owner:",
+        "role": "Role:",
+        "select_destination_node": "-- Select destination node --"
+    },
+    "members": {
+        "empty_state_description": "To display network members, create a members.yaml file in your seed directory.",
+        "members_file_format": "Members File Format",
+        "members_file_description": "Create a YAML file at <code>$SEED_HOME/members.yaml</code> with the following structure:",
+        "members_import_instructions": "Run <code>meshcore-hub collector seed</code> to import members.<br/>To associate nodes with members, add a <code>member_id</code> tag to nodes in <code>node_tags.yaml</code>."
+    },
+    "not_found": {
+        "description": "The page you're looking for doesn't exist or has been moved."
+    },
+    "custom_page": {
+        "failed_to_load": "Failed to load page"
+    },
+    "admin": {
+        "access_denied": "Access Denied",
+        "admin_not_enabled": "The admin interface is not enabled.",
+        "admin_enable_hint": "Set <code>WEB_ADMIN_ENABLED=true</code> to enable admin features.",
+        "auth_required": "Authentication Required",
+        "auth_required_description": "You must sign in to access the admin interface.",
+        "welcome": "Welcome to the admin panel.",
+        "members_description": "Manage network members and operators.",
+        "tags_description": "Manage custom tags and metadata for network nodes."
+    },
+    "admin_members": {
+        "network_members": "Network Members ({{count}})",
+        "member_id": "Member ID",
+        "member_id_hint": "Unique identifier (letters, numbers, underscore)",
+        "empty_state_hint": "Click \"Add Member\" to create the first member."
+    },
+    "admin_node_tags": {
+        "select_node": "Select Node",
+        "select_node_placeholder": "-- Select a node --",
+        "load_tags": "Load Tags",
+        "move_warning": "This will move the tag from the current node to the destination node.",
+        "copy_all": "Copy All",
+        "copy_all_info": "Tags that already exist on the destination node will be skipped. Original tags remain on this node.",
+        "delete_all": "Delete All",
+        "delete_all_warning": "All tags will be permanently deleted.",
+        "destination_node": "Destination Node",
+        "tag_key": "Tag Key",
+        "for_this_node": "for this node",
+        "empty_state_hint": "Add a new tag below.",
+        "select_a_node": "Select a Node",
+        "select_a_node_description": "Choose a node from the dropdown above to view and manage its tags.",
+        "copied_entities": "Copied {{copied}} tag(s), skipped {{skipped}}"
+    },
+    "footer": {
+        "powered_by": "Powered by"
+    }
+}

