feat: add JoeAppEngine OPC UA nodes, fix DCL auto-reconnect and quality push

- Add JoeAppEngine folder to OPC UA nodes.json (BTCS, AlarmCntsBySeverity, Scheduler/ScanTime)
- Fix DataConnectionActor: capture Self in PreStart for use from non-actor threads,
  preventing Self.Tell failure in Disconnected event handler
- Implement InstanceActor.HandleConnectionQualityChanged to mark attributes Bad on disconnect
- Fix LmxFakeProxy TagMapper to serialize arrays as JSON instead of "System.Int32[]"
- Allow DataType and DataSourceReference updates in TemplateService.UpdateAttributeAsync
- Update test_infra_opcua.md with JoeAppEngine documentation

CLAUDE.md

@@ -109,9 +109,9 @@ This project contains design documentation for a distributed SCADA system built
 
 ### Security & Auth
 - Authentication: direct LDAP bind (username/password), no Kerberos/NTLM. LDAPS/StartTLS required.
-- JWT sessions: HMAC-SHA256 shared symmetric key, 15-minute expiry with sliding refresh, 30-minute idle timeout.
+- Cookie+JWT hybrid sessions: HttpOnly/Secure cookie carries an embedded JWT (HMAC-SHA256 shared symmetric key), 15-minute expiry with sliding refresh, 30-minute idle timeout. Cookies are the correct transport for Blazor Server (SignalR circuits).
 - LDAP failure: new logins fail; active sessions continue with current roles.
-- Load balancer in front of central UI; JWT + shared Data Protection keys for failover transparency.
+- Load balancer in front of central UI; cookie-embedded JWT + shared Data Protection keys for failover transparency.
 
 ### Cluster & Failover
 - Keep-oldest split-brain resolver with `down-if-alone = on`, 15s stable-after.
@@ -123,7 +123,7 @@ This project contains design documentation for a distributed SCADA system built
 ### UI & Monitoring
 - Central UI: Blazor Server (ASP.NET Core + SignalR) with Bootstrap CSS. No third-party component frameworks (no Blazorise, MudBlazor, Radzen, etc.). Build custom Blazor components for tables, grids, forms, etc.
 - UI design: Clean, corporate, internal-use aesthetic. Not flashy. Use the `frontend-design` skill when designing UI pages/components.
-- Real-time push for debug view, health dashboard, deployment status.
+- Debug view: 2s polling timer. Health dashboard: 10s polling timer. Deployment status: real-time push via SignalR.
 - Health reports: 30s interval, 60s offline threshold, monotonic sequence numbers, raw error counts per interval.
 - Dead letter monitoring as a health metric.
 - Site Event Logging: 30-day retention, 1GB storage cap, daily purge, paginated queries with keyword search.
@@ -149,3 +149,12 @@ This project contains design documentation for a distributed SCADA system built
 
 - When consulting with the Codex MCP tool, use model `gpt-5.4`.
 - When a task requires setting up or controlling system state (sites, templates, instances, data connections, deployments, security, etc.) and the Central UI is not needed, prefer the ScadaLink CLI over manual DB edits or UI navigation. See [`src/ScadaLink.CLI/README.md`](src/ScadaLink.CLI/README.md) for the full command reference.
+
+### CLI Quick Reference (Docker / OrbStack)
+
+- **Contact point**: `akka.tcp://scadalink@scadalink-central-a:8081` — the hostname must match the container's Akka `NodeHostname` config. Do NOT use `localhost:9011`; Akka remoting requires the hostname in the URI to match what the node advertises.
+- **Test user**: `--username multi-role --password password` — has Admin, Design, and Deployment roles. The `admin` user only has the Admin role and cannot create templates, data connections, or deploy.
+- **Config file**: `~/.scadalink/config.json` — stores contact points, LDAP settings (including `searchBase`, `serviceAccountDn`, `serviceAccountPassword`), and default format. See `docker/README.md` for a ready-to-use test config.
+- **Rebuild cluster**: `bash docker/deploy.sh` — builds the `scadalink:latest` image and recreates all containers. Run this after code changes to ManagementActor, Host, or any server-side component.
+- **Infrastructure services**: `cd infra && docker compose up -d` — starts LDAP, MS SQL, OPC UA, SMTP, REST API, and LmxFakeProxy. These are separate from the cluster containers in `docker/`.
+- **All test LDAP passwords**: `password` (see `infra/glauth/config.toml` for users and groups).

Component-CentralUI.md

@@ -18,19 +18,15 @@ Central cluster only. Sites have no user interface.
 
 - A **load balancer** sits in front of the central cluster and routes to the active node.
 - On central failover, the Blazor Server SignalR circuit is interrupted. The browser automatically attempts to reconnect via SignalR's built-in reconnection logic.
-- Since sessions use **JWT tokens** (not server-side state), the user's authentication survives failover — the new active node validates the same JWT. No re-login required if the token is still valid.
-- Active debug view streams and in-progress real-time subscriptions are lost on failover and must be re-opened by the user.
+- Since sessions use **authentication cookies** carrying an embedded JWT (not server-side state), the user's authentication survives failover — the new active node validates the same cookie-embedded JWT. No re-login required if the token is still valid.
+- Active debug view polling and in-progress deployment status subscriptions are lost on failover and must be re-opened by the user.
 - Both central nodes share the same **ASP.NET Data Protection keys** (stored in the configuration database or shared configuration) so that tokens and anti-forgery tokens remain valid across failover.
 
 ## Real-Time Updates
 
-All real-time features use **server push via SignalR** (built into Blazor Server):
-
-- **Debug view**: Attribute value and alarm state changes streamed live from sites.
-- **Health dashboard**: Site status, connection health, error rates, and buffer depths update automatically when new health reports arrive.
-- **Deployment status**: Pending/in-progress/success/failed transitions push to the UI immediately.
-
-No manual refresh or polling is required for any of these features.
+- **Debug view**: Near-real-time display of attribute values and alarm states, updated via a **2-second polling timer**. This avoids the complexity of cross-cluster streaming while providing responsive feedback — 2s latency is imperceptible for debugging purposes.
+- **Health dashboard**: Site status, connection health, error rates, and buffer depths update via a **10-second auto-refresh timer**. Since health reports arrive from sites every 30 seconds, a 10s poll interval catches updates within one reporting cycle without unnecessary overhead.
+- **Deployment status**: Pending/in-progress/success/failed transitions **push to the UI immediately** via SignalR (built into Blazor Server). No polling required for deployment tracking.
 
 ## Responsibilities
 
@@ -104,8 +100,8 @@ No manual refresh or polling is required for any of these features.
 
 ### Debug View (Deployment Role)
 - Select a deployed instance and open a live debug view.
-- Real-time streaming of all attribute values (with quality and timestamp) and alarm states for that instance.
-- Initial snapshot of current state followed by streaming updates via the site-wide Akka stream.
+- Near-real-time polling (2s interval) of all attribute values (with quality and timestamp) and alarm states for that instance.
+- Initial snapshot of current state followed by periodic polling for updates.
 - Stream includes attribute values formatted as `[InstanceUniqueName].[AttributePath].[AttributeName]` and alarm states formatted as `[InstanceUniqueName].[AlarmName]`.
 - Subscribe-on-demand — stream starts when opened, stops when closed.
 

Component-DataConnectionLayer.md

@@ -32,10 +32,11 @@ IDataConnection : IAsyncDisposable
 ├── Write(tagPath, value) → void
 ├── WriteBatch(values) → void
 ├── WriteBatchAndWait(values, flagPath, flagValue, responsePath, responseValue, timeout) → bool
-└── Status → ConnectionHealth
+├── Status → ConnectionHealth
+└── Disconnected → event Action?
 ```
 
-Additional protocols can be added by implementing this interface.
+The `Disconnected` event is raised by an adapter when it detects an unexpected connection loss (server offline, network failure, keep-alive timeout). The `DataConnectionActor` subscribes to this event to trigger the reconnection state machine. Additional protocols can be added by implementing this interface.
 
 ### Concrete Type Mappings
 
@@ -51,6 +52,7 @@ Additional protocols can be added by implementing this interface.
 | `WriteBatch(values)` | OPC UA Write (multiple nodes) | gRPC `WriteBatch` RPC (throws on failure) |
 | `WriteBatchAndWait(...)` | OPC UA Write + poll for confirmation | `WriteBatch` + poll `Read` at 100ms intervals until response value matches or timeout |
 | `Status` | OPC UA session state | `IsConnected` — true when `SessionId` is non-empty |
+| `Disconnected` | `Session.KeepAlive` event fires with bad `ServiceResult` | gRPC subscription stream ends or throws non-cancellation `RpcException` |
 
 ### Common Value Type
 
@@ -66,8 +68,11 @@ Both protocols produce the same value tuple consumed by Instance Actors. Before
 ## Supported Protocols
 
 ### OPC UA
-- Standard OPC UA client implementation.
-- Supports subscriptions (monitored items) and read/write operations.
+- Uses the **OPC Foundation .NET Standard Library** (`OPCFoundation.NetStandard.Opc.Ua.Client`).
+- Session-based connection with endpoint discovery, certificate handling, and configurable security modes.
+- Subscriptions via OPC UA Monitored Items with data change notifications (1000ms sampling, queue size 10, discard-oldest).
+- Read/Write via OPC UA Read/Write services with StatusCode-based quality mapping.
+- Disconnect detection via `Session.KeepAlive` event (see Disconnect Detection Pattern below).
 
 ### LmxProxy (Custom Protocol)
 
@@ -97,6 +102,49 @@ LmxProxy is a gRPC-based protocol for communicating with LMX data servers. The D
 
 **Proto Source**: The `.proto` file originates from the LmxProxy server repository (`lmx/Proxy/Grpc/Protos/scada.proto` in ScadaBridge). The C# stubs are pre-generated and stored at `Adapters/LmxProxyGrpc/`.
 
+**Test Infrastructure**: The `infra/lmxfakeproxy/` project provides a fake LmxProxy server that bridges to the OPC UA test server. It implements the full `scada.ScadaService` proto, enabling end-to-end testing of `RealLmxProxyClient` without a Windows LmxProxy deployment. See [test_infra_lmxfakeproxy.md](test_infra_lmxfakeproxy.md) for setup.
+
+## Connection Configuration Reference
+
+All settings are parsed from the data connection's `Configuration` JSON dictionary (stored as `IDictionary<string, string>` connection details). Invalid numeric values fall back to defaults silently.
+
+### OPC UA Settings
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| `endpoint` / `EndpointUrl` | string | `opc.tcp://localhost:4840` | OPC UA server endpoint URL |
+| `SessionTimeoutMs` | int | `60000` | OPC UA session timeout in milliseconds |
+| `OperationTimeoutMs` | int | `15000` | Transport operation timeout in milliseconds |
+| `PublishingIntervalMs` | int | `1000` | Subscription publishing interval in milliseconds |
+| `KeepAliveCount` | int | `10` | Keep-alive frames before session timeout |
+| `LifetimeCount` | int | `30` | Subscription lifetime in publish intervals |
+| `MaxNotificationsPerPublish` | int | `100` | Max notifications batched per publish cycle |
+| `SamplingIntervalMs` | int | `1000` | Per-item server sampling rate in milliseconds |
+| `QueueSize` | int | `10` | Per-item notification buffer size |
+| `SecurityMode` | string | `None` | Preferred endpoint security: `None`, `Sign`, or `SignAndEncrypt` |
+| `AutoAcceptUntrustedCerts` | bool | `true` | Accept untrusted server certificates |
+
+### LmxProxy Settings
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| `Host` | string | `localhost` | LmxProxy server hostname |
+| `Port` | int | `50051` | LmxProxy gRPC port |
+| `ApiKey` | string | *(none)* | API key for `x-api-key` header authentication |
+| `SamplingIntervalMs` | int | `0` | Subscription sampling interval: 0 = on-change, >0 = time-based (ms) |
+| `UseTls` | bool | `false` | Use HTTPS instead of plain HTTP/2 for gRPC channel |
+
+### Shared Settings (appsettings.json)
+
+These are configured via `DataConnectionOptions` in `appsettings.json`, not per-connection:
+
+| Setting | Default | Description |
+|---------|---------|-------------|
+| `ReconnectInterval` | 5s | Fixed interval between reconnection attempts |
+| `TagResolutionRetryInterval` | 10s | Retry interval for unresolved tag paths |
+| `WriteTimeout` | 30s | Timeout for write operations |
+| `LmxProxyKeepAliveInterval` | 30s | Keep-alive ping interval for LmxProxy sessions |
+
 ## Subscription Management
 
 - When an Instance Actor is created (as part of the Site Runtime actor hierarchy), it registers its data source references with the Data Connection Layer.
@@ -130,17 +178,34 @@ Each data connection is managed by a dedicated connection actor that uses the Ak
 
 This pattern ensures no messages are lost during connection transitions and is the standard Akka.NET approach for actors with I/O lifecycle dependencies.
 
-**LmxProxy-specific notes**: The `RealLmxProxyClient` holds the `SessionId` returned by the `Connect` RPC and includes it in all subsequent operations. The `LmxProxyDataConnection` adapter has no keep-alive timer — session liveness is handled by the DCL's existing reconnect cycle. Subscriptions use server-streaming gRPC — a background task reads from the `ResponseStream` and invokes the callback for each `VtqMessage`. On connection failure, the DCL actor transitions to **Reconnecting**, disposes the client (which cancels active subscriptions), and retries at the fixed interval.
+**LmxProxy-specific notes**: The `RealLmxProxyClient` holds the `SessionId` returned by the `Connect` RPC and includes it in all subsequent operations. Subscriptions use server-streaming gRPC — a background task reads from the `ResponseStream` and invokes the callback for each `VtqMessage`. When the stream breaks (server offline, network failure), the background task detects the `RpcException` or stream end and invokes the `onStreamError` callback, which triggers the adapter's `Disconnected` event. The DCL actor transitions to **Reconnecting**, pushes bad quality, disposes the client, and retries at the fixed interval.
+
+**OPC UA-specific notes**: The `RealOpcUaClient` uses the OPC Foundation SDK's `Session.KeepAlive` event for proactive disconnect detection. The SDK sends keep-alive requests at the subscription's `KeepAliveCount × PublishingInterval` (default: 10s). When keep-alive fails, the `ConnectionLost` event fires, triggering the same reconnection flow. On reconnection, the DCL re-creates the OPC UA session and subscription, then re-adds all monitored items.
 
 ## Connection Lifecycle & Reconnection
 
 The DCL manages connection lifecycle automatically:
 
 1. **Connection drop detection**: When a connection to a data source is lost, the DCL immediately pushes a value update with quality `bad` for **every tag subscribed on that connection**. Instance Actors and their downstream consumers (alarms, scripts checking quality) see the staleness immediately.
-2. **Auto-reconnect with fixed interval**: The DCL retries the connection at a configurable fixed interval (e.g., every 5 seconds). The retry interval is defined **per data connection**. This is consistent with the fixed-interval retry philosophy used throughout the system. For LmxProxy, the DCL's reconnect cycle owns all recovery — re-establishing the gRPC channel and session after any connection failure. Individual gRPC operations (reads, writes) fail immediately to the caller on error; there is no operation-level retry within the adapter.
+2. **Auto-reconnect with fixed interval**: The DCL retries the connection at a configurable fixed interval (e.g., every 5 seconds). The retry interval is defined **per data connection**. This is consistent with the fixed-interval retry philosophy used throughout the system. Individual gRPC/OPC UA operations (reads, writes) fail immediately to the caller on error; there is no operation-level retry within the adapter.
 3. **Connection state transitions**: The DCL tracks each connection's state as `connected`, `disconnected`, or `reconnecting`. All transitions are logged to Site Event Logging.
 4. **Transparent re-subscribe**: On successful reconnection, the DCL automatically re-establishes all previously active subscriptions for that connection. Instance Actors require no action — they simply see quality return to `good` as fresh values arrive from restored subscriptions.
 
+### Disconnect Detection Pattern
+
+Each adapter implements the `IDataConnection.Disconnected` event to proactively signal connection loss to the `DataConnectionActor`. Detection uses two complementary paths:
+
+**Proactive detection** (server goes offline between operations):
+- **OPC UA**: The OPC Foundation SDK fires `Session.KeepAlive` events at regular intervals. `RealOpcUaClient` hooks this event; when `ServiceResult.IsBad(e.Status)` (server unreachable, keep-alive timeout), it fires `ConnectionLost`. The `OpcUaDataConnection` adapter translates this into `IDataConnection.Disconnected`.
+- **LmxProxy**: gRPC server-streaming subscriptions run in background tasks reading from `ResponseStream`. When the server goes offline, the stream either ends normally (server closed) or throws a non-cancellation `RpcException`. `RealLmxProxyClient` invokes the `onStreamError` callback, which `LmxProxyDataConnection` translates into `IDataConnection.Disconnected`.
+
+**Reactive detection** (failure discovered during an operation):
+- Both adapters wrap `ReadAsync` (and by extension `ReadBatchAsync`) with exception handling. If a read throws a non-cancellation exception, the adapter calls `RaiseDisconnected()` and re-throws. The `DataConnectionActor`'s existing error handling catches the exception while the disconnect event triggers the reconnection state machine.
+
+**Event marshalling**: The `DataConnectionActor` subscribes to `_adapter.Disconnected` in `PreStart()`. Since `Disconnected` may fire from a background thread (gRPC stream task, OPC UA keep-alive timer), the handler sends an `AdapterDisconnected` message to `Self`, marshalling the notification onto the actor's message loop. This triggers `BecomeReconnecting()` → bad quality push → retry timer.
+
+**Once-only guard**: Both `LmxProxyDataConnection` and `OpcUaDataConnection` use a `volatile bool _disconnectFired` flag to ensure `RaiseDisconnected()` fires exactly once per connection session. The flag resets on successful reconnection (`ConnectAsync`).
+
 ## Write Failure Handling
 
 Writes to physical devices are **synchronous** from the script's perspective:

Component-ManagementService.md

@@ -6,7 +6,7 @@ The Management Service is an Akka.NET actor on the central cluster that provides
 
 ## Location
 
-Central cluster only (active node). The ManagementActor runs as a cluster singleton on the central cluster.
+Central cluster only. The ManagementActor runs as a plain actor on **every** central node (not a cluster singleton). Because the actor is completely stateless — it holds no locks and no local state, delegating all work to repositories and services — running on all nodes improves availability without requiring coordination between instances. Either node can serve any request independently.
 
 `src/ScadaLink.ManagementService/`
 
@@ -17,7 +17,7 @@ Central cluster only (active node). The ManagementActor runs as a cluster single
 - Validate and authorize all incoming commands using the authenticated user identity carried in message envelopes.
 - Delegate to the appropriate services and repositories for each operation.
 - Return structured response messages for all commands and queries.
-- Failover: The ManagementActor is available on the active central node and fails over with it. ClusterClient handles reconnection transparently.
+- Failover: The ManagementActor runs on all central nodes, so no actor-level failover is needed. If one node goes down, the ClusterClient transparently routes to the ManagementActor on the remaining node.
 
 ## Key Classes
 
@@ -168,7 +168,7 @@ The ManagementActor receives the following services and repositories via DI (inj
 - **Configuration Database (via IAuditService)**: All mutating operations are audit logged through the existing transactional audit mechanism.
 - **Communication Layer**: Deployment commands and remote queries (parked messages, event logs) are routed to sites via Communication.
 - **Security & Auth**: Authorization rules are enforced on every command using the authenticated user identity from the message envelope.
-- **Cluster Infrastructure**: ManagementActor runs on the active central node; ClusterClientReceptionist requires cluster membership.
+- **Cluster Infrastructure**: ManagementActor runs on all central nodes; ClusterClientReceptionist requires cluster membership.
 - **All service components**: The ManagementActor delegates to the same services used by the Central UI — Template Engine, Deployment Manager, etc.
 
 ## Interactions

Component-Security.md

@@ -24,17 +24,21 @@ Central cluster. Sites do not have user-facing interfaces and do not perform ind
 
 ## Session Management
 
-### JWT Tokens
+### Cookie + JWT Hybrid
 - On successful authentication, the app issues a **JWT** signed with a shared symmetric key (HMAC-SHA256). Both central cluster nodes use the same signing key from configuration, so either node can issue and validate tokens.
-- **JWT claims**: User display name, username, list of roles (Admin, Design, Deployment), and for site-scoped Deployment, the list of permitted site IDs. All authorization decisions are made from token claims without hitting the database.
+- The JWT is embedded in an **authentication cookie** rather than being passed as a bearer token. This is the correct transport for Blazor Server, where persistent SignalR circuits do not carry Authorization headers — the browser automatically sends the cookie with every SignalR connection and HTTP request.
+- The cookie is **HttpOnly** and **Secure** (requires HTTPS).
+- On each request, the server extracts and validates the JWT from the cookie. All authorization decisions are made from the JWT claims without hitting the database.
+- **JWT claims**: User display name, username, list of roles (Admin, Design, Deployment), and for site-scoped Deployment, the list of permitted site IDs.
 
 ### Token Lifecycle
-- **JWT expiry**: 15 minutes. On each request, if the token is near expiry, the app re-queries LDAP for current group memberships and issues a fresh token with updated claims. Roles are never more than 15 minutes stale.
+- **JWT expiry**: 15 minutes. On each request, if the cookie-embedded JWT is near expiry, the app re-queries LDAP for current group memberships and issues a fresh JWT, writing an updated cookie. Roles are never more than 15 minutes stale.
 - **Idle timeout**: Configurable, default **30 minutes**. If no requests are made within the idle window, the token is not refreshed and the user must re-login. Tracked via a last-activity timestamp in the token.
 - **Sliding refresh**: Active users stay logged in indefinitely — the token refreshes every 15 minutes as long as requests are made within the 30-minute idle window.
 
 ### Load Balancer Compatibility
-- JWT tokens are self-contained — no server-side session state. A load balancer in front of the central cluster can route requests to either node without sticky sessions or a shared session store. Central failover is transparent to users with valid tokens.
+- The authentication cookie carries a self-contained JWT — no server-side session state. A load balancer in front of the central cluster can route requests to either node without sticky sessions or a shared session store.
+- Since both central nodes share the same JWT signing key, either node can validate the cookie-embedded JWT. Central failover is transparent to users with valid cookies.
 
 ## LDAP Connection Failure
 

docker/README.md

@@ -185,12 +185,38 @@ curl -s http://localhost:9002/health/ready | python3 -m json.tool
 
 ### CLI Access
 
-Connect the ScadaLink CLI to the central cluster via host-mapped Akka remoting ports:
+Connect the ScadaLink CLI to the central cluster. With OrbStack, the contact point hostname must match the container's Akka `NodeHostname` config, so use the container name directly (OrbStack resolves container names via DNS):
 
