@attraccess/plugin-wago 0.1.0-nightly.941.1 → 0.1.0-nightly.943.1

package/dist/index.js

@@ -1414,7 +1414,7 @@ var WagoService = class {
   /** Server-side commissioning revokes the enrollment it created without exposing credentials to a browser. */
   async revokeEnrollmentById(id) {
     const enrollment = await this.enrollments.findOneBy({ id });
-    if (enrollment && this.isActiveEnrollment(enrollment)) await this.revokeEnrollment(enrollment);
+    if (enrollment && !enrollment.consumedAt) await this.revokeEnrollment(enrollment);
   }
   async deleteEnrollmentById(id) {
     await this.enrollments.delete(id);
@@ -1486,6 +1486,34 @@ var WagoService = class {
       }
     });
   }
+  /** Reverses the durable claim marker left behind when delivery is interrupted before completion is recorded. */
+  async rollbackInterruptedClaim(hardwareId, mqttServerId, enrollmentId) {
+    const controller = await this.controllers.findOneBy({ hardwareId });
+    if (!controller || controller.trustState !== "claimed" || controller.mqttServerId !== mqttServerId || controller.enrollmentId !== enrollmentId)
+      return;
+    await this.withClaimLock(
+      controller.id,
+      () => this.withClaimConfigurationLock(async () => {
+        const current = await this.controllers.findOneBy({ id: controller.id });
+        if (!current || current.trustState !== "claimed" || current.mqttServerId !== mqttServerId || current.enrollmentId !== enrollmentId)
+          return;
+        const identity = `wago-controller-${current.hardwareId}`;
+        const manual = await this.context.getMqttCredentialProvisioning().revoke({
+          mqttServerId,
+          identity,
+          username: identity,
+          vhost: "/"
+        });
+        if (manual)
+          throw new import_common.ConflictException(`Manual credential revocation is required: ${manual.instructions.join(" ")}`);
+        current.trustState = "untrusted";
+        current.name = null;
+        current.enrollmentId = null;
+        current.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        await this.controllers.save(current);
+      })
+    );
+  }
   async prepareClaim(id, name, verifier, mqttServerId) {
     const controller = await this.controllers.findOneBy({ id });
     if (!controller) throw new import_common.NotFoundException(`WAGO controller ${id} not found`);
@@ -2158,7 +2186,7 @@ var configuredRuntimeBundleSignature = process.env.WAGO_CC100_RUNTIME_BUNDLE_SIG
 var configuredRuntimeSigningPublicKey = process.env.WAGO_CC100_RUNTIME_SIGNING_PUBLIC_KEY_PATH?.trim() ?? "";
 var SIGNING_NAMESPACE = "attraccess-wago-runtime";
 var SIGNING_IDENTITY = "attraccess-wago-runtime";
-var defaultSshCredential = { username: "root", password: "wago" };
+var VERIFIER_PREFIX = "encrypted:v1:";
 var WagoCommissioningService = class {
   constructor(context, wago) {
     __publicField(this, "context", context);
@@ -2166,15 +2194,16 @@ var WagoCommissioningService = class {
     __publicField(this, "sessions");
     __publicField(this, "deliveryLocks", /* @__PURE__ */ new Map());
   }
-  onApplicationBootstrap() {
+  async onApplicationBootstrap() {
     this.sessions = this.context.getRepository(WagoCommissioningSession);
-    this.wago.registerCommissioningDiscoveryHandler((controller) => this.claimDiscovered(controller));
-    void this.resumePendingDeliveries().catch(
-      (error) => this.context.logger?.warn(`Could not resume pending WAGO commissioning deliveries: ${String(error)}`)
-    );
-    void this.reconcileCompletedSessions().catch(
-      (error) => this.context.logger?.warn(`Could not retire superseded WAGO commissioning sessions: ${String(error)}`)
-    );
+    try {
+      await this.recoverSessions();
+      await this.reconcileCompletedSessions();
+      this.wago.registerCommissioningDiscoveryHandler((controller) => this.claimDiscovered(controller));
+      for (const controller of await this.wago.list()) await this.claimDiscovered(controller);
+    } catch {
+      this.context.logger?.warn("WAGO commissioning recovery failed; automatic discovery claim is disabled.");
+    }
   }
   support() {
     return {
@@ -2192,9 +2221,19 @@ var WagoCommissioningService = class {
       throw new import_common2.ConflictException(
         "no CC100 firmware baseline is configured; commissioning is disabled until an exact supported baseline is set"
       );
-    if (!await this.context.getMqttServerConfig(input.mqttServerId))
-      throw new import_common2.NotFoundException("MQTT server not found");
-    const hostKeyFingerprint = await scanHostKey(input.targetHost);
+    let brokerAvailable;
+    try {
+      brokerAvailable = Boolean(await this.context.getMqttServerConfig(input.mqttServerId));
+    } catch {
+      throw new import_common2.ConflictException("Commissioning MQTT configuration could not be resolved.");
+    }
+    if (!brokerAvailable) throw new import_common2.NotFoundException("MQTT server not found");
+    let hostKeyFingerprint;
+    try {
+      hostKeyFingerprint = await scanHostKey(input.targetHost);
+    } catch {
+      throw new import_common2.ConflictException("Commissioning SSH host-key scan failed.");
+    }
     const hardwareId = `cc100-${(0, import_node_crypto4.createHash)("sha256").update(hostKeyFingerprint).digest("hex").slice(0, 16)}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const session = await this.sessions.save(
@@ -2209,7 +2248,7 @@ var WagoCommissioningService = class {
         enrollmentExpiresAt: null,
         enrollmentId: null,
         // This verifier authenticates the first runtime announcement and is never exposed to an operator.