src/meshcore_hub/web/static/locales/languages.md

@@ -0,0 +1,427 @@
+# Translation Reference Guide
+
+This document provides a comprehensive reference for translating the MeshCore Hub web dashboard.
+
+## File Structure
+
+Translation files are JSON files named by language code (e.g., `en.json`, `es.json`, `fr.json`) and located in `/src/meshcore_hub/web/static/locales/`.
+
+## Variable Interpolation
+
+Many translations use `{{variable}}` syntax for dynamic content. These must be preserved exactly:
+
+```json
+"total": "{{count}} total"
+```
+
+When translating, keep the variable names unchanged:
+```json
+"total": "{{count}} au total"  // French example
+```
+
+## Translation Sections
+
+### 1. `entities`
+
+Core entity names used throughout the application. These are referenced by other translations for composition.
+
+| Key | English | Context |
+|-----|---------|---------|
+| `home` | Home | Homepage/breadcrumb navigation |
+| `dashboard` | Dashboard | Main dashboard page |
+| `nodes` | Nodes | Mesh network nodes (plural) |
+| `node` | Node | Single mesh network node |
+| `node_detail` | Node Detail | Node details page |
+| `advertisements` | Advertisements | Network advertisements (plural) |
+| `advertisement` | Advertisement | Single advertisement |
+| `messages` | Messages | Network messages (plural) |
+| `message` | Message | Single message |
+| `map` | Map | Network map page |
+| `members` | Members | Network members (plural) |
+| `member` | Member | Single network member |
+| `admin` | Admin | Admin panel |
+| `tags` | Tags | Node metadata tags (plural) |
+| `tag` | Tag | Single tag |
+
+**Usage:** These are used with composite patterns. For example, `t('common.add_entity', { entity: t('entities.node') })` produces "Add Node".
+
+### 2. `common`
+
+Reusable patterns and UI elements used across multiple pages.
+
+#### Actions
+
+| Key | English | Context |
+|-----|---------|---------|
+| `filter` | Filter | Filter button/action |
+| `clear` | Clear | Clear action |
+| `clear_filters` | Clear Filters | Reset all filters |
+| `search` | Search | Search button/action |
+| `cancel` | Cancel | Cancel button in dialogs |
+| `delete` | Delete | Delete button |
+| `edit` | Edit | Edit button |
+| `move` | Move | Move button |
+| `save` | Save | Save button |
+| `save_changes` | Save Changes | Save changes button |
+| `add` | Add | Add button |
+| `close` | close | Close button (lowercase for accessibility) |
+| `sign_in` | Sign In | Authentication sign in |
+| `sign_out` | Sign Out | Authentication sign out |
+| `go_home` | Go Home | Return to homepage button |
+
+#### Composite Patterns with Entity
+
+These patterns use `{{entity}}` variable - the entity name is provided dynamically:
+
+| Key | English | Example Output |
+|-----|---------|----------------|
+| `add_entity` | Add {{entity}} | "Add Node", "Add Tag" |
+| `add_new_entity` | Add New {{entity}} | "Add New Member" |
+| `edit_entity` | Edit {{entity}} | "Edit Tag" |
+| `delete_entity` | Delete {{entity}} | "Delete Member" |
+| `delete_all_entity` | Delete All {{entity}} | "Delete All Tags" |
+| `move_entity` | Move {{entity}} | "Move Tag" |
+| `move_entity_to_another_node` | Move {{entity}} to Another Node | "Move Tag to Another Node" |
+| `copy_entity` | Copy {{entity}} | "Copy Tags" |
+| `copy_all_entity_to_another_node` | Copy All {{entity}} to Another Node | "Copy All Tags to Another Node" |
+| `view_entity` | View {{entity}} | "View Node" |
+| `recent_entity` | Recent {{entity}} | "Recent Advertisements" |
+| `total_entity` | Total {{entity}} | "Total Nodes" |
+| `all_entity` | All {{entity}} | "All Messages" |
+
+#### Empty State Patterns
+
+These patterns indicate when data is absent. Use `{{entity}}` in lowercase (e.g., "nodes", not "Nodes"):
+
+| Key | English | Context |
+|-----|---------|---------|
+| `no_entity_found` | No {{entity}} found | Search/filter returned no results |
+| `no_entity_recorded` | No {{entity}} recorded | No historical records exist |
+| `no_entity_defined` | No {{entity}} defined | No configuration/definitions exist |
+| `no_entity_in_database` | No {{entity}} in database | Database is empty |
+| `no_entity_configured` | No {{entity}} configured | System not configured |
+| `no_entity_yet` | No {{entity}} yet | Empty state, expecting data later |
+| `entity_not_found_details` | {{entity}} not found: {{details}} | Specific item not found with details |
+| `page_not_found` | Page not found | 404 error message |
+
+#### Confirmation Patterns
+
+Used in delete/move dialogs. Variables: `{{entity}}`, `{{name}}`, `{{count}}`:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `delete_entity_confirm` | Are you sure you want to delete {{entity}} <strong>{{name}}</strong>? | Single item delete confirmation |
+| `delete_all_entity_confirm` | Are you sure you want to delete all {{count}} {{entity}} from <strong>{{name}}</strong>? | Bulk delete confirmation |
+| `cannot_be_undone` | This action cannot be undone. | Warning in delete dialogs |
+
+#### Success Messages
+
+Toast/flash messages after successful operations:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `entity_added_success` | {{entity}} added successfully | After creating new item |
+| `entity_updated_success` | {{entity}} updated successfully | After updating item |
+| `entity_deleted_success` | {{entity}} deleted successfully | After deleting item |
+| `entity_moved_success` | {{entity}} moved successfully | After moving tag to another node |
+| `all_entity_deleted_success` | All {{entity}} deleted successfully | After bulk delete |
+| `copy_all_entity_description` | Copy all {{count}} {{entity}} from <strong>{{name}}</strong> to another node. | Copy operation description |
+
+#### Navigation & Status
+
+| Key | English | Context |
+|-----|---------|---------|
+| `previous` | Previous | Pagination previous |
+| `next` | Next | Pagination next |
+| `loading` | Loading... | Loading indicator |
+| `error` | Error | Error state |
+| `failed_to_load_page` | Failed to load page | Page load error |
+
+#### Counts & Metrics
+
+| Key | English | Context |
+|-----|---------|---------|
+| `total` | {{count}} total | Total count display |
+| `shown` | {{count}} shown | Filtered count display |
+| `count_entity` | {{count}} {{entity}} | Generic count with entity |
+
+#### Form Fields & Labels
+
+| Key | English | Context |
+|-----|---------|---------|
+| `type` | Type | Type field/column header |
+| `name` | Name | Name field/column header |
+| `key` | Key | Key field (for tags) |
+| `value` | Value | Value field (for tags) |
+| `time` | Time | Time column header |
+| `actions` | Actions | Actions column header |
+| `updated` | Updated | Last updated timestamp |
+| `view_details` | View Details | View details link |
+| `all_types` | All Types | "All types" filter option |
+| `node_type` | Node Type | Node type field |
+| `show` | Show | Show/display action |
+| `search_placeholder` | Search by name, ID, or public key... | Search input placeholder |
+| `contact` | Contact | Contact information field |
+| `description` | Description | Description field |
+| `callsign` | Callsign | Amateur radio callsign field |
+| `tags` | Tags | Tags label/header |
+| `last_seen` | Last Seen | Last seen timestamp (table header) |
+| `first_seen_label` | First seen: | First seen label (inline with colon) |
+| `last_seen_label` | Last seen: | Last seen label (inline with colon) |
+| `location` | Location | Geographic location |
+| `public_key` | Public Key | Node public key |
+| `received` | Received | Received timestamp |
+| `received_by` | Received By | Received by field |
+| `receivers` | Receivers | Multiple receivers |
+| `from` | From | Message sender |
+| `unnamed` | Unnamed | Fallback for unnamed items |
+| `unnamed_node` | Unnamed Node | Fallback for unnamed nodes |
+
+**Note:** Keys ending in `_label` have colons and are used inline. Keys without `_label` are for table headers.
+
+### 3. `links`
+
+Platform and external link labels:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `website` | Website | Website link label |
+| `github` | GitHub | GitHub link label (preserve capitalization) |
+| `discord` | Discord | Discord link label |
+| `youtube` | YouTube | YouTube link label (preserve capitalization) |
+| `profile` | Profile | Radio profile label |
+
+### 4. `auto_refresh`
+
+Auto-refresh controls for list pages (nodes, advertisements, messages):
+
+| Key | English | Context |
+|-----|---------|---------|
+| `pause` | Pause auto-refresh | Tooltip on pause button when auto-refresh is active |
+| `resume` | Resume auto-refresh | Tooltip on play button when auto-refresh is paused |
+
+### 5. `time`
+
+Time-related labels and formats:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `days_ago` | {{count}}d ago | Days ago (abbreviated) |
+| `hours_ago` | {{count}}h ago | Hours ago (abbreviated) |
+| `minutes_ago` | {{count}}m ago | Minutes ago (abbreviated) |
+| `less_than_minute` | <1m ago | Less than one minute ago |
+| `last_7_days` | Last 7 days | Last 7 days label |
+| `per_day_last_7_days` | Per day (last 7 days) | Per day over last 7 days |
+| `over_time_last_7_days` | Over time (last 7 days) | Over time last 7 days |
+| `activity_per_day_last_7_days` | Activity per day (last 7 days) | Activity chart label |
+
+### 6. `node_types`
+
+Mesh network node type labels:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `chat` | Chat | Chat node type |
+| `repeater` | Repeater | Repeater/relay node type |
+| `companion` | Companion | Companion/observer node type |
+| `room` | Room Server | Room server/group node type |
+| `unknown` | Unknown | Unknown node type fallback |
+
+### 7. `home`
+
+Homepage-specific content:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `welcome_default` | Welcome to the {{network_name}} mesh network dashboard. Monitor network activity, view connected nodes, and explore message history. | Default welcome message |
+| `all_discovered_nodes` | All discovered nodes | Stat description |
+| `network_info` | Network Info | Network info card title |
+| `network_activity` | Network Activity | Activity chart title |
+| `meshcore_attribution` | Our local off-grid mesh network is made possible by | Attribution text before MeshCore logo |
+| `frequency` | Frequency | Radio frequency label |
+| `bandwidth` | Bandwidth | Radio bandwidth label |
+| `spreading_factor` | Spreading Factor | LoRa spreading factor label |
+| `coding_rate` | Coding Rate | LoRa coding rate label |
+| `tx_power` | TX Power | Transmit power label |
+| `advertisements` | Advertisements | Homepage stat label |
+| `messages` | Messages | Homepage stat label |
+
+**Note:** MeshCore tagline "Connecting people and things, without using the internet" is hardcoded in English and should not be translated (trademark).
+
+### 8. `dashboard`
+
+Dashboard page content:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `all_discovered_nodes` | All discovered nodes | Stat label |
+| `recent_channel_messages` | Recent Channel Messages | Recent messages card title |
+| `channel` | Channel {{number}} | Channel label with number |
+
+### 9. `nodes`
+
+Node-specific labels:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `scan_to_add` | Scan to add as contact | QR code instruction |
+
+### 10. `advertisements`
+
+Currently empty - advertisements page uses common patterns.
+
+### 11. `messages`
+
+Message type labels:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `type_direct` | Direct | Direct message type |
+| `type_channel` | Channel | Channel message type |
+| `type_contact` | Contact | Contact message type |
+| `type_public` | Public | Public message type |
+
+### 12. `map`
+
+Map page content:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `show_labels` | Show Labels | Toggle to show node labels |
+| `infrastructure_only` | Infrastructure Only | Toggle to show only infrastructure nodes |
+| `legend` | Legend: | Map legend header |
+| `infrastructure` | Infrastructure | Infrastructure node category |
+| `public` | Public | Public node category |
+| `nodes_on_map` | {{count}} nodes on map | Status text with coordinates |
+| `nodes_none_have_coordinates` | {{count}} nodes (none have coordinates) | Status text without coordinates |
+| `gps_description` | Nodes are placed on the map based on GPS coordinates from node reports or manual tags. | Map data source explanation |
+| `owner` | Owner: | Node owner label |
+| `role` | Role: | Member role label |
+| `select_destination_node` | -- Select destination node -- | Dropdown placeholder |
+
+### 13. `members`
+
+Members page content:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `empty_state_description` | To display network members, create a members.yaml file in your seed directory. | Empty state instructions |
+| `members_file_format` | Members File Format | Documentation section title |
+| `members_file_description` | Create a YAML file at <code>$SEED_HOME/members.yaml</code> with the following structure: | File creation instructions |
+| `members_import_instructions` | Run <code>meshcore-hub collector seed</code> to import members.<br/>To associate nodes with members, add a <code>member_id</code> tag to nodes in <code>node_tags.yaml</code>. | Import instructions (HTML allowed) |
+
+### 14. `not_found`
+
+404 page content:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `description` | The page you're looking for doesn't exist or has been moved. | 404 description |
+
+### 15. `custom_page`
+
+Custom markdown page errors:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `failed_to_load` | Failed to load page | Page load error |
+
+### 16. `admin`
+
+Admin panel content:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `access_denied` | Access Denied | Access denied heading |
+| `admin_not_enabled` | The admin interface is not enabled. | Admin disabled message |
+| `admin_enable_hint` | Set <code>WEB_ADMIN_ENABLED=true</code> to enable admin features. | Configuration hint (HTML allowed) |
+| `auth_required` | Authentication Required | Auth required heading |
+| `auth_required_description` | You must sign in to access the admin interface. | Auth required description |
+| `welcome` | Welcome to the admin panel. | Admin welcome message |
+| `members_description` | Manage network members and operators. | Members card description |
+| `tags_description` | Manage custom tags and metadata for network nodes. | Tags card description |
+
+### 17. `admin_members`
+
+Admin members page:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `network_members` | Network Members ({{count}}) | Page heading with count |
+| `member_id` | Member ID | Member ID field label |
+| `member_id_hint` | Unique identifier (letters, numbers, underscore) | Member ID input hint |
+| `empty_state_hint` | Click "Add Member" to create the first member. | Empty state hint |
+
+**Note:** Confirmation and success messages use `common.*` patterns.
+
+### 18. `admin_node_tags`
+
+Admin node tags page:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `select_node` | Select Node | Section heading |
+| `select_node_placeholder` | -- Select a node -- | Dropdown placeholder |
+| `load_tags` | Load Tags | Load button |
+| `move_warning` | This will move the tag from the current node to the destination node. | Move operation warning |
+| `copy_all` | Copy All | Copy all button |
+| `copy_all_info` | Tags that already exist on the destination node will be skipped. Original tags remain on this node. | Copy operation info |
+| `delete_all` | Delete All | Delete all button |
+| `delete_all_warning` | All tags will be permanently deleted. | Delete all warning |
+| `destination_node` | Destination Node | Destination node field |
+| `tag_key` | Tag Key | Tag key field |
+| `for_this_node` | for this node | Suffix for "No tags found for this node" |
+| `empty_state_hint` | Add a new tag below. | Empty state hint |
+| `select_a_node` | Select a Node | Empty state heading |
+| `select_a_node_description` | Choose a node from the dropdown above to view and manage its tags. | Empty state description |
+| `copied_entities` | Copied {{copied}} tag(s), skipped {{skipped}} | Copy operation result message |
+
+**Note:** Titles, confirmations, and success messages use `common.*` patterns.
+
+### 19. `footer`
+
+Footer content:
+
+| Key | English | Context |
+|-----|---------|---------|
+| `powered_by` | Powered by | "Powered by" attribution |
+
+## Translation Tips
+
+1. **Preserve HTML tags:** Some strings contain `<code>`, `<strong>`, or `<br/>` tags - keep these intact.
+
+2. **Preserve variables:** Keep `{{variable}}` placeholders exactly as-is, only translate surrounding text.
+
+3. **Entity composition:** Many translations reference `entities.*` keys. When translating entities, consider how they'll work in composite patterns (e.g., "Add {{entity}}" should make sense with "Node", "Tag", etc.).
+
+4. **Capitalization:**
+   - Entity names should follow your language's capitalization rules for UI elements
+   - Inline labels (with colons) typically use sentence case
+   - Table headers typically use title case
+   - Action buttons can vary by language convention
+
+5. **Colons:** Keys ending in `_label` include colons in English. Adjust punctuation to match your language's conventions for inline labels.
+
+6. **Plurals:** Some languages have complex plural rules. You may need to add plural variants for `{{count}}` patterns. Consult the i18n library documentation for plural support.
+
+7. **Length:** UI space is limited. Try to keep translations concise, especially for button labels and table headers.
+
+8. **Brand names:** Preserve "MeshCore", "GitHub", "YouTube" capitalization.
+
+## Testing Your Translation
+
+1. Create your translation file: `locales/xx.json` (where `xx` is your language code)
+2. Copy the structure from `en.json`
+3. Translate all values, preserving all variables and HTML
+4. Test in the application by setting the language
+5. Check all pages for:
+   - Text overflow/truncation
+   - Proper variable interpolation
+   - Natural phrasing in context
+
+## Getting Help
+
+If you're unsure about the context of a translation key, check:
+1. The "Context" column in this reference
+2. The JavaScript files in `/src/meshcore_hub/web/static/js/spa/pages/`
+3. Grep for the key: `grep -r "t('section.key')" src/`