 ```bash
 dotnet run --project src/ScadaLink.CLI -- \
-    --contact-points akka.tcp://scadalink@localhost:9011 \
-    --username admin --password password \
+    --contact-points akka.tcp://scadalink@scadalink-central-a:8081 \
+    --username multi-role --password password \
+    template list
+```
+
+> **Note:** The `multi-role` test user has Admin, Design, and Deployment roles. The `admin` user only has the Admin role and cannot perform design or deployment operations. See `infra/glauth/config.toml` for all test users and their group memberships.
+
+A recommended `~/.scadalink/config.json` for the Docker test environment:
+
+```json
+{
+  "contactPoints": ["akka.tcp://scadalink@scadalink-central-a:8081"],
+  "ldap": {
+    "server": "localhost",
+    "port": 3893,
+    "useTls": false,
+    "searchBase": "dc=scadalink,dc=local",
+    "serviceAccountDn": "cn=admin,dc=scadalink,dc=local",
+    "serviceAccountPassword": "password"
+  }
+}
+```
+
+With this config file in place, the contact points and LDAP settings are automatic:
+
+```bash
+dotnet run --project src/ScadaLink.CLI -- \
+    --username multi-role --password password \
     template list
 ```
 

docs/plans/2026-03-19-lmxfakeproxy-design.md

@@ -0,0 +1,228 @@
+# LmxFakeProxy: OPC UA-Backed Test Proxy for LmxProxy Protocol
+
+**Date:** 2026-03-19
+**Status:** Approved
+
+## Purpose
+
+Create a test-infrastructure gRPC server that implements the `scada.ScadaService` proto (full parity with the real LmxProxy server) but bridges to the existing OPC UA test server instead of System Platform MXAccess. This enables end-to-end testing of the `RealLmxProxyClient` and the LmxProxy DCL adapter against real data without requiring a Windows-hosted LmxProxy deployment.
+
+## Architecture
+
+```
+┌─────────────────────┐       gRPC (50051)       ┌──────────────────┐     OPC UA (50000)     ┌─────────────────┐
+│  RealLmxProxyClient │ ◄──────────────────────► │   LmxFakeProxy   │ ◄───────────────────► │  OPC PLC Server  │
+│  (ScadaLink DCL)    │   scada.ScadaService      │  (infra service)  │   OPC Foundation SDK  │  (Docker)        │
+└─────────────────────┘                           └──────────────────┘                        └─────────────────┘
+```
+
+- Full proto parity: implements every RPC in `scada.proto`
+- Configurable OPC UA endpoint prefix (`--opc-prefix`, default `ns=3;s=`)
+- Optional API key enforcement (`--api-key`, default accept-all)
+- Full session tracking with validation
+- Native OPC UA MonitoredItems for subscription streaming
+- OPC UA reconnection with bad-quality push on disconnect
+- Runs as Docker service (port 50051) or standalone via `dotnet run`
+
+## Tag Address Mapping
+
+Configurable prefix prepend. Default maps LMX flat addresses to OPC PLC namespace 3:
+
+| LMX Tag | OPC UA NodeId |
+|---------|--------------|
+| `Motor.Speed` | `ns=3;s=Motor.Speed` |
+| `Pump.FlowRate` | `ns=3;s=Pump.FlowRate` |
+| `Tank.HighLevel` | `ns=3;s=Tank.HighLevel` |
+
+Mapping: `opcNodeId = $"{prefix}{lmxTag}"`
+
+**Value conversions:**
+- OPC UA value → VtqMessage: `ToString()` for value, `DateTime.UtcNow.Ticks` for timestamp, StatusCode mapped to `"Good"` / `"Uncertain"` / `"Bad"`
+- Write value parsing (string → typed): attempt `double` → `bool` → `uint` → fall back to `string`
+- Quality mapping: StatusCode 0 = Good, high bit set = Bad, else Uncertain
+
+## gRPC Service Implementation
+
+### Connection Management
+- **Connect** — Validate API key (if configured), generate Guid session ID, store in `ConcurrentDictionary<string, SessionInfo>`. Return success + session ID.
+- **Disconnect** — Remove session. No-op for unknown sessions.
+- **GetConnectionState** — Look up session, return connection info. Return `is_connected=false` for unknown sessions.
+- **CheckApiKey** — Return `is_valid=true` if no key configured or key matches.
+
+### Read Operations
+- **Read** — Validate session, map tag to OPC UA NodeId, read via OPC UA client, return VtqMessage.
+- **ReadBatch** — Same for multiple tags, sequential reads.
+
+### Write Operations
+- **Write** — Validate session, parse string value to typed, write via OPC UA.
+- **WriteBatch** — Write each item, collect per-item results.
+- **WriteBatchAndWait** — Write all items, poll `flag_tag` at `poll_interval_ms` until match or timeout.
+
+### Subscription
+- **Subscribe** — Validate session, create OPC UA MonitoredItems for each tag with `sampling_ms` as the OPC UA SamplingInterval. Stream VtqMessage on each data change notification. Stream stays open until client cancels. On cancellation, remove monitored items.
+
+### Error Handling
+- Invalid session → `success=false`, `message="Invalid or expired session"`
+- OPC UA failure → `success=false` with status code in message
+- OPC UA disconnected → active streams get Bad quality push then close, RPCs return failure
+
+## OPC UA Client Bridge
+
+Single shared OPC UA session to the backend server, reused across all gRPC client sessions.
+
+**`OpcUaBridge` class (behind `IOpcUaBridge` interface):**
+- `ConnectAsync()` — Establish OPC UA session (always `MessageSecurityMode.None`, auto-accept certs)
+- `ReadAsync(nodeId)` — Single node read
+- `WriteAsync(nodeId, value)` — Single node write
+- `AddMonitoredItems(nodeIds, samplingMs, callback)` — Add to shared subscription
+- `RemoveMonitoredItems(handles)` — Remove from shared subscription
+
+**Reconnection:**
+- Detect disconnection via `Session.KeepAlive` event
+- On disconnect: set `_connected = false`, push Bad quality VtqMessage to all active subscription streams, close streams
+- Background reconnect loop at 5-second fixed interval
+- On reconnection: re-create subscription, re-add monitored items for still-active gRPC streams
+- RPCs while disconnected return `success=false, "OPC UA backend unavailable"`
+
+**Single session rationale:** OPC PLC is local/lightweight, mirrors how real LmxProxy shares MXAccess, simpler lifecycle.
+
+## API Key Authentication
+
+Accept-any by default, optional enforcement:
+- If `--api-key` is not set, all requests are accepted regardless of key
+- If `--api-key` is set, the `x-api-key` gRPC metadata header must match on every call
+- Validation happens in a gRPC interceptor (mirrors the real LmxProxy's `ApiKeyInterceptor`)
+
+## Project Structure
+
+```
+infra/lmxfakeproxy/
+├── LmxFakeProxy.csproj
+├── Program.cs                    # Host builder, CLI args / env vars, Kestrel on 50051
+├── Services/
+│   └── ScadaServiceImpl.cs       # gRPC service implementation
+├── Bridge/
+│   └── OpcUaBridge.cs            # IOpcUaBridge + implementation
+├── Sessions/
+│   └── SessionManager.cs         # ConcurrentDictionary session tracking
+├── Protos/
+│   └── scada.proto               # Copied from DCL (generates server stubs)
+├── Dockerfile                    # Multi-stage SDK → runtime
+├── README.md
+└── tests/
+    └── LmxFakeProxy.Tests/
+        ├── LmxFakeProxy.Tests.csproj
+        ├── SessionManagerTests.cs
+        ├── TagMappingTests.cs
+        └── ScadaServiceTests.cs
+```
+
+**NuGet dependencies:**
+- `Grpc.AspNetCore` — gRPC server hosting
+- `OPCFoundation.NetStandard.Opc.Ua.Client` — OPC UA SDK
+- `Microsoft.Extensions.Hosting` — generic host
+- Tests: `xunit`, `NSubstitute`, `Grpc.Net.Client`
+
+**CLI arguments / environment variables:**
+| Arg | Env Var | Default |
+|-----|---------|---------|
+| `--port` | `PORT` | `50051` |
+| `--opc-endpoint` | `OPC_ENDPOINT` | `opc.tcp://localhost:50000` |
+| `--opc-prefix` | `OPC_PREFIX` | `ns=3;s=` |
+| `--api-key` | `API_KEY` | *(none — accept all)* |
+
+Env vars take precedence over CLI args.
+
+## Docker & Infrastructure Integration
+
+**docker-compose.yml addition:**
+```yaml
+lmxfakeproxy:
+  build: ./lmxfakeproxy
+  container_name: scadalink-lmxfakeproxy
+  ports:
+    - "50051:50051"
+  environment:
+    OPC_ENDPOINT: "opc.tcp://opcua:50000"
+    OPC_PREFIX: "ns=3;s="
+  depends_on:
+    - opcua
+  networks:
+    - scadalink-net
+  restart: unless-stopped
+```
+
+**Dockerfile (multi-stage):**
+```dockerfile
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+COPY . .
+RUN dotnet publish -c Release -o /app
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0
+WORKDIR /app
+COPY --from=build /app .
+EXPOSE 50051
+ENTRYPOINT ["dotnet", "LmxFakeProxy.dll"]
+```
+
+**Documentation updates:**
+- `test_infra.md` — Add LmxFakeProxy to services table (6th service)
+- `infra/README.md` — Add to quick-start table
+- New `test_infra_lmxfakeproxy.md` — Dedicated per-service doc
+- `Component-DataConnectionLayer.md` — Note fake proxy availability for LmxProxy testing
+
+## Unit Tests
+
+### SessionManagerTests.cs
+- `Connect_ReturnsUniqueSessionId`
+- `Connect_WithValidApiKey_Succeeds`
+- `Connect_WithInvalidApiKey_Fails`
+- `Connect_WithNoKeyConfigured_AcceptsAnyKey`
+- `Disconnect_RemovesSession`
+- `Disconnect_UnknownSession_ReturnsFalse`
+- `ValidateSession_ValidId_ReturnsTrue`
+- `ValidateSession_InvalidId_ReturnsFalse`
+- `GetConnectionState_ReturnsCorrectInfo`
+- `GetConnectionState_UnknownSession_ReturnsNotConnected`
+
+### TagMappingTests.cs
+- `ToOpcNodeId_PrependsPrefix`
+- `ToOpcNodeId_CustomPrefix`
+- `ToOpcNodeId_EmptyPrefix_PassesThrough`
+- `ConvertWriteValue_ParsesDouble`
+- `ConvertWriteValue_ParsesBool`
+- `ConvertWriteValue_ParsesUint`
+- `ConvertWriteValue_FallsBackToString`
+- `MapStatusCode_Good_ReturnsGood`
+- `MapStatusCode_Bad_ReturnsBad`
+- `MapStatusCode_Uncertain_ReturnsUncertain`
+- `ToVtqMessage_ConvertsCorrectly`
+
+### ScadaServiceTests.cs (mocked IOpcUaBridge)
+- `Read_ValidSession_ReturnsVtq`
+- `Read_InvalidSession_ReturnsFailure`
+- `ReadBatch_ReturnsAllTags`
+- `Write_ValidSession_Succeeds`
+- `Write_InvalidSession_ReturnsFailure`
+- `WriteBatch_ReturnsPerItemResults`
+- `Subscribe_StreamsUpdatesUntilCancelled`
+- `Subscribe_InvalidSession_ThrowsRpcException`
+- `CheckApiKey_Valid_ReturnsTrue`
+- `CheckApiKey_Invalid_ReturnsFalse`
+
+## Verification
+
+```bash
+# Unit tests
+cd infra/lmxfakeproxy
+dotnet test tests/LmxFakeProxy.Tests/
+
+# Docker build
+cd infra
+docker compose build lmxfakeproxy
+docker compose up -d lmxfakeproxy
+
+# Integration smoke test (using RealLmxProxyClient from ScadaLink)
+# Connect, read Motor.Speed, write Motor.Speed=42.0, read back, subscribe
+```

docs/plans/2026-03-19-lmxfakeproxy-implementation.md.tasks.json

@@ -0,0 +1,16 @@
+{
+  "planPath": "docs/plans/2026-03-19-lmxfakeproxy-implementation.md",
+  "tasks": [
+    {"id": 1, "nativeId": "3", "subject": "Task 1: Project Scaffolding", "status": "pending"},
+    {"id": 2, "nativeId": "4", "subject": "Task 2: TagMapper Utility + Tests", "status": "pending", "blockedBy": [1]},
+    {"id": 3, "nativeId": "5", "subject": "Task 3: SessionManager + Tests", "status": "pending", "blockedBy": [1]},
+    {"id": 4, "nativeId": "6", "subject": "Task 4: IOpcUaBridge + OpcUaBridge Implementation", "status": "pending", "blockedBy": [1]},
+    {"id": 5, "nativeId": "7", "subject": "Task 5: ScadaServiceImpl + Tests", "status": "pending", "blockedBy": [2, 3, 4]},
+    {"id": 6, "nativeId": "8", "subject": "Task 6: Program.cs Host Builder", "status": "pending", "blockedBy": [5]},
+    {"id": 7, "nativeId": "9", "subject": "Task 7: Dockerfile + Docker Compose", "status": "pending", "blockedBy": [6]},
+    {"id": 8, "nativeId": "10", "subject": "Task 8: Documentation Updates", "status": "pending", "blockedBy": [6]},
+    {"id": 9, "nativeId": "11", "subject": "Task 9: Integration Smoke Test", "status": "pending", "blockedBy": [5, 7]},
+    {"id": 10, "nativeId": "12", "subject": "Task 10: End-to-End Verification", "status": "pending", "blockedBy": [7, 8, 9]}
+  ],
+  "lastUpdated": "2026-03-19T00:00:00Z"
+}

infra/README.md

@@ -17,6 +17,7 @@ This starts five services:
 | MS SQL 2022 | 1433 | Configuration and machine data databases |
 | SMTP (Mailpit) | 1025 (SMTP), 8025 (web) | Email capture for notification testing |
 | REST API (Flask) | 5200 | External REST API for Gateway and Inbound API testing |
+| LmxFakeProxy (.NET gRPC) | 50051 (gRPC) | LmxProxy-compatible server bridging to OPC UA test server |
 
 ## First-Time SQL Setup
 

infra/docker-compose.yml

@@ -74,6 +74,20 @@ services:
       - scadalink-net
     restart: unless-stopped
 
+  lmxfakeproxy:
+    build: ./lmxfakeproxy
+    container_name: scadalink-lmxfakeproxy
+    ports:
+      - "50051:50051"
+    environment:
+      OPC_ENDPOINT: "opc.tcp://opcua:50000"
+      OPC_PREFIX: "ns=3;s="
+    depends_on:
+      - opcua
+    networks:
+      - scadalink-net
+    restart: unless-stopped
+
 volumes:
   scadalink-mssql-data:
 

infra/lmxfakeproxy/.dockerignore

@@ -0,0 +1,3 @@
+tests/
+bin/
+obj/

infra/lmxfakeproxy/Bridge/IOpcUaBridge.cs

@@ -0,0 +1,25 @@
+namespace LmxFakeProxy.Bridge;
+
+public record OpcUaReadResult(object? Value, DateTime SourceTimestamp, uint StatusCode);
+
+public interface IOpcUaBridge : IAsyncDisposable
+{
+    bool IsConnected { get; }
+
+    Task ConnectAsync(CancellationToken cancellationToken = default);
+
+    Task<OpcUaReadResult> ReadAsync(string nodeId, CancellationToken cancellationToken = default);
+
+    Task<uint> WriteAsync(string nodeId, object? value, CancellationToken cancellationToken = default);
+
+    Task<string> AddMonitoredItemsAsync(
+        IEnumerable<string> nodeIds,
+        int samplingIntervalMs,
+        Action<string, object?, DateTime, uint> onValueChanged,
+        CancellationToken cancellationToken = default);
+
+    Task RemoveMonitoredItemsAsync(string handle, CancellationToken cancellationToken = default);
+
+    event Action? Disconnected;
+    event Action? Reconnected;
+}

infra/lmxfakeproxy/Bridge/OpcUaBridge.cs

@@ -0,0 +1,300 @@
+using Opc.Ua;
+using Opc.Ua.Client;
+using Opc.Ua.Configuration;
+
+namespace LmxFakeProxy.Bridge;
+
+public class OpcUaBridge : IOpcUaBridge
+{
+    private readonly string _endpointUrl;
+    private readonly ILogger<OpcUaBridge> _logger;
+    private Opc.Ua.Client.ISession? _session;
+    private Subscription? _subscription;
+    private volatile bool _connected;
+    private volatile bool _reconnecting;
+    private CancellationTokenSource? _reconnectCts;
+
+    private readonly Dictionary<string, List<MonitoredItem>> _handleItems = new();
+    private readonly Dictionary<string, Action<string, object?, DateTime, uint>> _handleCallbacks = new();
+    private readonly object _lock = new();
+
+    public OpcUaBridge(string endpointUrl, ILogger<OpcUaBridge> logger)
+    {
+        _endpointUrl = endpointUrl;
+        _logger = logger;
+    }
+
+    public bool IsConnected => _connected;
+    public event Action? Disconnected;
+    public event Action? Reconnected;
+
+    public async Task ConnectAsync(CancellationToken cancellationToken = default)
+    {
+        var appConfig = new ApplicationConfiguration
+        {
+            ApplicationName = "LmxFakeProxy",
+            ApplicationType = ApplicationType.Client,
+            SecurityConfiguration = new SecurityConfiguration
+            {
+                AutoAcceptUntrustedCertificates = true,
+                ApplicationCertificate = new CertificateIdentifier(),
+                TrustedIssuerCertificates = new CertificateTrustList { StorePath = Path.Combine(Path.GetTempPath(), "LmxFakeProxy", "pki", "issuers") },
+                TrustedPeerCertificates = new CertificateTrustList { StorePath = Path.Combine(Path.GetTempPath(), "LmxFakeProxy", "pki", "trusted") },
+                RejectedCertificateStore = new CertificateTrustList { StorePath = Path.Combine(Path.GetTempPath(), "LmxFakeProxy", "pki", "rejected") }
+            },
+            ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60000 },
+            TransportQuotas = new TransportQuotas { OperationTimeout = 15000 }
+        };
+
+        await appConfig.Validate(ApplicationType.Client);
+        appConfig.CertificateValidator.CertificateValidation += (_, e) => e.Accept = true;
+
+        EndpointDescription? endpoint;
+        try
+        {
+#pragma warning disable CS0618
+            using var discoveryClient = DiscoveryClient.Create(new Uri(_endpointUrl));
+            var endpoints = discoveryClient.GetEndpoints(null);
+#pragma warning restore CS0618
+            endpoint = endpoints
+                .Where(e => e.SecurityMode == MessageSecurityMode.None)
+                .FirstOrDefault() ?? endpoints.FirstOrDefault();
+        }
+        catch
+        {
+            endpoint = new EndpointDescription(_endpointUrl);
+        }
+
+        var endpointConfig = EndpointConfiguration.Create(appConfig);
+        var configuredEndpoint = new ConfiguredEndpoint(null, endpoint, endpointConfig);
+
+        _session = await Session.Create(
+            appConfig, configuredEndpoint, false,
+            "LmxFakeProxy-Session", 60000, null, null, cancellationToken);
+
+        _session.KeepAlive += OnSessionKeepAlive;
+
+        _subscription = new Subscription(_session.DefaultSubscription)
+        {
+            DisplayName = "LmxFakeProxy",
+            PublishingEnabled = true,
+            PublishingInterval = 500,
+            KeepAliveCount = 10,
+            LifetimeCount = 30,
+            MaxNotificationsPerPublish = 1000
+        };
+
+        _session.AddSubscription(_subscription);
+        await _subscription.CreateAsync(cancellationToken);
+
+        _connected = true;
+        _logger.LogInformation("OPC UA bridge connected to {Endpoint}", _endpointUrl);
+    }
+
+    public async Task<OpcUaReadResult> ReadAsync(string nodeId, CancellationToken cancellationToken = default)
+    {
+        EnsureConnected();
+        var readValue = new ReadValueId { NodeId = nodeId, AttributeId = Attributes.Value };
+        var response = await _session!.ReadAsync(
+            null, 0, TimestampsToReturn.Source,
+            new ReadValueIdCollection { readValue }, cancellationToken);
+        var result = response.Results[0];
+        return new OpcUaReadResult(result.Value, result.SourceTimestamp, result.StatusCode.Code);
+    }
+
+    public async Task<uint> WriteAsync(string nodeId, object? value, CancellationToken cancellationToken = default)
+    {
+        EnsureConnected();
+        var writeValue = new WriteValue
+        {
+            NodeId = nodeId,
+            AttributeId = Attributes.Value,
+            Value = new DataValue(new Variant(value))
+        };
+        var response = await _session!.WriteAsync(
+            null, new WriteValueCollection { writeValue }, cancellationToken);
+        return response.Results[0].Code;
+    }
+
+    public async Task<string> AddMonitoredItemsAsync(
+        IEnumerable<string> nodeIds, int samplingIntervalMs,
+        Action<string, object?, DateTime, uint> onValueChanged,
+        CancellationToken cancellationToken = default)
+    {
+        EnsureConnected();
+        var handle = Guid.NewGuid().ToString("N");
+        var items = new List<MonitoredItem>();
+
+        foreach (var nodeId in nodeIds)
+        {
+            var monitoredItem = new MonitoredItem(_subscription!.DefaultItem)
+            {
+                DisplayName = nodeId,
+                StartNodeId = nodeId,
+                AttributeId = Attributes.Value,
+                SamplingInterval = samplingIntervalMs,
+                QueueSize = 10,
+                DiscardOldest = true
+            };
+
+            monitoredItem.Notification += (item, e) =>
+            {
+                if (e.NotificationValue is MonitoredItemNotification notification)
+                {
+                    var val = notification.Value?.Value;
+                    var ts = notification.Value?.SourceTimestamp ?? DateTime.UtcNow;
+                    var sc = notification.Value?.StatusCode.Code ?? 0;
+                    onValueChanged(nodeId, val, ts, sc);
+                }
+            };
+
+            items.Add(monitoredItem);
+            _subscription!.AddItem(monitoredItem);
+        }
+
+        await _subscription!.ApplyChangesAsync(cancellationToken);
+
+        lock (_lock)
+        {
+            _handleItems[handle] = items;
+            _handleCallbacks[handle] = onValueChanged;
+        }
+
+        return handle;
+    }
+
+    public async Task RemoveMonitoredItemsAsync(string handle, CancellationToken cancellationToken = default)
+    {
+        List<MonitoredItem>? items;
+        lock (_lock)
+        {
+            if (!_handleItems.Remove(handle, out items))
+                return;
+            _handleCallbacks.Remove(handle);
+        }
+
+        if (_subscription != null)
+        {
+            foreach (var item in items)
+                _subscription.RemoveItem(item);
+            try { await _subscription.ApplyChangesAsync(cancellationToken); }
+            catch { /* best-effort during cleanup */ }
+        }
+    }
+
+    private void OnSessionKeepAlive(Opc.Ua.Client.ISession session, KeepAliveEventArgs e)
+    {
+        if (ServiceResult.IsBad(e.Status))
+        {
+            if (!_connected) return;
+            _connected = false;
+            _logger.LogWarning("OPC UA backend connection lost");
+            Disconnected?.Invoke();
+            StartReconnectLoop();
+        }
+    }
+
+    private void StartReconnectLoop()
+    {
+        if (_reconnecting) return;
+        _reconnecting = true;
+        _reconnectCts = new CancellationTokenSource();
+
+        _ = Task.Run(async () =>
+        {
+            while (!_reconnectCts.Token.IsCancellationRequested)
+            {
+                await Task.Delay(5000, _reconnectCts.Token);
+                try
+                {
+                    _logger.LogInformation("Attempting OPC UA reconnection...");
+                    if (_session != null)
+                    {
+                        _session.KeepAlive -= OnSessionKeepAlive;
+                        try { await _session.CloseAsync(); } catch { }
+                        _session = null;
+                        _subscription = null;
+                    }
+
+                    await ConnectAsync(_reconnectCts.Token);
+
+                    // Re-add monitored items for active handles
+                    lock (_lock)
+                    {
+                        foreach (var (handle, callback) in _handleCallbacks)
+                        {
+                            if (_handleItems.TryGetValue(handle, out var oldItems))
+                            {
+                                var nodeIds = oldItems.Select(i => i.StartNodeId.ToString()).ToList();
+                                var newItems = new List<MonitoredItem>();
+                                foreach (var nodeId in nodeIds)
+                                {
+                                    var monitoredItem = new MonitoredItem(_subscription!.DefaultItem)
+                                    {
+                                        DisplayName = nodeId,
+                                        StartNodeId = nodeId,
+                                        AttributeId = Attributes.Value,
+                                        SamplingInterval = oldItems[0].SamplingInterval,
+                                        QueueSize = 10,
+                                        DiscardOldest = true
+                                    };
+                                    var capturedNodeId = nodeId;
+                                    var capturedCallback = callback;
+                                    monitoredItem.Notification += (item, ev) =>
+                                    {
+                                        if (ev.NotificationValue is MonitoredItemNotification notification)
+                                        {
+                                            var val = notification.Value?.Value;
+                                            var ts = notification.Value?.SourceTimestamp ?? DateTime.UtcNow;
+                                            var sc = notification.Value?.StatusCode.Code ?? 0;
+                                            capturedCallback(capturedNodeId, val, ts, sc);
+                                        }
+                                    };
+                                    newItems.Add(monitoredItem);
+                                    _subscription!.AddItem(monitoredItem);
+                                }
+                                _handleItems[handle] = newItems;
+                            }
+                        }
+                    }
+
+                    if (_subscription != null)
+                        await _subscription.ApplyChangesAsync();
+
+                    _reconnecting = false;
+                    _logger.LogInformation("OPC UA reconnection successful");
+                    Reconnected?.Invoke();
+                    return;
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "OPC UA reconnection attempt failed, retrying in 5s");
+                }
+            }
+        }, _reconnectCts.Token);
+    }
+
+    private void EnsureConnected()
+    {
+        if (!_connected || _session == null)
+            throw new InvalidOperationException("OPC UA backend unavailable");
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        _reconnectCts?.Cancel();
+        _reconnectCts?.Dispose();
+        if (_subscription != null)
+        {
+            try { await _subscription.DeleteAsync(true); } catch { }
+            _subscription = null;
+        }
+        if (_session != null)
+        {
+            _session.KeepAlive -= OnSessionKeepAlive;
+            try { await _session.CloseAsync(); } catch { }
+            _session = null;
+        }
+        _connected = false;
+    }
+}

infra/lmxfakeproxy/Dockerfile

@@ -0,0 +1,13 @@
+# Build stage forced to amd64: Grpc.Tools protoc crashes on linux/arm64 (Apple Silicon)
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+COPY LmxFakeProxy.csproj .
+RUN dotnet restore
+COPY . .
+RUN dotnet publish -c Release -o /app
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0
+WORKDIR /app
+COPY --from=build /app .
+EXPOSE 50051
+ENTRYPOINT ["dotnet", "LmxFakeProxy.dll"]

infra/lmxfakeproxy/LmxFakeProxy.csproj

@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <RootNamespace>LmxFakeProxy</RootNamespace>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Compile Remove="tests\**\*" />
+    <Content Remove="tests\**\*" />
+    <None Remove="tests\**\*" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Protobuf Include="Protos/scada.proto" GrpcServices="Server" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Grpc.AspNetCore" Version="2.71.0" />
+    <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.374.126" />
+  </ItemGroup>
+</Project>

infra/lmxfakeproxy/Program.cs

@@ -0,0 +1,57 @@
+using LmxFakeProxy;
+using LmxFakeProxy.Bridge;
+using LmxFakeProxy.Services;
+using LmxFakeProxy.Sessions;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Configuration: env vars take precedence over CLI args
+var port = Environment.GetEnvironmentVariable("PORT") ?? GetArg(args, "--port") ?? "50051";
+var opcEndpoint = Environment.GetEnvironmentVariable("OPC_ENDPOINT") ?? GetArg(args, "--opc-endpoint") ?? "opc.tcp://localhost:50000";
+var opcPrefix = Environment.GetEnvironmentVariable("OPC_PREFIX") ?? GetArg(args, "--opc-prefix") ?? "ns=3;s=";
+var apiKey = Environment.GetEnvironmentVariable("API_KEY") ?? GetArg(args, "--api-key");
+
+builder.WebHost.ConfigureKestrel(options =>
+{
+    options.ListenAnyIP(int.Parse(port), listenOptions =>
+    {
+        listenOptions.Protocols = Microsoft.AspNetCore.Server.Kestrel.Core.HttpProtocols.Http2;
+    });
+});
+
+// Register services
+builder.Services.AddSingleton(new SessionManager(apiKey));
+builder.Services.AddSingleton(new TagMapper(opcPrefix));
+builder.Services.AddSingleton<IOpcUaBridge>(sp =>
+    new OpcUaBridge(opcEndpoint, sp.GetRequiredService<ILogger<OpcUaBridge>>()));
+builder.Services.AddGrpc();
+
+var app = builder.Build();
+
+app.MapGrpcService<ScadaServiceImpl>();
+app.MapGet("/", () => "LmxFakeProxy is running");
+
+// Connect to OPC UA backend
+var logger = app.Services.GetRequiredService<ILogger<Program>>();
+logger.LogInformation("LmxFakeProxy starting on port {Port}", port);
+logger.LogInformation("OPC UA endpoint: {Endpoint}, prefix: {Prefix}", opcEndpoint, opcPrefix);
+logger.LogInformation("API key enforcement: {Enforced}", apiKey != null ? "enabled" : "disabled (accept all)");
+
+var bridge = app.Services.GetRequiredService<IOpcUaBridge>();
+try
+{
+    await ((OpcUaBridge)bridge).ConnectAsync();
+    logger.LogInformation("OPC UA bridge connected");
+}
+catch (Exception ex)
+{
+    logger.LogWarning(ex, "Initial OPC UA connection failed — will retry when first request arrives");
+}
+
+await app.RunAsync();
+
+static string? GetArg(string[] args, string name)
+{
+    var idx = Array.IndexOf(args, name);
+    return idx >= 0 && idx + 1 < args.Length ? args[idx + 1] : null;
+}

infra/lmxfakeproxy/Protos/scada.proto

@@ -0,0 +1,166 @@
+syntax = "proto3";
+
+option csharp_namespace = "LmxFakeProxy.Grpc";
+
+package scada;
+
+// The SCADA service definition
+service ScadaService {
+  // Connection management
+  rpc Connect(ConnectRequest) returns (ConnectResponse);
+  rpc Disconnect(DisconnectRequest) returns (DisconnectResponse);
+  rpc GetConnectionState(GetConnectionStateRequest) returns (GetConnectionStateResponse);
+
+  // Read operations
+  rpc Read(ReadRequest) returns (ReadResponse);
+  rpc ReadBatch(ReadBatchRequest) returns (ReadBatchResponse);
+
+  // Write operations
+  rpc Write(WriteRequest) returns (WriteResponse);
+  rpc WriteBatch(WriteBatchRequest) returns (WriteBatchResponse);
+  rpc WriteBatchAndWait(WriteBatchAndWaitRequest) returns (WriteBatchAndWaitResponse);
+
+  // Subscription operations (server streaming) - now streams VtqMessage directly
+  rpc Subscribe(SubscribeRequest) returns (stream VtqMessage);
+
+  // Authentication
+  rpc CheckApiKey(CheckApiKeyRequest) returns (CheckApiKeyResponse);
+}
+
+// === CONNECTION MESSAGES ===
+
+message ConnectRequest {
+  string client_id = 1;
+  string api_key = 2;
+}
+
+message ConnectResponse {
+  bool success = 1;
+  string message = 2;
+  string session_id = 3;
+}
+
+message DisconnectRequest {
+  string session_id = 1;
+}
+
+message DisconnectResponse {
+  bool success = 1;
+  string message = 2;
+}
+
+message GetConnectionStateRequest {
+  string session_id = 1;
+}
+
+message GetConnectionStateResponse {
+  bool is_connected = 1;
+  string client_id = 2;
+  int64 connected_since_utc_ticks = 3;
+}
+
+// === VTQ MESSAGE ===
+
+message VtqMessage {
+  string tag = 1;
+  string value = 2;
+  int64 timestamp_utc_ticks = 3;
+  string quality = 4;  // "Good", "Uncertain", "Bad"
+}
+
+// === READ MESSAGES ===
+
+message ReadRequest {
+  string session_id = 1;
+  string tag = 2;
+}
+
+message ReadResponse {
+  bool success = 1;
+  string message = 2;
+  VtqMessage vtq = 3;
+}
+
+message ReadBatchRequest {
+  string session_id = 1;
+  repeated string tags = 2;
+}
+
+message ReadBatchResponse {
+  bool success = 1;
+  string message = 2;
+  repeated VtqMessage vtqs = 3;
+}
+
+// === WRITE MESSAGES ===
+
+message WriteRequest {
+  string session_id = 1;
+  string tag = 2;
+  string value = 3;
+}
+
+message WriteResponse {
+  bool success = 1;
+  string message = 2;
+}
+
+message WriteItem {
+  string tag = 1;
+  string value = 2;
+}
+
+message WriteResult {
+  string tag = 1;
+  bool success = 2;
+  string message = 3;
+}
+
+message WriteBatchRequest {
+  string session_id = 1;
+  repeated WriteItem items = 2;
+}
+
+message WriteBatchResponse {
+  bool success = 1;
+  string message = 2;
+  repeated WriteResult results = 3;
+}
+
+message WriteBatchAndWaitRequest {
+  string session_id = 1;
+  repeated WriteItem items = 2;
+  string flag_tag = 3;
+  string flag_value = 4;
+  int32 timeout_ms = 5;
+  int32 poll_interval_ms = 6;
+}
+
+message WriteBatchAndWaitResponse {
+  bool success = 1;
+  string message = 2;
+  repeated WriteResult write_results = 3;
+  bool flag_reached = 4;
+  int32 elapsed_ms = 5;
+}
+
+// === SUBSCRIPTION MESSAGES ===
+
+message SubscribeRequest {
+  string session_id = 1;
+  repeated string tags = 2;
+  int32 sampling_ms = 3;
+}
+
+// Note: Subscribe RPC now streams VtqMessage directly (defined above)
+
+// === AUTHENTICATION MESSAGES ===
+
+message CheckApiKeyRequest {
+  string api_key = 1;
+}
+
+message CheckApiKeyResponse {
+  bool is_valid = 1;
+  string message = 2;
+}

infra/lmxfakeproxy/Services/ScadaServiceImpl.cs

@@ -0,0 +1,255 @@
+using Grpc.Core;
+using LmxFakeProxy.Bridge;
+using LmxFakeProxy.Grpc;
+using LmxFakeProxy.Sessions;
+
+namespace LmxFakeProxy.Services;
+
+public class ScadaServiceImpl : ScadaService.ScadaServiceBase
+{
+    private readonly SessionManager _sessions;
+    private readonly IOpcUaBridge _bridge;
+    private readonly TagMapper _tagMapper;
+
+    public ScadaServiceImpl(SessionManager sessions, IOpcUaBridge bridge, TagMapper tagMapper)
+    {
+        _sessions = sessions;
+        _bridge = bridge;
+        _tagMapper = tagMapper;
+    }
+
+    public override Task<ConnectResponse> Connect(ConnectRequest request, ServerCallContext context)
+    {
+        var (success, message, sessionId) = _sessions.Connect(request.ClientId, request.ApiKey);
+        return Task.FromResult(new ConnectResponse { Success = success, Message = message, SessionId = sessionId });
+    }
+
+    public override Task<DisconnectResponse> Disconnect(DisconnectRequest request, ServerCallContext context)
+    {
+        var ok = _sessions.Disconnect(request.SessionId);
+        return Task.FromResult(new DisconnectResponse
+        {
+            Success = ok,
+            Message = ok ? "Disconnected" : "Session not found"
+        });
+    }
+
+    public override Task<GetConnectionStateResponse> GetConnectionState(
+        GetConnectionStateRequest request, ServerCallContext context)
+    {
+        var (found, clientId, ticks) = _sessions.GetConnectionState(request.SessionId);
+        return Task.FromResult(new GetConnectionStateResponse
+        {
+            IsConnected = found, ClientId = clientId, ConnectedSinceUtcTicks = ticks
+        });
+    }
+
+    public override Task<CheckApiKeyResponse> CheckApiKey(CheckApiKeyRequest request, ServerCallContext context)
+    {
+        var valid = _sessions.CheckApiKey(request.ApiKey);
+        return Task.FromResult(new CheckApiKeyResponse
+        {
+            IsValid = valid, Message = valid ? "Valid" : "Invalid API key"
+        });
+    }
+
+    public override async Task<ReadResponse> Read(ReadRequest request, ServerCallContext context)
+    {
+        if (!_sessions.ValidateSession(request.SessionId))
+            return new ReadResponse { Success = false, Message = "Invalid or expired session" };
+
+        try
+        {
+            var nodeId = _tagMapper.ToOpcNodeId(request.Tag);
+            var result = await _bridge.ReadAsync(nodeId, context.CancellationToken);
+            return new ReadResponse
+            {
+                Success = true,
+                Vtq = TagMapper.ToVtqMessage(request.Tag, result.Value, result.SourceTimestamp, result.StatusCode)
+            };
+        }
+        catch (Exception ex)
+        {
+            return new ReadResponse { Success = false, Message = ex.Message };
+        }
+    }
+
+    public override async Task<ReadBatchResponse> ReadBatch(ReadBatchRequest request, ServerCallContext context)
+    {
+        if (!_sessions.ValidateSession(request.SessionId))
+            return new ReadBatchResponse { Success = false, Message = "Invalid or expired session" };
+
+        var response = new ReadBatchResponse { Success = true };
+        foreach (var tag in request.Tags)
+        {
+            try
+            {
+                var nodeId = _tagMapper.ToOpcNodeId(tag);
+                var result = await _bridge.ReadAsync(nodeId, context.CancellationToken);
+                response.Vtqs.Add(TagMapper.ToVtqMessage(tag, result.Value, result.SourceTimestamp, result.StatusCode));
+            }
+            catch (Exception ex)
+            {
+                response.Vtqs.Add(new VtqMessage
+                {
+                    Tag = tag, Value = "", Quality = "Bad", TimestampUtcTicks = DateTime.UtcNow.Ticks
+                });
+                response.Message = ex.Message;
+            }
+        }
+        return response;
+    }
+
+    public override async Task<WriteResponse> Write(WriteRequest request, ServerCallContext context)
+    {
+        if (!_sessions.ValidateSession(request.SessionId))
+            return new WriteResponse { Success = false, Message = "Invalid or expired session" };
+
+        try
+        {
+            var nodeId = _tagMapper.ToOpcNodeId(request.Tag);
+            var value = TagMapper.ParseWriteValue(request.Value);
+            var statusCode = await _bridge.WriteAsync(nodeId, value, context.CancellationToken);
+            return statusCode == 0
+                ? new WriteResponse { Success = true }
+                : new WriteResponse { Success = false, Message = $"OPC UA write failed: 0x{statusCode:X8}" };
+        }
+        catch (Exception ex)
+        {
+            return new WriteResponse { Success = false, Message = ex.Message };
+        }
+    }
+
+    public override async Task<WriteBatchResponse> WriteBatch(WriteBatchRequest request, ServerCallContext context)
+    {
+        if (!_sessions.ValidateSession(request.SessionId))
+            return new WriteBatchResponse { Success = false, Message = "Invalid or expired session" };
+
+        var response = new WriteBatchResponse { Success = true };
+        foreach (var item in request.Items)
+        {
+            try
+            {
+                var nodeId = _tagMapper.ToOpcNodeId(item.Tag);
+                var value = TagMapper.ParseWriteValue(item.Value);
+                var statusCode = await _bridge.WriteAsync(nodeId, value, context.CancellationToken);
+                response.Results.Add(new Grpc.WriteResult
+                {
+                    Tag = item.Tag, Success = statusCode == 0,
+                    Message = statusCode == 0 ? "" : $"0x{statusCode:X8}"
+                });
+                if (statusCode != 0) response.Success = false;
+            }
+            catch (Exception ex)
+            {
+                response.Results.Add(new Grpc.WriteResult { Tag = item.Tag, Success = false, Message = ex.Message });
+                response.Success = false;
+            }
+        }
+        return response;
+    }
+
+    public override async Task<WriteBatchAndWaitResponse> WriteBatchAndWait(
+        WriteBatchAndWaitRequest request, ServerCallContext context)
+    {
+        if (!_sessions.ValidateSession(request.SessionId))
+            return new WriteBatchAndWaitResponse { Success = false, Message = "Invalid or expired session" };
+
+        var startTime = DateTime.UtcNow;
+        var writeResults = new List<Grpc.WriteResult>();
+        var allWritesOk = true;
+
+        foreach (var item in request.Items)
+        {
+            try
+            {
+                var nodeId = _tagMapper.ToOpcNodeId(item.Tag);
+                var value = TagMapper.ParseWriteValue(item.Value);
+                var statusCode = await _bridge.WriteAsync(nodeId, value, context.CancellationToken);
+                writeResults.Add(new Grpc.WriteResult
+                {
+                    Tag = item.Tag, Success = statusCode == 0,
+                    Message = statusCode == 0 ? "" : $"0x{statusCode:X8}"
+                });
+                if (statusCode != 0) allWritesOk = false;
+            }
+            catch (Exception ex)
+            {
+                writeResults.Add(new Grpc.WriteResult { Tag = item.Tag, Success = false, Message = ex.Message });
+                allWritesOk = false;
+            }
+        }
+
+        if (!allWritesOk)
+        {
+            var failResp = new WriteBatchAndWaitResponse { Success = false, Message = "Write failed" };
+            failResp.WriteResults.AddRange(writeResults);
+            return failResp;
+        }
+
+        var flagNodeId = _tagMapper.ToOpcNodeId(request.FlagTag);
+        var timeoutMs = request.TimeoutMs > 0 ? request.TimeoutMs : 5000;
+        var pollMs = request.PollIntervalMs > 0 ? request.PollIntervalMs : 100;
+        var deadline = startTime.AddMilliseconds(timeoutMs);
+
+        while (DateTime.UtcNow < deadline)
+        {
+            context.CancellationToken.ThrowIfCancellationRequested();
+            try
+            {
+                var readResult = await _bridge.ReadAsync(flagNodeId, context.CancellationToken);
+                if (readResult.Value?.ToString() == request.FlagValue)
+                {
+                    var elapsed = (int)(DateTime.UtcNow - startTime).TotalMilliseconds;
+                    var resp = new WriteBatchAndWaitResponse { Success = true, FlagReached = true, ElapsedMs = elapsed };
+                    resp.WriteResults.AddRange(writeResults);
+                    return resp;
+                }
+            }
+            catch { }
+            await Task.Delay(pollMs, context.CancellationToken);
+        }
+
+        var finalResp = new WriteBatchAndWaitResponse
+        {
+            Success = true, FlagReached = false,
+            ElapsedMs = (int)(DateTime.UtcNow - startTime).TotalMilliseconds,
+            Message = "Timeout waiting for flag value"
+        };
+        finalResp.WriteResults.AddRange(writeResults);
+        return finalResp;
+    }
+
+    public override async Task Subscribe(
+        SubscribeRequest request, IServerStreamWriter<VtqMessage> responseStream, ServerCallContext context)
+    {
+        if (!_sessions.ValidateSession(request.SessionId))
+            throw new RpcException(new Status(StatusCode.Unauthenticated, "Invalid or expired session"));
+
+        var nodeIds = request.Tags.Select(t => _tagMapper.ToOpcNodeId(t)).ToList();
+        var tagByNodeId = request.Tags.Zip(nodeIds).ToDictionary(p => p.Second, p => p.First);
+
+        var handle = await _bridge.AddMonitoredItemsAsync(
+            nodeIds, request.SamplingMs,
+            (nodeId, value, timestamp, statusCode) =>
+            {
+                if (tagByNodeId.TryGetValue(nodeId, out var tag))
+                {
+                    var vtq = TagMapper.ToVtqMessage(tag, value, timestamp, statusCode);
+                    try { responseStream.WriteAsync(vtq).Wait(); }
+                    catch { }
+                }
+            },
+            context.CancellationToken);
+
+        try
+        {
+            await Task.Delay(Timeout.Infinite, context.CancellationToken);