-        pairingCode: (0, import_node_crypto4.randomBytes)(32).toString("base64url"),
+        pairingCode: this.encryptVerifier((0, import_node_crypto4.randomBytes)(32).toString("base64url")),
         codesysState: null,
         progressPercent: 0,
         progressStep: "Confirm controller identity",
@@ -2255,11 +2294,23 @@ var WagoCommissioningService = class {
     if (!session) throw new import_common2.NotFoundException("commissioning session not found");
     if (!["awaiting_delivery", "delivering", "awaiting_codesys_confirmation", "delivery_failed"].includes(session.state))
       throw new import_common2.ConflictException("commissioning session cannot be delivered in its current state");
+    if (input?.confirmInstall !== true)
+      throw new import_common2.ConflictException("explicit installation confirmation is required for every delivery attempt");
+    const credential = input.temporarySsh;
+    if (!credential || typeof credential.username !== "string" || !/^[a-zA-Z_][a-zA-Z0-9_.-]{0,63}$/.test(credential.username) || typeof credential.password !== "string" || !credential.password.trim() || /[\r\n\0]/.test(credential.password))
+      throw new import_common2.ConflictException("explicit valid SSH username and password are required for every delivery attempt");
     if (!isRuntimeArtifactConfigured())
       throw new import_common2.ConflictException("no immutable, signed CC100 runtime bundle is configured for commissioning");
-    const credential = input.temporarySsh?.username.trim() && input.temporarySsh.password ? input.temporarySsh : defaultSshCredential;
+    let pairingCode;
+    try {
+      pairingCode = this.decryptVerifier(session);
+    } catch {
+      await this.invalidateVerifier(session);
+      return this.toResponse(session);
+    }
     let enrollmentExpiresAt = null;
     try {
+      await this.revokeSessionEnrollment(session);
       session.state = "delivering";
       session.failureReason = null;
       await this.updateProgress(
@@ -2330,12 +2381,12 @@ var WagoCommissioningService = class {
           "Provisioning a restricted MQTT credential for the initial connection."
         );
         const enrollment = await this.wago.createEnrollment(session.hardwareId, session.mqttServerId);
+        session.enrollmentId = enrollment.id;
+        await this.save(session, "enrollment_created");
         if (!enrollment.password)
           throw new import_common2.ConflictException(
             "automatic restricted MQTT credential provisioning is required for secure commissioning"
           );
-        if (!session.pairingCode) throw new import_common2.ConflictException("commissioning session has no automatic claim verifier");
-        session.enrollmentId = enrollment.id;
         enrollmentExpiresAt = enrollment.expiresAt;
         await this.updateProgress(
           session,
@@ -2353,7 +2404,7 @@ var WagoCommissioningService = class {
             `WAGO_MQTT_USERNAME=${enrollment.username}`,
             `WAGO_MQTT_PASSWORD=${enrollment.password}`,
             `WAGO_ENROLLMENT_SECRET=${enrollment.claimSecret}`,
-            `WAGO_PAIRING_CODE=${session.pairingCode}`
+            `WAGO_PAIRING_CODE=${pairingCode}`
           ].join("\n")
         );
         await this.updateProgress(
@@ -2378,18 +2429,16 @@ var WagoCommissioningService = class {
       session.progressStep = "Waiting for controller connection";
       session.progressDetail = "Runtime delivered. Waiting for the controller to connect and complete its automatic claim.";
       return this.toResponse(await this.save(session, "bootstrap_delivered"));
-    } catch (error) {
+    } catch {
       if (session.enrollmentId !== null) {
         try {
-          await this.wago.revokeEnrollmentById(session.enrollmentId);
-        } catch (revocationError) {
+          await this.revokeSessionEnrollment(session);
+        } catch {
           session.state = "delivery_failed";
           session.enrollmentExpiresAt = null;
           session.progressStep = "Delivery failed";
           session.progressDetail = "Credential revocation requires attention before delivery can be retried.";
-          session.failureReason = `Secure delivery failed and bootstrap credential revocation requires attention: ${redact(
-            revocationError instanceof Error ? revocationError.message : String(revocationError)
-          )}`;
+          session.failureReason = "Secure delivery failed; bootstrap credential revocation requires attention.";
           return this.toResponse(await this.save(session, "enrollment_revocation_failed"));
         }
       }
@@ -2397,7 +2446,7 @@ var WagoCommissioningService = class {
       session.enrollmentExpiresAt = null;
       session.progressStep = "Delivery failed";
       session.progressDetail = "Review the error and retry automatic delivery when the controller is reachable.";
-      session.failureReason = error instanceof Error ? redact(error.message) : "Secure delivery failed";
+      session.failureReason = "Secure delivery failed. Check controller access and the configured runtime bundle.";
       return this.toResponse(await this.save(session, "delivery_failed"));
     }
   }
@@ -2405,8 +2454,9 @@ var WagoCommissioningService = class {
     return this.withDeliveryLock(id, async () => {
       const session = await this.sessions.findOneBy({ id });
       if (!session) throw new import_common2.NotFoundException("commissioning session not found");
-      if (session.enrollmentId !== null) await this.wago.revokeEnrollmentById(session.enrollmentId);
+      await this.revokeSessionEnrollment(session);
       session.state = "revoked";
+      session.pairingCode = null;
       session.failureReason = null;
       return this.toResponse(await this.save(session, "revoked"));
     });
@@ -2416,8 +2466,12 @@ var WagoCommissioningService = class {
       const session = await this.sessions.findOneBy({ id });
       if (!session) throw new import_common2.NotFoundException("commissioning session not found");
       if (session.enrollmentId !== null) {
-        await this.wago.revokeEnrollmentById(session.enrollmentId);
-        await this.wago.deleteEnrollmentById(session.enrollmentId);
+        try {
+          await this.wago.revokeEnrollmentById(session.enrollmentId);
+          await this.wago.deleteEnrollmentById(session.enrollmentId);
+        } catch {
+          throw new import_common2.ConflictException("Commissioning enrollment removal failed.");
+        }
       }
       await this.sessions.delete(id);
     });
@@ -2439,6 +2493,13 @@ var WagoCommissioningService = class {
       const current = await this.sessions.findOneBy({ id: session.id });
       if (!current || current.state !== "awaiting_discovery" || current.hardwareId !== controller.hardwareId || current.mqttServerId !== controller.mqttServerId || current.enrollmentId !== controller.enrollmentId || !current.controllerName || !current.pairingCode)
         return;
+      let pairingCode;
+      try {
+        pairingCode = this.decryptVerifier(current);
+      } catch {
+        await this.invalidateVerifier(current);
+        return;
+      }
       current.state = "awaiting_claim";
       current.failureReason = null;
       current.progressPercent = 100;
@@ -2446,21 +2507,21 @@ var WagoCommissioningService = class {
       current.progressDetail = "Applying permanent credentials and the reserved controller name.";
       await this.save(current, "automatic_claim_started");
       try {
-        await this.wago.claim(controller.id, current.controllerName, current.pairingCode, current.mqttServerId);
+        await this.wago.claim(controller.id, current.controllerName, pairingCode, current.mqttServerId);
         current.state = "completed";
         current.pairingCode = null;
         current.failureReason = null;
         current.progressStep = "Commissioning complete";
         current.progressDetail = "The controller is claimed and ready to configure.";
         await this.save(current, "automatic_claim_completed");
-      } catch (error) {
+      } catch {
         current.state = "awaiting_discovery";
-        current.failureReason = error instanceof Error ? redact(error.message) : "Automatic claim failed";
+        current.failureReason = "Automatic claim failed.";
         await this.save(current, "automatic_claim_failed");
         return;
       }
       await this.retireSupersededSessions(current.hardwareId, current.id).catch(
-        (error) => this.context.logger?.warn(`Could not retire superseded WAGO commissioning sessions: ${String(error)}`)
+        () => this.context.logger?.warn("Could not retire superseded WAGO commissioning sessions.")