src/meshcore_hub/web/static/locales/nl.json

@@ -0,0 +1,216 @@
+{
+    "entities": {
+        "home": "Startpagina",
+        "dashboard": "Dashboard",
+        "nodes": "Knooppunten",
+        "node": "Knooppunt",
+        "node_detail": "Knooppuntdetails",
+        "advertisements": "Advertenties",
+        "advertisement": "Advertentie",
+        "messages": "Berichten",
+        "message": "Bericht",
+        "map": "Kaart",
+        "members": "Leden",
+        "member": "Lid",
+        "admin": "Beheer",
+        "tags": "Labels",
+        "tag": "Label"
+    },
+    "common": {
+        "filter": "Filter",
+        "clear": "Wissen",
+        "clear_filters": "Filters wissen",
+        "search": "Zoeken",
+        "cancel": "Annuleren",
+        "delete": "Verwijderen",
+        "edit": "Bewerken",
+        "move": "Verplaatsen",
+        "save": "Opslaan",
+        "save_changes": "Wijzigingen opslaan",
+        "add": "Toevoegen",
+        "add_entity": "{{entity}} toevoegen",
+        "add_new_entity": "Nieuwe {{entity}} toevoegen",
+        "edit_entity": "{{entity}} bewerken",
+        "delete_entity": "{{entity}} verwijderen",
+        "delete_all_entity": "Alle {{entity}} verwijderen",
+        "move_entity": "{{entity}} verplaatsen",
+        "move_entity_to_another_node": "{{entity}} naar ander knooppunt verplaatsen",
+        "copy_entity": "{{entity}} kopiëren",
+        "copy_all_entity_to_another_node": "Alle {{entity}} naar ander knooppunt kopiëren",
+        "view_entity": "{{entity}} bekijken",
+        "recent_entity": "Recente {{entity}}",
+        "total_entity": "Totaal {{entity}}",
+        "all_entity": "Alle {{entity}}",
+        "no_entity_found": "Geen {{entity}} gevonden",
+        "no_entity_recorded": "Geen {{entity}} geregistreerd",
+        "no_entity_defined": "Geen {{entity}} gedefinieerd",
+        "no_entity_in_database": "Geen {{entity}} in database",
+        "no_entity_configured": "Geen {{entity}} geconfigureerd",
+        "no_entity_yet": "Nog geen {{entity}}",
+        "entity_not_found_details": "{{entity}} niet gevonden: {{details}}",
+        "page_not_found": "Pagina niet gevonden",
+        "delete_entity_confirm": "Weet u zeker dat u {{entity}} <strong>{{name}}</strong> wilt verwijderen?",
+        "delete_all_entity_confirm": "Weet u zeker dat u alle {{count}} {{entity}} van <strong>{{name}}</strong> wilt verwijderen?",
+        "cannot_be_undone": "Deze actie kan niet ongedaan worden gemaakt.",
+        "entity_added_success": "{{entity}} succesvol toegevoegd",
+        "entity_updated_success": "{{entity}} succesvol bijgewerkt",
+        "entity_deleted_success": "{{entity}} succesvol verwijderd",
+        "entity_moved_success": "{{entity}} succesvol verplaatst",
+        "all_entity_deleted_success": "Alle {{entity}} succesvol verwijderd",
+        "copy_all_entity_description": "Kopieer alle {{count}} {{entity}} van <strong>{{name}}</strong> naar een ander knooppunt.",
+        "previous": "Vorige",
+        "next": "Volgende",
+        "go_home": "Naar startpagina",
+        "loading": "Laden...",
+        "error": "Fout",
+        "failed_to_load_page": "Pagina laden mislukt",
+        "total": "{{count}} totaal",
+        "shown": "{{count}} weergegeven",
+        "count_entity": "{{count}} {{entity}}",
+        "type": "Type",
+        "name": "Naam",
+        "key": "Sleutel",
+        "value": "Waarde",
+        "time": "Tijd",
+        "actions": "Acties",
+        "updated": "Bijgewerkt",
+        "sign_in": "Inloggen",
+        "sign_out": "Uitloggen",
+        "view_details": "Details bekijken",
+        "all_types": "Alle types",
+        "node_type": "Knooppunttype",
+        "show": "Toon",
+        "search_placeholder": "Zoek op naam, ID of publieke sleutel...",
+        "contact": "Contact",
+        "description": "Beschrijving",
+        "callsign": "Roepnaam",
+        "tags": "Labels",
+        "last_seen": "Laatst gezien",
+        "first_seen_label": "Eerst gezien:",
+        "last_seen_label": "Laatst gezien:",
+        "location": "Locatie",
+        "public_key": "Publieke sleutel",
+        "received": "Ontvangen",
+        "received_by": "Ontvangen door",
+        "receivers": "Ontvangers",
+        "from": "Van",
+        "close": "sluiten",
+        "unnamed": "Naamloos",
+        "unnamed_node": "Naamloos knooppunt"
+    },
+    "links": {
+        "website": "Website",
+        "github": "GitHub",
+        "discord": "Discord",
+        "youtube": "YouTube",
+        "profile": "Profiel"
+    },
+    "auto_refresh": {
+        "pause": "Pauzeer verversen",
+        "resume": "Hervat verversen"
+    },
+    "time": {
+        "days_ago": "{{count}}d geleden",
+        "hours_ago": "{{count}}u geleden",
+        "minutes_ago": "{{count}}m geleden",
+        "less_than_minute": "<1m geleden",
+        "last_7_days": "Laatste 7 dagen",
+        "per_day_last_7_days": "Per dag (laatste 7 dagen)",
+        "over_time_last_7_days": "In de tijd (laatste 7 dagen)",
+        "activity_per_day_last_7_days": "Activiteit per dag (laatste 7 dagen)"
+    },
+    "node_types": {
+        "chat": "Chat",
+        "repeater": "Repeater",
+        "room": "Ruimte",
+        "unknown": "Onbekend"
+    },
+    "home": {
+        "welcome_default": "Welkom bij het {{network_name}} mesh-netwerk dashboard. Monitor netwerkactiviteit, bekijk verbonden knooppunten en verken berichtgeschiedenis.",
+        "all_discovered_nodes": "Alle ontdekte knooppunten",
+        "network_info": "Netwerkinfo",
+        "network_activity": "Netwerkactiviteit",
+        "meshcore_attribution": "Ons lokale off-grid mesh-netwerk is mogelijk gemaakt door",
+        "frequency": "Frequentie",
+        "bandwidth": "Bandbreedte",
+        "spreading_factor": "Spreading Factor",
+        "coding_rate": "Coderingssnelheid",
+        "tx_power": "TX Vermogen"
+    },
+    "dashboard": {
+        "all_discovered_nodes": "Alle ontdekte knooppunten",
+        "recent_channel_messages": "Recente kanaalberichten",
+        "channel": "Kanaal {{number}}"
+    },
+    "nodes": {
+        "scan_to_add": "Scan om als contact toe te voegen"
+    },
+    "advertisements": {},
+    "messages": {
+        "type_direct": "Direct",
+        "type_channel": "Kanaal",
+        "type_contact": "Contact",
+        "type_public": "Publiek"
+    },
+    "map": {
+        "show_labels": "Toon labels",
+        "infrastructure_only": "Alleen infrastructuur",
+        "legend": "Legenda:",
+        "infrastructure": "Infrastructuur",
+        "public": "Publiek",
+        "nodes_on_map": "{{count}} knooppunten op kaart",
+        "nodes_none_have_coordinates": "{{count}} knooppunten (geen met coördinaten)",
+        "gps_description": "Knooppunten worden op de kaart geplaatst op basis van GPS-coördinaten uit knooppuntrapporten of handmatige labels.",
+        "owner": "Eigenaar:",
+        "role": "Rol:",
+        "select_destination_node": "-- Selecteer bestemmingsknooppunt --"
+    },
+    "members": {
+        "empty_state_description": "Om netwerkleden weer te geven, maak een members.yaml bestand aan in je seed-directory.",
+        "members_file_format": "Members bestandsformaat",
+        "members_file_description": "Maak een YAML-bestand aan op <code>$SEED_HOME/members.yaml</code> met de volgende structuur:",
+        "members_import_instructions": "Voer <code>meshcore-hub collector seed</code> uit om leden te importeren.<br/>Om knooppunten aan leden te koppelen, voeg een <code>member_id</code> label toe aan knooppunten in <code>node_tags.yaml</code>."
+    },
+    "not_found": {
+        "description": "De pagina die u zoekt bestaat niet of is verplaatst."
+    },
+    "custom_page": {
+        "failed_to_load": "Pagina laden mislukt"
+    },
+    "admin": {
+        "access_denied": "Toegang geweigerd",
+        "admin_not_enabled": "De beheerinterface is niet ingeschakeld.",
+        "admin_enable_hint": "Stel <code>WEB_ADMIN_ENABLED=true</code> in om beheerfuncties in te schakelen.",
+        "auth_required": "Authenticatie vereist",
+        "auth_required_description": "U moet inloggen om toegang te krijgen tot de beheerinterface.",
+        "welcome": "Welkom bij het beheerpaneel.",
+        "members_description": "Beheer netwerkleden en operators.",
+        "tags_description": "Beheer aangepaste labels en metadata voor netwerkknooppunten."
+    },
+    "admin_members": {
+        "network_members": "Netwerkleden ({{count}})",
+        "member_id": "Lid-ID",
+        "member_id_hint": "Unieke identificatie (letters, cijfers, underscore)",
+        "empty_state_hint": "Klik op \"Lid toevoegen\" om het eerste lid aan te maken."
+    },
+    "admin_node_tags": {
+        "select_node": "Selecteer knooppunt",
+        "select_node_placeholder": "-- Selecteer een knooppunt --",
+        "load_tags": "Labels laden",
+        "move_warning": "Dit verplaatst het label van het huidige knooppunt naar het bestemmingsknooppunt.",
+        "copy_all": "Alles kopiëren",
+        "copy_all_info": "Labels die al bestaan op het bestemmingsknooppunt worden overgeslagen. Originele labels blijven op dit knooppunt.",
+        "delete_all": "Alles verwijderen",
+        "delete_all_warning": "Alle labels worden permanent verwijderd.",
+        "destination_node": "Bestemmingsknooppunt",
+        "tag_key": "Label sleutel",
+        "for_this_node": "voor dit knooppunt",
+        "empty_state_hint": "Voeg hieronder een nieuw label toe.",
+        "select_a_node": "Selecteer een knooppunt",
+        "select_a_node_description": "Kies een knooppunt uit de vervolgkeuzelijst hierboven om de labels te bekijken en beheren.",
+        "copied_entities": "{{copied}} label(s) gekopieerd, {{skipped}} overgeslagen"
+    },
+    "footer": {
+        "powered_by": "Mogelijk gemaakt door"
+    }
+}