+        }
+        catch (OperationCanceledException) { }
+        finally
+        {
+            await _bridge.RemoveMonitoredItemsAsync(handle);
+        }
+    }
+}

infra/lmxfakeproxy/Sessions/SessionManager.cs

@@ -0,0 +1,51 @@
+using System.Collections.Concurrent;
+
+namespace LmxFakeProxy.Sessions;
+
+public record SessionInfo(string ClientId, long ConnectedSinceUtcTicks);
+
+public class SessionManager
+{
+    private readonly string? _requiredApiKey;
+    private readonly ConcurrentDictionary<string, SessionInfo> _sessions = new();
+
+    public SessionManager(string? requiredApiKey)
+    {
+        _requiredApiKey = requiredApiKey;
+    }
+
+    public (bool Success, string Message, string SessionId) Connect(string clientId, string apiKey)
+    {
+        if (!CheckApiKey(apiKey))
+            return (false, "Invalid API key", string.Empty);
+
+        var sessionId = Guid.NewGuid().ToString("N");
+        var info = new SessionInfo(clientId, DateTime.UtcNow.Ticks);
+        _sessions[sessionId] = info;
+        return (true, "Connected", sessionId);
+    }
+
+    public bool Disconnect(string sessionId)
+    {
+        return _sessions.TryRemove(sessionId, out _);
+    }
+
+    public bool ValidateSession(string sessionId)
+    {
+        return _sessions.ContainsKey(sessionId);
+    }
+
+    public (bool Found, string ClientId, long ConnectedSinceUtcTicks) GetConnectionState(string sessionId)
+    {
+        if (_sessions.TryGetValue(sessionId, out var info))
+            return (true, info.ClientId, info.ConnectedSinceUtcTicks);
+        return (false, string.Empty, 0);
+    }
+
+    public bool CheckApiKey(string apiKey)
+    {
+        if (string.IsNullOrEmpty(_requiredApiKey))
+            return true;
+        return apiKey == _requiredApiKey;
+    }
+}

infra/lmxfakeproxy/TagMapper.cs

@@ -0,0 +1,53 @@
+using System.Collections;
+using System.Text.Json;
+using LmxFakeProxy.Grpc;
+
+namespace LmxFakeProxy;
+
+public class TagMapper
+{
+    private readonly string _prefix;
+
+    public TagMapper(string prefix)
+    {
+        _prefix = prefix;
+    }
+
+    public string ToOpcNodeId(string lmxTag) => $"{_prefix}{lmxTag}";
+
+    public static object ParseWriteValue(string value)
+    {
+        if (double.TryParse(value, System.Globalization.NumberStyles.Float,
+            System.Globalization.CultureInfo.InvariantCulture, out var d))
+            return d;
+        if (bool.TryParse(value, out var b))
+            return b;
+        return value;
+    }
+
+    public static string MapQuality(uint statusCode)
+    {
+        if (statusCode == 0) return "Good";
+        if ((statusCode & 0x80000000) != 0) return "Bad";
+        return "Uncertain";
+    }
+
+    public static string FormatValue(object? value)
+    {
+        if (value is null) return string.Empty;
+        if (value is Array or IList)
+            return JsonSerializer.Serialize(value);
+        return value.ToString() ?? string.Empty;
+    }
+
+    public static VtqMessage ToVtqMessage(string tag, object? value, DateTime timestampUtc, uint statusCode)
+    {
+        return new VtqMessage
+        {
+            Tag = tag,
+            Value = FormatValue(value),
+            TimestampUtcTicks = timestampUtc.Ticks,
+            Quality = MapQuality(statusCode)
+        };
+    }
+}

infra/lmxfakeproxy/tests/LmxFakeProxy.Tests/GlobalUsings.cs

@@ -0,0 +1 @@
+global using Xunit;

infra/lmxfakeproxy/tests/LmxFakeProxy.Tests/IntegrationSmokeTest.cs

@@ -0,0 +1,64 @@
+using ScadaLink.DataConnectionLayer.Adapters;
+
+namespace LmxFakeProxy.Tests;
+
+/// <summary>
+/// End-to-end smoke test connecting RealLmxProxyClient to LmxFakeProxy.
+/// Requires both OPC UA test server and LmxFakeProxy to be running.
+/// Run manually: dotnet test --filter "Category=Integration"
+/// </summary>
+[Trait("Category", "Integration")]
+public class IntegrationSmokeTest
+{
+    private const string Host = "localhost";
+    private const int Port = 50051;
+
+    [Fact]
+    public async Task ConnectReadWriteSubscribe_EndToEnd()
+    {
+        var factory = new RealLmxProxyClientFactory();
+        var client = factory.Create(Host, Port, null);
+
+        try
+        {
+            // Connect
+            await client.ConnectAsync();
+            Assert.True(client.IsConnected);
+
+            // Read initial value
+            var vtq = await client.ReadAsync("Motor.Speed");
+            Assert.Equal(LmxQuality.Good, vtq.Quality);
+
+            // Write a value
+            await client.WriteAsync("Motor.Speed", 42.5);
+
+            // Read back
+            var vtq2 = await client.ReadAsync("Motor.Speed");
+            Assert.Equal(42.5, (double)vtq2.Value!);
+
+            // ReadBatch
+            var batch = await client.ReadBatchAsync(new[] { "Motor.Speed", "Pump.FlowRate" });
+            Assert.Equal(2, batch.Count);
+
+            // Subscribe briefly
+            LmxVtq? lastUpdate = null;
+            var sub = await client.SubscribeAsync(
+                new[] { "Motor.Speed" },
+                (tag, v) => lastUpdate = v);
+
+            // Write to trigger subscription update
+            await client.WriteAsync("Motor.Speed", 99.0);
+            await Task.Delay(2000);
+
+            await sub.DisposeAsync();
+            Assert.NotNull(lastUpdate);
+
+            // Disconnect
+            await client.DisconnectAsync();
+        }
+        finally
+        {
+            await client.DisposeAsync();
+        }
+    }
+}

infra/lmxfakeproxy/tests/LmxFakeProxy.Tests/LmxFakeProxy.Tests.csproj

@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <RootNamespace>LmxFakeProxy.Tests</RootNamespace>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0" />
+    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Grpc.Core" Version="2.46.6" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../LmxFakeProxy.csproj" />
+    <ProjectReference Include="../../../../src/ScadaLink.DataConnectionLayer/ScadaLink.DataConnectionLayer.csproj" />
+  </ItemGroup>
+</Project>

infra/lmxfakeproxy/tests/LmxFakeProxy.Tests/ScadaServiceTests.cs

@@ -0,0 +1,164 @@
+using Grpc.Core;
+using NSubstitute;
+using LmxFakeProxy.Bridge;
+using LmxFakeProxy.Grpc;
+using LmxFakeProxy.Sessions;
+using LmxFakeProxy.Services;
+
+namespace LmxFakeProxy.Tests;
+
+public class ScadaServiceTests
+{
+    private readonly IOpcUaBridge _mockBridge;
+    private readonly SessionManager _sessionMgr;
+    private readonly TagMapper _tagMapper;
+    private readonly ScadaServiceImpl _service;
+
+    public ScadaServiceTests()
+    {
+        _mockBridge = Substitute.For<IOpcUaBridge>();
+        _mockBridge.IsConnected.Returns(true);
+        _sessionMgr = new SessionManager(null);
+        _tagMapper = new TagMapper("ns=3;s=");
+        _service = new ScadaServiceImpl(_sessionMgr, _mockBridge, _tagMapper);
+    }
+
+    private string ConnectClient(string clientId = "test-client")
+    {
+        var (_, _, sessionId) = _sessionMgr.Connect(clientId, "");
+        return sessionId;
+    }
+
+    private static ServerCallContext MockContext()
+    {
+        return new TestServerCallContext();
+    }
+
+    [Fact]
+    public async Task Connect_ReturnsSessionId()
+    {
+        var resp = await _service.Connect(
+            new ConnectRequest { ClientId = "c1", ApiKey = "" }, MockContext());
+        Assert.True(resp.Success);
+        Assert.NotEmpty(resp.SessionId);
+    }
+
+    [Fact]
+    public async Task Read_ValidSession_ReturnsVtq()
+    {
+        var sid = ConnectClient();
+        _mockBridge.ReadAsync("ns=3;s=Motor.Speed", Arg.Any<CancellationToken>())
+            .Returns(new OpcUaReadResult(42.5, DateTime.UtcNow, 0));
+
+        var resp = await _service.Read(
+            new ReadRequest { SessionId = sid, Tag = "Motor.Speed" }, MockContext());
+
+        Assert.True(resp.Success);
+        Assert.Equal("42.5", resp.Vtq.Value);
+        Assert.Equal("Good", resp.Vtq.Quality);
+    }
+
+    [Fact]
+    public async Task Read_InvalidSession_ReturnsFailure()
+    {
+        var resp = await _service.Read(
+            new ReadRequest { SessionId = "bogus", Tag = "Motor.Speed" }, MockContext());
+        Assert.False(resp.Success);
+        Assert.Contains("Invalid", resp.Message);
+    }
+
+    [Fact]
+    public async Task ReadBatch_ReturnsAllTags()
+    {
+        var sid = ConnectClient();
+        _mockBridge.ReadAsync(Arg.Any<string>(), Arg.Any<CancellationToken>())
+            .Returns(new OpcUaReadResult(1.0, DateTime.UtcNow, 0));
+
+        var req = new ReadBatchRequest { SessionId = sid };
+        req.Tags.AddRange(new[] { "Motor.Speed", "Pump.FlowRate" });
+
+        var resp = await _service.ReadBatch(req, MockContext());
+
+        Assert.True(resp.Success);
+        Assert.Equal(2, resp.Vtqs.Count);
+    }
+
+    [Fact]
+    public async Task Write_ValidSession_Succeeds()
+    {
+        var sid = ConnectClient();
+        _mockBridge.WriteAsync("ns=3;s=Motor.Speed", Arg.Any<object?>(), Arg.Any<CancellationToken>())
+            .Returns(0u);
+
+        var resp = await _service.Write(
+            new WriteRequest { SessionId = sid, Tag = "Motor.Speed", Value = "42.5" }, MockContext());
+
+        Assert.True(resp.Success);
+    }
+
+    [Fact]
+    public async Task Write_InvalidSession_ReturnsFailure()
+    {
+        var resp = await _service.Write(
+            new WriteRequest { SessionId = "bogus", Tag = "Motor.Speed", Value = "42.5" }, MockContext());
+        Assert.False(resp.Success);
+    }
+
+    [Fact]
+    public async Task WriteBatch_ReturnsPerItemResults()
+    {
+        var sid = ConnectClient();
+        _mockBridge.WriteAsync(Arg.Any<string>(), Arg.Any<object?>(), Arg.Any<CancellationToken>())
+            .Returns(0u);
+
+        var req = new WriteBatchRequest { SessionId = sid };
+        req.Items.Add(new WriteItem { Tag = "Motor.Speed", Value = "42.5" });
+        req.Items.Add(new WriteItem { Tag = "Pump.FlowRate", Value = "10.0" });
+
+        var resp = await _service.WriteBatch(req, MockContext());
+
+        Assert.True(resp.Success);
+        Assert.Equal(2, resp.Results.Count);
+        Assert.All(resp.Results, r => Assert.True(r.Success));
+    }
+
+    [Fact]
+    public async Task CheckApiKey_Valid_ReturnsTrue()
+    {
+        var resp = await _service.CheckApiKey(
+            new CheckApiKeyRequest { ApiKey = "anything" }, MockContext());
+        Assert.True(resp.IsValid);
+    }
+
+    [Fact]
+    public async Task CheckApiKey_Invalid_ReturnsFalse()
+    {
+        var mgr = new SessionManager("secret");
+        var svc = new ScadaServiceImpl(mgr, _mockBridge, _tagMapper);
+
+        var resp = await svc.CheckApiKey(
+            new CheckApiKeyRequest { ApiKey = "wrong" }, MockContext());
+        Assert.False(resp.IsValid);
+    }
+}
+
+/// <summary>
+/// Minimal ServerCallContext for unit testing gRPC services.
+/// </summary>
+internal class TestServerCallContext : ServerCallContext
+{
+    protected override string MethodCore => "test";
+    protected override string HostCore => "localhost";
+    protected override string PeerCore => "test-peer";
+    protected override DateTime DeadlineCore => DateTime.MaxValue;
+    protected override Metadata RequestHeadersCore => new();
+    protected override CancellationToken CancellationTokenCore => CancellationToken.None;
+    protected override Metadata ResponseTrailersCore => new();
+    protected override Status StatusCore { get; set; }
+    protected override WriteOptions? WriteOptionsCore { get; set; }
+    protected override AuthContext AuthContextCore => new("test", new Dictionary<string, List<AuthProperty>>());
+
+    protected override ContextPropagationToken CreatePropagationTokenCore(ContextPropagationOptions? options) =>
+        throw new NotImplementedException();
+    protected override Task WriteResponseHeadersAsyncCore(Metadata responseHeaders) => Task.CompletedTask;
+}

infra/lmxfakeproxy/tests/LmxFakeProxy.Tests/SessionManagerTests.cs

@@ -0,0 +1,116 @@
+namespace LmxFakeProxy.Tests;
+
+using LmxFakeProxy.Sessions;
+
+public class SessionManagerTests
+{
+    [Fact]
+    public void Connect_ReturnsUniqueSessionId()
+    {
+        var mgr = new SessionManager(null);
+        var (ok1, _, id1) = mgr.Connect("client1", "");
+        var (ok2, _, id2) = mgr.Connect("client2", "");
+        Assert.True(ok1);
+        Assert.True(ok2);
+        Assert.NotEqual(id1, id2);
+    }
+
+    [Fact]
+    public void Connect_WithValidApiKey_Succeeds()
+    {
+        var mgr = new SessionManager("secret");
+        var (ok, _, _) = mgr.Connect("client1", "secret");
+        Assert.True(ok);
+    }
+
+    [Fact]
+    public void Connect_WithInvalidApiKey_Fails()
+    {
+        var mgr = new SessionManager("secret");
+        var (ok, msg, id) = mgr.Connect("client1", "wrong");
+        Assert.False(ok);
+        Assert.Empty(id);
+        Assert.Contains("Invalid API key", msg);
+    }
+
+    [Fact]
+    public void Connect_WithNoKeyConfigured_AcceptsAnyKey()
+    {
+        var mgr = new SessionManager(null);
+        var (ok1, _, _) = mgr.Connect("c1", "anykey");
+        var (ok2, _, _) = mgr.Connect("c2", "");
+        Assert.True(ok1);
+        Assert.True(ok2);
+    }
+
+    [Fact]
+    public void Disconnect_RemovesSession()
+    {
+        var mgr = new SessionManager(null);
+        var (_, _, id) = mgr.Connect("client1", "");
+        Assert.True(mgr.ValidateSession(id));
+        var ok = mgr.Disconnect(id);
+        Assert.True(ok);
+        Assert.False(mgr.ValidateSession(id));
+    }
+
+    [Fact]
+    public void Disconnect_UnknownSession_ReturnsFalse()
+    {
+        var mgr = new SessionManager(null);
+        Assert.False(mgr.Disconnect("nonexistent"));
+    }
+
+    [Fact]
+    public void ValidateSession_ValidId_ReturnsTrue()
+    {
+        var mgr = new SessionManager(null);
+        var (_, _, id) = mgr.Connect("client1", "");
+        Assert.True(mgr.ValidateSession(id));
+    }
+
+    [Fact]
+    public void ValidateSession_InvalidId_ReturnsFalse()
+    {
+        var mgr = new SessionManager(null);
+        Assert.False(mgr.ValidateSession("bogus"));
+    }
+
+    [Fact]
+    public void GetConnectionState_ReturnsCorrectInfo()
+    {
+        var mgr = new SessionManager(null);
+        var (_, _, id) = mgr.Connect("myClient", "");
+        var (found, clientId, ticks) = mgr.GetConnectionState(id);
+        Assert.True(found);
+        Assert.Equal("myClient", clientId);
+        Assert.True(ticks > 0);
+    }
+
+    [Fact]
+    public void GetConnectionState_UnknownSession_ReturnsNotConnected()
+    {
+        var mgr = new SessionManager(null);
+        var (found, clientId, ticks) = mgr.GetConnectionState("unknown");
+        Assert.False(found);
+        Assert.Empty(clientId);
+        Assert.Equal(0, ticks);
+    }
+
+    [Fact]
+    public void CheckApiKey_NoKeyConfigured_AlwaysValid()
+    {
+        var mgr = new SessionManager(null);
+        Assert.True(mgr.CheckApiKey("anything"));
+        Assert.True(mgr.CheckApiKey(""));
+    }
+
+    [Fact]
+    public void CheckApiKey_WithKeyConfigured_ValidatesCorrectly()
+    {
+        var mgr = new SessionManager("mykey");
+        Assert.True(mgr.CheckApiKey("mykey"));
+        Assert.False(mgr.CheckApiKey("wrong"));
+        Assert.False(mgr.CheckApiKey(""));
+    }
+}

infra/lmxfakeproxy/tests/LmxFakeProxy.Tests/TagMappingTests.cs

@@ -0,0 +1,84 @@
+using Xunit;
+
+namespace LmxFakeProxy.Tests;
+
+public class TagMappingTests
+{
+    [Fact]
+    public void ToOpcNodeId_PrependsPrefix()
+    {
+        var mapper = new TagMapper("ns=3;s=");
+        Assert.Equal("ns=3;s=Motor.Speed", mapper.ToOpcNodeId("Motor.Speed"));
+    }
+
+    [Fact]
+    public void ToOpcNodeId_CustomPrefix()
+    {
+        var mapper = new TagMapper("ns=2;s=MyFolder.");
+        Assert.Equal("ns=2;s=MyFolder.Pump.Pressure", mapper.ToOpcNodeId("Pump.Pressure"));
+    }
+
+    [Fact]
+    public void ToOpcNodeId_EmptyPrefix_PassesThrough()
+    {
+        var mapper = new TagMapper("");
+        Assert.Equal("Motor.Speed", mapper.ToOpcNodeId("Motor.Speed"));
+    }
+
+    [Fact]
+    public void ParseWriteValue_Double()
+    {
+        Assert.Equal(42.5, TagMapper.ParseWriteValue("42.5"));
+        Assert.IsType<double>(TagMapper.ParseWriteValue("42.5"));
+    }
+
+    [Fact]
+    public void ParseWriteValue_Bool()
+    {
+        Assert.Equal(true, TagMapper.ParseWriteValue("true"));
+        Assert.Equal(false, TagMapper.ParseWriteValue("False"));
+    }
+
+    [Fact]
+    public void ParseWriteValue_Uint()
+    {
+        // "100" parses as double first (double.TryParse succeeds for integers)
+        var result = TagMapper.ParseWriteValue("100");
+        Assert.IsType<double>(result);
+    }
+
+    [Fact]
+    public void ParseWriteValue_FallsBackToString()
+    {
+        Assert.Equal("hello", TagMapper.ParseWriteValue("hello"));
+        Assert.IsType<string>(TagMapper.ParseWriteValue("hello"));
+    }
+
+    [Fact]
+    public void MapStatusCode_Good()
+    {
+        Assert.Equal("Good", TagMapper.MapQuality(0));
+    }
+
+    [Fact]
+    public void MapStatusCode_Bad()
+    {
+        Assert.Equal("Bad", TagMapper.MapQuality(0x80000000));
+    }
+
+    [Fact]
+    public void MapStatusCode_Uncertain()
+    {
+        Assert.Equal("Uncertain", TagMapper.MapQuality(0x40000000));
+    }
+
+    [Fact]
+    public void ToVtqMessage_ConvertsCorrectly()
+    {
+        var vtq = TagMapper.ToVtqMessage("Motor.Speed", 42.5, DateTime.UtcNow, 0);
+        Assert.Equal("Motor.Speed", vtq.Tag);
+        Assert.Equal("42.5", vtq.Value);
+        Assert.Equal("Good", vtq.Quality);
+        Assert.True(vtq.TimestampUtcTicks > 0);
+    }
+}

infra/opcua/nodes.json

@@ -133,6 +133,43 @@
           "Description": "Valve command (0=Close, 1=Open, 2=Stop)"
         }
       ]
+    },
+    {
+      "Folder": "JoeAppEngine",
+      "NodeList": [
+        {
+          "NodeId": "JoeAppEngine.BTCS",
+          "Name": "BTCS",
+          "DataType": "String",
+          "ValueRank": -1,
+          "AccessLevel": "CurrentReadOrWrite",
+          "Description": "BTCS string value"
+        },
+        {
+          "NodeId": "JoeAppEngine.AlarmCntsBySeverity",
+          "Name": "AlarmCntsBySeverity",
+          "DataType": "Int32",
+          "ValueRank": 1,
+          "ArrayDimensions": [13],
+          "AccessLevel": "CurrentReadOrWrite",
+          "Description": "13-element alarm counts by severity level"
+        }
+      ],
+      "FolderList": [
+        {
+          "Folder": "Scheduler",
+          "NodeList": [
+            {
+              "NodeId": "JoeAppEngine.Scheduler.ScanTime",
+              "Name": "ScanTime",
+              "DataType": "DateTime",
+              "ValueRank": -1,
+              "AccessLevel": "CurrentReadOrWrite",
+              "Description": "Current scan time (updates every second)"
+            }
+          ]
+        }
+      ]
     }
   ]
 }

src/ScadaLink.CLI/CliConfig.cs

@@ -8,6 +8,9 @@ public class CliConfig
     public string? LdapServer { get; set; }
     public int LdapPort { get; set; } = 636;
     public bool LdapUseTls { get; set; } = true;
+    public string LdapSearchBase { get; set; } = string.Empty;
+    public string LdapServiceAccountDn { get; set; } = string.Empty;
+    public string LdapServiceAccountPassword { get; set; } = string.Empty;
     public string DefaultFormat { get; set; } = "json";
 
     public static CliConfig Load()
@@ -31,6 +34,12 @@ public class CliConfig
                     config.LdapServer = fileConfig.Ldap.Server;
                     config.LdapPort = fileConfig.Ldap.Port;
                     config.LdapUseTls = fileConfig.Ldap.UseTls;
+                    if (!string.IsNullOrEmpty(fileConfig.Ldap.SearchBase))
+                        config.LdapSearchBase = fileConfig.Ldap.SearchBase;
+                    if (!string.IsNullOrEmpty(fileConfig.Ldap.ServiceAccountDn))
+                        config.LdapServiceAccountDn = fileConfig.Ldap.ServiceAccountDn;
+                    if (!string.IsNullOrEmpty(fileConfig.Ldap.ServiceAccountPassword))
+                        config.LdapServiceAccountPassword = fileConfig.Ldap.ServiceAccountPassword;
                 }
                 if (!string.IsNullOrEmpty(fileConfig.DefaultFormat)) config.DefaultFormat = fileConfig.DefaultFormat;
             }
@@ -62,5 +71,8 @@ public class CliConfig
         public string? Server { get; set; }
         public int Port { get; set; } = 636;
         public bool UseTls { get; set; } = true;
+        public string? SearchBase { get; set; }
+        public string? ServiceAccountDn { get; set; }
+        public string? ServiceAccountPassword { get; set; }
     }
 }

src/ScadaLink.CLI/Commands/ApiMethodCommands.cs

@@ -6,31 +6,31 @@ namespace ScadaLink.CLI.Commands;
 
 public static class ApiMethodCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("api-method") { Description = "Manage inbound API methods" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all API methods" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListApiMethodsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListApiMethodsCommand());
         });
         return cmd;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "API method ID", Required = true };
         var cmd = new Command("get") { Description = "Get an API method by ID" };
@@ -39,12 +39,12 @@ public static class ApiMethodCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetApiMethodCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetApiMethodCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Method name", Required = true };
         var scriptOption = new Option<string>("--script") { Description = "Script code", Required = true };
@@ -67,13 +67,13 @@ public static class ApiMethodCommands
             var parameters = result.GetValue(parametersOption);
             var returnDef = result.GetValue(returnDefOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateApiMethodCommand(name, script, timeout, parameters, returnDef));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "API method ID", Required = true };
         var scriptOption = new Option<string>("--script") { Description = "Script code", Required = true };
@@ -96,13 +96,13 @@ public static class ApiMethodCommands
             var parameters = result.GetValue(parametersOption);
             var returnDef = result.GetValue(returnDefOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateApiMethodCommand(id, script, timeout, parameters, returnDef));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "API method ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete an API method" };
@@ -111,7 +111,7 @@ public static class ApiMethodCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteApiMethodCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteApiMethodCommand(id));
         });
         return cmd;
     }

src/ScadaLink.CLI/Commands/AuditLogCommands.cs

@@ -6,16 +6,16 @@ namespace ScadaLink.CLI.Commands;
 
 public static class AuditLogCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("audit-log") { Description = "Query audit logs" };
 
-        command.Add(BuildQuery(contactPointsOption, formatOption));
+        command.Add(BuildQuery(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildQuery(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildQuery(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var userOption = new Option<string?>("--user") { Description = "Filter by username" };
         var entityTypeOption = new Option<string?>("--entity-type") { Description = "Filter by entity type" };
@@ -45,7 +45,7 @@ public static class AuditLogCommands
             var page = result.GetValue(pageOption);
             var pageSize = result.GetValue(pageSizeOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new QueryAuditLogCommand(user, entityType, action, from, to, page, pageSize));
         });
         return cmd;

src/ScadaLink.CLI/Commands/CommandHelpers.cs

@@ -1,27 +1,33 @@
 using System.CommandLine;
 using System.CommandLine.Parsing;
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
 using ScadaLink.Commons.Messages.Management;
+using ScadaLink.Security;
 
 namespace ScadaLink.CLI.Commands;
 
 internal static class CommandHelpers
 {
-    internal static AuthenticatedUser PlaceholderUser { get; } =
-        new("cli-user", "CLI User", ["Admin", "Design", "Deployment"], Array.Empty<string>());
-
     internal static string NewCorrelationId() => Guid.NewGuid().ToString("N");
 
     internal static async Task<int> ExecuteCommandAsync(
         ParseResult result,
         Option<string> contactPointsOption,
         Option<string> formatOption,
+        Option<string> usernameOption,
+        Option<string> passwordOption,
         object command)
     {
         var contactPointsRaw = result.GetValue(contactPointsOption);
+        var format = result.GetValue(formatOption) ?? "json";
+
+        var config = CliConfig.Load();
 
         if (string.IsNullOrWhiteSpace(contactPointsRaw))
         {
-            var config = CliConfig.Load();
             if (config.ContactPoints.Count > 0)
                 contactPointsRaw = string.Join(",", config.ContactPoints);
         }
@@ -34,21 +40,97 @@ internal static class CommandHelpers
 
         var contactPoints = contactPointsRaw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
 
+        // Authenticate via LDAP
+        var username = result.GetValue(usernameOption);
+        var password = result.GetValue(passwordOption);
+
+        if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(password))
+        {
+            OutputFormatter.WriteError(
+                "Credentials required. Use --username and --password options.",
+                "NO_CREDENTIALS");
+            return 1;
+        }
+
+        // Authenticate against LDAP
+        var securityOptions = new SecurityOptions
+        {
+            LdapServer = config.LdapServer ?? string.Empty,
+            LdapPort = config.LdapPort,
+            LdapUseTls = config.LdapUseTls,
+            AllowInsecureLdap = !config.LdapUseTls,
+            LdapSearchBase = config.LdapSearchBase,
+            LdapServiceAccountDn = config.LdapServiceAccountDn,
+            LdapServiceAccountPassword = config.LdapServiceAccountPassword
+        };
+
+        var ldapAuth = new LdapAuthService(
+            Options.Create(securityOptions),
+            NullLogger<LdapAuthService>.Instance);
+
+        var authResult = await ldapAuth.AuthenticateAsync(username, password);
+
+        if (!authResult.Success)
+        {
+            OutputFormatter.WriteError(
+                authResult.ErrorMessage ?? "Authentication failed.",
+                "AUTH_FAILED");
+            return 1;
+        }
+
         await using var connection = new ClusterConnection();
         await connection.ConnectAsync(contactPoints, TimeSpan.FromSeconds(10));
 
-        var envelope = new ManagementEnvelope(PlaceholderUser, command, NewCorrelationId());
+        // Resolve roles server-side
+        var resolveEnvelope = new ManagementEnvelope(
+            new AuthenticatedUser(authResult.Username!, authResult.DisplayName!, Array.Empty<string>(), Array.Empty<string>()),
+            new ResolveRolesCommand(authResult.Groups ?? (IReadOnlyList<string>)Array.Empty<string>()),
+            NewCorrelationId());
+        var resolveResponse = await connection.AskManagementAsync(resolveEnvelope, TimeSpan.FromSeconds(30));
+
+        string[] roles;
+        string[] permittedSiteIds;
+
+        if (resolveResponse is ManagementSuccess resolveSuccess)
+        {
+            var rolesDoc = JsonDocument.Parse(resolveSuccess.JsonData);
+            roles = rolesDoc.RootElement.TryGetProperty("Roles", out var rolesEl)
+                ? rolesEl.EnumerateArray().Select(e => e.GetString()!).ToArray()
+                : Array.Empty<string>();
+            permittedSiteIds = rolesDoc.RootElement.TryGetProperty("PermittedSiteIds", out var sitesEl)
+                ? sitesEl.EnumerateArray().Select(e => e.GetString()!).ToArray()
+                : Array.Empty<string>();
+        }
+        else
+        {
+            return HandleResponse(resolveResponse, format);
+        }
+
+        var authenticatedUser = new AuthenticatedUser(
+            authResult.Username!,
+            authResult.DisplayName!,
+            roles,
+            permittedSiteIds);
+
+        var envelope = new ManagementEnvelope(authenticatedUser, command, NewCorrelationId());
         var response = await connection.AskManagementAsync(envelope, TimeSpan.FromSeconds(30));
 
-        return HandleResponse(response);
+        return HandleResponse(response, format);
     }
 
-    internal static int HandleResponse(object response)
+    internal static int HandleResponse(object response, string format)
     {
         switch (response)
         {
             case ManagementSuccess success:
-                Console.WriteLine(success.JsonData);
+                if (string.Equals(format, "table", StringComparison.OrdinalIgnoreCase))
+                {
+                    WriteAsTable(success.JsonData);
+                }
+                else
+                {
+                    Console.WriteLine(success.JsonData);
+                }
                 return 0;
 
             case ManagementError error:
@@ -64,4 +146,51 @@ internal static class CommandHelpers
                 return 1;
         }
     }
+
+    private static void WriteAsTable(string json)
+    {
+        using var doc = JsonDocument.Parse(json);
+        var root = doc.RootElement;
+
+        if (root.ValueKind == JsonValueKind.Array)
+        {
+            var items = root.EnumerateArray().ToList();
+            if (items.Count == 0)
+            {
+                Console.WriteLine("(no results)");
+                return;
+            }
+
+            // Extract headers from first object's property names
+            var headers = items[0].ValueKind == JsonValueKind.Object
+                ? items[0].EnumerateObject().Select(p => p.Name).ToArray()
+                : new[] { "Value" };
+
+            var rows = items.Select(item =>
+            {
+                if (item.ValueKind == JsonValueKind.Object)
+                {
+                    return headers.Select(h =>
+                        item.TryGetProperty(h, out var val)
+                            ? val.ValueKind == JsonValueKind.Null ? "" : val.ToString()
+                            : "").ToArray();
+                }
+                return new[] { item.ToString() };
+            });
+
+            OutputFormatter.WriteTable(rows, headers);
+        }
+        else if (root.ValueKind == JsonValueKind.Object)
+        {
+            // Single object: render as key-value pairs
+            var headers = new[] { "Property", "Value" };
+            var rows = root.EnumerateObject().Select(p =>
+                new[] { p.Name, p.Value.ValueKind == JsonValueKind.Null ? "" : p.Value.ToString() });
+            OutputFormatter.WriteTable(rows, headers);
+        }
+        else
+        {
+            Console.WriteLine(root.ToString());
+        }
+    }
 }

src/ScadaLink.CLI/Commands/DataConnectionCommands.cs

@@ -6,22 +6,22 @@ namespace ScadaLink.CLI.Commands;
 
 public static class DataConnectionCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("data-connection") { Description = "Manage data connections" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
-        command.Add(BuildAssign(contactPointsOption, formatOption));
-        command.Add(BuildUnassign(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildAssign(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUnassign(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Data connection ID", Required = true };
         var cmd = new Command("get") { Description = "Get a data connection by ID" };
@@ -30,12 +30,12 @@ public static class DataConnectionCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetDataConnectionCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetDataConnectionCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Data connection ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Connection name", Required = true };
@@ -54,13 +54,13 @@ public static class DataConnectionCommands
             var protocol = result.GetValue(protocolOption)!;
             var config = result.GetValue(configOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateDataConnectionCommand(id, name, protocol, config));
         });
         return cmd;
     }
 
-    private static Command BuildUnassign(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUnassign(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--assignment-id") { Description = "Assignment ID", Required = true };
         var cmd = new Command("unassign") { Description = "Unassign a data connection from a site" };
@@ -69,23 +69,23 @@ public static class DataConnectionCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new UnassignDataConnectionFromSiteCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new UnassignDataConnectionFromSiteCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all data connections" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListDataConnectionsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListDataConnectionsCommand());
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Connection name", Required = true };
         var protocolOption = new Option<string>("--protocol") { Description = "Protocol (e.g. OpcUa)", Required = true };
@@ -101,13 +101,13 @@ public static class DataConnectionCommands
             var protocol = result.GetValue(protocolOption)!;
             var config = result.GetValue(configOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateDataConnectionCommand(name, protocol, config));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Data connection ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete a data connection" };
@@ -116,12 +116,12 @@ public static class DataConnectionCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteDataConnectionCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteDataConnectionCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildAssign(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildAssign(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var connectionIdOption = new Option<int>("--connection-id") { Description = "Data connection ID", Required = true };
         var siteIdOption = new Option<int>("--site-id") { Description = "Site ID", Required = true };
@@ -134,7 +134,7 @@ public static class DataConnectionCommands
             var connectionId = result.GetValue(connectionIdOption);
             var siteId = result.GetValue(siteIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new AssignDataConnectionToSiteCommand(connectionId, siteId));
         });
         return cmd;

src/ScadaLink.CLI/Commands/DbConnectionCommands.cs

@@ -6,31 +6,31 @@ namespace ScadaLink.CLI.Commands;
 
 public static class DbConnectionCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("db-connection") { Description = "Manage database connections" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all database connections" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListDatabaseConnectionsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListDatabaseConnectionsCommand());
         });
         return cmd;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Database connection ID", Required = true };
         var cmd = new Command("get") { Description = "Get a database connection by ID" };
@@ -39,12 +39,12 @@ public static class DbConnectionCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetDatabaseConnectionCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetDatabaseConnectionCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Connection name", Required = true };
         var connStrOption = new Option<string>("--connection-string") { Description = "Connection string", Required = true };
@@ -57,13 +57,13 @@ public static class DbConnectionCommands
             var name = result.GetValue(nameOption)!;
             var connStr = result.GetValue(connStrOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateDatabaseConnectionDefCommand(name, connStr));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Database connection ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Connection name", Required = true };
@@ -79,13 +79,13 @@ public static class DbConnectionCommands
             var name = result.GetValue(nameOption)!;
             var connStr = result.GetValue(connStrOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateDatabaseConnectionDefCommand(id, name, connStr));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Database connection ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete a database connection" };
@@ -94,7 +94,7 @@ public static class DbConnectionCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteDatabaseConnectionDefCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteDatabaseConnectionDefCommand(id));
         });
         return cmd;
     }

src/ScadaLink.CLI/Commands/DebugCommands.cs

@@ -6,16 +6,16 @@ namespace ScadaLink.CLI.Commands;
 
 public static class DebugCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("debug") { Description = "Runtime debugging" };
 
-        command.Add(BuildSnapshot(contactPointsOption, formatOption));
+        command.Add(BuildSnapshot(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildSnapshot(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildSnapshot(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var cmd = new Command("snapshot") { Description = "Get a point-in-time snapshot of instance attribute values and alarm states" };
@@ -23,7 +23,7 @@ public static class DebugCommands
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new DebugSnapshotCommand(result.GetValue(idOption)));
         });
         return cmd;

src/ScadaLink.CLI/Commands/DeployCommands.cs

@@ -6,18 +6,18 @@ namespace ScadaLink.CLI.Commands;
 
 public static class DeployCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("deploy") { Description = "Deployment operations" };
 
-        command.Add(BuildInstance(contactPointsOption, formatOption));
-        command.Add(BuildArtifacts(contactPointsOption, formatOption));
-        command.Add(BuildStatus(contactPointsOption, formatOption));
+        command.Add(BuildInstance(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildArtifacts(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildStatus(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildInstance(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildInstance(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var cmd = new Command("instance") { Description = "Deploy a single instance" };
@@ -26,12 +26,12 @@ public static class DeployCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new MgmtDeployInstanceCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new MgmtDeployInstanceCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildArtifacts(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildArtifacts(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var siteIdOption = new Option<int?>("--site-id") { Description = "Target site ID (all sites if omitted)" };
         var cmd = new Command("artifacts") { Description = "Deploy artifacts to site(s)" };
@@ -40,12 +40,12 @@ public static class DeployCommands
         {
             var siteId = result.GetValue(siteIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new MgmtDeployArtifactsCommand(siteId));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new MgmtDeployArtifactsCommand(siteId));
         });
         return cmd;
     }
 
-    private static Command BuildStatus(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildStatus(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var instanceIdOption = new Option<int?>("--instance-id") { Description = "Filter by instance ID" };
         var statusOption = new Option<string?>("--status") { Description = "Filter by status" };
@@ -66,7 +66,7 @@ public static class DeployCommands
             var page = result.GetValue(pageOption);
             var pageSize = result.GetValue(pageSizeOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new QueryDeploymentsCommand(instanceId, status, page, pageSize));
         });
         return cmd;

src/ScadaLink.CLI/Commands/ExternalSystemCommands.cs

@@ -6,21 +6,21 @@ namespace ScadaLink.CLI.Commands;
 
 public static class ExternalSystemCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("external-system") { Description = "Manage external systems" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
-        command.Add(BuildMethodGroup(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildMethodGroup(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "External system ID", Required = true };
         var cmd = new Command("get") { Description = "Get an external system by ID" };
@@ -29,12 +29,12 @@ public static class ExternalSystemCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetExternalSystemCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetExternalSystemCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "External system ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "System name", Required = true };
@@ -56,24 +56,24 @@ public static class ExternalSystemCommands
             var authType = result.GetValue(authTypeOption)!;
             var authConfig = result.GetValue(authConfigOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateExternalSystemCommand(id, name, url, authType, authConfig));
         });
         return cmd;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all external systems" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListExternalSystemsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListExternalSystemsCommand());
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "System name", Required = true };
         var urlOption = new Option<string>("--endpoint-url") { Description = "Endpoint URL", Required = true };
@@ -92,13 +92,13 @@ public static class ExternalSystemCommands
             var authType = result.GetValue(authTypeOption)!;
             var authConfig = result.GetValue(authConfigOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateExternalSystemCommand(name, url, authType, authConfig));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "External system ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete an external system" };