       );
     });
   }
@@ -2596,51 +2657,126 @@ printf '%s\\n' "$ATTRACCESS_SSH_PASSWORD"
       progressStep: session.progressStep,
       progressDetail: session.progressDetail,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).catch((error) => this.context.logger?.warn(`Could not update WAGO runtime transfer progress: ${String(error)}`));
-  }
-  async resumePendingDeliveries() {
-    const sessions = await this.sessions.find({ where: [{ state: "awaiting_delivery" }, { state: "delivering" }] });
-    for (const session of sessions) void this.deliverInBackground(session.id);
+    }).catch(() => this.context.logger?.warn("Could not update WAGO runtime transfer progress."));
   }
-  async reconcileCompletedSessions() {
-    const sessions = await this.sessions.find({ where: { state: "completed" } });
-    await Promise.all(sessions.map((session) => this.retireSupersededSessions(session.hardwareId, session.id)));
+  encryptVerifier(plaintext) {
+    try {
+      return VERIFIER_PREFIX + this.context.secrets.encrypt(plaintext);
+    } catch {
+      throw new import_common2.ConflictException("Commissioning verifier encryption failed.");
+    }
   }
-  async retireSupersededSessions(hardwareId, completedSessionId) {
-    const sessions = await this.sessions.find({ where: { hardwareId } });
-    await Promise.all(
-      sessions.filter(
-        (session) => session.id !== completedSessionId && session.state !== "completed" && session.state !== "revoked"
-      ).map(
-        (session) => this.withDeliveryLock(session.id, async () => {
-          const current = await this.sessions.findOneBy({ id: session.id });
-          if (!current || current.state === "completed" || current.state === "revoked") return;
-          if (current.enrollmentId !== null) await this.wago.revokeEnrollmentById(current.enrollmentId);
-          current.state = "revoked";
-          current.failureReason = null;
-          current.progressStep = "Superseded by completed commissioning";
-          current.progressDetail = "A newer commissioning session claimed this controller.";
-          await this.save(current, "superseded_by_completed_session");
-        })
-      )
-    );
+  decryptVerifier(session) {
+    try {
+      if (!session.pairingCode?.startsWith(VERIFIER_PREFIX)) throw new Error();
+      const plaintext = this.context.secrets.decrypt(session.pairingCode.slice(VERIFIER_PREFIX.length));
+      if (!/^[A-Za-z0-9_-]{43}$/.test(plaintext)) throw new Error();
+      return plaintext;
+    } catch {
+      throw new import_common2.ConflictException("Commissioning verifier is unavailable; create a new session.");
+    }
   }
-  async deliverInBackground(id) {
+  async revokeSessionEnrollment(session) {
+    if (session.enrollmentId == null) return;
     try {
-      await this.deliver(id);
-    } catch (error) {
-      try {
-        const session = await this.sessions.findOneBy({ id });
-        if (!session || !["awaiting_delivery", "delivering"].includes(session.state)) return;
-        session.state = "delivery_failed";
-        session.progressStep = "Delivery failed";
-        session.progressDetail = "Review the error and retry automatic delivery when the controller is reachable.";
-        session.failureReason = error instanceof Error ? redact(error.message) : "Secure delivery failed";
-        await this.save(session, "delivery_failed");
-      } catch (reportingError) {
-        this.context.logger?.warn(`Could not record WAGO commissioning delivery failure: ${String(reportingError)}`);
+      await this.wago.revokeEnrollmentById(session.enrollmentId);
+      await this.wago.deleteEnrollmentById(session.enrollmentId);
+    } catch {
+      throw new import_common2.ConflictException("Commissioning credential revocation requires attention.");
+    }
+    session.enrollmentId = null;
+    session.enrollmentExpiresAt = null;
+    await this.save(session, "enrollment_revoked");
+  }
+  async invalidateVerifier(session) {
+    session.state = "revoked";
+    session.pairingCode = null;
+    session.progressStep = "Commissioning session revoked";
+    session.progressDetail = "The saved verifier is unavailable. Create a new commissioning session.";
+    session.failureReason = "Commissioning verifier is unavailable; credential revocation requires attention.";
+    await this.save(session, "verifier_invalidated");
+    await this.revokeSessionEnrollment(session);
+    session.failureReason = null;
+    await this.save(session, "invalid_verifier_revoked");
+  }
+  async recoverSessions() {
+    let recoveryFailed = false;
+    for (let skip = 0; ; skip += 100) {
+      const page = await this.sessions.find({ order: { id: "ASC" }, take: 100, skip });
+      for (const session of page) {
+        try {
+          if (session.state === "completed" && !session.pairingCode) continue;
+          if (session.state === "revoked" && !session.pairingCode) {
+            await this.revokeSessionEnrollment(session);
+            continue;
+          }
+          try {
+            this.decryptVerifier(session);
+          } catch {
+            await this.invalidateVerifier(session);
+            continue;
+          }
+          if (session.state === "delivering" || session.state === "awaiting_claim") {
+            if (session.state === "awaiting_claim")
+              await this.wago.rollbackInterruptedClaim(session.hardwareId, session.mqttServerId, session.enrollmentId);
+            session.state = "delivery_failed";
+            session.progressStep = "Delivery interrupted";
+            session.progressDetail = "Retry with explicit SSH credentials and installation confirmation.";
+            session.failureReason = "Commissioning was interrupted.";
+            await this.save(session, "delivery_interrupted");
+            await this.revokeSessionEnrollment(session);
+          }
+        } catch {
+          recoveryFailed = true;
+        }
       }
+      if (page.length < 100) break;
     }
+    if (recoveryFailed) throw new import_common2.ConflictException("Commissioning recovery requires credential revocation.");
+  }
+  async reconcileCompletedSessions() {
+    let reconciliationFailed = false;
+    for (let skip = 0; ; skip += 100) {