src/meshcore_hub/web/templates/spa.html

@@ -30,6 +30,12 @@
 
     <!-- Favicon -->
     <link rel="icon" type="image/svg+xml" href="{{ logo_url }}">
+    {% if not logo_invert_light %}
+    <style>
+        /* Keep custom network logos full-color in light mode */
+        [data-theme="light"] img[src="{{ logo_url }}"] { filter: none !important; }
+    </style>
+    {% endif %}
 
     <!-- Tailwind CSS with DaisyUI -->
     <link href="https://cdn.jsdelivr.net/npm/daisyui@4.4.19/dist/full.min.css" rel="stylesheet" type="text/css" />
@@ -39,7 +45,7 @@
     <link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css" />
 
     <!-- Custom application styles -->
-    <link rel="stylesheet" href="/static/css/app.css">
+    <link rel="stylesheet" href="/static/css/app.css?v={{ version }}">
 
     <!-- Import map for ES module dependencies -->
     <script type="importmap">
@@ -60,24 +66,24 @@
                     <svg xmlns="http://www.w3.org/2000/svg" class="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h8m-8 6h16" /></svg>
                 </div>
                 <ul tabindex="0" class="menu menu-sm dropdown-content mt-3 z-[1] p-2 shadow bg-base-100 rounded-box w-52">
-                    <li><a href="/" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6" /></svg> Home</a></li>
+                    <li><a href="/" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6" /></svg> {{ t('entities.home') }}</a></li>
                     {% if features.dashboard %}
-                    <li><a href="/dashboard" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-dashboard" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z" /></svg> Dashboard</a></li>
+                    <li><a href="/dashboard" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-dashboard" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z" /></svg> {{ t('entities.dashboard') }}</a></li>
                     {% endif %}
                     {% if features.nodes %}
-                    <li><a href="/nodes" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-nodes" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10" /></svg> Nodes</a></li>
+                    <li><a href="/nodes" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-nodes" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10" /></svg> {{ t('entities.nodes') }}</a></li>
                     {% endif %}
                     {% if features.advertisements %}
-                    <li><a href="/advertisements" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-adverts" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5.882V19.24a1.76 1.76 0 01-3.417.592l-2.147-6.15M18 13a3 3 0 100-6M5.436 13.683A4.001 4.001 0 017 6h1.832c4.1 0 7.625-1.234 9.168-3v14c-1.543-1.766-5.067-3-9.168-3H7a3.988 3.988 0 01-1.564-.317z" /></svg> Advertisements</a></li>
+                    <li><a href="/advertisements" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-adverts" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5.882V19.24a1.76 1.76 0 01-3.417.592l-2.147-6.15M18 13a3 3 0 100-6M5.436 13.683A4.001 4.001 0 017 6h1.832c4.1 0 7.625-1.234 9.168-3v14c-1.543-1.766-5.067-3-9.168-3H7a3.988 3.988 0 01-1.564-.317z" /></svg> {{ t('entities.advertisements') }}</a></li>
                     {% endif %}
                     {% if features.messages %}
-                    <li><a href="/messages" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-messages" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 10h.01M12 10h.01M16 10h.01M9 16H5a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v8a2 2 0 01-2 2h-5l-5 5v-5z" /></svg> Messages</a></li>
+                    <li><a href="/messages" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-messages" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 10h.01M12 10h.01M16 10h.01M9 16H5a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v8a2 2 0 01-2 2h-5l-5 5v-5z" /></svg> {{ t('entities.messages') }}</a></li>
                     {% endif %}
                     {% if features.map %}
-                    <li><a href="/map" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-map" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 20l-5.447-2.724A1 1 0 013 16.382V5.618a1 1 0 011.447-.894L9 7m0 13l6-3m-6 3V7m6 10l4.553 2.276A1 1 0 0021 18.382V7.618a1 1 0 00-.553-.894L15 4m0 13V4m0 0L9 7" /></svg> Map</a></li>
+                    <li><a href="/map" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-map" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 20l-5.447-2.724A1 1 0 013 16.382V5.618a1 1 0 011.447-.894L9 7m0 13l6-3m-6 3V7m6 10l4.553 2.276A1 1 0 0021 18.382V7.618a1 1 0 00-.553-.894L15 4m0 13V4m0 0L9 7" /></svg> {{ t('entities.map') }}</a></li>
                     {% endif %}
                     {% if features.members %}
-                    <li><a href="/members" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-members" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4.354a4 4 0 110 5.292M15 21H3v-1a6 6 0 0112 0v1zm0 0h6v-1a6 6 0 00-9-5.197M13 7a4 4 0 11-8 0 4 4 0 018 0z" /></svg> Members</a></li>
+                    <li><a href="/members" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-members" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4.354a4 4 0 110 5.292M15 21H3v-1a6 6 0 0112 0v1zm0 0h6v-1a6 6 0 00-9-5.197M13 7a4 4 0 11-8 0 4 4 0 018 0z" /></svg> {{ t('entities.members') }}</a></li>
                     {% endif %}
                     {% if features.pages %}
                     {% for page in custom_pages %}
@@ -87,30 +93,30 @@
                 </ul>
             </div>
             <a href="/" class="btn btn-ghost text-xl">
-                <img src="{{ logo_url }}" alt="{{ network_name }}" class="theme-logo h-6 w-6 mr-2" />
+                <img src="{{ logo_url }}" alt="{{ network_name }}" class="theme-logo{% if logo_invert_light %} theme-logo--invert-light{% endif %} h-6 w-6 mr-2" />
                 {{ network_name }}
             </a>
         </div>
         <div class="navbar-center hidden lg:flex">
             <ul class="menu menu-horizontal px-1">
-                <li><a href="/" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6" /></svg> Home</a></li>
+                <li><a href="/" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6" /></svg> {{ t('entities.home') }}</a></li>
                 {% if features.dashboard %}
-                <li><a href="/dashboard" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-dashboard" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z" /></svg> Dashboard</a></li>
+                <li><a href="/dashboard" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-dashboard" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z" /></svg> {{ t('entities.dashboard') }}</a></li>
                 {% endif %}
                 {% if features.nodes %}
-                <li><a href="/nodes" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-nodes" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10" /></svg> Nodes</a></li>
+                <li><a href="/nodes" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-nodes" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10" /></svg> {{ t('entities.nodes') }}</a></li>
                 {% endif %}
                 {% if features.advertisements %}
-                <li><a href="/advertisements" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-adverts" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5.882V19.24a1.76 1.76 0 01-3.417.592l-2.147-6.15M18 13a3 3 0 100-6M5.436 13.683A4.001 4.001 0 017 6h1.832c4.1 0 7.625-1.234 9.168-3v14c-1.543-1.766-5.067-3-9.168-3H7a3.988 3.988 0 01-1.564-.317z" /></svg> Advertisements</a></li>
+                <li><a href="/advertisements" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-adverts" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 5.882V19.24a1.76 1.76 0 01-3.417.592l-2.147-6.15M18 13a3 3 0 100-6M5.436 13.683A4.001 4.001 0 017 6h1.832c4.1 0 7.625-1.234 9.168-3v14c-1.543-1.766-5.067-3-9.168-3H7a3.988 3.988 0 01-1.564-.317z" /></svg> {{ t('entities.advertisements') }}</a></li>
                 {% endif %}
                 {% if features.messages %}
-                <li><a href="/messages" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-messages" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 10h.01M12 10h.01M16 10h.01M9 16H5a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v8a2 2 0 01-2 2h-5l-5 5v-5z" /></svg> Messages</a></li>
+                <li><a href="/messages" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-messages" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 10h.01M12 10h.01M16 10h.01M9 16H5a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v8a2 2 0 01-2 2h-5l-5 5v-5z" /></svg> {{ t('entities.messages') }}</a></li>
                 {% endif %}
                 {% if features.map %}
-                <li><a href="/map" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-map" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 20l-5.447-2.724A1 1 0 013 16.382V5.618a1 1 0 011.447-.894L9 7m0 13l6-3m-6 3V7m6 10l4.553 2.276A1 1 0 0021 18.382V7.618a1 1 0 00-.553-.894L15 4m0 13V4m0 0L9 7" /></svg> Map</a></li>
+                <li><a href="/map" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-map" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 20l-5.447-2.724A1 1 0 013 16.382V5.618a1 1 0 011.447-.894L9 7m0 13l6-3m-6 3V7m6 10l4.553 2.276A1 1 0 0021 18.382V7.618a1 1 0 00-.553-.894L15 4m0 13V4m0 0L9 7" /></svg> {{ t('entities.map') }}</a></li>
                 {% endif %}
                 {% if features.members %}
-                <li><a href="/members" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-members" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4.354a4 4 0 110 5.292M15 21H3v-1a6 6 0 0112 0v1zm0 0h6v-1a6 6 0 00-9-5.197M13 7a4 4 0 11-8 0 4 4 0 018 0z" /></svg> Members</a></li>
+                <li><a href="/members" data-nav-link><svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4 nav-icon-members" fill="none" viewBox="0 0 24 24" stroke="currentColor"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4.354a4 4 0 110 5.292M15 21H3v-1a6 6 0 0112 0v1zm0 0h6v-1a6 6 0 00-9-5.197M13 7a4 4 0 11-8 0 4 4 0 018 0z" /></svg> {{ t('entities.members') }}</a></li>
                 {% endif %}
                 {% if features.pages %}
                 {% for page in custom_pages %}
@@ -150,18 +156,18 @@
                 {% endif %}
                 {% if network_contact_email and network_contact_discord %} | {% endif %}
                 {% if network_contact_discord %}
-                <a href="{{ network_contact_discord }}" target="_blank" rel="noopener noreferrer" class="link link-hover">Discord</a>
+                <a href="{{ network_contact_discord }}" target="_blank" rel="noopener noreferrer" class="link link-hover">{{ t('links.discord') }}</a>
                 {% endif %}
                 {% if (network_contact_email or network_contact_discord) and network_contact_github %} | {% endif %}
                 {% if network_contact_github %}
-                <a href="{{ network_contact_github }}" target="_blank" rel="noopener noreferrer" class="link link-hover">GitHub</a>
+                <a href="{{ network_contact_github }}" target="_blank" rel="noopener noreferrer" class="link link-hover">{{ t('links.github') }}</a>
                 {% endif %}
                 {% if (network_contact_email or network_contact_discord or network_contact_github) and network_contact_youtube %} | {% endif %}
                 {% if network_contact_youtube %}
-                <a href="{{ network_contact_youtube }}" target="_blank" rel="noopener noreferrer" class="link link-hover">YouTube</a>
+                <a href="{{ network_contact_youtube }}" target="_blank" rel="noopener noreferrer" class="link link-hover">{{ t('links.youtube') }}</a>
                 {% endif %}
             </p>
-            <p class="text-xs opacity-50 mt-2">{% if admin_enabled %}<a href="/a/" class="link link-hover">Admin</a> | {% endif %}Powered by <a href="https://github.com/ipnet-mesh/meshcore-hub" target="_blank" rel="noopener noreferrer" class="link link-hover">MeshCore Hub</a> {{ version }}</p>
+            <p class="text-xs opacity-50 mt-2">{% if admin_enabled %}<a href="/a/" class="link link-hover">{{ t('entities.admin') }}</a> | {% endif %}{{ t('footer.powered_by') }} <a href="https://github.com/ipnet-mesh/meshcore-hub" target="_blank" rel="noopener noreferrer" class="link link-hover">MeshCore Hub</a> {{ version }}</p>
         </aside>
     </footer>
 