@@ -107,25 +107,25 @@ public static class ExternalSystemCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteExternalSystemCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteExternalSystemCommand(id));
         });
         return cmd;
     }
 
-    // ── Method subcommands ──
+    // -- Method subcommands --
 
-    private static Command BuildMethodGroup(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildMethodGroup(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("method") { Description = "Manage external system methods" };
-        group.Add(BuildMethodList(contactPointsOption, formatOption));
-        group.Add(BuildMethodGet(contactPointsOption, formatOption));
-        group.Add(BuildMethodCreate(contactPointsOption, formatOption));
-        group.Add(BuildMethodUpdate(contactPointsOption, formatOption));
-        group.Add(BuildMethodDelete(contactPointsOption, formatOption));
+        group.Add(BuildMethodList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        group.Add(BuildMethodGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        group.Add(BuildMethodCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        group.Add(BuildMethodUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        group.Add(BuildMethodDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
         return group;
     }
 
-    private static Command BuildMethodList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildMethodList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var sysIdOption = new Option<int>("--external-system-id") { Description = "External system ID", Required = true };
         var cmd = new Command("list") { Description = "List methods for an external system" };
@@ -133,13 +133,13 @@ public static class ExternalSystemCommands
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new ListExternalSystemMethodsCommand(result.GetValue(sysIdOption)));
         });
         return cmd;
     }
 
-    private static Command BuildMethodGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildMethodGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Method ID", Required = true };
         var cmd = new Command("get") { Description = "Get an external system method by ID" };
@@ -147,13 +147,13 @@ public static class ExternalSystemCommands
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new GetExternalSystemMethodCommand(result.GetValue(idOption)));
         });
         return cmd;
     }
 
-    private static Command BuildMethodCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildMethodCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var sysIdOption = new Option<int>("--external-system-id") { Description = "External system ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Method name", Required = true };
@@ -172,7 +172,7 @@ public static class ExternalSystemCommands
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateExternalSystemMethodCommand(
                     result.GetValue(sysIdOption),
                     result.GetValue(nameOption)!,
@@ -184,7 +184,7 @@ public static class ExternalSystemCommands
         return cmd;
     }
 
-    private static Command BuildMethodUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildMethodUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Method ID", Required = true };
         var nameOption = new Option<string?>("--name") { Description = "Method name" };
@@ -203,7 +203,7 @@ public static class ExternalSystemCommands
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateExternalSystemMethodCommand(
                     result.GetValue(idOption),
                     result.GetValue(nameOption),
@@ -215,7 +215,7 @@ public static class ExternalSystemCommands
         return cmd;
     }
 
-    private static Command BuildMethodDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildMethodDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Method ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete an external system method" };
@@ -223,7 +223,7 @@ public static class ExternalSystemCommands
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new DeleteExternalSystemMethodCommand(result.GetValue(idOption)));
         });
         return cmd;

src/ScadaLink.CLI/Commands/HealthCommands.cs

@@ -6,30 +6,30 @@ namespace ScadaLink.CLI.Commands;
 
 public static class HealthCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("health") { Description = "Health monitoring" };
 
-        command.Add(BuildSummary(contactPointsOption, formatOption));
-        command.Add(BuildSite(contactPointsOption, formatOption));
-        command.Add(BuildEventLog(contactPointsOption, formatOption));
-        command.Add(BuildParkedMessages(contactPointsOption, formatOption));
+        command.Add(BuildSummary(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildSite(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildEventLog(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildParkedMessages(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildSummary(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildSummary(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("summary") { Description = "Get system health summary" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetHealthSummaryCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetHealthSummaryCommand());
         });
         return cmd;
     }
 
-    private static Command BuildSite(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildSite(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var identifierOption = new Option<string>("--identifier") { Description = "Site identifier", Required = true };
         var cmd = new Command("site") { Description = "Get health for a specific site" };
@@ -38,12 +38,12 @@ public static class HealthCommands
         {
             var identifier = result.GetValue(identifierOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetSiteHealthCommand(identifier));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetSiteHealthCommand(identifier));
         });
         return cmd;
     }
 
-    private static Command BuildEventLog(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildEventLog(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var siteOption = new Option<string>("--site") { Description = "Site identifier", Required = true };
         var eventTypeOption = new Option<string?>("--event-type") { Description = "Filter by event type" };
@@ -55,6 +55,7 @@ public static class HealthCommands
         pageOption.DefaultValueFactory = _ => 1;
         var pageSizeOption = new Option<int>("--page-size") { Description = "Page size" };
         pageSizeOption.DefaultValueFactory = _ => 50;
+        var instanceNameOption = new Option<string?>("--instance-name") { Description = "Filter by instance name" };
 
         var cmd = new Command("event-log") { Description = "Query site event logs" };
         cmd.Add(siteOption);
@@ -65,10 +66,11 @@ public static class HealthCommands
         cmd.Add(toOption);
         cmd.Add(pageOption);
         cmd.Add(pageSizeOption);
+        cmd.Add(instanceNameOption);
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new QueryEventLogsCommand(
                     result.GetValue(siteOption)!,
                     result.GetValue(eventTypeOption),
@@ -77,12 +79,13 @@ public static class HealthCommands
                     result.GetValue(fromOption),
                     result.GetValue(toOption),
                     result.GetValue(pageOption),
-                    result.GetValue(pageSizeOption)));
+                    result.GetValue(pageSizeOption),
+                    result.GetValue(instanceNameOption)));
         });
         return cmd;
     }
 
-    private static Command BuildParkedMessages(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildParkedMessages(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var siteOption = new Option<string>("--site") { Description = "Site identifier", Required = true };
         var pageOption = new Option<int>("--page") { Description = "Page number" };
@@ -97,7 +100,7 @@ public static class HealthCommands
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new QueryParkedMessagesCommand(
                     result.GetValue(siteOption)!,
                     result.GetValue(pageOption),

src/ScadaLink.CLI/Commands/InstanceCommands.cs

@@ -6,23 +6,26 @@ namespace ScadaLink.CLI.Commands;
 
 public static class InstanceCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("instance") { Description = "Manage instances" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildSetBindings(contactPointsOption, formatOption));
-        command.Add(BuildDeploy(contactPointsOption, formatOption));
-        command.Add(BuildEnable(contactPointsOption, formatOption));
-        command.Add(BuildDisable(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildSetBindings(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildSetOverrides(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildSetArea(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDiff(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDeploy(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildEnable(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDisable(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var cmd = new Command("get") { Description = "Get an instance by ID" };
@@ -31,12 +34,12 @@ public static class InstanceCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetInstanceCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetInstanceCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildSetBindings(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildSetBindings(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var bindingsOption = new Option<string>("--bindings") { Description = "JSON array of [attributeName, dataConnectionId] pairs", Required = true };
@@ -53,13 +56,13 @@ public static class InstanceCommands
             var bindings = pairs.Select(p =>
                 (p[0].ToString()!, int.Parse(p[1].ToString()!))).ToList();
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new SetConnectionBindingsCommand(id, bindings));
         });
         return cmd;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var siteIdOption = new Option<int?>("--site-id") { Description = "Filter by site ID" };
         var templateIdOption = new Option<int?>("--template-id") { Description = "Filter by template ID" };
@@ -75,13 +78,13 @@ public static class InstanceCommands
             var templateId = result.GetValue(templateIdOption);
             var search = result.GetValue(searchOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new ListInstancesCommand(siteId, templateId, search));
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Unique instance name", Required = true };
         var templateIdOption = new Option<int>("--template-id") { Description = "Template ID", Required = true };
@@ -100,13 +103,13 @@ public static class InstanceCommands
             var siteId = result.GetValue(siteIdOption);
             var areaId = result.GetValue(areaIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateInstanceCommand(name, templateId, siteId, areaId));
         });
         return cmd;
     }
 
-    private static Command BuildDeploy(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDeploy(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var cmd = new Command("deploy") { Description = "Deploy an instance" };
@@ -115,12 +118,12 @@ public static class InstanceCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new MgmtDeployInstanceCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new MgmtDeployInstanceCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildEnable(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildEnable(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var cmd = new Command("enable") { Description = "Enable an instance" };
@@ -129,12 +132,12 @@ public static class InstanceCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new MgmtEnableInstanceCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new MgmtEnableInstanceCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildDisable(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDisable(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var cmd = new Command("disable") { Description = "Disable an instance" };
@@ -143,12 +146,12 @@ public static class InstanceCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new MgmtDisableInstanceCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new MgmtDisableInstanceCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete an instance" };
@@ -157,7 +160,63 @@ public static class InstanceCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new MgmtDeleteInstanceCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new MgmtDeleteInstanceCommand(id));
+        });
+        return cmd;
+    }
+
+    private static Command BuildSetOverrides(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
+    {
+        var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
+        var overridesOption = new Option<string>("--overrides") { Description = "JSON object of attribute name -> value pairs, e.g. {\"Speed\": \"100\", \"Mode\": null}", Required = true };
+
+        var cmd = new Command("set-overrides") { Description = "Set attribute overrides for an instance" };
+        cmd.Add(idOption);
+        cmd.Add(overridesOption);
+        cmd.SetAction(async (ParseResult result) =>
+        {
+            var id = result.GetValue(idOption);
+            var overridesJson = result.GetValue(overridesOption)!;
+            var overrides = System.Text.Json.JsonSerializer.Deserialize<Dictionary<string, string?>>(overridesJson)
+                ?? throw new InvalidOperationException("Invalid overrides JSON");
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
+                new SetInstanceOverridesCommand(id, overrides));
+        });
+        return cmd;
+    }
+
+    private static Command BuildSetArea(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
+    {
+        var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
+        var areaIdOption = new Option<int?>("--area-id") { Description = "Area ID (omit to clear area assignment)" };
+
+        var cmd = new Command("set-area") { Description = "Reassign an instance to a different area" };
+        cmd.Add(idOption);
+        cmd.Add(areaIdOption);
+        cmd.SetAction(async (ParseResult result) =>
+        {
+            var id = result.GetValue(idOption);
+            var areaId = result.GetValue(areaIdOption);
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
+                new SetInstanceAreaCommand(id, areaId));
+        });
+        return cmd;
+    }
+
+    private static Command BuildDiff(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
+    {
+        var idOption = new Option<int>("--id") { Description = "Instance ID", Required = true };
+
+        var cmd = new Command("diff") { Description = "Show deployment diff (deployed vs current template)" };
+        cmd.Add(idOption);
+        cmd.SetAction(async (ParseResult result) =>
+        {
+            var id = result.GetValue(idOption);
+            return await CommandHelpers.ExecuteCommandAsync(
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
+                new GetDeploymentDiffCommand(id));
         });
         return cmd;
     }

src/ScadaLink.CLI/Commands/NotificationCommands.cs

@@ -6,21 +6,21 @@ namespace ScadaLink.CLI.Commands;
 
 public static class NotificationCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("notification") { Description = "Manage notification lists" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
-        command.Add(BuildSmtp(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildSmtp(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Notification list ID", Required = true };
         var cmd = new Command("get") { Description = "Get a notification list by ID" };
@@ -29,12 +29,12 @@ public static class NotificationCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetNotificationListCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetNotificationListCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Notification list ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "List name", Required = true };
@@ -51,13 +51,13 @@ public static class NotificationCommands
             var emailsRaw = result.GetValue(emailsOption)!;
             var emails = emailsRaw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToList();
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateNotificationListCommand(id, name, emails));
         });
         return cmd;
     }
 
-    private static Command BuildSmtp(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildSmtp(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("smtp") { Description = "Manage SMTP configuration" };
 
@@ -65,7 +65,7 @@ public static class NotificationCommands
         listCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListSmtpConfigsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListSmtpConfigsCommand());
         });
         group.Add(listCmd);
 
@@ -88,7 +88,7 @@ public static class NotificationCommands
             var authMode = result.GetValue(authModeOption)!;
             var from = result.GetValue(fromOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateSmtpConfigCommand(id, server, port, authMode, from));
         });
         group.Add(updateCmd);
@@ -96,18 +96,18 @@ public static class NotificationCommands
         return group;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all notification lists" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListNotificationListsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListNotificationListsCommand());
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Notification list name", Required = true };
         var emailsOption = new Option<string>("--emails") { Description = "Comma-separated recipient emails", Required = true };
@@ -121,13 +121,13 @@ public static class NotificationCommands
             var emailsRaw = result.GetValue(emailsOption)!;
             var emails = emailsRaw.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).ToList();
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateNotificationListCommand(name, emails));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Notification list ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete a notification list" };
@@ -136,7 +136,7 @@ public static class NotificationCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteNotificationListCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteNotificationListCommand(id));
         });
         return cmd;
     }

src/ScadaLink.CLI/Commands/SecurityCommands.cs

@@ -6,18 +6,18 @@ namespace ScadaLink.CLI.Commands;
 
 public static class SecurityCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("security") { Description = "Manage security settings" };
 
-        command.Add(BuildApiKey(contactPointsOption, formatOption));
-        command.Add(BuildRoleMapping(contactPointsOption, formatOption));
-        command.Add(BuildScopeRule(contactPointsOption, formatOption));
+        command.Add(BuildApiKey(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildRoleMapping(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildScopeRule(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildApiKey(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildApiKey(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("api-key") { Description = "Manage API keys" };
 
@@ -25,7 +25,7 @@ public static class SecurityCommands
         listCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListApiKeysCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListApiKeysCommand());
         });
         group.Add(listCmd);
 
@@ -36,7 +36,7 @@ public static class SecurityCommands
         {
             var name = result.GetValue(nameOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new CreateApiKeyCommand(name));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new CreateApiKeyCommand(name));
         });
         group.Add(createCmd);
 
@@ -47,7 +47,7 @@ public static class SecurityCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteApiKeyCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteApiKeyCommand(id));
         });
         group.Add(deleteCmd);
 
@@ -61,14 +61,14 @@ public static class SecurityCommands
             var id = result.GetValue(updateIdOption);
             var enabled = result.GetValue(enabledOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new UpdateApiKeyCommand(id, enabled));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new UpdateApiKeyCommand(id, enabled));
         });
         group.Add(updateCmd);
 
         return group;
     }
 
-    private static Command BuildRoleMapping(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildRoleMapping(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("role-mapping") { Description = "Manage LDAP role mappings" };
 
@@ -76,7 +76,7 @@ public static class SecurityCommands
         listCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListRoleMappingsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListRoleMappingsCommand());
         });
         group.Add(listCmd);
 
@@ -90,7 +90,7 @@ public static class SecurityCommands
             var ldapGroup = result.GetValue(ldapGroupOption)!;
             var role = result.GetValue(roleOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateRoleMappingCommand(ldapGroup, role));
         });
         group.Add(createCmd);
@@ -102,7 +102,7 @@ public static class SecurityCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteRoleMappingCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteRoleMappingCommand(id));
         });
         group.Add(deleteCmd);
 
@@ -119,7 +119,7 @@ public static class SecurityCommands
             var ldapGroup = result.GetValue(updateLdapGroupOption)!;
             var role = result.GetValue(updateRoleOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateRoleMappingCommand(id, ldapGroup, role));
         });
         group.Add(updateCmd);
@@ -127,7 +127,7 @@ public static class SecurityCommands
         return group;
     }
 
-    private static Command BuildScopeRule(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildScopeRule(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("scope-rule") { Description = "Manage LDAP scope rules" };
 
@@ -138,7 +138,7 @@ public static class SecurityCommands
         {
             var mappingId = result.GetValue(mappingIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListScopeRulesCommand(mappingId));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListScopeRulesCommand(mappingId));
         });
         group.Add(listCmd);
 
@@ -152,7 +152,7 @@ public static class SecurityCommands
             var mappingId = result.GetValue(addMappingIdOption);
             var siteId = result.GetValue(siteIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new AddScopeRuleCommand(mappingId, siteId));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new AddScopeRuleCommand(mappingId, siteId));
         });
         group.Add(addCmd);
 
@@ -163,7 +163,7 @@ public static class SecurityCommands
         {
             var id = result.GetValue(deleteIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteScopeRuleCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteScopeRuleCommand(id));
         });
         group.Add(deleteCmd);
 

src/ScadaLink.CLI/Commands/SharedScriptCommands.cs

@@ -6,31 +6,31 @@ namespace ScadaLink.CLI.Commands;
 
 public static class SharedScriptCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("shared-script") { Description = "Manage shared scripts" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all shared scripts" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListSharedScriptsCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListSharedScriptsCommand());
         });
         return cmd;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Shared script ID", Required = true };
         var cmd = new Command("get") { Description = "Get a shared script by ID" };
@@ -39,12 +39,12 @@ public static class SharedScriptCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetSharedScriptCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetSharedScriptCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Script name", Required = true };
         var codeOption = new Option<string>("--code") { Description = "Script code", Required = true };
@@ -63,13 +63,13 @@ public static class SharedScriptCommands
             var parameters = result.GetValue(parametersOption);
             var returnDef = result.GetValue(returnDefOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateSharedScriptCommand(name, code, parameters, returnDef));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Shared script ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Script name", Required = true };
@@ -91,13 +91,13 @@ public static class SharedScriptCommands
             var parameters = result.GetValue(parametersOption);
             var returnDef = result.GetValue(returnDefOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateSharedScriptCommand(id, name, code, parameters, returnDef));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Shared script ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete a shared script" };
@@ -106,7 +106,7 @@ public static class SharedScriptCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteSharedScriptCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteSharedScriptCommand(id));
         });
         return cmd;
     }

src/ScadaLink.CLI/Commands/SiteCommands.cs

@@ -6,22 +6,22 @@ namespace ScadaLink.CLI.Commands;
 
 public static class SiteCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("site") { Description = "Manage sites" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
-        command.Add(BuildDeployArtifacts(contactPointsOption, formatOption));
-        command.Add(BuildArea(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDeployArtifacts(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildArea(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Site ID", Required = true };
         var cmd = new Command("get") { Description = "Get a site by ID" };
@@ -30,23 +30,23 @@ public static class SiteCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetSiteCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetSiteCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all sites" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListSitesCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListSitesCommand());
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Site name", Required = true };
         var identifierOption = new Option<string>("--identifier") { Description = "Site identifier", Required = true };
@@ -68,13 +68,13 @@ public static class SiteCommands
             var nodeA = result.GetValue(nodeAOption);
             var nodeB = result.GetValue(nodeBOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateSiteCommand(name, identifier, desc, nodeA, nodeB));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Site ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Site name", Required = true };
@@ -96,13 +96,13 @@ public static class SiteCommands
             var nodeA = result.GetValue(nodeAOption);
             var nodeB = result.GetValue(nodeBOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateSiteCommand(id, name, desc, nodeA, nodeB));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Site ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete a site" };
@@ -111,12 +111,12 @@ public static class SiteCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteSiteCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteSiteCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildArea(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildArea(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("area") { Description = "Manage areas" };
 
@@ -127,7 +127,7 @@ public static class SiteCommands
         {
             var siteId = result.GetValue(siteIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListAreasCommand(siteId));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListAreasCommand(siteId));
         });
         group.Add(listCmd);
 
@@ -144,7 +144,7 @@ public static class SiteCommands
             var name = result.GetValue(nameOption)!;
             var parentId = result.GetValue(parentOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateAreaCommand(siteId, name, parentId));
         });
         group.Add(createCmd);
@@ -159,7 +159,7 @@ public static class SiteCommands
             var id = result.GetValue(updateIdOption);
             var name = result.GetValue(updateNameOption)!;
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new UpdateAreaCommand(id, name));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new UpdateAreaCommand(id, name));
         });
         group.Add(updateCmd);
 
@@ -170,14 +170,14 @@ public static class SiteCommands
         {
             var id = result.GetValue(deleteIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteAreaCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteAreaCommand(id));
         });
         group.Add(deleteCmd);
 
         return group;
     }
 
-    private static Command BuildDeployArtifacts(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDeployArtifacts(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var siteIdOption = new Option<int?>("--site-id") { Description = "Target site ID (all sites if omitted)" };
         var cmd = new Command("deploy-artifacts") { Description = "Deploy artifacts to site(s)" };
@@ -186,7 +186,7 @@ public static class SiteCommands
         {
             var siteId = result.GetValue(siteIdOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new MgmtDeployArtifactsCommand(siteId));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new MgmtDeployArtifactsCommand(siteId));
         });
         return cmd;
     }

src/ScadaLink.CLI/Commands/TemplateCommands.cs

@@ -6,36 +6,36 @@ namespace ScadaLink.CLI.Commands;
 
 public static class TemplateCommands
 {
-    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption)
+    public static Command Build(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var command = new Command("template") { Description = "Manage templates" };
 
-        command.Add(BuildList(contactPointsOption, formatOption));
-        command.Add(BuildGet(contactPointsOption, formatOption));
-        command.Add(BuildCreate(contactPointsOption, formatOption));
-        command.Add(BuildUpdate(contactPointsOption, formatOption));
-        command.Add(BuildValidate(contactPointsOption, formatOption));
-        command.Add(BuildDelete(contactPointsOption, formatOption));
-        command.Add(BuildAttribute(contactPointsOption, formatOption));
-        command.Add(BuildAlarm(contactPointsOption, formatOption));
-        command.Add(BuildScript(contactPointsOption, formatOption));
-        command.Add(BuildComposition(contactPointsOption, formatOption));
+        command.Add(BuildList(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildGet(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildCreate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildUpdate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildValidate(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildDelete(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildAttribute(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildAlarm(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildScript(contactPointsOption, formatOption, usernameOption, passwordOption));
+        command.Add(BuildComposition(contactPointsOption, formatOption, usernameOption, passwordOption));
 
         return command;
     }
 
-    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildList(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var cmd = new Command("list") { Description = "List all templates" };
         cmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ListTemplatesCommand());
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ListTemplatesCommand());
         });
         return cmd;
     }
 
-    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildGet(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
         var cmd = new Command("get") { Description = "Get a template by ID" };
@@ -44,12 +44,12 @@ public static class TemplateCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new GetTemplateCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new GetTemplateCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildCreate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var nameOption = new Option<string>("--name") { Description = "Template name", Required = true };
         var descOption = new Option<string?>("--description") { Description = "Template description" };
@@ -65,13 +65,13 @@ public static class TemplateCommands
             var desc = result.GetValue(descOption);
             var parentId = result.GetValue(parentOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new CreateTemplateCommand(name, desc, parentId));
         });
         return cmd;
     }
 
-    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildUpdate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
         var nameOption = new Option<string>("--name") { Description = "Template name", Required = true };
@@ -90,13 +90,13 @@ public static class TemplateCommands
             var desc = result.GetValue(descOption);
             var parentId = result.GetValue(parentOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateTemplateCommand(id, name, desc, parentId));
         });
         return cmd;
     }
 
-    private static Command BuildValidate(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildValidate(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
         var cmd = new Command("validate") { Description = "Validate a template" };
@@ -105,12 +105,12 @@ public static class TemplateCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new ValidateTemplateCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new ValidateTemplateCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildDelete(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var idOption = new Option<int>("--id") { Description = "Template ID", Required = true };
         var cmd = new Command("delete") { Description = "Delete a template" };
@@ -119,12 +119,12 @@ public static class TemplateCommands
         {
             var id = result.GetValue(idOption);
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption, new DeleteTemplateCommand(id));
+                result, contactPointsOption, formatOption, usernameOption, passwordOption, new DeleteTemplateCommand(id));
         });
         return cmd;
     }
 
-    private static Command BuildAttribute(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildAttribute(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("attribute") { Description = "Manage template attributes" };
 
@@ -148,7 +148,7 @@ public static class TemplateCommands
         addCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new AddTemplateAttributeCommand(
                     result.GetValue(templateIdOption),
                     result.GetValue(nameOption)!,
@@ -180,7 +180,7 @@ public static class TemplateCommands
         updateCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateTemplateAttributeCommand(
                     result.GetValue(updateIdOption),
                     result.GetValue(updateNameOption)!,
@@ -198,7 +198,7 @@ public static class TemplateCommands
         deleteCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new DeleteTemplateAttributeCommand(result.GetValue(deleteIdOption)));
         });
         group.Add(deleteCmd);
@@ -206,7 +206,7 @@ public static class TemplateCommands
         return group;
     }
 
-    private static Command BuildAlarm(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildAlarm(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("alarm") { Description = "Manage template alarms" };
 
@@ -230,7 +230,7 @@ public static class TemplateCommands
         addCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new AddTemplateAlarmCommand(
                     result.GetValue(templateIdOption),
                     result.GetValue(nameOption)!,
@@ -262,7 +262,7 @@ public static class TemplateCommands
         updateCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateTemplateAlarmCommand(
                     result.GetValue(updateIdOption),
                     result.GetValue(updateNameOption)!,
@@ -280,7 +280,7 @@ public static class TemplateCommands
         deleteCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new DeleteTemplateAlarmCommand(result.GetValue(deleteIdOption)));
         });
         group.Add(deleteCmd);
@@ -288,7 +288,7 @@ public static class TemplateCommands
         return group;
     }
 
-    private static Command BuildScript(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildScript(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("script") { Description = "Manage template scripts" };
 
@@ -315,7 +315,7 @@ public static class TemplateCommands
         addCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new AddTemplateScriptCommand(
                     result.GetValue(templateIdOption),
                     result.GetValue(nameOption)!,
@@ -351,7 +351,7 @@ public static class TemplateCommands
         updateCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new UpdateTemplateScriptCommand(
                     result.GetValue(updateIdOption),
                     result.GetValue(updateNameOption)!,
@@ -370,7 +370,7 @@ public static class TemplateCommands
         deleteCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new DeleteTemplateScriptCommand(result.GetValue(deleteIdOption)));
         });
         group.Add(deleteCmd);
@@ -378,7 +378,7 @@ public static class TemplateCommands
         return group;
     }
 
-    private static Command BuildComposition(Option<string> contactPointsOption, Option<string> formatOption)
+    private static Command BuildComposition(Option<string> contactPointsOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
     {
         var group = new Command("composition") { Description = "Manage template compositions" };
 
@@ -393,7 +393,7 @@ public static class TemplateCommands
         addCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new AddTemplateCompositionCommand(
                     result.GetValue(templateIdOption),
                     result.GetValue(instanceNameOption)!,
@@ -407,7 +407,7 @@ public static class TemplateCommands
         deleteCmd.SetAction(async (ParseResult result) =>
         {
             return await CommandHelpers.ExecuteCommandAsync(
-                result, contactPointsOption, formatOption,
+                result, contactPointsOption, formatOption, usernameOption, passwordOption,
                 new DeleteTemplateCompositionCommand(result.GetValue(deleteIdOption)));
         });
         group.Add(deleteCmd);

src/ScadaLink.CLI/Program.cs

@@ -16,20 +16,20 @@ rootCommand.Add(passwordOption);
 rootCommand.Add(formatOption);
 
 // Register command groups
-rootCommand.Add(TemplateCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(InstanceCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(SiteCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(DeployCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(DataConnectionCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(ExternalSystemCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(NotificationCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(SecurityCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(AuditLogCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(HealthCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(DebugCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(SharedScriptCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(DbConnectionCommands.Build(contactPointsOption, formatOption));
-rootCommand.Add(ApiMethodCommands.Build(contactPointsOption, formatOption));
+rootCommand.Add(TemplateCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(InstanceCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(SiteCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(DeployCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(DataConnectionCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(ExternalSystemCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(NotificationCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(SecurityCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(AuditLogCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(HealthCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(DebugCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(SharedScriptCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(DbConnectionCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
+rootCommand.Add(ApiMethodCommands.Build(contactPointsOption, formatOption, usernameOption, passwordOption));
 
 rootCommand.SetAction(_ =>
 {

src/ScadaLink.CLI/README.md

@@ -41,8 +41,8 @@ These options are accepted by the root command and inherited by all subcommands.
 | Option | Description |
 |--------|-------------|
 | `--contact-points <value>` | Comma-separated Akka cluster contact point URIs |
-| `--username <value>` | LDAP username (reserved for future auth integration) |
-| `--password <value>` | LDAP password (reserved for future auth integration) |
+| `--username <value>` | LDAP username for authentication |
+| `--password <value>` | LDAP password for authentication |
 | `--format <json\|table>` | Output format (default: `json`) |
 
 ## Configuration File
@@ -55,12 +55,19 @@ These options are accepted by the root command and inherited by all subcommands.
   "ldap": {
     "server": "ldap.company.com",
     "port": 636,
-    "useTls": true
+    "useTls": true,
+    "searchBase": "dc=example,dc=com",
+    "serviceAccountDn": "cn=admin,dc=example,dc=com",
+    "serviceAccountPassword": "secret"
   },
   "defaultFormat": "json"
 }
 ```
 