+      const page = await this.sessions.find({ where: { state: "completed" }, order: { id: "ASC" }, take: 100, skip });
+      for (const session of page) {
+        if (session.state !== "completed") continue;
+        try {
+          await this.retireSupersededSessions(session.hardwareId, session.id);
+        } catch {
+          reconciliationFailed = true;
+        }
+      }
+      if (page.length < 100) break;
+    }
+    if (reconciliationFailed)
+      throw new import_common2.ConflictException("Superseded commissioning credential cleanup requires attention.");
+  }
+  async retireSupersededSessions(hardwareId, completedSessionId) {
+    let retirementFailed = false;
+    for (let skip = 0; ; skip += 100) {
+      const sessions = await this.sessions.find({ where: { hardwareId }, order: { id: "ASC" }, take: 100, skip });
+      const results = await Promise.allSettled(
+        sessions.filter(
+          (session) => session.id !== completedSessionId && session.state !== "completed" && session.state !== "revoked"
+        ).map(
+          (session) => this.withDeliveryLock(session.id, async () => {
+            const current = await this.sessions.findOneBy({ id: session.id });
+            if (!current || current.state === "completed" || current.state === "revoked") return;
+            await this.revokeSessionEnrollment(current);
+            current.state = "revoked";
+            current.pairingCode = null;
+            current.failureReason = null;
+            current.progressStep = "Superseded by completed commissioning";
+            current.progressDetail = "A newer commissioning session claimed this controller.";
+            await this.save(current, "superseded_by_completed_session");
+          })
+        )
+      );
+      if (results.some((result) => result.status === "rejected")) retirementFailed = true;
+      if (sessions.length < 100) break;
+    }
+    if (retirementFailed)
+      throw new import_common2.ConflictException("Superseded commissioning credential cleanup requires attention.");
   }
   toResponse(session) {
     const { pairingCode: _pairingCode, ...response } = session;
@@ -2707,16 +2843,18 @@ function runProcess(command, args, input, environment) {
   return new Promise((resolve, reject) => {
     const child = (0, import_node_child_process.spawn)(command, args, { env: { ...process.env, ...environment }, stdio: ["pipe", "pipe", "pipe"] });
     let stdout = "";
-    let stderr = "";
     const timer = setTimeout(() => child.kill(), SSH_TIMEOUT_MS);
     child.stdin.on("error", () => void 0);
     child.stdout.on("data", (chunk) => stdout += chunk);
-    child.stderr.on("data", (chunk) => stderr += chunk);
-    child.on("error", reject);
+    child.stderr.on("data", () => void 0);
+    child.on("error", () => {
+      clearTimeout(timer);
+      reject(new Error("Commissioning subprocess failed."));
+    });
     child.on("close", (code) => {
       clearTimeout(timer);
       if (code === 0) resolve(stdout);
-      else reject(new Error(stderr || `${command} exited with status ${code}`));
+      else reject(new Error("Commissioning subprocess failed."));
     });
     child.stdin.end(input);
   });
@@ -2726,7 +2864,6 @@ async function uploadFile(source, args, environment, onProgress) {
   return new Promise((resolve, reject) => {
     const child = (0, import_node_child_process.spawn)("ssh", args, { env: { ...process.env, ...environment }, stdio: ["pipe", "ignore", "pipe"] });
     const stream = (0, import_node_fs.createReadStream)(source);
-    let stderr = "";
     let transferred = 0;
     let lastPercent = -1;
     let settled = false;
@@ -2736,13 +2873,13 @@ async function uploadFile(source, args, environment, onProgress) {
       settled = true;
       clearTimeout(timer);
       stream.destroy();
-      if (error) reject(error);
+      if (error) reject(new Error("Commissioning upload failed."));
       else resolve();
     };
     child.stdin.on("error", () => void 0);
-    child.stderr.on("data", (chunk) => stderr += chunk);
+    child.stderr.on("data", () => void 0);
     child.on("error", finish);
-    child.on("close", (code) => finish(code === 0 ? void 0 : new Error(stderr || `ssh exited with status ${code}`)));
+    child.on("close", (code) => finish(code === 0 ? void 0 : new Error("Commissioning upload failed.")));
     stream.on("error", (error) => {
       child.kill();
       finish(error);
@@ -2766,9 +2903,6 @@ function isPrivateAddress(host) {
   if (octets.some((octet) => octet > 255)) return false;
   return octets[0] === 10 || octets[0] === 192 && octets[1] === 168 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31;
 }
-function redact(value) {
-  return value.replace(/(?:password|secret|token)=?[^\s]*/gi, "[redacted]");
-}
 function isImmutableImage(image) {
   return /@sha256:[a-f0-9]{64}$/i.test(image);
 }
@@ -2882,8 +3016,13 @@ var WagoControllerApi = class {
     return this.commissioning.confirmHostKey(id, body.hostKeyFingerprint);
   }
   deliverCommissioningSession(id, body) {
+    if (body?.confirmInstall !== true) throw new import_common3.BadRequestException("Explicit installation consent is required");
+    if (typeof body.temporarySsh?.username !== "string" || !body.temporarySsh.username.trim() || typeof body.temporarySsh.password !== "string" || !body.temporarySsh.password) {
+      throw new import_common3.BadRequestException("Temporary SSH username and password are required");
+    }
     return this.commissioning.deliver(id, {
-      temporarySsh: body?.temporarySsh ? { username: body.temporarySsh.username ?? "", password: body.temporarySsh.password ?? "" } : void 0
+      confirmInstall: true,
+      temporarySsh: { username: body.temporarySsh.username, password: body.temporarySsh.password }
     });
   }
   revokeCommissioningSession(id) {

package/frontend/{__federation_expose_Plugin-BdPTyEH_.js → __federation_expose_Plugin-CVjUpNsq.js}

@@ -83,7 +83,7 @@ var confirmCommissioningHostKey = (id, hostKeyFingerprint) => api.request(`/comm
 	body: { hostKeyFingerprint }
 });
 var listCommissioningSessions = (limit = 100, offset = 0) => api.request(`/commissioning/sessions?limit=${limit}&offset=${offset}`);
-var deliverCommissioningSession = (id, input = {}) => api.request(`/commissioning/sessions/${id}/deliver`, {