@@ -175,7 +181,7 @@
     <script src="https://cdn.jsdelivr.net/npm/qrcodejs@1.0.0/qrcode.min.js"></script>
 
     <!-- Chart helper functions -->
-    <script src="/static/js/charts.js"></script>
+    <script src="/static/js/charts.js?v={{ version }}"></script>
 
     <!-- Embedded app configuration -->
     <script>
@@ -199,6 +205,6 @@
     </script>
 
     <!-- SPA Application (ES Module) -->
-    <script type="module" src="/static/js/spa/app.js"></script>
+    <script type="module" src="/static/js/spa/app.js?v={{ version }}"></script>
 </body>
 </html>

tests/test_api/conftest.py

@@ -2,6 +2,7 @@
 
 import os
 import tempfile
+from contextlib import contextmanager
 from datetime import datetime, timezone
 from unittest.mock import MagicMock, patch
 
@@ -81,6 +82,20 @@ def mock_db_manager(api_db_engine):
     manager = MagicMock(spec=DatabaseManager)
     Session = sessionmaker(bind=api_db_engine)
     manager.get_session = lambda: Session()
+
+    @contextmanager
+    def _session_scope():
+        session = Session()
+        try:
+            yield session
+            session.commit()
+        except Exception:
+            session.rollback()
+            raise
+        finally:
+            session.close()
+
+    manager.session_scope = _session_scope
     return manager
 
 

tests/test_api/test_auth.py

@@ -1,8 +1,28 @@
-"""Tests for API authentication."""
+"""Tests for API authentication.
+
+Verifies that constant-time key comparison (hmac.compare_digest) works
+correctly with no behavioral regressions from the original == operator.
+"""
+
+import base64
 
 
-class TestAuthenticationFlow:
-    """Tests for authentication behavior."""
+def _make_basic_auth(username: str, password: str) -> str:
+    """Create a Basic auth header value."""
+    credentials = base64.b64encode(f"{username}:{password}".encode()).decode()
+    return f"Basic {credentials}"
+
+
+def _clear_metrics_cache() -> None:
+    """Clear the metrics module cache."""
+    from meshcore_hub.api.metrics import _cache
+
+    _cache["output"] = b""
+    _cache["expires_at"] = 0.0
+
+
+class TestReadAuthentication:
+    """Tests for read-level authentication (require_read)."""
 
     def test_no_auth_when_keys_not_configured(self, client_no_auth):
         """Test that no auth is required when keys are not configured."""
@@ -30,46 +50,47 @@ class TestAuthenticationFlow:
         )
         assert response.status_code == 200
 
+    def test_read_key_accepted_on_multiple_endpoints(self, client_with_auth):
+        """Test that read key is accepted across different read endpoints."""
+        for endpoint in ["/api/v1/nodes", "/api/v1/messages"]:
+            response = client_with_auth.get(
+                endpoint,
+                headers={"Authorization": "Bearer test-read-key"},
+            )
+            assert response.status_code == 200, f"Read key rejected on {endpoint}"
+
     def test_read_endpoints_accept_admin_key(self, client_with_auth):
-        """Test that read endpoints accept admin key."""
+        """Test that admin key also grants read access."""
         response = client_with_auth.get(
             "/api/v1/nodes",
             headers={"Authorization": "Bearer test-admin-key"},
         )
         assert response.status_code == 200
 
-    def test_admin_endpoints_reject_read_key(self, client_with_auth):
-        """Test that admin endpoints reject read key."""
-        response = client_with_auth.post(
-            "/api/v1/commands/send-message",
-            json={
-                "destination": "abc123def456abc123def456abc123de",
-                "text": "Test",
-            },
-            headers={"Authorization": "Bearer test-read-key"},
-        )
-        assert response.status_code == 403
+    def test_admin_key_grants_read_on_multiple_endpoints(self, client_with_auth):
+        """Test that admin key grants read access across different endpoints."""
+        for endpoint in ["/api/v1/nodes", "/api/v1/messages"]:
+            response = client_with_auth.get(
+                endpoint,
+                headers={"Authorization": "Bearer test-admin-key"},
+            )
+            assert (
+                response.status_code == 200
+            ), f"Admin key rejected on read endpoint {endpoint}"
 
-    def test_admin_endpoints_accept_admin_key(self, client_with_auth):
-        """Test that admin endpoints accept admin key."""
-        response = client_with_auth.post(
-            "/api/v1/commands/send-message",
-            json={
-                "destination": "abc123def456abc123def456abc123de",
-                "text": "Test",
-            },
-            headers={"Authorization": "Bearer test-admin-key"},
-        )
-        assert response.status_code == 200
-
-    def test_invalid_key_rejected(self, client_with_auth):
-        """Test that invalid keys are rejected."""
+    def test_invalid_key_rejected_on_read_endpoint(self, client_with_auth):
+        """Test that invalid keys are rejected with 401 on read endpoints."""
         response = client_with_auth.get(
             "/api/v1/nodes",
             headers={"Authorization": "Bearer invalid-key"},
         )
         assert response.status_code == 401
 
+    def test_no_auth_header_rejected_on_read_endpoint(self, client_with_auth):
+        """Test that missing auth header is rejected on read endpoints."""
+        response = client_with_auth.get("/api/v1/nodes")
+        assert response.status_code == 401
+
     def test_missing_bearer_prefix_rejected(self, client_with_auth):
         """Test that tokens without Bearer prefix are rejected."""
         response = client_with_auth.get(
@@ -87,6 +108,124 @@ class TestAuthenticationFlow:
         assert response.status_code == 401
 