+The `searchBase` and `serviceAccountDn`/`serviceAccountPassword` fields are required for LDAP servers that need search-then-bind authentication (including the test GLAuth server). Without them, direct bind with `cn={username},{searchBase}` is attempted, which may fail if the user's DN doesn't follow that pattern.
+
+For the Docker test environment, see `docker/README.md` for a ready-to-use config.
+
 ## Environment Variables
 
 | Variable | Description |
@@ -435,7 +442,7 @@ scadalink --contact-points <uri> instance set-bindings --id <int> --bindings <js
 | Option | Required | Description |
 |--------|----------|-------------|
 | `--id` | yes | Instance ID |
-| `--bindings` | yes | JSON string mapping attribute names to data connection IDs (e.g. `{"attr1": 1, "attr2": 2}`) |
+| `--bindings` | yes | JSON array of `[attributeName, dataConnectionId]` pairs (e.g. `[["Speed",7],["Temperature",7]]`) |
 
 ---
 
@@ -1270,7 +1277,7 @@ The CLI connects to the Central cluster using Akka.NET's `ClusterClient`. It doe
 
 The connection is established per-command invocation and torn down cleanly via `CoordinatedShutdown` when the command completes.
 
-Role enforcement is applied by the ManagementActor on the server side. The current CLI placeholder user carries `Admin`, `Design`, and `Deployment` roles; production use will integrate LDAP authentication via `--username` / `--password`.
+Role enforcement is applied by the ManagementActor on the server side. The CLI authenticates against LDAP using `--username` / `--password`, resolves LDAP group memberships, then maps groups to ScadaLink roles (Admin, Design, Deployment) via role mappings configured in the security settings. Operations require the appropriate role — for example, creating templates requires `Design`, deploying requires `Deployment`. In the test environment, use the `multi-role` user (password: `password`) which has all three roles.
 
 ## Issues & Missing Features
 

src/ScadaLink.CLI/ScadaLink.CLI.csproj

@@ -7,14 +7,20 @@
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <AssemblyName>scadalink</AssemblyName>
   </PropertyGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="ScadaLink.CLI.Tests" />
+  </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Akka" Version="1.5.62" />
     <PackageReference Include="Akka.Remote" Version="1.5.62" />
     <PackageReference Include="Akka.Cluster.Tools" Version="1.5.62" />
     <PackageReference Include="System.CommandLine" Version="2.0.5" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.5" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.5" />
     <PackageReference Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="../ScadaLink.Commons/ScadaLink.Commons.csproj" />
+    <ProjectReference Include="../ScadaLink.Security/ScadaLink.Security.csproj" />
   </ItemGroup>
 </Project>

src/ScadaLink.CentralUI/Components/Pages/Deployment/Instances.razor

@@ -65,6 +65,16 @@
                                 }
                             </select>
                         </div>
+                        <div class="col-md-2">
+                            <label class="form-label small">Area</label>
+                            <select class="form-select form-select-sm" @bind="_createAreaId">
+                                <option value="0">No area</option>
+                                @foreach (var a in _allAreas.Where(a => a.SiteId == _createSiteId))
+                                {
+                                    <option value="@a.Id">@a.Name</option>
+                                }
+                            </select>
+                        </div>
                         <div class="col-md-2">
                             <button class="btn btn-success btn-sm me-1" @onclick="CreateInstance">Create</button>
                             <button class="btn btn-outline-secondary btn-sm" @onclick="() => _showCreateForm = false">Cancel</button>
@@ -181,10 +191,62 @@
                             }
                             <button class="btn btn-outline-info btn-sm py-0 px-1 me-1"
                                     @onclick="() => ToggleBindings(inst)">Bindings</button>
+                            <button class="btn btn-outline-secondary btn-sm py-0 px-1 me-1"
+                                    @onclick="() => ToggleOverrides(inst)">Overrides</button>
+                            <button class="btn btn-outline-info btn-sm py-0 px-1 me-1"
+                                    @onclick="() => ShowDiff(inst)" disabled="@(_actionInProgress || inst.State == InstanceState.NotDeployed)">Diff</button>
                             <button class="btn btn-outline-danger btn-sm py-0 px-1"
                                     @onclick="() => DeleteInstance(inst)" disabled="@_actionInProgress">Delete</button>
                         </td>
                     </tr>
+                    @if (_overrideInstanceId == inst.Id)
+                    {
+                        <tr>
+                            <td colspan="7" class="bg-light p-3">
+                                <div class="d-flex justify-content-between align-items-center mb-2">
+                                    <strong>Attribute Overrides for @inst.UniqueName</strong>
+                                    <div>
+                                        <label class="form-label small d-inline me-1">Reassign Area:</label>
+                                        <select class="form-select form-select-sm d-inline-block me-1" style="width:auto;" @bind="_reassignAreaId">
+                                            <option value="0">No area</option>
+                                            @foreach (var a in _allAreas.Where(a => a.SiteId == inst.SiteId))
+                                            {
+                                                <option value="@a.Id">@a.Name</option>
+                                            }
+                                        </select>
+                                        <button class="btn btn-sm btn-outline-primary" @onclick="() => ReassignArea(inst)" disabled="@_actionInProgress">Set Area</button>
+                                    </div>
+                                </div>
+                                @if (_overrideAttrs.Count == 0)
+                                {
+                                    <p class="text-muted small mb-0">No overridable (non-locked) attributes in this template.</p>
+                                }
+                                else
+                                {
+                                    <table class="table table-sm table-bordered mb-2">
+                                        <thead class="table-light">
+                                            <tr><th>Attribute</th><th>Template Value</th><th>Override Value</th></tr>
+                                        </thead>
+                                        <tbody>
+                                            @foreach (var attr in _overrideAttrs)
+                                            {
+                                                <tr>
+                                                    <td class="small">@attr.Name <span class="badge bg-light text-dark">@attr.DataType</span></td>
+                                                    <td class="small text-muted">@(attr.Value ?? "—")</td>
+                                                    <td>
+                                                        <input type="text" class="form-control form-control-sm"
+                                                               value="@GetOverrideValue(attr.Name)"
+                                                               @onchange="(e) => OnOverrideChanged(attr.Name, e)" />
+                                                    </td>
+                                                </tr>
+                                            }
+                                        </tbody>
+                                    </table>
+                                    <button class="btn btn-success btn-sm" @onclick="SaveOverrides" disabled="@_actionInProgress">Save Overrides</button>
+                                }
+                            </td>
+                        </tr>
+                    }
                     @if (_bindingInstanceId == inst.Id)
                     {
                         <tr>
@@ -268,6 +330,55 @@
         <div class="text-muted small">
             @_filteredInstances.Count instance(s) total
         </div>
+
+        @* Diff Modal *@
+        @if (_showDiffModal)
+        {
+            <div class="modal d-block" tabindex="-1" style="background-color: rgba(0,0,0,0.5);">
+                <div class="modal-dialog modal-lg">
+                    <div class="modal-content">
+                        <div class="modal-header">
+                            <h5 class="modal-title">Deployment Diff — @_diffInstanceName</h5>
+                            <button type="button" class="btn-close" @onclick="() => _showDiffModal = false"></button>
+                        </div>
+                        <div class="modal-body">
+                            @if (_diffLoading)
+                            {
+                                <LoadingSpinner IsLoading="true" />
+                            }
+                            else if (_diffError != null)
+                            {
+                                <div class="alert alert-danger">@_diffError</div>
+                            }
+                            else if (_diffResult != null)
+                            {
+                                <div class="mb-2">
+                                    <span class="badge @(_diffResult.IsStale ? "bg-warning text-dark" : "bg-success")">
+                                        @(_diffResult.IsStale ? "Stale — changes pending" : "Current")
+                                    </span>
+                                    <span class="text-muted small ms-2">
+                                        Deployed: @_diffResult.DeployedRevisionHash[..8]
+                                        | Current: @_diffResult.CurrentRevisionHash[..8]
+                                        | Deployed at: @_diffResult.DeployedAt.LocalDateTime.ToString("yyyy-MM-dd HH:mm")
+                                    </span>
+                                </div>
+                                @if (!_diffResult.IsStale)
+                                {
+                                    <p class="text-muted">No differences between deployed and current configuration.</p>
+                                }
+                                else
+                                {
+                                    <p class="text-muted small">The deployed revision hash differs from the current template-derived hash. Redeploy to apply changes.</p>
+                                }
+                            }
+                        </div>
+                        <div class="modal-footer">
+                            <button class="btn btn-secondary btn-sm" @onclick="() => _showDiffModal = false">Close</button>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        }
     }
 </div>
 
@@ -508,6 +619,7 @@
     private string _createName = string.Empty;
     private int _createTemplateId;
     private int _createSiteId;
+    private int _createAreaId;
     private string? _createError;
 
     private void ShowCreateForm()
@@ -515,6 +627,7 @@
         _createName = string.Empty;
         _createTemplateId = 0;
         _createSiteId = 0;
+        _createAreaId = 0;
         _createError = null;
         _showCreateForm = true;
     }
@@ -530,7 +643,7 @@
         {
             var user = await GetCurrentUserAsync();
             var result = await InstanceService.CreateInstanceAsync(
-                _createName.Trim(), _createTemplateId, _createSiteId, null, user);
+                _createName.Trim(), _createTemplateId, _createSiteId, _createAreaId == 0 ? null : _createAreaId, user);
             if (result.IsSuccess)
             {
                 _showCreateForm = false;
@@ -548,6 +661,118 @@
         }
     }
 
+    // Override state
+    private int _overrideInstanceId;
+    private List<TemplateAttribute> _overrideAttrs = new();
+    private Dictionary<string, string?> _overrideValues = new();
+    private int _reassignAreaId;
+
+    private async Task ToggleOverrides(Instance inst)
+    {
+        if (_overrideInstanceId == inst.Id) { _overrideInstanceId = 0; return; }
+        _overrideInstanceId = inst.Id;
+        _overrideValues.Clear();
+        _reassignAreaId = inst.AreaId ?? 0;
+
+        var attrs = await TemplateEngineRepository.GetAttributesByTemplateIdAsync(inst.TemplateId);
+        _overrideAttrs = attrs.Where(a => !a.IsLocked).ToList();
+
+        var overrides = await TemplateEngineRepository.GetOverridesByInstanceIdAsync(inst.Id);
+        foreach (var o in overrides)
+        {
+            _overrideValues[o.AttributeName] = o.OverrideValue;
+        }
+    }
+
+    private string? GetOverrideValue(string attrName) =>
+        _overrideValues.GetValueOrDefault(attrName);
+
+    private void OnOverrideChanged(string attrName, ChangeEventArgs e)
+    {
+        var val = e.Value?.ToString();
+        if (string.IsNullOrEmpty(val))
+            _overrideValues.Remove(attrName);
+        else
+            _overrideValues[attrName] = val;
+    }
+
+    private async Task SaveOverrides()
+    {
+        _actionInProgress = true;
+        try
+        {
+            var user = await GetCurrentUserAsync();
+            foreach (var (attrName, value) in _overrideValues)
+            {
+                await InstanceService.SetAttributeOverrideAsync(_overrideInstanceId, attrName, value, user);
+            }
+            _toast.ShowSuccess($"Saved {_overrideValues.Count} override(s).");
+            _overrideInstanceId = 0;
+        }
+        catch (Exception ex)
+        {
+            _toast.ShowError($"Save overrides failed: {ex.Message}");
+        }
+        _actionInProgress = false;
+    }
+
+    private async Task ReassignArea(Instance inst)
+    {
+        _actionInProgress = true;
+        try
+        {
+            var user = await GetCurrentUserAsync();
+            var result = await InstanceService.AssignToAreaAsync(inst.Id, _reassignAreaId == 0 ? null : _reassignAreaId, user);
+            if (result.IsSuccess)
+            {
+                _toast.ShowSuccess($"Area reassigned for '{inst.UniqueName}'.");
+                await LoadDataAsync();
+            }
+            else
+            {
+                _toast.ShowError($"Reassign failed: {result.Error}");
+            }
+        }
+        catch (Exception ex)
+        {
+            _toast.ShowError($"Reassign failed: {ex.Message}");
+        }
+        _actionInProgress = false;
+    }
+
+    // Diff state
+    private bool _showDiffModal;
+    private bool _diffLoading;
+    private string? _diffError;
+    private string _diffInstanceName = string.Empty;
+    private DeploymentComparisonResult? _diffResult;
+
+    private async Task ShowDiff(Instance inst)
+    {
+        _showDiffModal = true;
+        _diffLoading = true;
+        _diffError = null;
+        _diffResult = null;
+        _diffInstanceName = inst.UniqueName;
+        try
+        {
+            var result = await DeploymentService.GetDeploymentComparisonAsync(inst.Id);
+            if (result.IsSuccess)
+            {
+                _diffResult = result.Value;
+            }
+            else
+            {
+                _diffError = result.Error;
+            }
+        }
+        catch (Exception ex)
+        {
+            _diffError = $"Failed to load diff: {ex.Message}";
+        }
+        _diffLoading = false;
+    }
+
     // Connection binding state
     private int _bindingInstanceId;
     private List<TemplateAttribute> _bindingDataSourceAttrs = new();

src/ScadaLink.CentralUI/Components/Pages/Design/ExternalSystems.razor

@@ -50,8 +50,8 @@
 
         @if (_tab == "extsys") { @RenderExternalSystems() }
         else if (_tab == "dbconn") { @RenderDbConnections() }
-        else if (_tab == "notif") { @RenderNotificationLists() }
-        else if (_tab == "inbound") { @RenderInboundApiMethods() }
+        else if (_tab == "notif") { @RenderNotificationLists() @RenderSmtpConfig() }
+        else if (_tab == "inbound") { @RenderInboundApiMethods() @RenderApiKeyMethodAssignments() }
     }
 </div>
 
@@ -66,6 +66,8 @@
     private ExternalSystemDefinition? _editingExtSys;
     private string _extSysName = "", _extSysUrl = "", _extSysAuth = "ApiKey";
     private string? _extSysAuthConfig;
+    private int _extSysMaxRetries = 3;
+    private int _extSysRetryDelaySeconds = 5;
     private string? _extSysFormError;
 
     // Database Connections
@@ -73,8 +75,21 @@
     private bool _showDbConnForm;
     private DatabaseConnectionDefinition? _editingDbConn;
     private string _dbConnName = "", _dbConnString = "";
+    private int _dbConnMaxRetries = 3;
+    private int _dbConnRetryDelaySeconds = 5;
     private string? _dbConnFormError;
 
+    // SMTP Configuration
+    private List<SmtpConfiguration> _smtpConfigs = new();
+    private bool _showSmtpForm;
+    private SmtpConfiguration? _editingSmtp;
+    private string _smtpHost = "", _smtpFromAddress = "", _smtpAuthType = "OAuth2";
+    private int _smtpPort = 587;
+    private string? _smtpFormError;
+
+    // API Key list
+    private List<ApiKey> _apiKeys = new();
+
     // Notification Lists
     private List<NotificationList> _notificationLists = new();
     private bool _showNotifForm;
@@ -123,6 +138,8 @@
             }
 
             _apiMethods = (await InboundApiRepository.GetAllApiMethodsAsync()).ToList();
+            _smtpConfigs = (await NotificationRepository.GetAllSmtpConfigurationsAsync()).ToList();
+            _apiKeys = (await InboundApiRepository.GetAllApiKeysAsync()).ToList();
         }
         catch (Exception ex) { _errorMessage = ex.Message; }
         _loading = false;
@@ -144,8 +161,10 @@
                     <div class="col-md-3"><label class="form-label small">Endpoint URL</label><input type="text" class="form-control form-control-sm" @bind="_extSysUrl" /></div>
                     <div class="col-md-2"><label class="form-label small">Auth Type</label>
                         <select class="form-select form-select-sm" @bind="_extSysAuth"><option>ApiKey</option><option>BasicAuth</option></select></div>
-                    <div class="col-md-3"><label class="form-label small">Auth Config (JSON)</label><input type="text" class="form-control form-control-sm" @bind="_extSysAuthConfig" /></div>
-                    <div class="col-md-2">
+                    <div class="col-md-2"><label class="form-label small">Auth Config (JSON)</label><input type="text" class="form-control form-control-sm" @bind="_extSysAuthConfig" /></div>
+                    <div class="col-md-1"><label class="form-label small">Max Retries</label><input type="number" class="form-control form-control-sm" @bind="_extSysMaxRetries" min="0" /></div>
+                    <div class="col-md-1"><label class="form-label small">Retry Delay (s)</label><input type="number" class="form-control form-control-sm" @bind="_extSysRetryDelaySeconds" min="0" /></div>
+                    <div class="col-md-1">
                         <button class="btn btn-success btn-sm me-1" @onclick="SaveExtSys">Save</button>
                         <button class="btn btn-outline-secondary btn-sm" @onclick="() => _showExtSysForm = false">Cancel</button></div>
                 </div>
@@ -154,14 +173,15 @@
         }
 
         <table class="table table-sm table-striped">
-            <thead class="table-dark"><tr><th>Name</th><th>URL</th><th>Auth</th><th style="width:120px;">Actions</th></tr></thead>
+            <thead class="table-dark"><tr><th>Name</th><th>URL</th><th>Auth</th><th>Retries</th><th>Delay</th><th style="width:120px;">Actions</th></tr></thead>
             <tbody>
                 @foreach (var es in _externalSystems)
                 {
                     <tr>
                         <td>@es.Name</td><td class="small">@es.EndpointUrl</td><td><span class="badge bg-secondary">@es.AuthType</span></td>
+                        <td class="small">@es.MaxRetries</td><td class="small">@es.RetryDelay.TotalSeconds s</td>
                         <td>
-                            <button class="btn btn-outline-primary btn-sm py-0 px-1 me-1" @onclick="() => { _editingExtSys = es; _extSysName = es.Name; _extSysUrl = es.EndpointUrl; _extSysAuth = es.AuthType; _extSysAuthConfig = es.AuthConfiguration; _showExtSysForm = true; }">Edit</button>
+                            <button class="btn btn-outline-primary btn-sm py-0 px-1 me-1" @onclick="() => { _editingExtSys = es; _extSysName = es.Name; _extSysUrl = es.EndpointUrl; _extSysAuth = es.AuthType; _extSysAuthConfig = es.AuthConfiguration; _extSysMaxRetries = es.MaxRetries; _extSysRetryDelaySeconds = (int)es.RetryDelay.TotalSeconds; _showExtSysForm = true; }">Edit</button>
                             <button class="btn btn-outline-danger btn-sm py-0 px-1" @onclick="() => DeleteExtSys(es)">Delete</button>
                         </td>
                     </tr>
@@ -177,6 +197,8 @@
         _extSysName = _extSysUrl = string.Empty;
         _extSysAuth = "ApiKey";
         _extSysAuthConfig = null;
+        _extSysMaxRetries = 3;
+        _extSysRetryDelaySeconds = 5;
         _extSysFormError = null;
     }
 
@@ -186,8 +208,8 @@
         if (string.IsNullOrWhiteSpace(_extSysName) || string.IsNullOrWhiteSpace(_extSysUrl)) { _extSysFormError = "Name and URL required."; return; }
         try
         {
-            if (_editingExtSys != null) { _editingExtSys.Name = _extSysName.Trim(); _editingExtSys.EndpointUrl = _extSysUrl.Trim(); _editingExtSys.AuthType = _extSysAuth; _editingExtSys.AuthConfiguration = _extSysAuthConfig?.Trim(); await ExternalSystemRepository.UpdateExternalSystemAsync(_editingExtSys); }
-            else { var es = new ExternalSystemDefinition(_extSysName.Trim(), _extSysUrl.Trim(), _extSysAuth) { AuthConfiguration = _extSysAuthConfig?.Trim() }; await ExternalSystemRepository.AddExternalSystemAsync(es); }
+            if (_editingExtSys != null) { _editingExtSys.Name = _extSysName.Trim(); _editingExtSys.EndpointUrl = _extSysUrl.Trim(); _editingExtSys.AuthType = _extSysAuth; _editingExtSys.AuthConfiguration = _extSysAuthConfig?.Trim(); _editingExtSys.MaxRetries = _extSysMaxRetries; _editingExtSys.RetryDelay = TimeSpan.FromSeconds(_extSysRetryDelaySeconds); await ExternalSystemRepository.UpdateExternalSystemAsync(_editingExtSys); }
+            else { var es = new ExternalSystemDefinition(_extSysName.Trim(), _extSysUrl.Trim(), _extSysAuth) { AuthConfiguration = _extSysAuthConfig?.Trim(), MaxRetries = _extSysMaxRetries, RetryDelay = TimeSpan.FromSeconds(_extSysRetryDelaySeconds) }; await ExternalSystemRepository.AddExternalSystemAsync(es); }
             await ExternalSystemRepository.SaveChangesAsync(); _showExtSysForm = false; _toast.ShowSuccess("Saved."); await LoadAllAsync();
         }
         catch (Exception ex) { _extSysFormError = ex.Message; }
@@ -205,7 +227,7 @@
     {
         <div class="d-flex justify-content-between mb-2">
             <h6 class="mb-0">Database Connections</h6>
-            <button class="btn btn-primary btn-sm" @onclick="() => { _showDbConnForm = true; _editingDbConn = null; _dbConnName = _dbConnString = string.Empty; _dbConnFormError = null; }">Add</button>
+            <button class="btn btn-primary btn-sm" @onclick="() => { _showDbConnForm = true; _editingDbConn = null; _dbConnName = _dbConnString = string.Empty; _dbConnMaxRetries = 3; _dbConnRetryDelaySeconds = 5; _dbConnFormError = null; }">Add</button>
         </div>
 
         @if (_showDbConnForm)
@@ -213,7 +235,9 @@
             <div class="card mb-2"><div class="card-body">
                 <div class="row g-2 align-items-end">
                     <div class="col-md-3"><label class="form-label small">Name</label><input type="text" class="form-control form-control-sm" @bind="_dbConnName" /></div>
-                    <div class="col-md-6"><label class="form-label small">Connection String</label><input type="text" class="form-control form-control-sm" @bind="_dbConnString" /></div>
+                    <div class="col-md-4"><label class="form-label small">Connection String</label><input type="text" class="form-control form-control-sm" @bind="_dbConnString" /></div>
+                    <div class="col-md-1"><label class="form-label small">Max Retries</label><input type="number" class="form-control form-control-sm" @bind="_dbConnMaxRetries" min="0" /></div>
+                    <div class="col-md-1"><label class="form-label small">Retry Delay (s)</label><input type="number" class="form-control form-control-sm" @bind="_dbConnRetryDelaySeconds" min="0" /></div>
                     <div class="col-md-3">
                         <button class="btn btn-success btn-sm me-1" @onclick="SaveDbConn">Save</button>
                         <button class="btn btn-outline-secondary btn-sm" @onclick="() => _showDbConnForm = false">Cancel</button></div>
@@ -223,14 +247,15 @@
         }
 