+var deliverCommissioningSession = (id, input) => api.request(`/commissioning/sessions/${id}/deliver`, {
 	method: "POST",
 	body: input
 });
@@ -183,7 +183,20 @@ function useConfirmCommissioningHostKeyMutation() {
 function useDeliverCommissioningSessionMutation() {
 	const queryClient = useQueryClient();
 	return useMutation({
-		mutationFn: ({ id, ...input }) => deliverCommissioningSession(id, input),
+		gcTime: 0,
+		retry: false,
+		networkMode: "always",
+		mutationFn: (variables) => {
+			const temporarySsh = { ...variables.temporarySsh };
+			const confirmInstall = variables.confirmInstall;
+			variables.temporarySsh.password = "";
+			variables.confirmInstall = false;
+			if (confirmInstall !== true) throw new Error("Explicit installation consent is required");
+			return deliverCommissioningSession(variables.id, {
+				confirmInstall,
+				temporarySsh
+			});
+		},
 		onSuccess: async () => {
 			await queryClient.invalidateQueries({ queryKey: queryKeys.controllers });
 			await queryClient.invalidateQueries({ queryKey: queryKeys.commissioningSessions });
@@ -324,7 +337,7 @@ function getErrorMessage$1(error) {
 }
 //#endregion
 //#region frontend/src/ConfigurationEditor.tsx
-var { Alert: Alert$4, Button: Button$5, Card, Checkbox, Form: Form$1, Input: Input$1, Label: Label$2, Modal: Modal$1, ModalBackdrop: ModalBackdrop$1, ModalBody: ModalBody$1, ModalContainer: ModalContainer$1, ModalDialog: ModalDialog$1, ModalFooter: ModalFooter$1, ModalHeader: ModalHeader$1, ModalHeading: ModalHeading$1, TextArea, TextField: TextField$1 } = await importShared("@heroui/react");
+var { Alert: Alert$4, Button: Button$5, Card, Checkbox: Checkbox$1, Form: Form$1, Input: Input$1, Label: Label$2, Modal: Modal$1, ModalBackdrop: ModalBackdrop$1, ModalBody: ModalBody$1, ModalContainer: ModalContainer$1, ModalDialog: ModalDialog$1, ModalFooter: ModalFooter$1, ModalHeader: ModalHeader$1, ModalHeading: ModalHeading$1, TextArea, TextField: TextField$1 } = await importShared("@heroui/react");
 var { useEffect: useEffect$3, useRef, useState: useState$3 } = await importShared("react");
 var emptySnapshot = {
 	version: 1,
@@ -518,7 +531,7 @@ function ConfigurationEditor({ controllerId, onOpenChange }) {
 											className: "wg:text-sm wg:font-medium",
 											children: "Select preset changes to copy into this draft"
 										}),
-										presetPreview.diff.map((change) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox, {
+										presetPreview.diff.map((change) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$1, {
 											isDisabled: isApplyingPreset,
 											isSelected: selectedPaths.includes(change.path),
 											onChange: (selected) => setSelectedPaths((paths) => selected ? [...paths, change.path] : paths.filter((path) => path !== change.path)),
@@ -800,7 +813,7 @@ function StandardDrawer({ isOpen, onOpenChange, children }) {
 }
 //#endregion
 //#region frontend/src/CommissioningModal.tsx
-var { Alert: Alert$3, Button: Button$3, DrawerBody: DrawerBody$1, DrawerFooter: DrawerFooter$1, DrawerHeader: DrawerHeader$1, Input, Label: Label$1, ListBox: ListBox$1, Select: Select$1, Spinner: Spinner$2, TextField } = await importShared("@heroui/react");
+var { Alert: Alert$3, Button: Button$3, Checkbox, DrawerBody: DrawerBody$1, DrawerFooter: DrawerFooter$1, DrawerHeader: DrawerHeader$1, Input, Label: Label$1, ListBox: ListBox$1, Select: Select$1, Spinner: Spinner$2, TextField } = await importShared("@heroui/react");
 var { AlertCircleIcon, CheckCircle2Icon, CpuIcon: CpuIcon$1 } = await importShared("lucide-react");
 var { useEffect: useEffect$2, useState: useState$2 } = await importShared("react");
 function CommissioningModal({ isOpen, session: resumedSession, onOpenChange }) {
@@ -817,14 +830,20 @@ function CommissioningModal({ isOpen, session: resumedSession, onOpenChange }) {
 	const [controllerIp, setControllerIp] = useState$2("");
 	const [mqttServerId, setMqttServerId] = useState$2(null);
 	const [hostKeyFingerprint, setHostKeyFingerprint] = useState$2("");
-	const [sshUsername, setSshUsername] = useState$2("root");
-	const [sshPassword, setSshPassword] = useState$2("wago");
+	const [sshUsername, setSshUsername] = useState$2("");
+	const [sshPassword, setSshPassword] = useState$2("");
+	const [confirmInstall, setConfirmInstall] = useState$2(false);
 	const [isCancelConfirmationOpen, setCancelConfirmationOpen] = useState$2(false);
 	const mutationSession = deliverSessionMutation.data ?? resumedSession ?? createdSession;
 	const session = mutationSession ? commissioningSessionsQuery.data?.find((candidate) => candidate.id === mutationSession.id) ?? mutationSession : null;
 	const selectedMqttServerId = mqttServerId === null ? null : Number(mqttServerId);
 	const isLoading = createSessionMutation.isPending || confirmHostKeyMutation.isPending || deliverSessionMutation.isPending || removeSessionMutation.isPending;
-	const loadingStatus = createSessionMutation.isPending ? ["Preparing commissioning", "Scanning and pinning the controller SSH identity."] : removeSessionMutation.isPending ? ["Canceling enrollment", "Revoking access and removing the enrollment records."] : confirmHostKeyMutation.isPending ? ["Confirming controller identity", "Saving the administrator-confirmed SSH host key."] : null;
+	const loadingStatus = createSessionMutation.isPending ? ["Preparing commissioning", "Scanning the SSH key for your review. A scan alone does not authenticate the controller."] : removeSessionMutation.isPending ? ["Canceling enrollment", "Revoking access and removing the enrollment records."] : confirmHostKeyMutation.isPending ? ["Confirming controller identity", "Saving the administrator-confirmed SSH host key."] : null;
+	useEffect$2(() => {
+		setSshPassword("");
+		setConfirmInstall(false);
+		setHostKeyFingerprint("");
+	}, [isOpen, resumedSession?.id]);
 	useEffect$2(() => {
 		if (!isOpen) return;
 		setMqttServerId(resumedSession?.mqttServerId.toString() ?? settingsQuery.data?.defaultMqttServerId?.toString() ?? null);
@@ -843,10 +862,12 @@ function CommissioningModal({ isOpen, session: resumedSession, onOpenChange }) {
 		setControllerIp("");
 		setMqttServerId(null);
 		setHostKeyFingerprint("");
-		setSshUsername("root");
-		setSshPassword("wago");
+		setSshUsername("");
+		setSshPassword("");
+		setConfirmInstall(false);