 
+class TestAdminAuthentication:
+    """Tests for admin-level authentication (require_admin)."""
+
+    def test_admin_endpoints_accept_admin_key(self, client_with_auth):
+        """Test that admin endpoints accept admin key."""
+        response = client_with_auth.post(
+            "/api/v1/commands/send-message",
+            json={
+                "destination": "abc123def456abc123def456abc123de",
+                "text": "Test",
+            },
+            headers={"Authorization": "Bearer test-admin-key"},
+        )
+        assert response.status_code == 200
+
+    def test_admin_endpoints_reject_read_key(self, client_with_auth):
+        """Test that admin endpoints reject read key with 403."""
+        response = client_with_auth.post(
+            "/api/v1/commands/send-message",
+            json={
+                "destination": "abc123def456abc123def456abc123de",
+                "text": "Test",
+            },
+            headers={"Authorization": "Bearer test-read-key"},
+        )
+        assert response.status_code == 403
+
+    def test_admin_endpoints_reject_invalid_key(self, client_with_auth):
+        """Test that admin endpoints reject invalid keys with 403."""
+        response = client_with_auth.post(
+            "/api/v1/commands/send-message",
+            json={
+                "destination": "abc123def456abc123def456abc123de",
+                "text": "Test",
+            },
+            headers={"Authorization": "Bearer completely-wrong-key"},
+        )
+        assert response.status_code == 403
+
+    def test_admin_endpoints_reject_no_auth_header(self, client_with_auth):
+        """Test that admin endpoints reject missing auth header with 401."""
+        response = client_with_auth.post(
+            "/api/v1/commands/send-message",
+            json={
+                "destination": "abc123def456abc123def456abc123de",
+                "text": "Test",
+            },
+        )
+        assert response.status_code == 401
+
+
+class TestMetricsAuthentication:
+    """Tests for metrics endpoint authentication (Basic auth with hmac.compare_digest)."""
+
+    def test_metrics_no_auth_when_no_read_key(self, client_no_auth):
+        """Test that metrics requires no auth when no read key is configured."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+
+    def test_metrics_accepts_valid_basic_auth(self, client_with_auth):
+        """Test that metrics accepts correct Basic credentials."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={"Authorization": _make_basic_auth("metrics", "test-read-key")},
+        )
+        assert response.status_code == 200
+
+    def test_metrics_rejects_no_auth_when_key_set(self, client_with_auth):
+        """Test 401 when read key is set but no auth provided."""
+        _clear_metrics_cache()
+        response = client_with_auth.get("/metrics")
+        assert response.status_code == 401
+        assert "WWW-Authenticate" in response.headers
+
+    def test_metrics_rejects_wrong_password(self, client_with_auth):
+        """Test that metrics rejects incorrect password."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={"Authorization": _make_basic_auth("metrics", "wrong-key")},
+        )
+        assert response.status_code == 401
+
+    def test_metrics_rejects_wrong_username(self, client_with_auth):
+        """Test that metrics rejects incorrect username."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={"Authorization": _make_basic_auth("admin", "test-read-key")},
+        )
+        assert response.status_code == 401
+
+    def test_metrics_rejects_bearer_auth(self, client_with_auth):
+        """Test that Bearer auth does not work for metrics."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={"Authorization": "Bearer test-read-key"},
+        )
+        assert response.status_code == 401
+
+    def test_metrics_rejects_admin_key_as_password(self, client_with_auth):
+        """Test that admin key is not accepted as metrics password.
+
+        Metrics uses only the read key for Basic auth, not the admin key.
+        """
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={
+                "Authorization": _make_basic_auth("metrics", "test-admin-key"),
+            },
+        )
+        assert response.status_code == 401
+
+
 class TestHealthEndpoint:
     """Tests for health check endpoint."""
 

tests/test_api/test_dashboard.py

@@ -35,35 +35,71 @@ class TestDashboardStats:
         assert data["total_advertisements"] == 1
 
 
-class TestDashboardHtml:
-    """Tests for GET /dashboard endpoint."""
+class TestDashboardHtmlRemoved:
+    """Tests that legacy HTML dashboard endpoint has been removed."""
 
-    def test_dashboard_html_response(self, client_no_auth):
-        """Test dashboard returns HTML."""
+    def test_dashboard_html_endpoint_removed(self, client_no_auth):
+        """Test that GET /dashboard no longer returns HTML (legacy endpoint removed)."""
         response = client_no_auth.get("/api/v1/dashboard")
-        assert response.status_code == 200
-        assert "text/html" in response.headers["content-type"]
-        assert "<!DOCTYPE html>" in response.text
-        assert "MeshCore Hub Dashboard" in response.text
+        assert response.status_code in (404, 405)
 
-    def test_dashboard_contains_stats(
-        self, client_no_auth, sample_node, sample_message
-    ):
-        """Test dashboard HTML contains stat values."""
-        response = client_no_auth.get("/api/v1/dashboard")
-        assert response.status_code == 200
-        # Check that stats are present
-        assert "Total Nodes" in response.text
-        assert "Active Nodes" in response.text
-        assert "Total Messages" in response.text
+    def test_dashboard_html_endpoint_removed_trailing_slash(self, client_no_auth):
+        """Test that GET /dashboard/ also returns 404/405."""
+        response = client_no_auth.get("/api/v1/dashboard/")
+        assert response.status_code in (404, 405)
 
-    def test_dashboard_contains_recent_data(self, client_no_auth, sample_node):
-        """Test dashboard HTML contains recent nodes."""
-        response = client_no_auth.get("/api/v1/dashboard")
+
+class TestDashboardAuthenticatedJsonRoutes:
+    """Tests that dashboard JSON sub-routes return valid JSON with authentication."""
+
+    def test_stats_returns_json_when_authenticated(self, client_with_auth):
+        """Test GET /dashboard/stats returns 200 with valid JSON when authenticated."""
+        response = client_with_auth.get(
+            "/api/v1/dashboard/stats",
+            headers={"Authorization": "Bearer test-read-key"},
+        )
         assert response.status_code == 200
-        assert "Recent Nodes" in response.text
-        # The node name should appear in the table
-        assert sample_node.name in response.text
+        data = response.json()
+        assert "total_nodes" in data
+        assert "active_nodes" in data
+        assert "total_messages" in data
+        assert "total_advertisements" in data
+
+    def test_activity_returns_json_when_authenticated(self, client_with_auth):
+        """Test GET /dashboard/activity returns 200 with valid JSON when authenticated."""
+        response = client_with_auth.get(
+            "/api/v1/dashboard/activity",
+            headers={"Authorization": "Bearer test-read-key"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert "days" in data
+        assert "data" in data
+        assert isinstance(data["data"], list)
+
+    def test_message_activity_returns_json_when_authenticated(self, client_with_auth):
+        """Test GET /dashboard/message-activity returns 200 with valid JSON when authenticated."""
+        response = client_with_auth.get(
+            "/api/v1/dashboard/message-activity",
+            headers={"Authorization": "Bearer test-read-key"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert "days" in data
+        assert "data" in data
+        assert isinstance(data["data"], list)
+
+    def test_node_count_returns_json_when_authenticated(self, client_with_auth):
+        """Test GET /dashboard/node-count returns 200 with valid JSON when authenticated."""
+        response = client_with_auth.get(
+            "/api/v1/dashboard/node-count",
+            headers={"Authorization": "Bearer test-read-key"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert "days" in data
+        assert "data" in data
+        assert isinstance(data["data"], list)
 
 
 class TestDashboardActivity:

tests/test_api/test_metrics.py

@@ -0,0 +1,346 @@
+"""Tests for Prometheus metrics endpoint."""
+
+import base64
+from datetime import datetime, timezone
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+from sqlalchemy.orm import sessionmaker
+
+from meshcore_hub.api.app import create_app
+from meshcore_hub.api.dependencies import (
+    get_db_manager,
+    get_db_session,
+    get_mqtt_client,
+)
+from meshcore_hub.common.models import Node, NodeTag
+
+
+def _make_basic_auth(username: str, password: str) -> str:
+    """Create a Basic auth header value."""
+    credentials = base64.b64encode(f"{username}:{password}".encode()).decode()
+    return f"Basic {credentials}"
+
+
+def _clear_metrics_cache() -> None:
+    """Clear the metrics module cache."""
+    from meshcore_hub.api.metrics import _cache
+
+    _cache["output"] = b""
+    _cache["expires_at"] = 0.0
+
+
+class TestMetricsEndpoint:
+    """Tests for basic metrics endpoint availability."""
+
+    def test_metrics_endpoint_available(self, client_no_auth):
+        """Test that /metrics endpoint returns 200."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+
+    def test_metrics_content_type(self, client_no_auth):
+        """Test that metrics returns correct content type."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert "text/plain" in response.headers["content-type"]
+
+    def test_metrics_contains_expected_names(self, client_no_auth):
+        """Test that metrics output contains expected metric names."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        content = response.text
+        assert "meshcore_info" in content
+        assert "meshcore_nodes_total" in content
+        assert "meshcore_nodes_active" in content
+        assert "meshcore_advertisements_total" in content
+        assert "meshcore_telemetry_total" in content
+        assert "meshcore_trace_paths_total" in content
+        assert "meshcore_members_total" in content
+
+    def test_metrics_info_has_version(self, client_no_auth):
+        """Test that meshcore_info includes version label."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert 'meshcore_info{version="' in response.text
+
+
+class TestMetricsAuth:
+    """Tests for metrics endpoint authentication."""
+
+    def test_no_auth_when_no_read_key(self, client_no_auth):
+        """Test that no auth is required when no read key is configured."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+
+    def test_401_when_read_key_set_no_auth(self, client_with_auth):
+        """Test 401 when read key is set but no auth provided."""
+        _clear_metrics_cache()
+        response = client_with_auth.get("/metrics")
+        assert response.status_code == 401
+        assert "WWW-Authenticate" in response.headers
+
+    def test_success_with_correct_basic_auth(self, client_with_auth):
+        """Test successful auth with correct Basic credentials."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={"Authorization": _make_basic_auth("metrics", "test-read-key")},
+        )
+        assert response.status_code == 200
+
+    def test_fail_with_wrong_password(self, client_with_auth):
+        """Test 401 with incorrect password."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={"Authorization": _make_basic_auth("metrics", "wrong-key")},
+        )
+        assert response.status_code == 401
+
+    def test_fail_with_wrong_username(self, client_with_auth):
+        """Test 401 with incorrect username."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={
+                "Authorization": _make_basic_auth("admin", "test-read-key"),
+            },
+        )
+        assert response.status_code == 401
+
+    def test_fail_with_bearer_auth(self, client_with_auth):
+        """Test that Bearer auth does not work for metrics."""
+        _clear_metrics_cache()
+        response = client_with_auth.get(
+            "/metrics",
+            headers={"Authorization": "Bearer test-read-key"},
+        )
+        assert response.status_code == 401
+
+
+class TestMetricsData:
+    """Tests for metrics data accuracy."""
+
+    def test_nodes_total_reflects_database(self, client_no_auth, sample_node):
+        """Test that nodes_total matches actual node count."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        # Should have at least 1 node
+        assert "meshcore_nodes_total 1.0" in response.text
+
+    def test_messages_total_reflects_database(self, client_no_auth, sample_message):
+        """Test that messages_total reflects database state."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert "meshcore_messages_total" in response.text
+
+    def test_advertisements_total_reflects_database(
+        self, client_no_auth, sample_advertisement
+    ):
+        """Test that advertisements_total reflects database state."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert "meshcore_advertisements_total 1.0" in response.text
+
+    def test_members_total_reflects_database(self, client_no_auth, sample_member):
+        """Test that members_total reflects database state."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert "meshcore_members_total 1.0" in response.text
+
+    def test_nodes_by_type_has_labels(self, client_no_auth, sample_node):
+        """Test that nodes_by_type includes adv_type labels."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert 'meshcore_nodes_by_type{adv_type="REPEATER"}' in response.text
+
+    def test_telemetry_total_reflects_database(self, client_no_auth, sample_telemetry):
+        """Test that telemetry_total reflects database state."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert "meshcore_telemetry_total 1.0" in response.text
+
+    def test_trace_paths_total_reflects_database(
+        self, client_no_auth, sample_trace_path
+    ):
+        """Test that trace_paths_total reflects database state."""
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert "meshcore_trace_paths_total 1.0" in response.text
+
+    def test_node_last_seen_timestamp_present(self, api_db_session, client_no_auth):
+        """Test that node_last_seen_timestamp is present for nodes with last_seen."""
+        seen_at = datetime(2025, 6, 15, 12, 0, 0, tzinfo=timezone.utc)
+        node = Node(
+            public_key="lastseen1234lastseen1234lastseen",
+            name="Seen Node",
+            adv_type="REPEATER",
+            first_seen=seen_at,
+            last_seen=seen_at,
+        )
+        api_db_session.add(node)
+        api_db_session.commit()
+
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        # Labels are sorted alphabetically by prometheus_client
+        assert (
+            "meshcore_node_last_seen_timestamp_seconds"
+            '{adv_type="REPEATER",'
+            'node_name="Seen Node",'
+            'public_key="lastseen1234lastseen1234lastseen",'
+            'role=""}'
+        ) in response.text
+
+    def test_node_last_seen_timestamp_with_role(self, api_db_session, client_no_auth):
+        """Test that node_last_seen_timestamp includes role label from node tags."""
+        seen_at = datetime(2025, 6, 15, 12, 0, 0, tzinfo=timezone.utc)
+        node = Node(
+            public_key="rolenode1234rolenode1234rolenode",
+            name="Infra Node",
+            adv_type="REPEATER",
+            first_seen=seen_at,
+            last_seen=seen_at,
+        )
+        api_db_session.add(node)
+        api_db_session.flush()
+
+        tag = NodeTag(node_id=node.id, key="role", value="infra")
+        api_db_session.add(tag)
+        api_db_session.commit()
+
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert (
+            "meshcore_node_last_seen_timestamp_seconds"
+            '{adv_type="REPEATER",'
+            'node_name="Infra Node",'
+            'public_key="rolenode1234rolenode1234rolenode",'
+            'role="infra"}'
+        ) in response.text
+
+    def test_node_last_seen_timestamp_skips_null(self, api_db_session, client_no_auth):
+        """Test that nodes with last_seen=None are excluded from the metric."""
+        node = Node(
+            public_key="neverseen1234neverseen1234neversx",
+            name="Never Seen",
+            adv_type="CLIENT",
+            first_seen=datetime.now(timezone.utc),
+            last_seen=None,
+        )
+        api_db_session.add(node)
+        api_db_session.commit()
+
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert "neverseen1234neverseen1234neversx" not in response.text
+
+    def test_node_last_seen_timestamp_multiple_nodes(
+        self, api_db_session, client_no_auth
+    ):
+        """Test that multiple nodes each get their own labeled time series."""
+        seen1 = datetime(2025, 6, 15, 10, 0, 0, tzinfo=timezone.utc)
+        seen2 = datetime(2025, 6, 15, 11, 0, 0, tzinfo=timezone.utc)
+        node1 = Node(
+            public_key="multinode1multinode1multinode1mu",
+            name="Node One",
+            adv_type="REPEATER",
+            first_seen=seen1,
+            last_seen=seen1,
+        )
+        node2 = Node(
+            public_key="multinode2multinode2multinode2mu",
+            name="Node Two",
+            adv_type="CHAT",
+            first_seen=seen2,
+            last_seen=seen2,
+        )
+        api_db_session.add_all([node1, node2])
+        api_db_session.commit()
+
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert ('public_key="multinode1multinode1multinode1mu"') in response.text
+        assert ('public_key="multinode2multinode2multinode2mu"') in response.text
+
+    def test_nodes_with_location(self, api_db_session, client_no_auth):
+        """Test that nodes_with_location counts correctly."""
+        node = Node(
+            public_key="locationtest1234locationtest1234",
+            name="GPS Node",
+            adv_type="CHAT",
+            lat=37.7749,
+            lon=-122.4194,
+            first_seen=datetime.now(timezone.utc),
+            last_seen=datetime.now(timezone.utc),
+        )
+        api_db_session.add(node)
+        api_db_session.commit()
+
+        _clear_metrics_cache()
+        response = client_no_auth.get("/metrics")
+        assert response.status_code == 200
+        assert "meshcore_nodes_with_location 1.0" in response.text
+
+
+class TestMetricsDisabled:
+    """Tests for when metrics are disabled."""
+
+    def test_metrics_404_when_disabled(
+        self, test_db_path, api_db_engine, mock_mqtt, mock_db_manager
+    ):
+        """Test that /metrics returns 404 when disabled."""
+        db_url = f"sqlite:///{test_db_path}"
+
+        with patch("meshcore_hub.api.app._db_manager", mock_db_manager):
+            app = create_app(
+                database_url=db_url,
+                metrics_enabled=False,
+            )
+
+            Session = sessionmaker(bind=api_db_engine)
+
+            def override_get_db_manager(request=None):
+                return mock_db_manager
+
+            def override_get_db_session():
+                session = Session()
+                try:
+                    yield session
+                finally:
+                    session.close()
+
+            def override_get_mqtt_client(request=None):
+                return mock_mqtt
+
+            app.dependency_overrides[get_db_manager] = override_get_db_manager
+            app.dependency_overrides[get_db_session] = override_get_db_session
+            app.dependency_overrides[get_mqtt_client] = override_get_mqtt_client
+
+            client = TestClient(app, raise_server_exceptions=True)
+            response = client.get("/metrics")
+            assert response.status_code == 404
+
+
+class TestMetricsCache:
+    """Tests for metrics caching behavior."""
+
+    def test_cache_returns_same_output(self, client_no_auth):
+        """Test that cached responses return the same content."""
+        _clear_metrics_cache()
+        response1 = client_no_auth.get("/metrics")
+        response2 = client_no_auth.get("/metrics")
+        assert response1.text == response2.text

tests/test_api/test_nodes.py

@@ -102,6 +102,57 @@ class TestListNodesFilters:
         data = response.json()
         assert len(data["items"]) == 0
 