         <table class="table table-sm table-striped">
-            <thead class="table-dark"><tr><th>Name</th><th>Connection String</th><th style="width:120px;">Actions</th></tr></thead>
+            <thead class="table-dark"><tr><th>Name</th><th>Connection String</th><th>Retries</th><th>Delay</th><th style="width:120px;">Actions</th></tr></thead>
             <tbody>
                 @foreach (var dc in _dbConnections)
                 {
                     <tr>
                         <td>@dc.Name</td><td class="small text-muted text-truncate" style="max-width:400px;">@dc.ConnectionString</td>
+                        <td class="small">@dc.MaxRetries</td><td class="small">@dc.RetryDelay.TotalSeconds s</td>
                         <td>
-                            <button class="btn btn-outline-primary btn-sm py-0 px-1 me-1" @onclick="() => { _editingDbConn = dc; _dbConnName = dc.Name; _dbConnString = dc.ConnectionString; _showDbConnForm = true; }">Edit</button>
+                            <button class="btn btn-outline-primary btn-sm py-0 px-1 me-1" @onclick="() => { _editingDbConn = dc; _dbConnName = dc.Name; _dbConnString = dc.ConnectionString; _dbConnMaxRetries = dc.MaxRetries; _dbConnRetryDelaySeconds = (int)dc.RetryDelay.TotalSeconds; _showDbConnForm = true; }">Edit</button>
                             <button class="btn btn-outline-danger btn-sm py-0 px-1" @onclick="() => DeleteDbConn(dc)">Delete</button>
                         </td>
                     </tr>
@@ -245,8 +270,8 @@
         if (string.IsNullOrWhiteSpace(_dbConnName) || string.IsNullOrWhiteSpace(_dbConnString)) { _dbConnFormError = "Name and connection string required."; return; }
         try
         {
-            if (_editingDbConn != null) { _editingDbConn.Name = _dbConnName.Trim(); _editingDbConn.ConnectionString = _dbConnString.Trim(); await ExternalSystemRepository.UpdateDatabaseConnectionAsync(_editingDbConn); }
-            else { var dc = new DatabaseConnectionDefinition(_dbConnName.Trim(), _dbConnString.Trim()); await ExternalSystemRepository.AddDatabaseConnectionAsync(dc); }
+            if (_editingDbConn != null) { _editingDbConn.Name = _dbConnName.Trim(); _editingDbConn.ConnectionString = _dbConnString.Trim(); _editingDbConn.MaxRetries = _dbConnMaxRetries; _editingDbConn.RetryDelay = TimeSpan.FromSeconds(_dbConnRetryDelaySeconds); await ExternalSystemRepository.UpdateDatabaseConnectionAsync(_editingDbConn); }
+            else { var dc = new DatabaseConnectionDefinition(_dbConnName.Trim(), _dbConnString.Trim()) { MaxRetries = _dbConnMaxRetries, RetryDelay = TimeSpan.FromSeconds(_dbConnRetryDelaySeconds) }; await ExternalSystemRepository.AddDatabaseConnectionAsync(dc); }
             await ExternalSystemRepository.SaveChangesAsync(); _showDbConnForm = false; _toast.ShowSuccess("Saved."); await LoadAllAsync();
         }
         catch (Exception ex) { _dbConnFormError = ex.Message; }
@@ -434,4 +459,127 @@
         try { await InboundApiRepository.DeleteApiMethodAsync(m.Id); await InboundApiRepository.SaveChangesAsync(); _toast.ShowSuccess("Deleted."); await LoadAllAsync(); }
         catch (Exception ex) { _toast.ShowError(ex.Message); }
     }
+
+    // ==== SMTP Configuration ====
+    private RenderFragment RenderSmtpConfig() => __builder =>
+    {
+        <hr class="my-3" />
+        <div class="d-flex justify-content-between mb-2">
+            <h6 class="mb-0">SMTP Configuration</h6>
+            @if (_smtpConfigs.Count == 0)
+            {
+                <button class="btn btn-primary btn-sm" @onclick="ShowSmtpAddForm">Add SMTP Config</button>
+            }
+        </div>
+
+        @if (_showSmtpForm)
+        {
+            <div class="card mb-2"><div class="card-body">
+                <div class="row g-2 align-items-end">
+                    <div class="col-md-3"><label class="form-label small">Host</label><input type="text" class="form-control form-control-sm" @bind="_smtpHost" /></div>
+                    <div class="col-md-1"><label class="form-label small">Port</label><input type="number" class="form-control form-control-sm" @bind="_smtpPort" /></div>
+                    <div class="col-md-2"><label class="form-label small">Auth Type</label>
+                        <select class="form-select form-select-sm" @bind="_smtpAuthType"><option>OAuth2</option><option>Basic</option></select></div>
+                    <div class="col-md-3"><label class="form-label small">From Address</label><input type="email" class="form-control form-control-sm" @bind="_smtpFromAddress" /></div>
+                    <div class="col-md-3">
+                        <button class="btn btn-success btn-sm me-1" @onclick="SaveSmtpConfig">Save</button>
+                        <button class="btn btn-outline-secondary btn-sm" @onclick="() => _showSmtpForm = false">Cancel</button></div>
+                </div>
+                @if (_smtpFormError != null) { <div class="text-danger small mt-1">@_smtpFormError</div> }
+            </div></div>
+        }
+
+        @foreach (var smtp in _smtpConfigs)
+        {
+            <div class="card mb-2">
+                <div class="card-body py-2">
+                    <div class="d-flex justify-content-between align-items-center">
+                        <span class="small">
+                            <strong>@smtp.Host</strong>:@smtp.Port |
+                            Auth: <span class="badge bg-secondary">@smtp.AuthType</span> |
+                            From: @smtp.FromAddress
+                        </span>
+                        <button class="btn btn-outline-primary btn-sm py-0 px-1" @onclick="() => { _editingSmtp = smtp; _smtpHost = smtp.Host; _smtpPort = smtp.Port; _smtpAuthType = smtp.AuthType; _smtpFromAddress = smtp.FromAddress; _showSmtpForm = true; }">Edit</button>
+                    </div>
+                </div>
+            </div>
+        }
+    };
+
+    private void ShowSmtpAddForm()
+    {
+        _showSmtpForm = true;
+        _editingSmtp = null;
+        _smtpHost = string.Empty;
+        _smtpPort = 587;
+        _smtpAuthType = "OAuth2";
+        _smtpFromAddress = string.Empty;
+        _smtpFormError = null;
+    }
+
+    private async Task SaveSmtpConfig()
+    {
+        _smtpFormError = null;
+        if (string.IsNullOrWhiteSpace(_smtpHost) || string.IsNullOrWhiteSpace(_smtpFromAddress)) { _smtpFormError = "Host and From Address required."; return; }
+        try
+        {
+            if (_editingSmtp != null)
+            {
+                _editingSmtp.Host = _smtpHost.Trim();
+                _editingSmtp.Port = _smtpPort;
+                _editingSmtp.AuthType = _smtpAuthType;
+                _editingSmtp.FromAddress = _smtpFromAddress.Trim();
+                await NotificationRepository.UpdateSmtpConfigurationAsync(_editingSmtp);
+            }
+            else
+            {
+                var smtp = new SmtpConfiguration(_smtpHost.Trim(), _smtpAuthType, _smtpFromAddress.Trim()) { Port = _smtpPort };
+                await NotificationRepository.AddSmtpConfigurationAsync(smtp);
+            }
+            await NotificationRepository.SaveChangesAsync();
+            _showSmtpForm = false;
+            _toast.ShowSuccess("SMTP configuration saved.");
+            await LoadAllAsync();
+        }
+        catch (Exception ex) { _smtpFormError = ex.Message; }
+    }
+
+    // ==== API Key → Method Assignments ====
+    private RenderFragment RenderApiKeyMethodAssignments() => __builder =>
+    {
+        <hr class="my-3" />
+        <div class="d-flex justify-content-between mb-2">
+            <h6 class="mb-0">API Keys</h6>
+        </div>
+
+        <table class="table table-sm table-striped">
+            <thead class="table-dark"><tr><th>Key Name</th><th>Enabled</th><th style="width:120px;">Actions</th></tr></thead>
+            <tbody>
+                @foreach (var key in _apiKeys)
+                {
+                    <tr>
+                        <td>@key.Name</td>
+                        <td><span class="badge @(key.IsEnabled ? "bg-success" : "bg-secondary")">@(key.IsEnabled ? "Enabled" : "Disabled")</span></td>
+                        <td>
+                            <button class="btn btn-outline-primary btn-sm py-0 px-1" @onclick="() => ToggleApiKeyEnabled(key)">
+                                @(key.IsEnabled ? "Disable" : "Enable")
+                            </button>
+                        </td>
+                    </tr>
+                }
+            </tbody>
+        </table>
+    };
+
+    private async Task ToggleApiKeyEnabled(ApiKey key)
+    {
+        try
+        {
+            key.IsEnabled = !key.IsEnabled;
+            await InboundApiRepository.UpdateApiKeyAsync(key);
+            await InboundApiRepository.SaveChangesAsync();
+            _toast.ShowSuccess($"API key '{key.Name}' {(key.IsEnabled ? "enabled" : "disabled")}.");
+        }
+        catch (Exception ex) { _toast.ShowError(ex.Message); }
+    }
 }

src/ScadaLink.CentralUI/Components/Pages/Design/Templates.razor

@@ -476,9 +476,10 @@
         _validationResult = null;
         try
         {
-            // Use the ValidationService for on-demand validation
+            // Use the full validation pipeline via TemplateService
+            // This performs flattening, collision detection, script compilation,
+            // trigger reference validation, and connection binding checks
             var validationService = new ValidationService();
-            // Build a minimal flattened config from the template's direct members for validation
             var flatConfig = new Commons.Types.Flattening.FlattenedConfiguration
             {
                 InstanceUniqueName = $"validation-{_selectedTemplate.Name}",
@@ -511,6 +512,17 @@
                 }).ToList()
             };
             _validationResult = validationService.Validate(flatConfig);
+
+            // Also check for naming collisions across the inheritance/composition graph
+            var collisions = await TemplateService.DetectCollisionsAsync(_selectedTemplate.Id);
+            if (collisions.Count > 0)
+            {
+                var collisionErrors = collisions.Select(c =>
+                    Commons.Types.Flattening.ValidationEntry.Error(
+                        Commons.Types.Flattening.ValidationCategory.NamingCollision, c)).ToArray();
+                var collisionResult = new Commons.Types.Flattening.ValidationResult { Errors = collisionErrors };
+                _validationResult = Commons.Types.Flattening.ValidationResult.Merge(_validationResult, collisionResult);
+            }
         }
         catch (Exception ex)
         {

src/ScadaLink.CentralUI/Components/Pages/Monitoring/EventLogs.razor

@@ -44,10 +44,14 @@
             <label class="form-label small">To</label>
             <input type="datetime-local" class="form-control form-control-sm" @bind="_filterTo" />
         </div>
-        <div class="col-md-2">
+        <div class="col-md-1">
             <label class="form-label small">Keyword</label>
             <input type="text" class="form-control form-control-sm" @bind="_filterKeyword" />
         </div>
+        <div class="col-md-2">
+            <label class="form-label small">Instance</label>
+            <input type="text" class="form-control form-control-sm" @bind="_filterInstanceName" placeholder="Instance name" />
+        </div>
         <div class="col-md-1 d-flex align-items-end">
             <button class="btn btn-primary btn-sm" @onclick="Search" disabled="@(string.IsNullOrEmpty(_selectedSiteId) || _searching)">
                 @if (_searching) { <span class="spinner-border spinner-border-sm"></span> }
@@ -111,6 +115,7 @@
     private DateTime? _filterFrom;
     private DateTime? _filterTo;
     private string? _filterKeyword;
+    private string? _filterInstanceName;
 
     private List<EventLogEntry>? _entries;
     private bool _hasMore;
@@ -146,7 +151,7 @@
                 To: _filterTo.HasValue ? new DateTimeOffset(_filterTo.Value, TimeSpan.Zero) : null,
                 EventType: string.IsNullOrWhiteSpace(_filterEventType) ? null : _filterEventType.Trim(),
                 Severity: string.IsNullOrWhiteSpace(_filterSeverity) ? null : _filterSeverity,
-                InstanceId: null,
+                InstanceId: string.IsNullOrWhiteSpace(_filterInstanceName) ? null : _filterInstanceName.Trim(),
                 KeywordFilter: string.IsNullOrWhiteSpace(_filterKeyword) ? null : _filterKeyword.Trim(),
                 ContinuationToken: _continuationToken,
                 PageSize: 50,

src/ScadaLink.CentralUI/Components/Pages/Monitoring/Health.razor

@@ -71,6 +71,10 @@
                             <span class="badge bg-danger me-2">Offline</span>
                         }
                         <strong>@siteId</strong>
+                        @if (state.LatestReport?.NodeRole != null)
+                        {
+                            <span class="badge @(state.LatestReport.NodeRole == "Active" ? "bg-primary" : "bg-secondary") ms-2">@state.LatestReport.NodeRole</span>
+                        }
                     </div>
                     <small class="text-muted">
                         Last report: @state.LastReportReceivedAt.LocalDateTime.ToString("HH:mm:ss") | Seq: @state.LastSequenceNumber

src/ScadaLink.CentralUI/Components/Pages/Monitoring/ParkedMessages.razor

@@ -70,9 +70,11 @@
                         <td class="small"><TimestampDisplay Value="@msg.LastAttemptTimestamp" /></td>
                         <td>
                             <button class="btn btn-outline-success btn-sm py-0 px-1 me-1"
-                                    title="Retry message (not yet implemented)">Retry</button>
+                                    @onclick="() => RetryMessage(msg)" disabled="@_actionInProgress"
+                                    title="Retry message (move back to pending)">Retry</button>
                             <button class="btn btn-outline-danger btn-sm py-0 px-1"
-                                    title="Discard message (not yet implemented)">Discard</button>
+                                    @onclick="() => DiscardMessage(msg)" disabled="@_actionInProgress"
+                                    title="Permanently discard message">Discard</button>
                         </td>
                     </tr>
                 }
@@ -102,6 +104,7 @@
     private bool _searching;
     private string? _errorMessage;
 
+    private bool _actionInProgress;
     private ToastNotification _toast = default!;
     private ConfirmDialog _confirmDialog = default!;
 
@@ -150,4 +153,65 @@
         }
         _searching = false;
     }
+
+    private async Task RetryMessage(ParkedMessageEntry msg)
+    {
+        _actionInProgress = true;
+        try
+        {
+            var request = new ParkedMessageRetryRequest(
+                CorrelationId: Guid.NewGuid().ToString("N"),
+                SiteId: _selectedSiteId,
+                MessageId: msg.MessageId,
+                Timestamp: DateTimeOffset.UtcNow);
+            var response = await CommunicationService.RetryParkedMessageAsync(_selectedSiteId, request);
+            if (response.Success)
+            {
+                _toast.ShowSuccess($"Message {msg.MessageId[..Math.Min(12, msg.MessageId.Length)]} queued for retry.");
+                await FetchPage();
+            }
+            else
+            {
+                _toast.ShowError(response.ErrorMessage ?? "Retry failed.");
+            }
+        }
+        catch (Exception ex)
+        {
+            _toast.ShowError($"Retry failed: {ex.Message}");
+        }
+        _actionInProgress = false;
+    }
+
+    private async Task DiscardMessage(ParkedMessageEntry msg)
+    {
+        var confirmed = await _confirmDialog.ShowAsync(
+            $"Permanently discard message {msg.MessageId[..Math.Min(12, msg.MessageId.Length)]}? This cannot be undone.",
+            "Discard Parked Message");
+        if (!confirmed) return;
+
+        _actionInProgress = true;
+        try
+        {
+            var request = new ParkedMessageDiscardRequest(
+                CorrelationId: Guid.NewGuid().ToString("N"),
+                SiteId: _selectedSiteId,
+                MessageId: msg.MessageId,
+                Timestamp: DateTimeOffset.UtcNow);
+            var response = await CommunicationService.DiscardParkedMessageAsync(_selectedSiteId, request);
+            if (response.Success)
+            {
+                _toast.ShowSuccess($"Message {msg.MessageId[..Math.Min(12, msg.MessageId.Length)]} discarded.");
+                await FetchPage();
+            }
+            else
+            {
+                _toast.ShowError(response.ErrorMessage ?? "Discard failed.");
+            }
+        }
+        catch (Exception ex)
+        {
+            _toast.ShowError($"Discard failed: {ex.Message}");
+        }
+        _actionInProgress = false;
+    }
 }

src/ScadaLink.Commons/Interfaces/Protocol/IDataConnection.cs

@@ -22,4 +22,11 @@ public interface IDataConnection : IAsyncDisposable
     Task<IReadOnlyDictionary<string, WriteResult>> WriteBatchAsync(IDictionary<string, object?> values, CancellationToken cancellationToken = default);
     Task<bool> WriteBatchAndWaitAsync(IDictionary<string, object?> values, string flagPath, object? flagValue, string responsePath, object? responseValue, TimeSpan timeout, CancellationToken cancellationToken = default);
     ConnectionHealth Status { get; }
+
+    /// <summary>
+    /// Raised when the adapter detects an unexpected connection loss (e.g., gRPC stream error,
+    /// network timeout). The DataConnectionActor listens for this to trigger reconnection
+    /// and push bad quality to all subscribed tags.
+    /// </summary>
+    event Action? Disconnected;
 }

src/ScadaLink.Commons/Messages/Health/SiteHealthReport.cs

@@ -14,4 +14,5 @@ public record SiteHealthReport(
     int DeadLetterCount,
     int DeployedInstanceCount,
     int EnabledInstanceCount,
-    int DisabledInstanceCount);
+    int DisabledInstanceCount,
+    string NodeRole = "Unknown");

src/ScadaLink.Commons/Messages/Management/DeploymentCommands.cs

@@ -2,3 +2,4 @@ namespace ScadaLink.Commons.Messages.Management;
 
 public record MgmtDeployArtifactsCommand(int? SiteId = null);
 public record QueryDeploymentsCommand(int? InstanceId = null, string? Status = null, int Page = 1, int PageSize = 50);
+public record GetDeploymentDiffCommand(int InstanceId);

src/ScadaLink.Commons/Messages/Management/InstanceCommands.cs

@@ -8,3 +8,5 @@ public record MgmtEnableInstanceCommand(int InstanceId);
 public record MgmtDisableInstanceCommand(int InstanceId);
 public record MgmtDeleteInstanceCommand(int InstanceId);
 public record SetConnectionBindingsCommand(int InstanceId, IReadOnlyList<(string AttributeName, int DataConnectionId)> Bindings);
+public record SetInstanceOverridesCommand(int InstanceId, IReadOnlyDictionary<string, string?> Overrides);
+public record SetInstanceAreaCommand(int InstanceId, int? AreaId);

src/ScadaLink.Commons/Messages/Management/RemoteQueryCommands.cs

@@ -1,4 +1,6 @@
 namespace ScadaLink.Commons.Messages.Management;
 
-public record QueryEventLogsCommand(string SiteIdentifier, string? EventType = null, string? Severity = null, string? Keyword = null, DateTimeOffset? From = null, DateTimeOffset? To = null, int Page = 1, int PageSize = 50);
+public record QueryEventLogsCommand(string SiteIdentifier, string? EventType = null, string? Severity = null, string? Keyword = null, DateTimeOffset? From = null, DateTimeOffset? To = null, int Page = 1, int PageSize = 50, string? InstanceName = null);
 public record QueryParkedMessagesCommand(string SiteIdentifier, int Page = 1, int PageSize = 50);
+public record RetryParkedMessageCommand(string SiteIdentifier, string MessageId);
+public record DiscardParkedMessageCommand(string SiteIdentifier, string MessageId);

src/ScadaLink.Commons/Messages/Management/SecurityCommands.cs

@@ -11,3 +11,4 @@ public record UpdateApiKeyCommand(int ApiKeyId, bool IsEnabled);
 public record ListScopeRulesCommand(int MappingId);
 public record AddScopeRuleCommand(int MappingId, int SiteId);
 public record DeleteScopeRuleCommand(int ScopeRuleId);
+public record ResolveRolesCommand(IReadOnlyList<string> LdapGroups);

src/ScadaLink.Commons/Messages/RemoteQuery/ParkedMessageDiscardRequest.cs

@@ -0,0 +1,18 @@
+namespace ScadaLink.Commons.Messages.RemoteQuery;
+
+/// <summary>
+/// Request to permanently discard a parked message at a site.
+/// </summary>
+public record ParkedMessageDiscardRequest(
+    string CorrelationId,
+    string SiteId,
+    string MessageId,
+    DateTimeOffset Timestamp);
+
+/// <summary>
+/// Response from discarding a parked message.
+/// </summary>
+public record ParkedMessageDiscardResponse(
+    string CorrelationId,
+    bool Success,
+    string? ErrorMessage = null);

src/ScadaLink.Commons/Messages/RemoteQuery/ParkedMessageRetryRequest.cs

@@ -0,0 +1,18 @@
+namespace ScadaLink.Commons.Messages.RemoteQuery;
+
+/// <summary>
+/// Request to retry a parked message at a site (move back to pending queue).
+/// </summary>
+public record ParkedMessageRetryRequest(
+    string CorrelationId,
+    string SiteId,
+    string MessageId,
+    DateTimeOffset Timestamp);
+
+/// <summary>
+/// Response from retrying a parked message.
+/// </summary>
+public record ParkedMessageRetryResponse(
+    string CorrelationId,
+    bool Success,
+    string? ErrorMessage = null);

src/ScadaLink.Communication/CommunicationService.cs

@@ -161,6 +161,22 @@ public class CommunicationService
             envelope, _options.QueryTimeout, cancellationToken);
     }
 
+    public async Task<ParkedMessageRetryResponse> RetryParkedMessageAsync(
+        string siteId, ParkedMessageRetryRequest request, CancellationToken cancellationToken = default)
+    {
+        var envelope = new SiteEnvelope(siteId, request);
+        return await GetActor().Ask<ParkedMessageRetryResponse>(
+            envelope, _options.QueryTimeout, cancellationToken);
+    }
+
+    public async Task<ParkedMessageDiscardResponse> DiscardParkedMessageAsync(
+        string siteId, ParkedMessageDiscardRequest request, CancellationToken cancellationToken = default)
+    {
+        var envelope = new SiteEnvelope(siteId, request);
+        return await GetActor().Ask<ParkedMessageDiscardResponse>(
+            envelope, _options.QueryTimeout, cancellationToken);
+    }
+
     // ── Pattern 8: Heartbeat (site→central, Tell) ──
     // Heartbeats are received by central, not sent. No method needed here.
 

src/ScadaLink.DataConnectionLayer/Actors/DataConnectionActor.cs

@@ -62,6 +62,12 @@ public class DataConnectionActor : UntypedActor, IWithStash, IWithTimers
 
     private readonly IDictionary<string, string> _connectionDetails;
 
+    /// <summary>
+    /// Captured Self reference for use from non-actor threads (event handlers, callbacks).
+    /// Akka.NET's Self property is only valid inside the actor's message loop.
+    /// </summary>
+    private IActorRef _self = null!;
+
     public DataConnectionActor(
         string connectionName,
         IDataConnection adapter,
@@ -79,13 +85,28 @@ public class DataConnectionActor : UntypedActor, IWithStash, IWithTimers
     protected override void PreStart()
     {
         _log.Info("DataConnectionActor [{0}] starting in Connecting state", _connectionName);
+
+        // Capture Self for use from non-actor threads (event handlers, callbacks).
+        // Akka.NET's Self property is only valid inside the actor's message loop.
+        _self = Self;
+
+        // Listen for unexpected adapter disconnections
+        _adapter.Disconnected += OnAdapterDisconnected;
+
         BecomeConnecting();
     }
 
+    private void OnAdapterDisconnected()
+    {
+        // Marshal the event onto the actor's message loop using captured _self reference.
+        // This runs on a background thread (gRPC stream reader), so Self would throw.
+        _self.Tell(new AdapterDisconnected());
+    }
+
     protected override void PostStop()
     {
         _log.Info("DataConnectionActor [{0}] stopping — disposing adapter", _connectionName);
-        // Clean up the adapter asynchronously
+        _adapter.Disconnected -= OnAdapterDisconnected;
         _ = _adapter.DisposeAsync().AsTask();
     }
 
@@ -276,7 +297,7 @@ public class DataConnectionActor : UntypedActor, IWithStash, IWithTimers
 
     private void HandleDisconnect()
     {
-        _log.Warning("[{0}] Adapter reported disconnect", _connectionName);
+        _log.Warning("[{0}] AdapterDisconnected message received — transitioning to Reconnecting", _connectionName);
         BecomeReconnecting();
     }
 

src/ScadaLink.DataConnectionLayer/Adapters/ILmxProxyClient.cs

@@ -39,6 +39,7 @@ public interface ILmxProxyClient : IAsyncDisposable
     Task<ILmxSubscription> SubscribeAsync(
         IEnumerable<string> addresses,
         Action<string, LmxVtq> onUpdate,
+        Action? onStreamError = null,
         CancellationToken cancellationToken = default);
 }
 
@@ -48,7 +49,7 @@ public interface ILmxProxyClient : IAsyncDisposable
 /// </summary>
 public interface ILmxProxyClientFactory
 {
-    ILmxProxyClient Create(string host, int port, string? apiKey);
+    ILmxProxyClient Create(string host, int port, string? apiKey, int samplingIntervalMs = 0, bool useTls = false);
 }
 
 /// <summary>
@@ -56,7 +57,7 @@ public interface ILmxProxyClientFactory
 /// </summary>
 public class DefaultLmxProxyClientFactory : ILmxProxyClientFactory
 {
-    public ILmxProxyClient Create(string host, int port, string? apiKey) => new StubLmxProxyClient();
+    public ILmxProxyClient Create(string host, int port, string? apiKey, int samplingIntervalMs = 0, bool useTls = false) => new StubLmxProxyClient();
 }
 
 /// <summary>
@@ -93,7 +94,7 @@ internal class StubLmxProxyClient : ILmxProxyClient
     public Task WriteBatchAsync(IDictionary<string, object> values, CancellationToken cancellationToken = default)
         => Task.CompletedTask;
 
-    public Task<ILmxSubscription> SubscribeAsync(IEnumerable<string> addresses, Action<string, LmxVtq> onUpdate, CancellationToken cancellationToken = default)
+    public Task<ILmxSubscription> SubscribeAsync(IEnumerable<string> addresses, Action<string, LmxVtq> onUpdate, Action? onStreamError = null, CancellationToken cancellationToken = default)
         => Task.FromResult<ILmxSubscription>(new StubLmxSubscription());
 
     public ValueTask DisposeAsync()

src/ScadaLink.DataConnectionLayer/Adapters/IOpcUaClient.cs

@@ -1,12 +1,28 @@
 namespace ScadaLink.DataConnectionLayer.Adapters;
 
+/// <summary>
+/// Configuration options for OPC UA connections, parsed from connection details JSON.
+/// All values have defaults matching the OPC Foundation SDK's typical settings.
+/// </summary>
+public record OpcUaConnectionOptions(
+    int SessionTimeoutMs = 60000,
+    int OperationTimeoutMs = 15000,
+    int PublishingIntervalMs = 1000,
+    int KeepAliveCount = 10,
+    int LifetimeCount = 30,
+    int MaxNotificationsPerPublish = 100,
+    int SamplingIntervalMs = 1000,
+    int QueueSize = 10,
+    string SecurityMode = "None",
+    bool AutoAcceptUntrustedCerts = true);
+
 /// <summary>
 /// WP-7: Abstraction over OPC UA client library for testability.
 /// The real implementation would wrap an OPC UA SDK (e.g., OPC Foundation .NET Standard Library).
 /// </summary>
 public interface IOpcUaClient : IAsyncDisposable
 {
-    Task ConnectAsync(string endpointUrl, CancellationToken cancellationToken = default);
+    Task ConnectAsync(string endpointUrl, OpcUaConnectionOptions? options = null, CancellationToken cancellationToken = default);
     Task DisconnectAsync(CancellationToken cancellationToken = default);
     bool IsConnected { get; }
 
@@ -24,6 +40,12 @@ public interface IOpcUaClient : IAsyncDisposable
         string nodeId, CancellationToken cancellationToken = default);
 
     Task<uint> WriteValueAsync(string nodeId, object? value, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Raised when the OPC UA session detects a keep-alive failure or the server
+    /// becomes unreachable. The adapter layer uses this to trigger reconnection.
+    /// </summary>
+    event Action? ConnectionLost;
 }
 
 /// <summary>
@@ -50,8 +72,11 @@ public class DefaultOpcUaClientFactory : IOpcUaClientFactory
 internal class StubOpcUaClient : IOpcUaClient
 {
     public bool IsConnected { get; private set; }
+#pragma warning disable CS0067
+    public event Action? ConnectionLost;
+#pragma warning restore CS0067
 
-    public Task ConnectAsync(string endpointUrl, CancellationToken cancellationToken = default)
+    public Task ConnectAsync(string endpointUrl, OpcUaConnectionOptions? options = null, CancellationToken cancellationToken = default)
     {
         IsConnected = true;
         return Task.CompletedTask;

src/ScadaLink.DataConnectionLayer/Adapters/LmxProxyDataConnection.cs

@@ -23,6 +23,7 @@ public class LmxProxyDataConnection : IDataConnection
     private ConnectionHealth _status = ConnectionHealth.Disconnected;
 
     private readonly Dictionary<string, ILmxSubscription> _subscriptions = new();
+    private volatile bool _disconnectFired;
 
     public LmxProxyDataConnection(ILmxProxyClientFactory clientFactory, ILogger<LmxProxyDataConnection> logger)
     {
@@ -31,6 +32,7 @@ public class LmxProxyDataConnection : IDataConnection
     }
 
     public ConnectionHealth Status => _status;
+    public event Action? Disconnected;
 
     public async Task ConnectAsync(IDictionary<string, string> connectionDetails, CancellationToken cancellationToken = default)
     {
@@ -39,11 +41,15 @@ public class LmxProxyDataConnection : IDataConnection
             _port = port;
         connectionDetails.TryGetValue("ApiKey", out var apiKey);
 
+        var samplingIntervalMs = connectionDetails.TryGetValue("SamplingIntervalMs", out var sampStr) && int.TryParse(sampStr, out var samp) ? samp : 0;
+        var useTls = connectionDetails.TryGetValue("UseTls", out var tlsStr) && bool.TryParse(tlsStr, out var tls) && tls;
+
         _status = ConnectionHealth.Connecting;
-        _client = _clientFactory.Create(_host, _port, apiKey);
+        _client = _clientFactory.Create(_host, _port, apiKey, samplingIntervalMs, useTls);
 
         await _client.ConnectAsync(cancellationToken);
         _status = ConnectionHealth.Connected;
+        _disconnectFired = false;
 
         _logger.LogInformation("LmxProxy connected to {Host}:{Port}", _host, _port);
     }
@@ -62,13 +68,22 @@ public class LmxProxyDataConnection : IDataConnection
     {
         EnsureConnected();
 
-        var vtq = await _client!.ReadAsync(tagPath, cancellationToken);
-        var quality = MapQuality(vtq.Quality);
-        var tagValue = new TagValue(vtq.Value, quality, new DateTimeOffset(vtq.TimestampUtc, TimeSpan.Zero));
+        try
+        {
+            var vtq = await _client!.ReadAsync(tagPath, cancellationToken);
+            var quality = MapQuality(vtq.Quality);
+            var tagValue = new TagValue(vtq.Value, quality, new DateTimeOffset(vtq.TimestampUtc, TimeSpan.Zero));
 
-        return vtq.Quality == LmxQuality.Bad
-            ? new ReadResult(false, tagValue, "LmxProxy read returned bad quality")
-            : new ReadResult(true, tagValue, null);
+            return vtq.Quality == LmxQuality.Bad
+                ? new ReadResult(false, tagValue, "LmxProxy read returned bad quality")
+                : new ReadResult(true, tagValue, null);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning(ex, "LmxProxy read failed for {TagPath} — connection may be lost", tagPath);
+            RaiseDisconnected();
+            throw;
+        }
     }
 
     public async Task<IReadOnlyDictionary<string, ReadResult>> ReadBatchAsync(IEnumerable<string> tagPaths, CancellationToken cancellationToken = default)
@@ -161,6 +176,11 @@ public class LmxProxyDataConnection : IDataConnection
                 var quality = MapQuality(vtq.Quality);
                 callback(path, new TagValue(vtq.Value, quality, new DateTimeOffset(vtq.TimestampUtc, TimeSpan.Zero)));
             },
+            onStreamError: () =>
+            {
+                _logger.LogWarning("LmxProxy subscription stream ended unexpectedly for {TagPath}", tagPath);
+                RaiseDisconnected();
+            },
             cancellationToken);
 
         var subscriptionId = Guid.NewGuid().ToString("N");
@@ -199,6 +219,19 @@ public class LmxProxyDataConnection : IDataConnection
             throw new InvalidOperationException("LmxProxy client is not connected.");
     }
 