 		setCancelConfirmationOpen(false);
 		createSessionMutation.reset();
+		confirmHostKeyMutation.reset();
 		deliverSessionMutation.reset();
 		removeSessionMutation.reset();
 		onOpenChange(false);
@@ -863,14 +884,17 @@ function CommissioningModal({ isOpen, session: resumedSession, onOpenChange }) {
 		} });
 	}
 	function deliverSession() {
-		if (!session) return;
+		if (!session || isLoading || !confirmInstall || !sshUsername.trim() || !sshPassword || !canInstall(session)) return;
 		deliverSessionMutation.mutate({
 			id: session.id,
+			confirmInstall: true,
 			temporarySsh: {
-				username: sshUsername,
+				username: sshUsername.trim(),
 				password: sshPassword
 			}
 		});
+		setSshPassword("");
+		setConfirmInstall(false);
 	}
 	function confirmHostKey() {
 		if (!session) return;
@@ -925,7 +949,9 @@ function CommissioningModal({ isOpen, session: resumedSession, onOpenChange }) {
 							sshUsername,
 							sshPassword,
 							onSshUsernameChange: setSshUsername,
-							onSshPasswordChange: setSshPassword
+							onSshPasswordChange: setSshPassword,
+							confirmInstall,
+							onConfirmInstallChange: setConfirmInstall
 						}),
 						session && activeStep === 3 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProgressStep, {
 							name: title,
@@ -956,22 +982,22 @@ function CommissioningModal({ isOpen, session: resumedSession, onOpenChange }) {
 					isPending: isLoading,
 					isDisabled: !controllerIp.trim() || selectedMqttServerId === null || mqttServersQuery.isPending || mqttServersQuery.isError,
 					onPress: createSession,
-					children: isLoading ? "Preparing commissioning" : "Start automatic commissioning"
+					children: isLoading ? "Preparing commissioning" : "Scan controller for review"
 				}),
 				session?.state === "awaiting_identity_confirmation" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$3, {
 					isPending: isLoading,
-					isDisabled: hostKeyFingerprint !== session.hostKeyFingerprint,
+					isDisabled: !hostKeyFingerprint || hostKeyFingerprint !== session.hostKeyFingerprint,
 					onPress: confirmHostKey,
 					children: isLoading ? "Confirming identity" : "Confirm host key"
 				}),
-				session && ["awaiting_delivery", "delivery_failed"].includes(session.state) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$3, {
+				session && canInstall(session) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$3, {
 					isPending: isLoading,
-					isDisabled: !sshUsername.trim() || !sshPassword,
+					isDisabled: isLoading || !confirmInstall || !sshUsername.trim() || !sshPassword,
 					onPress: deliverSession,
-					children: isLoading ? "Starting delivery" : session.state === "delivery_failed" ? "Retry delivery" : "Start secure delivery"
+					children: isLoading ? "Starting installation" : session.state === "delivery_failed" ? "Retry installation" : "Install runtime"
 				}),
 				session && session.state !== "completed" && session.state !== "revoked" && (isCancelConfirmationOpen ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$3, {
-					color: "danger",
+					variant: "danger",
 					isPending: isLoading,
 					onPress: () => removeSessionMutation.mutate(session.id, { onSuccess: close }),
 					children: isLoading ? "Canceling enrollment" : "Confirm cancellation"
@@ -989,7 +1015,7 @@ function DevicePassport({ className, name, step }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("aside", {
 		className: `wg:min-w-0 wg:rounded-large wg:bg-default-100 wg:p-5 ${className ?? ""}`,
 		children: [
-			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(CpuIcon$1, { className: "wg:h-10 wg:w-10 wg:text-accent-soft-foreground" }),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(CpuIcon$1, { className: "wg:h-10 wg:w-10 wg:text-primary" }),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
 				className: "wg:mt-4 wg:text-xs wg:font-semibold wg:uppercase wg:tracking-wider wg:text-muted",
 				children: "CC100 device passport"
@@ -1003,15 +1029,15 @@ function DevicePassport({ className, name, step }) {
 				children: [
 					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PassportRow, {
 						label: "Identity",
-						value: step >= 2 ? "Verified automatically" : "Not scanned"
+						value: step >= 2 ? "Review required" : "Not scanned"
 					}),
 					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PassportRow, {
 						label: "Runtime",
-						value: step >= 3 ? "Provisioning" : "Not delivered"
+						value: step >= 2 ? "See session status" : "Not installed"
 					}),
 					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PassportRow, {
 						label: "Claim",
-						value: step >= 3 ? "Automatic" : "Queued"
+						value: step >= 3 ? "See session status" : "Pending"
 					})
 				]
 			}),
@@ -1022,7 +1048,7 @@ function DevicePassport({ className, name, step }) {
 					1,
 					2,
 					3
-				].map((index) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `wg:h-1.5 wg:flex-1 wg:rounded-full ${index <= step ? "wg:bg-accent" : "wg:bg-default-300"}` }, index))
+				].map((index) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `wg:h-1.5 wg:flex-1 wg:rounded-full ${index <= step ? "wg:bg-primary" : "wg:bg-default-300"}` }, index))
 			})
 		]
 	});
@@ -1039,9 +1065,9 @@ function PassportRow({ label, value }) {
 function StepHeading({ step }) {
 	const content = [
 		["Give this controller a useful name", "This name is reserved now and applied automatically when the controller comes online."],
-		["Connect it securely", "Enter the private address and MQTT server. The controller identity is verified automatically."],
-		["Verifying and provisioning", "The server pins the SSH fingerprint automatically and installs the runtime without an operator confirmation."],
-		["Commissioning continues automatically", "You can close this window and start another controller at any time."]
+		["Connect the controller", "Enter its private address and choose an MQTT server. Review the scanned identity before installation."],
+		["Review and approve installation", "Confirm the controller identity, enter temporary SSH credentials, and approve the changes for this attempt."],
+		["Commissioning status", "A saved session does not authorize a new installation. After an interruption, review the status before retrying."]