+    def test_filter_by_adv_type_matches_legacy_labels(
+        self, client_no_auth, api_db_session
+    ):
+        """Canonical adv_type filters match legacy LetsMesh adv_type values only."""
+        from datetime import datetime, timezone
+
+        from meshcore_hub.common.models import Node
+
+        repeater_node = Node(
+            public_key="ab" * 32,
+            adv_type="PyMC-Repeater",
+            first_seen=datetime.now(timezone.utc),
+        )
+        companion_node = Node(
+            public_key="cd" * 32,
+            adv_type="offline companion",
+            first_seen=datetime.now(timezone.utc),
+        )
+        room_node = Node(
+            public_key="ef" * 32,
+            adv_type="room server",
+            first_seen=datetime.now(timezone.utc),
+        )
+        name_only_room_node = Node(
+            public_key="12" * 32,
+            name="WAL-SE Room Server",
+            adv_type="unknown",
+            first_seen=datetime.now(timezone.utc),
+        )
+        api_db_session.add(repeater_node)
+        api_db_session.add(companion_node)
+        api_db_session.add(room_node)
+        api_db_session.add(name_only_room_node)
+        api_db_session.commit()
+
+        response = client_no_auth.get("/api/v1/nodes?adv_type=repeater")
+        assert response.status_code == 200
+        repeater_keys = {item["public_key"] for item in response.json()["items"]}
+        assert repeater_node.public_key in repeater_keys
+
+        response = client_no_auth.get("/api/v1/nodes?adv_type=companion")
+        assert response.status_code == 200
+        companion_keys = {item["public_key"] for item in response.json()["items"]}
+        assert companion_node.public_key in companion_keys
+
+        response = client_no_auth.get("/api/v1/nodes?adv_type=room")
+        assert response.status_code == 200
+        room_keys = {item["public_key"] for item in response.json()["items"]}
+        assert room_node.public_key in room_keys
+        assert name_only_room_node.public_key not in room_keys
+
     def test_filter_by_member_id(self, client_no_auth, sample_node_with_member_tag):
         """Test filtering nodes by member_id tag."""
         # Match alice

tests/test_api/test_trace_paths.py

@@ -2,6 +2,53 @@
 
 from datetime import datetime, timedelta, timezone
 
+from meshcore_hub.common.models import TracePath
+
+
+class TestMultibytePathHashes:
+    """Tests for multibyte path hash support in trace path API responses."""
+
+    def test_list_trace_paths_returns_multibyte_path_hashes(
+        self, client_no_auth, api_db_session
+    ):
+        """Test that GET /trace-paths returns multibyte path hashes faithfully."""
+        multibyte_hashes = ["4a2b", "b3fa"]
+        trace = TracePath(
+            initiator_tag=77777,
+            path_hashes=multibyte_hashes,
+            hop_count=2,
+            received_at=datetime.now(timezone.utc),
+        )
+        api_db_session.add(trace)
+        api_db_session.commit()
+        api_db_session.refresh(trace)
+
+        response = client_no_auth.get("/api/v1/trace-paths")
+        assert response.status_code == 200
+        data = response.json()
+        assert len(data["items"]) == 1
+        assert data["items"][0]["path_hashes"] == multibyte_hashes
+
+    def test_get_trace_path_returns_mixed_length_path_hashes(
+        self, client_no_auth, api_db_session
+    ):
+        """Test that GET /trace-paths/{id} returns mixed-length path hashes."""
+        mixed_hashes = ["4a", "b3fa", "02"]
+        trace = TracePath(
+            initiator_tag=88888,
+            path_hashes=mixed_hashes,
+            hop_count=3,
+            received_at=datetime.now(timezone.utc),
+        )
+        api_db_session.add(trace)
+        api_db_session.commit()
+        api_db_session.refresh(trace)
+
+        response = client_no_auth.get(f"/api/v1/trace-paths/{trace.id}")
+        assert response.status_code == 200
+        data = response.json()
+        assert data["path_hashes"] == mixed_hashes
+
 
 class TestListTracePaths:
     """Tests for GET /trace-paths endpoint."""

tests/test_collector/test_handlers/test_advertisement.py

@@ -71,6 +71,26 @@ class TestHandleAdvertisement:
         assert ad.public_key == "a" * 64
         assert ad.name == "TestNode"
 
+    def test_updates_node_location_fields(self, db_manager, db_session):
+        """Advertisement payload lat/lon updates node coordinates."""
+        payload = {
+            "public_key": "a" * 64,
+            "name": "LocNode",
+            "adv_type": "repeater",
+            "lat": 42.1234,
+            "lon": -71.9876,
+        }
+
+        handle_advertisement("b" * 64, "advertisement", payload, db_manager)
+
+        node = db_session.execute(
+            select(Node).where(Node.public_key == "a" * 64)
+        ).scalar_one_or_none()
+
+        assert node is not None
+        assert node.lat == 42.1234
+        assert node.lon == -71.9876
+
     def test_handles_missing_public_key(self, db_manager, db_session):
         """Test that missing public_key is handled gracefully."""
         payload = {

tests/test_collector/test_letsmesh_decoder.py

@@ -0,0 +1,138 @@
+"""Tests for LetsMesh packet decoder integration."""
+
+import subprocess
+from unittest.mock import patch
+
+from meshcore_hub.collector.letsmesh_decoder import LetsMeshPacketDecoder
+
+
+def test_decode_payload_returns_none_without_raw() -> None:
+    """Decoder returns None when packet has no raw hex."""
+    decoder = LetsMeshPacketDecoder(enabled=True)
+    assert decoder.decode_payload({"packet_type": 5}) is None
+
+
+def test_decode_payload_rejects_non_hex_raw_without_invoking_decoder() -> None:
+    """Decoder returns None and does not execute subprocess for invalid raw hex."""
+    decoder = LetsMeshPacketDecoder(enabled=True, command="meshcore-decoder")
+
+    with (
+        patch("meshcore_hub.collector.letsmesh_decoder.shutil.which", return_value="1"),
+        patch("meshcore_hub.collector.letsmesh_decoder.subprocess.run") as mock_run,
+    ):
+        assert decoder.decode_payload({"raw": "ZZ-not-hex"}) is None
+
+    mock_run.assert_not_called()
+
+
+def test_decode_payload_invokes_decoder_with_keys() -> None:
+    """Decoder command includes channel keys and returns parsed JSON."""
+    decoder = LetsMeshPacketDecoder(
+        enabled=True,
+        command="meshcore-decoder",
+        channel_keys=["0xABCDEF", "name=012345", "abcDEF"],
+        timeout_seconds=1.5,
+    )
+    completed = subprocess.CompletedProcess(
+        args=["meshcore-decoder"],
+        returncode=0,
+        stdout='{"payload":{"decoded":{"decrypted":{"message":"hello"}}}}',
+        stderr="",
+    )
+
+    with (
+        patch("meshcore_hub.collector.letsmesh_decoder.shutil.which", return_value="1"),
+        patch(
+            "meshcore_hub.collector.letsmesh_decoder.subprocess.run",
+            return_value=completed,
+        ) as mock_run,
+    ):
+        decoded = decoder.decode_payload({"raw": "A1B2C3"})
+
+    assert isinstance(decoded, dict)
+    payload = decoded.get("payload")
+    assert isinstance(payload, dict)
+    decoded_payload = payload.get("decoded")
+    assert isinstance(decoded_payload, dict)
+    decrypted = decoded_payload.get("decrypted")
+    assert isinstance(decrypted, dict)
+    assert decrypted.get("message") == "hello"
+    command = mock_run.call_args.args[0]
+    assert command == [
+        "meshcore-decoder",
+        "decode",
+        "A1B2C3",
+        "--json",
+        "--key",
+        "8B3387E9C5CDEA6AC9E5EDBAA115CD72",
+        "9CD8FCF22A47333B591D96A2B848B73F",
+        "ABCDEF",
+        "012345",
+    ]
+    assert mock_run.call_args.kwargs["timeout"] == 1.5
+
+
+def test_decode_payload_returns_none_for_decoder_error() -> None:
+    """Decoder returns None when decoder exits with failure."""
+    decoder = LetsMeshPacketDecoder(enabled=True, command="meshcore-decoder")
+    completed = subprocess.CompletedProcess(
+        args=["meshcore-decoder"],
+        returncode=1,
+        stdout="",
+        stderr="decode error",
+    )
+
+    with (
+        patch("meshcore_hub.collector.letsmesh_decoder.shutil.which", return_value="1"),
+        patch(
+            "meshcore_hub.collector.letsmesh_decoder.subprocess.run",
+            return_value=completed,
+        ),
+    ):
+        assert decoder.decode_payload({"raw": "A1B2C3"}) is None
+
+
+def test_builtin_channel_keys_present_by_default() -> None:
+    """Public and #test keys are always present even without .env keys."""
+    decoder = LetsMeshPacketDecoder(enabled=True, command="meshcore-decoder")
+    assert decoder._channel_keys == [
+        "8B3387E9C5CDEA6AC9E5EDBAA115CD72",
+        "9CD8FCF22A47333B591D96A2B848B73F",
+    ]
+
+
+def test_channel_name_lookup_from_decoded_hash() -> None:
+    """Decoder resolves channel names from configured label=key entries."""
+    key_hex = "EB50A1BCB3E4E5D7BF69A57C9DADA211"
+    decoder = LetsMeshPacketDecoder(
+        enabled=False,
+        channel_keys=[f"#bot={key_hex}"],
+    )
+    channel_hash = decoder._compute_channel_hash(key_hex)
+    decoded_packet = {
+        "payload": {
+            "decoded": {
+                "channelHash": channel_hash,
+            }
+        }
+    }
+
+    assert decoder.channel_name_from_decoded(decoded_packet) == "bot"
+
+
+def test_channel_labels_by_index_includes_labeled_entries() -> None:
+    """Channel labels map includes built-ins and label=key env entries."""
+    decoder = LetsMeshPacketDecoder(
+        enabled=False,
+        channel_keys=[
+            "bot=EB50A1BCB3E4E5D7BF69A57C9DADA211",
+            "chat=D0BDD6D71538138ED979EEC00D98AD97",
+        ],
+    )
+
+    labels = decoder.channel_labels_by_index()
+
+    assert labels[17] == "Public"
+    assert labels[217] == "#test"
+    assert labels[202] == "#bot"
+    assert labels[184] == "#chat"