+    /// <summary>
+    /// Marks the connection as disconnected and fires the Disconnected event once.
+    /// Thread-safe: only the first caller triggers the event.
+    /// </summary>
+    private void RaiseDisconnected()
+    {
+        if (_disconnectFired) return;
+        _disconnectFired = true;
+        _status = ConnectionHealth.Disconnected;
+        _logger.LogWarning("LmxProxy connection to {Host}:{Port} lost", _host, _port);
+        Disconnected?.Invoke();
+    }
+
     private static QualityCode MapQuality(LmxQuality quality) => quality switch
     {
         LmxQuality.Good => QualityCode.Good,

src/ScadaLink.DataConnectionLayer/Adapters/OpcUaDataConnection.cs

@@ -33,29 +33,62 @@ public class OpcUaDataConnection : IDataConnection
         _logger = logger;
     }
 
+    private volatile bool _disconnectFired;
+
     public ConnectionHealth Status => _status;
+    public event Action? Disconnected;
 
     public async Task ConnectAsync(IDictionary<string, string> connectionDetails, CancellationToken cancellationToken = default)
     {
-        // Support both "endpoint" (from JSON config) and "EndpointUrl" (programmatic)
         _endpointUrl = connectionDetails.TryGetValue("endpoint", out var url)
             ? url
             : connectionDetails.TryGetValue("EndpointUrl", out var url2)
                 ? url2
                 : "opc.tcp://localhost:4840";
+
+        var options = new OpcUaConnectionOptions(
+            SessionTimeoutMs: ParseInt(connectionDetails, "SessionTimeoutMs", 60000),
+            OperationTimeoutMs: ParseInt(connectionDetails, "OperationTimeoutMs", 15000),
+            PublishingIntervalMs: ParseInt(connectionDetails, "PublishingIntervalMs", 1000),
+            KeepAliveCount: ParseInt(connectionDetails, "KeepAliveCount", 10),
+            LifetimeCount: ParseInt(connectionDetails, "LifetimeCount", 30),
+            MaxNotificationsPerPublish: ParseInt(connectionDetails, "MaxNotificationsPerPublish", 100),
+            SamplingIntervalMs: ParseInt(connectionDetails, "SamplingIntervalMs", 1000),
+            QueueSize: ParseInt(connectionDetails, "QueueSize", 10),
+            SecurityMode: connectionDetails.TryGetValue("SecurityMode", out var secMode) ? secMode : "None",
+            AutoAcceptUntrustedCerts: ParseBool(connectionDetails, "AutoAcceptUntrustedCerts", true));
+
         _status = ConnectionHealth.Connecting;
 
         _client = _clientFactory.Create();
-        await _client.ConnectAsync(_endpointUrl, cancellationToken);
+        _client.ConnectionLost += OnClientConnectionLost;
+        await _client.ConnectAsync(_endpointUrl, options, cancellationToken);
 
         _status = ConnectionHealth.Connected;
+        _disconnectFired = false;
         _logger.LogInformation("OPC UA connected to {Endpoint}", _endpointUrl);
     }
 
+    internal static int ParseInt(IDictionary<string, string> d, string key, int defaultValue)
+    {
+        return d.TryGetValue(key, out var str) && int.TryParse(str, out var val) ? val : defaultValue;
+    }
+
+    internal static bool ParseBool(IDictionary<string, string> d, string key, bool defaultValue)
+    {
+        return d.TryGetValue(key, out var str) && bool.TryParse(str, out var val) ? val : defaultValue;
+    }
+
+    private void OnClientConnectionLost()
+    {
+        RaiseDisconnected();
+    }
+
     public async Task DisconnectAsync(CancellationToken cancellationToken = default)
     {
         if (_client != null)
         {
+            _client.ConnectionLost -= OnClientConnectionLost;
             await _client.DisconnectAsync(cancellationToken);
             _status = ConnectionHealth.Disconnected;
             _logger.LogInformation("OPC UA disconnected from {Endpoint}", _endpointUrl);
@@ -92,13 +125,22 @@ public class OpcUaDataConnection : IDataConnection
     {
         EnsureConnected();
 
-        var (value, timestamp, statusCode) = await _client!.ReadValueAsync(tagPath, cancellationToken);
-        var quality = MapStatusCode(statusCode);
+        try
+        {
+            var (value, timestamp, statusCode) = await _client!.ReadValueAsync(tagPath, cancellationToken);
+            var quality = MapStatusCode(statusCode);
 
-        if (quality == QualityCode.Bad)
-            return new ReadResult(false, null, $"OPC UA read returned bad status: 0x{statusCode:X8}");
+            if (quality == QualityCode.Bad)
+                return new ReadResult(false, null, $"OPC UA read returned bad status: 0x{statusCode:X8}");
 
-        return new ReadResult(true, new TagValue(value, quality, new DateTimeOffset(timestamp, TimeSpan.Zero)), null);
+            return new ReadResult(true, new TagValue(value, quality, new DateTimeOffset(timestamp, TimeSpan.Zero)), null);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning(ex, "OPC UA read failed for {TagPath} — connection may be lost", tagPath);
+            RaiseDisconnected();
+            throw;
+        }
     }
 
     public async Task<IReadOnlyDictionary<string, ReadResult>> ReadBatchAsync(IEnumerable<string> tagPaths, CancellationToken cancellationToken = default)
@@ -163,6 +205,7 @@ public class OpcUaDataConnection : IDataConnection
     {
         if (_client != null)
         {
+            _client.ConnectionLost -= OnClientConnectionLost;
             await _client.DisposeAsync();
             _client = null;
         }
@@ -175,6 +218,19 @@ public class OpcUaDataConnection : IDataConnection
             throw new InvalidOperationException("OPC UA client is not connected.");
     }
 
+    /// <summary>
+    /// Marks the connection as disconnected and fires the Disconnected event once.
+    /// Thread-safe: only the first caller triggers the event.
+    /// </summary>
+    private void RaiseDisconnected()
+    {
+        if (_disconnectFired) return;
+        _disconnectFired = true;
+        _status = ConnectionHealth.Disconnected;
+        _logger.LogWarning("OPC UA connection to {Endpoint} lost", _endpointUrl);
+        Disconnected?.Invoke();
+    }
+
     /// <summary>
     /// Maps OPC UA StatusCode to QualityCode.
     /// StatusCode 0 = Good, high bit set = Bad, otherwise Uncertain.

src/ScadaLink.DataConnectionLayer/Adapters/RealLmxProxyClient.cs

@@ -14,25 +14,31 @@ internal class RealLmxProxyClient : ILmxProxyClient
     private readonly string _host;
     private readonly int _port;
     private readonly string? _apiKey;
+    private readonly int _samplingIntervalMs;
+    private readonly bool _useTls;
     private GrpcChannel? _channel;
     private ScadaService.ScadaServiceClient? _client;
     private string? _sessionId;
     private Metadata? _headers;
 
-    public RealLmxProxyClient(string host, int port, string? apiKey)
+    public RealLmxProxyClient(string host, int port, string? apiKey, int samplingIntervalMs = 0, bool useTls = false)
     {
         _host = host;
         _port = port;
         _apiKey = apiKey;
+        _samplingIntervalMs = samplingIntervalMs;
+        _useTls = useTls;
     }
 
     public bool IsConnected => _client != null && !string.IsNullOrEmpty(_sessionId);
 
     public async Task ConnectAsync(CancellationToken cancellationToken = default)
     {
-        AppContext.SetSwitch("System.Net.Http.SocketsHttpHandler.Http2UnencryptedSupport", true);
+        if (!_useTls)
+            AppContext.SetSwitch("System.Net.Http.SocketsHttpHandler.Http2UnencryptedSupport", true);
 
-        _channel = GrpcChannel.ForAddress($"http://{_host}:{_port}");
+        var scheme = _useTls ? "https" : "http";
+        _channel = GrpcChannel.ForAddress($"{scheme}://{_host}:{_port}");
         _client = new ScadaService.ScadaServiceClient(_channel);
 
         _headers = new Metadata();
@@ -111,13 +117,13 @@ internal class RealLmxProxyClient : ILmxProxyClient
             throw new InvalidOperationException($"WriteBatch failed: {response.Message}");
     }
 
-    public Task<ILmxSubscription> SubscribeAsync(IEnumerable<string> addresses, Action<string, LmxVtq> onUpdate, CancellationToken cancellationToken = default)
+    public Task<ILmxSubscription> SubscribeAsync(IEnumerable<string> addresses, Action<string, LmxVtq> onUpdate, Action? onStreamError = null, CancellationToken cancellationToken = default)
     {
         EnsureConnected();
         var tags = addresses.ToList();
         var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
 
-        var request = new SubscribeRequest { SessionId = _sessionId!, SamplingMs = 0 };
+        var request = new SubscribeRequest { SessionId = _sessionId!, SamplingMs = _samplingIntervalMs };
         request.Tags.AddRange(tags);
 
         var call = _client!.Subscribe(request, _headers, cancellationToken: cts.Token);
@@ -131,9 +137,18 @@ internal class RealLmxProxyClient : ILmxProxyClient
                     var msg = call.ResponseStream.Current;
                     onUpdate(msg.Tag, ConvertVtq(msg));
                 }
+                // Stream ended normally (server closed) — treat as disconnect
+                _sessionId = null;
+                onStreamError?.Invoke();
             }
             catch (OperationCanceledException) { }
             catch (RpcException ex) when (ex.StatusCode == StatusCode.Cancelled) { }
+            catch (RpcException)
+            {
+                // gRPC error (server offline, network failure) — signal disconnect
+                _sessionId = null;
+                onStreamError?.Invoke();
+            }
         }, cts.Token);
 
         return Task.FromResult<ILmxSubscription>(new CtsSubscription(cts));
@@ -191,6 +206,6 @@ internal class RealLmxProxyClient : ILmxProxyClient
 /// </summary>
 public class RealLmxProxyClientFactory : ILmxProxyClientFactory
 {
-    public ILmxProxyClient Create(string host, int port, string? apiKey)
-        => new RealLmxProxyClient(host, port, apiKey);
+    public ILmxProxyClient Create(string host, int port, string? apiKey, int samplingIntervalMs = 0, bool useTls = false)
+        => new RealLmxProxyClient(host, port, apiKey, samplingIntervalMs, useTls);
 }

src/ScadaLink.DataConnectionLayer/Adapters/RealOpcUaClient.cs

@@ -14,31 +14,44 @@ public class RealOpcUaClient : IOpcUaClient
     private Subscription? _subscription;
     private readonly Dictionary<string, MonitoredItem> _monitoredItems = new();
     private readonly Dictionary<string, Action<string, object?, DateTime, uint>> _callbacks = new();
+    private volatile bool _connectionLostFired;
+    private OpcUaConnectionOptions _options = new();
 
     public bool IsConnected => _session?.Connected ?? false;
+    public event Action? ConnectionLost;
 
-    public async Task ConnectAsync(string endpointUrl, CancellationToken cancellationToken = default)
+    public async Task ConnectAsync(string endpointUrl, OpcUaConnectionOptions? options = null, CancellationToken cancellationToken = default)
     {
+        var opts = options ?? new OpcUaConnectionOptions();
+
+        var preferredSecurityMode = opts.SecurityMode?.ToUpperInvariant() switch
+        {
+            "SIGN" => MessageSecurityMode.Sign,
+            "SIGNANDENCRYPT" => MessageSecurityMode.SignAndEncrypt,
+            _ => MessageSecurityMode.None
+        };
+
         var appConfig = new ApplicationConfiguration
         {
             ApplicationName = "ScadaLink-DCL",
             ApplicationType = ApplicationType.Client,
             SecurityConfiguration = new SecurityConfiguration
             {
-                AutoAcceptUntrustedCertificates = true,
+                AutoAcceptUntrustedCertificates = opts.AutoAcceptUntrustedCerts,
                 ApplicationCertificate = new CertificateIdentifier(),
                 TrustedIssuerCertificates = new CertificateTrustList { StorePath = Path.Combine(Path.GetTempPath(), "ScadaLink", "pki", "issuers") },
                 TrustedPeerCertificates = new CertificateTrustList { StorePath = Path.Combine(Path.GetTempPath(), "ScadaLink", "pki", "trusted") },
                 RejectedCertificateStore = new CertificateTrustList { StorePath = Path.Combine(Path.GetTempPath(), "ScadaLink", "pki", "rejected") }
             },
-            ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60000 },
-            TransportQuotas = new TransportQuotas { OperationTimeout = 15000 }
+            ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = opts.SessionTimeoutMs },
+            TransportQuotas = new TransportQuotas { OperationTimeout = opts.OperationTimeoutMs }
         };
 
         await appConfig.ValidateAsync(ApplicationType.Client);
-        appConfig.CertificateValidator.CertificateValidation += (_, e) => e.Accept = true;
+        if (opts.AutoAcceptUntrustedCerts)
+            appConfig.CertificateValidator.CertificateValidation += (_, e) => e.Accept = true;
 
-        // Discover endpoints from the server, pick the no-security one
+        // Discover endpoints from the server, pick the preferred security mode
         EndpointDescription? endpoint;
         try
         {
@@ -49,7 +62,7 @@ public class RealOpcUaClient : IOpcUaClient
             var endpoints = discoveryClient.GetEndpoints(null);
 #pragma warning restore CS0618
             endpoint = endpoints
-                .Where(e => e.SecurityMode == MessageSecurityMode.None)
+                .Where(e => e.SecurityMode == preferredSecurityMode)
                 .FirstOrDefault() ?? endpoints.FirstOrDefault();
         }
         catch
@@ -66,17 +79,24 @@ public class RealOpcUaClient : IOpcUaClient
 #pragma warning restore CS0618
         _session = await sessionFactory.CreateAsync(
             appConfig, configuredEndpoint, false,
-            "ScadaLink-DCL-Session", 60000, null, null, cancellationToken);
+            "ScadaLink-DCL-Session", (uint)opts.SessionTimeoutMs, null, null, cancellationToken);
+
+        // Detect server going offline via keep-alive failures
+        _connectionLostFired = false;
+        _session.KeepAlive += OnSessionKeepAlive;
+
+        // Store options for monitored item creation
+        _options = opts;
 
         // Create a default subscription for all monitored items
         _subscription = new Subscription(_session.DefaultSubscription)
         {
             DisplayName = "ScadaLink",
             PublishingEnabled = true,
-            PublishingInterval = 1000,
-            KeepAliveCount = 10,
-            LifetimeCount = 30,
-            MaxNotificationsPerPublish = 100
+            PublishingInterval = opts.PublishingIntervalMs,
+            KeepAliveCount = (uint)opts.KeepAliveCount,
+            LifetimeCount = (uint)opts.LifetimeCount,
+            MaxNotificationsPerPublish = (uint)opts.MaxNotificationsPerPublish
         };
 
         _session.AddSubscription(_subscription);
@@ -92,6 +112,7 @@ public class RealOpcUaClient : IOpcUaClient
         }
         if (_session != null)
         {
+            _session.KeepAlive -= OnSessionKeepAlive;
             await _session.CloseAsync(cancellationToken);
             _session = null;
         }
@@ -112,8 +133,8 @@ public class RealOpcUaClient : IOpcUaClient
             DisplayName = nodeId,
             StartNodeId = nodeId,
             AttributeId = Attributes.Value,
-            SamplingInterval = 1000,
-            QueueSize = 10,
+            SamplingInterval = _options.SamplingIntervalMs,
+            QueueSize = (uint)_options.QueueSize,
             DiscardOldest = true
         };
 
@@ -188,6 +209,20 @@ public class RealOpcUaClient : IOpcUaClient
         return response.Results[0].Code;
     }
 
+    /// <summary>
+    /// Called by the OPC UA SDK when a keep-alive response arrives (or fails).
+    /// When CurrentState is bad, the server is unreachable.
+    /// </summary>
+    private void OnSessionKeepAlive(ISession session, KeepAliveEventArgs e)
+    {
+        if (ServiceResult.IsBad(e.Status))
+        {
+            if (_connectionLostFired) return;
+            _connectionLostFired = true;
+            ConnectionLost?.Invoke();
+        }
+    }
+
     public async ValueTask DisposeAsync()
     {
         await DisconnectAsync();

src/ScadaLink.HealthMonitoring/SiteHealthCollector.cs

@@ -114,6 +114,9 @@ public class SiteHealthCollector : ISiteHealthCollector
         // Snapshot current S&F buffer depths
         var sfBufferDepths = new Dictionary<string, int>(_sfBufferDepths);
 
+        // Determine node role from active/standby state
+        var nodeRole = _isActiveNode ? "Active" : "Standby";
+
         return new SiteHealthReport(
             SiteId: siteId,
             SequenceNumber: 0, // Caller (HealthReportSender) assigns the sequence number
@@ -126,6 +129,7 @@ public class SiteHealthCollector : ISiteHealthCollector
             DeadLetterCount: deadLetters,
             DeployedInstanceCount: _deployedInstanceCount,
             EnabledInstanceCount: _enabledInstanceCount,
-            DisabledInstanceCount: _disabledInstanceCount);
+            DisabledInstanceCount: _disabledInstanceCount,
+            NodeRole: nodeRole);
     }
 }

src/ScadaLink.Host/Health/AkkaClusterHealthCheck.cs

@@ -1,19 +1,42 @@
+using Akka.Actor;
+using Akka.Cluster;
 using Microsoft.Extensions.Diagnostics.HealthChecks;
 
 namespace ScadaLink.Host.Health;
 
 /// <summary>
-/// Health check that verifies Akka.NET cluster membership.
-/// Initially returns healthy; will be refined when Akka cluster integration is complete.
+/// Health check that verifies this node is an active member of the Akka.NET cluster.
+/// Returns healthy only if the node's self-member status is Up or Joining.
 /// </summary>
 public class AkkaClusterHealthCheck : IHealthCheck
 {
+    private readonly ActorSystem? _system;
+
+    public AkkaClusterHealthCheck(ActorSystem? system = null)
+    {
+        _system = system;
+    }
+
     public Task<HealthCheckResult> CheckHealthAsync(
         HealthCheckContext context,
         CancellationToken cancellationToken = default)
     {
-        // TODO: Query Akka Cluster.Get(system).State to verify this node is Up.
-        // For now, return healthy as Akka cluster wiring is being established.
-        return Task.FromResult(HealthCheckResult.Healthy("Akka cluster health check placeholder."));
+        if (_system == null)
+            return Task.FromResult(HealthCheckResult.Degraded("ActorSystem not yet available."));
+
+        var cluster = Cluster.Get(_system);
+        var status = cluster.SelfMember.Status;
+
+        var result = status switch
+        {
+            MemberStatus.Up or MemberStatus.Joining =>
+                HealthCheckResult.Healthy($"Akka cluster member status: {status}"),
+            MemberStatus.Leaving or MemberStatus.Exiting =>
+                HealthCheckResult.Degraded($"Akka cluster member status: {status}"),
+            _ =>
+                HealthCheckResult.Unhealthy($"Akka cluster member status: {status}")
+        };
+
+        return Task.FromResult(result);
     }
 }

src/ScadaLink.SiteRuntime/Actors/InstanceActor.cs

@@ -284,17 +284,36 @@ public class InstanceActor : ReceiveActor
     {
         if (_tagPathToAttribute.TryGetValue(update.TagPath, out var attrName))
         {
+            // Normalize array values to JSON strings so they survive Akka serialization
+            var value = update.Value is Array
+                ? System.Text.Json.JsonSerializer.Serialize(update.Value, update.Value.GetType())
+                : update.Value;
+
             var changed = new AttributeValueChanged(
                 _instanceUniqueName, update.TagPath, attrName,
-                update.Value, update.Quality.ToString(), update.Timestamp);
+                value, update.Quality.ToString(), update.Timestamp);
             HandleAttributeValueChanged(changed);
         }
     }
 
     private void HandleConnectionQualityChanged(ConnectionQualityChanged qualityChanged)
     {
-        _logger.LogInformation("Connection {Connection} quality changed to {Quality}",
-            qualityChanged.ConnectionName, qualityChanged.Quality);
+        _logger.LogWarning("Connection {Connection} quality changed to {Quality} for instance {Instance}",
+            qualityChanged.ConnectionName, qualityChanged.Quality, _instanceUniqueName);
+
+        if (_configuration == null) return;
+
+        // Mark all attributes bound to this connection with the new quality
+        var qualityStr = qualityChanged.Quality.ToString();
+        foreach (var attr in _configuration.Attributes)
+        {
+            if (attr.BoundDataConnectionName == qualityChanged.ConnectionName &&
+                !string.IsNullOrEmpty(attr.DataSourceReference))
+            {
+                _attributeQualities[attr.CanonicalName] = qualityStr;
+                _attributeTimestamps[attr.CanonicalName] = qualityChanged.Timestamp;
+            }
+        }
     }
 
     /// <summary>

src/ScadaLink.TemplateEngine/TemplateService.cs

@@ -236,7 +236,8 @@ public class TemplateService
         existing.Value = proposed.Value;
         existing.Description = proposed.Description;
         existing.IsLocked = proposed.IsLocked;
-        // DataType and DataSourceReference are NOT updated (fixed fields)
+        existing.DataType = proposed.DataType;
+        existing.DataSourceReference = proposed.DataSourceReference;
 
         await _repository.UpdateTemplateAttributeAsync(existing, cancellationToken);
         await _auditService.LogAsync(user, "Update", "TemplateAttribute", attributeId.ToString(), existing.Name, existing, cancellationToken);

test_infra.md

@@ -11,6 +11,7 @@ This document describes the local Docker-based test infrastructure for ScadaLink
 | MS SQL 2022 | `mcr.microsoft.com/mssql/server:2022-latest` | 1433 | `infra/mssql/setup.sql` |
 | SMTP (Mailpit) | `axllent/mailpit:latest` | 1025 (SMTP), 8025 (web) | Environment vars |
 | REST API (Flask) | Custom build (`infra/restapi/Dockerfile`) | 5200 | `infra/restapi/app.py` |
+| LmxFakeProxy | Custom build (`infra/lmxfakeproxy/Dockerfile`) | 50051 (gRPC) | Environment vars |
 
 ## Quick Start
 
@@ -40,6 +41,7 @@ Each service has a dedicated document with configuration details, verification s
 - [test_infra_db.md](test_infra_db.md) — MS SQL 2022 database
 - [test_infra_smtp.md](test_infra_smtp.md) — SMTP test server (Mailpit)
 - [test_infra_restapi.md](test_infra_restapi.md) — REST API test server (Flask)
+- [test_infra_lmxfakeproxy.md](test_infra_lmxfakeproxy.md) — LmxProxy fake server (OPC UA bridge)
 