 	][step];
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
 		/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
@@ -1065,7 +1091,7 @@ function StepHeading({ step }) {
 function OperationStatus({ title, description }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		"aria-live": "polite",
-		className: "wg:rounded-large wg:border wg:border-accent/30 wg:bg-accent/5 wg:p-3",
+		className: "wg:rounded-large wg:border wg:border-primary/30 wg:bg-primary/5 wg:p-3",
 		children: [
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 				className: "wg:flex wg:items-center wg:gap-2",
@@ -1083,7 +1109,7 @@ function OperationStatus({ title, description }) {
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
 				className: "wg:mt-3 wg:h-1 wg:overflow-hidden wg:rounded-full wg:bg-default-200",
-				children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "wg:h-full wg:w-2/5 wg:animate-pulse wg:rounded-full wg:bg-accent" })
+				children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "wg:h-full wg:w-2/5 wg:animate-pulse wg:rounded-full wg:bg-primary" })
 			})
 		]
 	});
@@ -1103,93 +1129,139 @@ function NameStep({ name, onNameChange }) {
 function ConnectionStep({ controllerIp, mqttServerId, mqttServersQuery, onControllerIpChange, onMqttServerIdChange }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-4",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
-			isRequired: true,
-			name: "controller-ip",
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Controller IP address" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
-				value: controllerIp,
-				placeholder: "192.168.1.42",
-				onChange: (event) => onControllerIpChange(event.target.value)
-			})]
-		}), mqttServersQuery.isPending ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
-			className: "wg:flex wg:justify-center wg:p-2",
-			children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Spinner$2, {
-				color: "accent",
-				size: "sm"
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3, {
+				status: "accent",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Title, { children: "Prepare the CC100 (751-9301), firmware 31" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Description, { children: "Have the controller powered using its specified supply and wait for it to finish starting. Connect its Ethernet cable to the intended local network. Ask your network administrator for its assigned IP address and ensure the Attraccess server can reach it. Keep power and networking connected during installation. If the model or firmware is uncertain, check the device label and your maintenance records with the responsible administrator before proceeding." })] })]
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
+				isRequired: true,
+				name: "controller-ip",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Controller IP address" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
+					value: controllerIp,
+					placeholder: "192.168.1.42",
+					onChange: (event) => onControllerIpChange(event.target.value)
+				})]
+			}),
+			mqttServersQuery.isPending ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+				className: "wg:flex wg:justify-center wg:p-2",
+				children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Spinner$2, {
+					color: "accent",
+					size: "sm"
+				})
+			}) : mqttServersQuery.isError ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ErrorAlert$1, { error: mqttServersQuery.error }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Select$1, {
+				className: "wg:w-full",
+				name: "mqttServerId",
+				placeholder: "Select an MQTT server",
+				value: mqttServerId,
+				onChange: onMqttServerIdChange,
+				children: [
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "MQTT server" }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Select$1.Trigger, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Select$1.Value, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Select$1.Indicator, {})] }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Select$1.Popover, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ListBox$1, {
+						renderEmptyState: () => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+							className: "wg:block wg:p-3 wg:text-sm wg:text-muted",
+							children: "No MQTT servers configured."
+						}),
+						children: (mqttServersQuery.data ?? []).map((server) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ListBox$1.Item, {
+							id: server.id.toString(),
+							textValue: server.name,
+							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+								className: "wg:min-w-0 wg:truncate",
+								children: server.name
+							}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ListBox$1.ItemIndicator, {})]
+						}, server.id))
+					}) })
+				]
 			})
-		}) : mqttServersQuery.isError ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ErrorAlert$1, { error: mqttServersQuery.error }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Select$1, {
-			className: "wg:w-full",
-			name: "mqttServerId",
-			placeholder: "Select an MQTT server",
-			value: mqttServerId,
-			onChange: onMqttServerIdChange,
-			children: [
-				/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "MQTT server" }),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Select$1.Trigger, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Select$1.Value, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Select$1.Indicator, {})] }),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Select$1.Popover, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ListBox$1, {
-					renderEmptyState: () => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
-						className: "wg:block wg:p-3 wg:text-sm wg:text-muted",
-						children: "No MQTT servers configured."
-					}),
-					children: (mqttServersQuery.data ?? []).map((server) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ListBox$1.Item, {
-						id: server.id.toString(),
-						textValue: server.name,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
-							className: "wg:min-w-0 wg:truncate",
-							children: server.name
-						}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ListBox$1.ItemIndicator, {})]
-					}, server.id))
-				}) })
-			]
-		})]
+		]
 	});
 }
 function HostKeyConfirmationStep({ fingerprint, expectedFingerprint, onFingerprintChange }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-4",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3, {
-			status: "warning",
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Title, { children: "Verify the controller SSH key" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Description, { children: "Compare this fingerprint with the value shown on the physical controller or from a trusted inventory record. Enter it exactly to authorize delivery." })] })]
-		}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
-			isRequired: true,
-			name: "host-key-fingerprint",
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Scanned SSH host-key fingerprint" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
-				value: fingerprint,
-				placeholder: expectedFingerprint,
-				onChange: (event) => onFingerprintChange(event.target.value)
-			})]
-		})]
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3, {
+				status: "warning",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Title, { children: "Review the controller SSH key" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Description, { children: "Compare the scanned fingerprint with a trusted inventory record or a fingerprint obtained independently through a trusted administrator. Copying the scan back here is not independent authentication. If no trusted fingerprint is available, confirm the physical controller and its cabling on an isolated network you control; this reduces exposure but does not independently authenticate the SSH key. Stop if the device or network is uncertain. Confirming the key does not start installation." })] })]
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
+				className: "wg:break-all wg:text-sm",
+				children: ["Scanned fingerprint: ", expectedFingerprint]
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
+				isRequired: true,
+				name: "host-key-fingerprint",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Reviewed SSH host-key fingerprint" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
+					value: fingerprint,
+					onChange: (event) => onFingerprintChange(event.target.value)
+				})]
+			})
+		]
 	});
 }
-function DeliveryStep({ isDelivering, session, sshUsername, sshPassword, onSshUsernameChange, onSshPasswordChange }) {
+function canInstall(session) {
+	return [
+		"awaiting_delivery",
+		"delivery_failed",
+		"awaiting_codesys_confirmation"
+	].includes(session.state);
+}
+function DeliveryStep({ isDelivering, session, sshUsername, sshPassword, onSshUsernameChange, onSshPasswordChange, confirmInstall, onConfirmInstallChange }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-4",
 		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningStatusPanel, {
 			isActive: isDelivering || session.state === "delivering",
 			session
-		}), ["awaiting_delivery", "delivery_failed"].includes(session.state) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
-			className: "wg:grid wg:gap-4 wg:sm:grid-cols-2",
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
-				isRequired: true,
-				name: "ssh-username",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Temporary SSH username" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
-					value: sshUsername,
-					onChange: (event) => onSshUsernameChange(event.target.value)
+		}), canInstall(session) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3, {
+				status: "warning",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$3.Title, { children: "Review this installation attempt" }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3.Description, { children: [
+					"Installing on ",
+					session.targetHost,
+					" can interrupt CODESYS and replaces an existing Attraccess runtime container. Make sure connected equipment can safely tolerate the interruption and replacement. Installation does not certify the controller as hardened or the connected equipment as ready for use."