 ## Connection Strings
 
@@ -107,6 +109,7 @@ infra/
   opcua/nodes.json            # Custom OPC UA tag definitions
   restapi/app.py              # Flask REST API server
   restapi/Dockerfile          # REST API container build
+  lmxfakeproxy/              # .NET gRPC proxy bridging LmxProxy protocol to OPC UA
   tools/                      # Python CLI tools (opcua, ldap, mssql, smtp, restapi)
   README.md                   # Quick-start for the infra folder
 ```

test_infra_lmxfakeproxy.md

@@ -0,0 +1,76 @@
+# Test Infrastructure: LmxFakeProxy
+
+## Overview
+
+LmxFakeProxy is a .NET gRPC server that implements the `scada.ScadaService` proto (full parity with the real LmxProxy server) but bridges to the OPC UA test server instead of System Platform MXAccess. This enables end-to-end testing of `RealLmxProxyClient` and the LmxProxy DCL adapter.
+
+## Image & Ports
+
+- **Image**: Custom build (`infra/lmxfakeproxy/Dockerfile`)
+- **gRPC endpoint**: `localhost:50051`
+
+## Configuration
+
+| Environment Variable | Default | Description |
+|---------------------|---------|-------------|
+| `PORT` | `50051` | gRPC listen port |
+| `OPC_ENDPOINT` | `opc.tcp://localhost:50000` | Backend OPC UA server |
+| `OPC_PREFIX` | `ns=3;s=` | Prefix prepended to LMX tags to form OPC UA NodeIds |
+| `API_KEY` | *(none)* | If set, enforces API key on all gRPC calls |
+
+## Tag Address Mapping
+
+LMX-style flat addresses are mapped to OPC UA NodeIds by prepending the configured prefix:
+
+| LMX Tag | OPC UA NodeId |
+|---------|--------------|
+| `Motor.Speed` | `ns=3;s=Motor.Speed` |
+| `Pump.FlowRate` | `ns=3;s=Pump.FlowRate` |
+| `Tank.Level` | `ns=3;s=Tank.Level` |
+
+## Supported RPCs
+
+Full parity with the `scada.ScadaService` proto:
+
+- **Connect / Disconnect / GetConnectionState** — Session management
+- **Read / ReadBatch** — Read tag values via OPC UA
+- **Write / WriteBatch / WriteBatchAndWait** — Write values via OPC UA
+- **Subscribe** — Server-streaming subscriptions via OPC UA MonitoredItems
+- **CheckApiKey** — API key validation
+
+## Verification
+
+1. Ensure the OPC UA test server is running:
+```bash
+docker ps --filter name=scadalink-opcua
+```
+
+2. Start the fake proxy:
+```bash
+docker compose up -d lmxfakeproxy
+```
+
+3. Check logs:
+```bash
+docker logs scadalink-lmxfakeproxy
+```
+
+4. Test with the ScadaLink CLI or a gRPC client.
+
+## Running Standalone (without Docker)
+
+```bash
+cd infra/lmxfakeproxy
+dotnet run -- --opc-endpoint opc.tcp://localhost:50000 --opc-prefix "ns=3;s="
+```
+
+With API key enforcement:
+```bash
+dotnet run -- --api-key my-secret-key
+```
+
+## Relevance to ScadaLink Components
+
+- **Data Connection Layer** — Test `RealLmxProxyClient` and `LmxProxyDataConnection` against real OPC UA data
+- **Site Runtime** — Deploy instances with LmxProxy data connections pointing at this server
+- **Integration Tests** — End-to-end tests of the LmxProxy protocol path

test_infra_opcua.md

@@ -33,12 +33,13 @@ The file `infra/opcua/nodes.json` defines a single `ConfigFolder` object (not an
 | Pump | FlowRate, Pressure, Running | Double, Boolean |
 | Tank | Level, Temperature, HighLevel, LowLevel | Double, Boolean |
 | Valve | Position, Command | Double, UInt32 |
+| JoeAppEngine | BTCS, AlarmCntsBySeverity, Scheduler/ScanTime | String, Int32[], DateTime |
 
-All custom nodes hold their initial/default values (0 for numerics, false for booleans) until written. OPC PLC's custom node format does not support random value generation for these nodes.
+All custom nodes hold their initial/default values (0 for numerics, false for booleans, empty for strings, epoch for DateTime) until written. OPC PLC's custom node format does not support random value generation for these nodes.
 
-Custom nodes live in namespace 3 (`http://microsoft.com/Opc/OpcPlc/`). Node IDs follow the pattern `ns=3;s=<Folder>.<Tag>` (e.g., `ns=3;s=Motor.Speed`).
+Custom nodes live in namespace 3 (`http://microsoft.com/Opc/OpcPlc/`). Node IDs follow the pattern `ns=3;s=<Folder>.<Tag>` (e.g., `ns=3;s=Motor.Speed`). Nested folders use dot notation: `ns=3;s=JoeAppEngine.Scheduler.ScanTime`.
 
-The browse path from the Objects root is: `OpcPlc > ScadaLink > Motor|Pump|Tank|Valve`.
+The browse path from the Objects root is: `OpcPlc > ScadaLink > Motor|Pump|Tank|Valve|JoeAppEngine`.
 
 ## Verification
 

tests/ScadaLink.CLI.Tests/CliConfigTests.cs

@@ -0,0 +1,90 @@
+using ScadaLink.CLI;
+
+namespace ScadaLink.CLI.Tests;
+
+public class CliConfigTests
+{
+    [Fact]
+    public void Load_DefaultValues_WhenNoConfigExists()
+    {
+        // Clear environment variables that might affect the test
+        var origContact = Environment.GetEnvironmentVariable("SCADALINK_CONTACT_POINTS");
+        var origLdap = Environment.GetEnvironmentVariable("SCADALINK_LDAP_SERVER");
+        var origFormat = Environment.GetEnvironmentVariable("SCADALINK_FORMAT");
+
+        try
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_CONTACT_POINTS", null);
+            Environment.SetEnvironmentVariable("SCADALINK_LDAP_SERVER", null);
+            Environment.SetEnvironmentVariable("SCADALINK_FORMAT", null);
+
+            var config = CliConfig.Load();
+
+            Assert.Equal(636, config.LdapPort);
+            Assert.True(config.LdapUseTls);
+            Assert.Equal("json", config.DefaultFormat);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_CONTACT_POINTS", origContact);
+            Environment.SetEnvironmentVariable("SCADALINK_LDAP_SERVER", origLdap);
+            Environment.SetEnvironmentVariable("SCADALINK_FORMAT", origFormat);
+        }
+    }
+
+    [Fact]
+    public void Load_ContactPoints_FromEnvironment()
+    {
+        var orig = Environment.GetEnvironmentVariable("SCADALINK_CONTACT_POINTS");
+        try
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_CONTACT_POINTS", "host1:8080,host2:8080");
+
+            var config = CliConfig.Load();
+
+            Assert.Equal(2, config.ContactPoints.Count);
+            Assert.Equal("host1:8080", config.ContactPoints[0]);
+            Assert.Equal("host2:8080", config.ContactPoints[1]);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_CONTACT_POINTS", orig);
+        }
+    }
+
+    [Fact]
+    public void Load_LdapServer_FromEnvironment()
+    {
+        var orig = Environment.GetEnvironmentVariable("SCADALINK_LDAP_SERVER");
+        try
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_LDAP_SERVER", "ldap.example.com");
+
+            var config = CliConfig.Load();
+
+            Assert.Equal("ldap.example.com", config.LdapServer);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_LDAP_SERVER", orig);
+        }
+    }
+
+    [Fact]
+    public void Load_Format_FromEnvironment()
+    {
+        var orig = Environment.GetEnvironmentVariable("SCADALINK_FORMAT");
+        try
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_FORMAT", "table");
+
+            var config = CliConfig.Load();
+
+            Assert.Equal("table", config.DefaultFormat);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SCADALINK_FORMAT", orig);
+        }
+    }
+}

tests/ScadaLink.CLI.Tests/CommandHelpersTests.cs

@@ -0,0 +1,131 @@
+using ScadaLink.CLI.Commands;
+using ScadaLink.Commons.Messages.Management;
+
+namespace ScadaLink.CLI.Tests;
+
+public class CommandHelpersTests
+{
+    [Fact]
+    public void HandleResponse_ManagementSuccess_JsonFormat_ReturnsZero()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        var response = new ManagementSuccess("corr-1", "{\"id\":1,\"name\":\"test\"}");
+        var exitCode = CommandHelpers.HandleResponse(response, "json");
+
+        Assert.Equal(0, exitCode);
+        Assert.Contains("{\"id\":1,\"name\":\"test\"}", writer.ToString());
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void HandleResponse_ManagementSuccess_TableFormat_ArrayData_ReturnsZero()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        var json = "[{\"Id\":1,\"Name\":\"Alpha\"},{\"Id\":2,\"Name\":\"Beta\"}]";
+        var response = new ManagementSuccess("corr-1", json);
+        var exitCode = CommandHelpers.HandleResponse(response, "table");
+
+        Assert.Equal(0, exitCode);
+        var output = writer.ToString();
+        Assert.Contains("Id", output);
+        Assert.Contains("Name", output);
+        Assert.Contains("Alpha", output);
+        Assert.Contains("Beta", output);
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void HandleResponse_ManagementSuccess_TableFormat_ObjectData_ReturnsZero()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        var json = "{\"Id\":1,\"Name\":\"Alpha\",\"Status\":\"Active\"}";
+        var response = new ManagementSuccess("corr-1", json);
+        var exitCode = CommandHelpers.HandleResponse(response, "table");
+
+        Assert.Equal(0, exitCode);
+        var output = writer.ToString();
+        Assert.Contains("Property", output);
+        Assert.Contains("Value", output);
+        Assert.Contains("Id", output);
+        Assert.Contains("Alpha", output);
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void HandleResponse_ManagementSuccess_TableFormat_EmptyArray_ShowsNoResults()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        var response = new ManagementSuccess("corr-1", "[]");
+        var exitCode = CommandHelpers.HandleResponse(response, "table");
+
+        Assert.Equal(0, exitCode);
+        Assert.Contains("(no results)", writer.ToString());
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void HandleResponse_ManagementError_ReturnsOne()
+    {
+        var errWriter = new StringWriter();
+        Console.SetError(errWriter);
+
+        var response = new ManagementError("corr-1", "Something failed", "FAIL_CODE");
+        var exitCode = CommandHelpers.HandleResponse(response, "json");
+
+        Assert.Equal(1, exitCode);
+        Assert.Contains("Something failed", errWriter.ToString());
+
+        Console.SetError(new StreamWriter(Console.OpenStandardError()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void HandleResponse_ManagementUnauthorized_ReturnsTwo()
+    {
+        var errWriter = new StringWriter();
+        Console.SetError(errWriter);
+
+        var response = new ManagementUnauthorized("corr-1", "Access denied");
+        var exitCode = CommandHelpers.HandleResponse(response, "json");
+
+        Assert.Equal(2, exitCode);
+        Assert.Contains("Access denied", errWriter.ToString());
+
+        Console.SetError(new StreamWriter(Console.OpenStandardError()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void HandleResponse_UnexpectedType_ReturnsOne()
+    {
+        var errWriter = new StringWriter();
+        Console.SetError(errWriter);
+
+        var exitCode = CommandHelpers.HandleResponse("unexpected", "json");
+
+        Assert.Equal(1, exitCode);
+        Assert.Contains("Unexpected response type", errWriter.ToString());
+
+        Console.SetError(new StreamWriter(Console.OpenStandardError()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void NewCorrelationId_ReturnsNonEmpty32CharHex()
+    {
+        var id = CommandHelpers.NewCorrelationId();
+
+        Assert.NotNull(id);
+        Assert.Equal(32, id.Length);
+        Assert.True(id.All(c => "0123456789abcdef".Contains(c)));
+    }
+}

tests/ScadaLink.CLI.Tests/OutputFormatterTests.cs

@@ -0,0 +1,102 @@
+using ScadaLink.CLI;
+
+namespace ScadaLink.CLI.Tests;
+
+public class OutputFormatterTests
+{
+    [Fact]
+    public void WriteJson_WritesIndentedJson()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        OutputFormatter.WriteJson(new { Name = "test", Value = 42 });
+
+        var output = writer.ToString().Trim();
+        Assert.Contains("\"name\"", output);
+        Assert.Contains("\"value\": 42", output);
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void WriteError_WritesToStdErr()
+    {
+        var writer = new StringWriter();
+        Console.SetError(writer);
+
+        OutputFormatter.WriteError("something went wrong", "ERR_CODE");
+
+        var output = writer.ToString().Trim();
+        Assert.Contains("something went wrong", output);
+        Assert.Contains("ERR_CODE", output);
+
+        Console.SetError(new StreamWriter(Console.OpenStandardError()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void WriteTable_RendersHeadersAndRows()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        var headers = new[] { "Id", "Name", "Status" };
+        var rows = new List<string[]>
+        {
+            new[] { "1", "Alpha", "Active" },
+            new[] { "2", "Beta", "Inactive" }
+        };
+
+        OutputFormatter.WriteTable(rows, headers);
+
+        var output = writer.ToString();
+        Assert.Contains("Id", output);
+        Assert.Contains("Name", output);
+        Assert.Contains("Status", output);
+        Assert.Contains("Alpha", output);
+        Assert.Contains("Beta", output);
+        Assert.Contains("Inactive", output);
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void WriteTable_EmptyRows_ShowsHeadersOnly()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        var headers = new[] { "Id", "Name" };
+        OutputFormatter.WriteTable(Array.Empty<string[]>(), headers);
+
+        var output = writer.ToString();
+        Assert.Contains("Id", output);
+        Assert.Contains("Name", output);
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+
+    [Fact]
+    public void WriteTable_ColumnWidthsAdjustToContent()
+    {
+        var writer = new StringWriter();
+        Console.SetOut(writer);
+
+        var headers = new[] { "X", "LongColumnName" };
+        var rows = new List<string[]>
+        {
+            new[] { "ShortValue", "Y" }
+        };
+
+        OutputFormatter.WriteTable(rows, headers);
+
+        var lines = writer.ToString().Split(Environment.NewLine, StringSplitOptions.RemoveEmptyEntries);
+        // Header line: "X" should be padded to at least "ShortValue" width
+        Assert.True(lines.Length >= 2);
+        // The "X" column header should be padded wider than 1 character
+        var headerLine = lines[0];
+        Assert.True(headerLine.IndexOf("LongColumnName") > 1);
+
+        Console.SetOut(new StreamWriter(Console.OpenStandardOutput()) { AutoFlush = true });
+    }
+}

tests/ScadaLink.CLI.Tests/ScadaLink.CLI.Tests.csproj

@@ -0,0 +1,28 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../src/ScadaLink.CLI/ScadaLink.CLI.csproj" />
+    <ProjectReference Include="../../src/ScadaLink.Commons/ScadaLink.Commons.csproj" />
+  </ItemGroup>
+
+</Project>

tests/ScadaLink.CentralUI.Tests/ComponentRenderingTests.cs

@@ -0,0 +1,83 @@
+using System.Security.Claims;
+using Bunit;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.Extensions.DependencyInjection;
+using ScadaLink.CentralUI.Components.Pages;
+
+namespace ScadaLink.CentralUI.Tests;
+
+/// <summary>
+/// bUnit rendering tests for CentralUI Blazor components.
+/// Verifies that pages render their expected markup structure.
+/// </summary>
+public class ComponentRenderingTests : BunitContext
+{
+    [Fact]
+    public void LoginPage_RendersForm_WithUsernameAndPasswordFields()
+    {
+        var cut = Render<Login>();
+
+        // Verify the form action
+        var form = cut.Find("form");
+        Assert.Equal("/auth/login", form.GetAttribute("action"));
+
+        // Verify username field
+        var usernameInput = cut.Find("input#username");
+        Assert.Equal("text", usernameInput.GetAttribute("type"));
+        Assert.Equal("username", usernameInput.GetAttribute("name"));
+
+        // Verify password field
+        var passwordInput = cut.Find("input#password");
+        Assert.Equal("password", passwordInput.GetAttribute("type"));
+        Assert.Equal("password", passwordInput.GetAttribute("name"));
+
+        // Verify submit button
+        var submitButton = cut.Find("button[type='submit']");
+        Assert.Contains("Sign In", submitButton.TextContent);
+    }
+
+    [Fact]
+    public void LoginPage_WithoutError_DoesNotRenderAlert()
+    {
+        var cut = Render<Login>();
+
+        Assert.Throws<Bunit.ElementNotFoundException>(() => cut.Find("div.alert.alert-danger"));
+    }
+
+    [Fact]
+    public void Dashboard_RequiresAuthorizeAttribute()
+    {
+        var authorizeAttrs = typeof(Dashboard)
+            .GetCustomAttributes(typeof(AuthorizeAttribute), true);
+        Assert.NotEmpty(authorizeAttrs);
+    }
+
+    [Fact]
+    public void TemplateEditor_RequiresDesignPolicy()
+    {
+        var authorizeAttrs = typeof(ScadaLink.CentralUI.Components.Pages.Design.Templates)
+            .GetCustomAttributes(typeof(AuthorizeAttribute), true);
+        Assert.NotEmpty(authorizeAttrs);
+
+        var attr = (AuthorizeAttribute)authorizeAttrs[0];
+        Assert.Equal("RequireDesign", attr.Policy);
+    }
+
+    [Fact]
+    public void LoginPage_RendersLdapCredentialHint()
+    {
+        var cut = Render<Login>();
+
+        Assert.Contains("LDAP credentials", cut.Markup);
+    }
+
+    [Fact]
+    public void LoginPage_RendersScadaLinkTitle()
+    {
+        var cut = Render<Login>();
+
+        var title = cut.Find("h4.card-title");
+        Assert.Equal("ScadaLink", title.TextContent);
+    }
+}

tests/ScadaLink.CentralUI.Tests/ScadaLink.CentralUI.Tests.csproj

@@ -9,8 +9,10 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="bunit" Version="2.0.33-preview" />
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="NSubstitute" Version="5.3.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
   </ItemGroup>
@@ -19,6 +21,10 @@
     <Using Include="Xunit" />
   </ItemGroup>
 
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+  </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="../../src/ScadaLink.CentralUI/ScadaLink.CentralUI.csproj" />
   </ItemGroup>

tests/ScadaLink.ClusterInfrastructure.Tests/ClusterOptionsTests.cs

@@ -0,0 +1,51 @@
+namespace ScadaLink.ClusterInfrastructure.Tests;
+
+/// <summary>
+/// Tests for ClusterOptions default values and property setters.
+/// </summary>
+public class ClusterOptionsTests
+{
+    [Fact]
+    public void DefaultValues_AreCorrect()
+    {
+        var options = new ClusterOptions();
+
+        Assert.Equal("keep-oldest", options.SplitBrainResolverStrategy);
+        Assert.Equal(TimeSpan.FromSeconds(15), options.StableAfter);
+        Assert.Equal(TimeSpan.FromSeconds(2), options.HeartbeatInterval);
+        Assert.Equal(TimeSpan.FromSeconds(10), options.FailureDetectionThreshold);
+        Assert.Equal(1, options.MinNrOfMembers);
+    }
+
+    [Fact]
+    public void SeedNodes_DefaultsToEmptyList()
+    {
+        var options = new ClusterOptions();
+
+        Assert.NotNull(options.SeedNodes);
+        Assert.Empty(options.SeedNodes);
+    }
+
+    [Fact]
+    public void Properties_CanBeSetToCustomValues()
+    {
+        var options = new ClusterOptions
+        {
+            SeedNodes = new List<string> { "akka.tcp://system@node1:2551", "akka.tcp://system@node2:2551" },
+            SplitBrainResolverStrategy = "keep-majority",
+            StableAfter = TimeSpan.FromSeconds(30),
+            HeartbeatInterval = TimeSpan.FromSeconds(5),
+            FailureDetectionThreshold = TimeSpan.FromSeconds(20),
+            MinNrOfMembers = 2
+        };
+
+        Assert.Equal(2, options.SeedNodes.Count);
+        Assert.Contains("akka.tcp://system@node1:2551", options.SeedNodes);
+        Assert.Contains("akka.tcp://system@node2:2551", options.SeedNodes);
+        Assert.Equal("keep-majority", options.SplitBrainResolverStrategy);
+        Assert.Equal(TimeSpan.FromSeconds(30), options.StableAfter);
+        Assert.Equal(TimeSpan.FromSeconds(5), options.HeartbeatInterval);
+        Assert.Equal(TimeSpan.FromSeconds(20), options.FailureDetectionThreshold);
+        Assert.Equal(2, options.MinNrOfMembers);
+    }
+}

tests/ScadaLink.ClusterInfrastructure.Tests/UnitTest1.cs

@@ -1,10 +0,0 @@
-namespace ScadaLink.ClusterInfrastructure.Tests;
-
-public class UnitTest1
-{
-    [Fact]
-    public void Test1()
-    {
-
-    }
-}

tests/ScadaLink.DataConnectionLayer.Tests/LmxProxyDataConnectionTests.cs

@@ -17,7 +17,7 @@ public class LmxProxyDataConnectionTests
     {
         _mockClient = Substitute.For<ILmxProxyClient>();
         _mockFactory = Substitute.For<ILmxProxyClientFactory>();
-        _mockFactory.Create(Arg.Any<string>(), Arg.Any<int>(), Arg.Any<string?>()).Returns(_mockClient);
+        _mockFactory.Create(Arg.Any<string>(), Arg.Any<int>(), Arg.Any<string?>(), Arg.Any<int>(), Arg.Any<bool>()).Returns(_mockClient);
         _adapter = new LmxProxyDataConnection(_mockFactory, NullLogger<LmxProxyDataConnection>.Instance);
     }
 
@@ -41,7 +41,7 @@ public class LmxProxyDataConnectionTests
         });
 
         Assert.Equal(ConnectionHealth.Connected, _adapter.Status);
-        _mockFactory.Received(1).Create("myhost", 5001, null);
+        _mockFactory.Received(1).Create("myhost", 5001, null, 0, false);
         await _mockClient.Received(1).ConnectAsync(Arg.Any<CancellationToken>());
     }
 
@@ -57,7 +57,7 @@ public class LmxProxyDataConnectionTests
             ["ApiKey"] = "my-secret-key"
         });
 
-        _mockFactory.Received(1).Create("server", 50051, "my-secret-key");
+        _mockFactory.Received(1).Create("server", 50051, "my-secret-key", 0, false);
     }
 
     [Fact]
@@ -67,7 +67,7 @@ public class LmxProxyDataConnectionTests
 
         await _adapter.ConnectAsync(new Dictionary<string, string>());
 
-        _mockFactory.Received(1).Create("localhost", 50051, null);
+        _mockFactory.Received(1).Create("localhost", 50051, null, 0, false);
     }
 
     [Fact]
@@ -201,7 +201,7 @@ public class LmxProxyDataConnectionTests
     {
         await ConnectAdapter();
         var mockSub = Substitute.For<ILmxSubscription>();
-        _mockClient.SubscribeAsync(Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<CancellationToken>())
+        _mockClient.SubscribeAsync(Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<Action?>(), Arg.Any<CancellationToken>())
             .Returns(mockSub);
 
         var subId = await _adapter.SubscribeAsync("Tag1", (_, _) => { });
@@ -209,7 +209,7 @@ public class LmxProxyDataConnectionTests
         Assert.NotNull(subId);
         Assert.NotEmpty(subId);
         await _mockClient.Received(1).SubscribeAsync(
-            Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<CancellationToken>());
+            Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<Action?>(), Arg.Any<CancellationToken>());
     }
 
     [Fact]
@@ -217,7 +217,7 @@ public class LmxProxyDataConnectionTests
     {
         await ConnectAdapter();
         var mockSub = Substitute.For<ILmxSubscription>();
-        _mockClient.SubscribeAsync(Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<CancellationToken>())
+        _mockClient.SubscribeAsync(Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<Action?>(), Arg.Any<CancellationToken>())
             .Returns(mockSub);
 
         var subId = await _adapter.SubscribeAsync("Tag1", (_, _) => { });
@@ -240,7 +240,7 @@ public class LmxProxyDataConnectionTests
     {
         await ConnectAdapter();
         var mockSub = Substitute.For<ILmxSubscription>();
-        _mockClient.SubscribeAsync(Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<CancellationToken>())
+        _mockClient.SubscribeAsync(Arg.Any<IEnumerable<string>>(), Arg.Any<Action<string, LmxVtq>>(), Arg.Any<Action?>(), Arg.Any<CancellationToken>())
             .Returns(mockSub);
         await _adapter.SubscribeAsync("Tag1", (_, _) => { });
 
@@ -277,4 +277,46 @@ public class LmxProxyDataConnectionTests
         await Assert.ThrowsAsync<InvalidOperationException>(() =>
             _adapter.SubscribeAsync("tag1", (_, _) => { }));
     }
+
+    // --- Configuration Parsing ---
+
+    [Fact]
+    public async Task Connect_ParsesSamplingInterval()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>
+        {
+            ["Host"] = "server",
+            ["Port"] = "50051",
+            ["SamplingIntervalMs"] = "500"
+        });
+
+        _mockFactory.Received(1).Create("server", 50051, null, 500, false);
+    }
+
+    [Fact]
+    public async Task Connect_ParsesUseTls()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>
+        {
+            ["Host"] = "server",
+            ["Port"] = "50051",
+            ["UseTls"] = "true"
+        });
+
+        _mockFactory.Received(1).Create("server", 50051, null, 0, true);
+    }
+
+    [Fact]
+    public async Task Connect_DefaultsSamplingAndTls()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>());
+
+        _mockFactory.Received(1).Create("localhost", 50051, null, 0, false);
+    }
 }

tests/ScadaLink.DataConnectionLayer.Tests/OpcUaDataConnectionTests.cs

@@ -34,7 +34,7 @@ public class OpcUaDataConnectionTests
         });
 
         Assert.Equal(ConnectionHealth.Connected, _adapter.Status);
-        await _mockClient.Received(1).ConnectAsync("opc.tcp://localhost:4840", Arg.Any<CancellationToken>());
+        await _mockClient.Received(1).ConnectAsync("opc.tcp://localhost:4840", Arg.Any<OpcUaConnectionOptions?>(), Arg.Any<CancellationToken>());
     }
 
     [Fact]
@@ -149,4 +149,123 @@ public class OpcUaDataConnectionTests
 
         Assert.Equal(ConnectionHealth.Disconnected, _adapter.Status);
     }
+
+    // --- Configuration Parsing ---
+
+    [Fact]
+    public async Task Connect_ParsesAllConfigurationKeys()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>
+        {
+            ["EndpointUrl"] = "opc.tcp://myserver:4840",
+            ["SessionTimeoutMs"] = "120000",
+            ["OperationTimeoutMs"] = "30000",
+            ["PublishingIntervalMs"] = "500",
+            ["KeepAliveCount"] = "5",
+            ["LifetimeCount"] = "15",
+            ["MaxNotificationsPerPublish"] = "200",
+            ["SamplingIntervalMs"] = "250",
+            ["QueueSize"] = "20",
+            ["SecurityMode"] = "SignAndEncrypt",
+            ["AutoAcceptUntrustedCerts"] = "false"
+        });
+
+        await _mockClient.Received(1).ConnectAsync(
+            "opc.tcp://myserver:4840",
+            Arg.Is<OpcUaConnectionOptions?>(o =>
+                o != null &&
+                o.SessionTimeoutMs == 120000 &&
+                o.OperationTimeoutMs == 30000 &&
+                o.PublishingIntervalMs == 500 &&
+                o.KeepAliveCount == 5 &&
+                o.LifetimeCount == 15 &&
+                o.MaxNotificationsPerPublish == 200 &&
+                o.SamplingIntervalMs == 250 &&
+                o.QueueSize == 20 &&
+                o.SecurityMode == "SignAndEncrypt" &&
+                o.AutoAcceptUntrustedCerts == false),
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Connect_UsesDefaults_WhenKeysNotProvided()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>());
+
+        await _mockClient.Received(1).ConnectAsync(
+            "opc.tcp://localhost:4840",
+            Arg.Is<OpcUaConnectionOptions?>(o =>
+                o != null &&
+                o.SessionTimeoutMs == 60000 &&
+                o.OperationTimeoutMs == 15000 &&
+                o.PublishingIntervalMs == 1000 &&
+                o.KeepAliveCount == 10 &&
+                o.LifetimeCount == 30 &&
+                o.MaxNotificationsPerPublish == 100 &&
+                o.SamplingIntervalMs == 1000 &&
+                o.QueueSize == 10 &&
+                o.SecurityMode == "None" &&
+                o.AutoAcceptUntrustedCerts == true),
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Connect_IgnoresInvalidNumericValues()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>
+        {
+            ["SessionTimeoutMs"] = "notanumber",
+            ["OperationTimeoutMs"] = "",
+            ["PublishingIntervalMs"] = "abc",
+            ["QueueSize"] = "12.5"
+        });
+
+        await _mockClient.Received(1).ConnectAsync(
+            Arg.Any<string>(),
+            Arg.Is<OpcUaConnectionOptions?>(o =>
+                o != null &&
+                o.SessionTimeoutMs == 60000 &&
+                o.OperationTimeoutMs == 15000 &&
+                o.PublishingIntervalMs == 1000 &&
+                o.QueueSize == 10),
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Connect_ParsesSecurityMode()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>
+        {
+            ["SecurityMode"] = "Sign"
+        });
+
+        await _mockClient.Received(1).ConnectAsync(
+            Arg.Any<string>(),
+            Arg.Is<OpcUaConnectionOptions?>(o => o != null && o.SecurityMode == "Sign"),
+            Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Connect_ParsesAutoAcceptCerts()
+    {
+        _mockClient.IsConnected.Returns(true);
+
+        await _adapter.ConnectAsync(new Dictionary<string, string>
+        {
+            ["AutoAcceptUntrustedCerts"] = "false"
+        });
+
+        await _mockClient.Received(1).ConnectAsync(
+            Arg.Any<string>(),
+            Arg.Is<OpcUaConnectionOptions?>(o => o != null && o.AutoAcceptUntrustedCerts == false),
+            Arg.Any<CancellationToken>());
+    }
 }

tests/ScadaLink.HealthMonitoring.Tests/HealthReportSenderTests.cs

@@ -23,6 +23,7 @@ public class HealthReportSenderTests
     {
         var transport = new FakeTransport();
         var collector = new SiteHealthCollector();
+        collector.SetActiveNode(true);
         var options = Options.Create(new HealthMonitoringOptions
         {
             ReportInterval = TimeSpan.FromMilliseconds(50)
@@ -61,6 +62,7 @@ public class HealthReportSenderTests
     {
         var transport = new FakeTransport();
         var collector = new SiteHealthCollector();
+        collector.SetActiveNode(true);
         var options = Options.Create(new HealthMonitoringOptions
         {
             ReportInterval = TimeSpan.FromMilliseconds(50)
@@ -91,6 +93,7 @@ public class HealthReportSenderTests
     {
         var transport = new FakeTransport();
         var collector = new SiteHealthCollector();
+        collector.SetActiveNode(true);
         var options = Options.Create(new HealthMonitoringOptions
         {
             ReportInterval = TimeSpan.FromMilliseconds(50)

tests/ScadaLink.InboundAPI.Tests/InboundScriptExecutorTests.cs

@@ -17,7 +17,7 @@ public class InboundScriptExecutorTests
 
     public InboundScriptExecutorTests()
     {
-        _executor = new InboundScriptExecutor(NullLogger<InboundScriptExecutor>.Instance);
+        _executor = new InboundScriptExecutor(NullLogger<InboundScriptExecutor>.Instance, Substitute.For<IServiceProvider>());
         var locator = Substitute.For<IInstanceLocator>();
         var commService = Substitute.For<CommunicationService>(
             Microsoft.Extensions.Options.Options.Create(new CommunicationOptions()),
@@ -47,9 +47,10 @@ public class InboundScriptExecutorTests
     }
 
     [Fact]
-    public async Task UnregisteredHandler_ReturnsFailure()
+    public async Task UnregisteredHandler_InvalidScript_ReturnsCompilationFailure()
     {
-        var method = new ApiMethod("unknown", "return 1;") { Id = 1, TimeoutSeconds = 10 };
+        // Use an invalid script that cannot be compiled by Roslyn
+        var method = new ApiMethod("unknown", "%%% invalid C# %%%") { Id = 1, TimeoutSeconds = 10 };
 
         var result = await _executor.ExecuteAsync(
             method,
@@ -58,7 +59,22 @@ public class InboundScriptExecutorTests
             TimeSpan.FromSeconds(10));
 
         Assert.False(result.Success);
-        Assert.Contains("not compiled", result.ErrorMessage);
+        Assert.Contains("Script compilation failed", result.ErrorMessage);
+    }
+
+    [Fact]
+    public async Task UnregisteredHandler_ValidScript_LazyCompiles()
+    {
+        // Valid script that is not pre-registered triggers lazy compilation
+        var method = new ApiMethod("lazy", "return 1;") { Id = 1, TimeoutSeconds = 10 };
+
+        var result = await _executor.ExecuteAsync(
+            method,
+            new Dictionary<string, object?>(),
+            _route,
+            TimeSpan.FromSeconds(10));
+
+        Assert.True(result.Success);
     }
 
     [Fact]

tests/ScadaLink.NotificationService.Tests/NotificationDeliveryServiceTests.cs

@@ -3,6 +3,7 @@ using NSubstitute;
 using NSubstitute.ExceptionExtensions;
 using ScadaLink.Commons.Entities.Notifications;
 using ScadaLink.Commons.Interfaces.Repositories;
+using ScadaLink.StoreAndForward;
 
 namespace ScadaLink.NotificationService.Tests;
 
@@ -145,4 +146,50 @@ public class NotificationDeliveryServiceTests
         Assert.False(result.Success);
         Assert.Contains("store-and-forward not available", result.ErrorMessage);
     }
+
+    [Fact]
+    public async Task Send_UsesBccDelivery_AllRecipientsInBcc()
+    {
+        SetupHappyPath();
+        IEnumerable<string>? capturedBcc = null;
+        _smtpClient.SendAsync(
+            Arg.Any<string>(),
+            Arg.Do<IEnumerable<string>>(bcc => capturedBcc = bcc),
+            Arg.Any<string>(),
+            Arg.Any<string>(),
+            Arg.Any<CancellationToken>())
+            .Returns(Task.CompletedTask);
+
+        var service = CreateService();
+        await service.SendAsync("ops-team", "Alert", "Body");
+
+        Assert.NotNull(capturedBcc);
+        var bccList = capturedBcc!.ToList();
+        Assert.Equal(2, bccList.Count);
+        Assert.Contains("alice@example.com", bccList);
+        Assert.Contains("bob@example.com", bccList);
+    }
+
+    [Fact]
+    public async Task Send_TransientError_WithStoreAndForward_BuffersMessage()
+    {
+        SetupHappyPath();
+        _smtpClient.SendAsync(Arg.Any<string>(), Arg.Any<IEnumerable<string>>(), Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>())
+            .Throws(new TimeoutException("Connection timed out"));
+
+        var dbName = $"file:sf_test_{Guid.NewGuid():N}?mode=memory&cache=shared";
+        var storage = new StoreAndForward.StoreAndForwardStorage(
+            $"Data Source={dbName}", NullLogger<StoreAndForward.StoreAndForwardStorage>.Instance);
+        await storage.InitializeAsync();
+
+        var sfOptions = new StoreAndForward.StoreAndForwardOptions();
+        var sfService = new StoreAndForward.StoreAndForwardService(
+            storage, sfOptions, NullLogger<StoreAndForward.StoreAndForwardService>.Instance);
+
+        var service = CreateService(sf: sfService);
+        var result = await service.SendAsync("ops-team", "Alert", "Body");
+
+        Assert.True(result.Success);
+        Assert.True(result.WasBuffered);
+    }
 }

tests/ScadaLink.NotificationService.Tests/OAuth2TokenServiceTests.cs

@@ -0,0 +1,139 @@
+using System.Net;
+using System.Text.Json;
+using Microsoft.Extensions.Logging.Abstractions;
+using NSubstitute;
+
+namespace ScadaLink.NotificationService.Tests;
+
+/// <summary>
+/// Tests for OAuth2 token flow — token acquisition, caching, and credential parsing.
+/// </summary>
+public class OAuth2TokenServiceTests
+{
+    private static HttpClient CreateMockHttpClient(HttpStatusCode statusCode, string responseJson)
+    {
+        var handler = new MockHttpMessageHandler(statusCode, responseJson);
+        return new HttpClient(handler);
+    }
+
+    private static IHttpClientFactory CreateMockFactory(HttpClient client)
+    {
+        var factory = Substitute.For<IHttpClientFactory>();
+        factory.CreateClient(Arg.Any<string>()).Returns(client);
+        return factory;
+    }
+
+    [Fact]
+    public async Task GetTokenAsync_ReturnsAccessToken_FromTokenEndpoint()
+    {
+        var tokenResponse = JsonSerializer.Serialize(new
+        {
+            access_token = "mock-access-token-12345",
+            expires_in = 3600,
+            token_type = "Bearer"
+        });
+
+        var client = CreateMockHttpClient(HttpStatusCode.OK, tokenResponse);
+        var factory = CreateMockFactory(client);
+        var service = new OAuth2TokenService(factory, NullLogger<OAuth2TokenService>.Instance);
+
+        var token = await service.GetTokenAsync("tenant123:client456:secret789");
+
+        Assert.Equal("mock-access-token-12345", token);
+    }
+
+    [Fact]
+    public async Task GetTokenAsync_CachesToken_OnSubsequentCalls()
+    {
+        var tokenResponse = JsonSerializer.Serialize(new
+        {
+            access_token = "cached-token",
+            expires_in = 3600,
+            token_type = "Bearer"
+        });
+
+        var handler = new CountingHttpMessageHandler(HttpStatusCode.OK, tokenResponse);
+        var client = new HttpClient(handler);
+        var factory = CreateMockFactory(client);
+        var service = new OAuth2TokenService(factory, NullLogger<OAuth2TokenService>.Instance);
+
+        var token1 = await service.GetTokenAsync("tenant:client:secret");
+        var token2 = await service.GetTokenAsync("tenant:client:secret");
+
+        Assert.Equal("cached-token", token1);
+        Assert.Equal("cached-token", token2);
+        Assert.Equal(1, handler.CallCount); // Only one HTTP call should be made
+    }
+
+    [Fact]
+    public async Task GetTokenAsync_InvalidCredentialFormat_ThrowsInvalidOperationException()
+    {
+        var client = CreateMockHttpClient(HttpStatusCode.OK, "{}");
+        var factory = CreateMockFactory(client);
+        var service = new OAuth2TokenService(factory, NullLogger<OAuth2TokenService>.Instance);
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => service.GetTokenAsync("invalid-no-colons"));
+    }
+
+    [Fact]
+    public async Task GetTokenAsync_HttpFailure_ThrowsHttpRequestException()
+    {
+        var client = CreateMockHttpClient(HttpStatusCode.Unauthorized, "Unauthorized");
+        var factory = CreateMockFactory(client);
+        var service = new OAuth2TokenService(factory, NullLogger<OAuth2TokenService>.Instance);
+
+        await Assert.ThrowsAsync<HttpRequestException>(
+            () => service.GetTokenAsync("tenant:client:secret"));
+    }
+
+    /// <summary>
+    /// Simple mock HTTP handler that returns a fixed response.
+    /// </summary>
+    private class MockHttpMessageHandler : HttpMessageHandler
+    {
+        private readonly HttpStatusCode _statusCode;
+        private readonly string _responseContent;
+
+        public MockHttpMessageHandler(HttpStatusCode statusCode, string responseContent)
+        {
+            _statusCode = statusCode;
+            _responseContent = responseContent;
+        }
+
+        protected override Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            return Task.FromResult(new HttpResponseMessage(_statusCode)
+            {
+                Content = new StringContent(_responseContent)
+            });
+        }
+    }
+
+    /// <summary>
+    /// Mock HTTP handler that counts invocations.
+    /// </summary>
+    private class CountingHttpMessageHandler : HttpMessageHandler
+    {
+        private readonly HttpStatusCode _statusCode;
+        private readonly string _responseContent;
+        public int CallCount { get; private set; }
+
+        public CountingHttpMessageHandler(HttpStatusCode statusCode, string responseContent)
+        {
+            _statusCode = statusCode;
+            _responseContent = responseContent;
+        }
+
+        protected override Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            CallCount++;
+            return Task.FromResult(new HttpResponseMessage(_statusCode)
+            {
+                Content = new StringContent(_responseContent)
+            });
+        }
+    }
+}

tests/ScadaLink.NotificationService.Tests/ScadaLink.NotificationService.Tests.csproj

@@ -23,6 +23,7 @@
   <ItemGroup>
     <ProjectReference Include="../../src/ScadaLink.NotificationService/ScadaLink.NotificationService.csproj" />
     <ProjectReference Include="../../src/ScadaLink.Commons/ScadaLink.Commons.csproj" />
+    <ProjectReference Include="../../src/ScadaLink.StoreAndForward/ScadaLink.StoreAndForward.csproj" />
   </ItemGroup>
 
 </Project>