+				] })] })]
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+				className: "wg:grid wg:gap-4 wg:sm:grid-cols-2",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
+					isRequired: true,
+					isDisabled: isDelivering,
+					name: "ssh-username",
+					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Temporary SSH username" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
+						autoComplete: "off",
+						value: sshUsername,
+						onChange: (event) => onSshUsernameChange(event.target.value)
+					})]
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
+					isRequired: true,
+					isDisabled: isDelivering,
+					name: "ssh-password",
+					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Temporary SSH password" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
+						autoComplete: "off",
+						type: "password",
+						value: sshPassword,
+						onChange: (event) => onSshPasswordChange(event.target.value)
+					})]
 				})]
-			}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField, {
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox, {
 				isRequired: true,
-				name: "ssh-password",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$1, { children: "Temporary SSH password" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input, {
-					type: "password",
-					value: sshPassword,
-					onChange: (event) => onSshPasswordChange(event.target.value)
-				})]
-			})]
-		})]
+				isDisabled: isDelivering,
+				isSelected: confirmInstall,
+				onChange: onConfirmInstallChange,
+				name: "confirm-install",
+				children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox.Indicator, {}) }), "I approve CODESYS interruption and replacement of the existing Attraccess runtime container for this installation attempt."] })
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+				className: "wg:text-sm wg:text-muted",
+				children: "Enter the controller credentials explicitly; no default credentials are used. The password and approval are cleared after submitting or closing. Every retry needs a new approval and password. Restarting the server does not start or resume an installation."
+			})
+		] })]
 	});
 }
 function ProgressStep({ name, session }) {
-	const complete = session.state === "completed";
+	const complete = session.state === "completed" || session.state === "revoked";
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-4",
 		children: [
@@ -1209,7 +1281,7 @@ function ProgressStep({ name, session }) {
 					children: "Safe to close"
 				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
 					className: "wg:mt-1 wg:text-muted",
-					children: "This session is saved in the CC100 devices table. Start another commissioning session while this one continues in the background."
+					children: "This session is saved in the CC100 devices table. Closing this window does not cancel an installation already submitted. If installation is interrupted, reopening the session or restarting the server does not authorize another attempt."
 				})]
 			}),
 			session.failureReason && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$3, {
@@ -1223,11 +1295,11 @@ function CommissioningStatusPanel({ isActive, session }) {
 	const percent = session.progressPercent ?? 0;
 	const isQueued = session.state === "awaiting_delivery";
 	const hasFailure = !isActive && Boolean(session.failureReason);
-	const title = isQueued ? "Delivery queued" : session.progressStep ?? (isActive ? "Preparing commissioning" : commissioningLabel(session.state));
-	const detail = isQueued ? "The server will begin or resume this saved delivery automatically." : session.progressDetail ?? "Waiting for the next commissioning operation.";
+	const title = isQueued ? "Installation approval required" : session.progressStep ?? (isActive ? "Preparing commissioning" : commissioningLabel(session.state));
+	const detail = isQueued ? "Review the installation, enter temporary SSH credentials, and approve this attempt. Saved sessions do not start or resume installation automatically." : session.progressDetail ?? "Waiting for the next commissioning operation.";
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		"aria-live": "polite",
-		className: "wg:rounded-large wg:border wg:border-accent/30 wg:bg-accent/5 wg:p-4",
+		className: "wg:rounded-large wg:border wg:border-primary/30 wg:bg-primary/5 wg:p-4",
 		children: [
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 				className: "wg:flex wg:items-start wg:gap-3",
@@ -1254,7 +1326,7 @@ function CommissioningStatusPanel({ isActive, session }) {
 						/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
 							className: "wg:mt-3 wg:h-1.5 wg:overflow-hidden wg:rounded-full wg:bg-default-200",
 							children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
-								className: `wg:h-full wg:rounded-full wg:transition-[width] wg:duration-500 ${hasFailure ? "wg:bg-danger" : "wg:bg-accent"}`,
+								className: `wg:h-full wg:rounded-full wg:transition-[width] wg:duration-500 ${hasFailure ? "wg:bg-danger" : "wg:bg-primary"}`,
 								style: { width: `${percent}%` }
 							})
 						})

package/frontend/remoteEntry.js

@@ -9,7 +9,7 @@ var exportSet = /* @__PURE__ */ new Set([
 ]);
 var moduleMap = { "./plugin": () => {
 	dynamicLoadingCss(["style.css"], false, "./plugin");
-	return __federation_import("./__federation_expose_Plugin-BdPTyEH_.js").then((module) => Object.keys(module).every((item) => exportSet.has(item)) ? () => module.default : () => module);
+	return __federation_import("./__federation_expose_Plugin-CVjUpNsq.js").then((module) => Object.keys(module).every((item) => exportSet.has(item)) ? () => module.default : () => module);
 } };
 var seen = {};
 var dynamicLoadingCss = (cssFilePaths, dontAppendStylesToHead, exposeItemName) => {

package/frontend/style.css

@@ -259,17 +259,7 @@
   border-top-width: 1px;
 }
 
-.wg\:border-accent\/30 {
-  border-color: var(--accent);
-}
-
-@supports (color: color-mix(in lab, red, red)) {
-  .wg\:border-accent\/30 {
-    border-color: color-mix(in oklab, var(--accent) 30%, transparent);
-  }
-}
-
-.wg\:bg-accent, .wg\:bg-accent\/5 {
+.wg\:bg-accent\/5 {
   background-color: var(--accent);
 }
 
@@ -371,6 +361,10 @@
   letter-spacing: var(--wg-tracking-wider);
 }
 
+.wg\:break-all {
+  word-break: break-all;
+}
+
 .wg\:text-accent-soft-foreground {
   color: var(--accent-soft-foreground);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attraccess/plugin-wago",
-  "version": "0.1.0-nightly.941.1",
+  "version": "0.1.0-nightly.943.1",
   "description": "Official Attraccess integration for WAGO CC100 controllers.",
   "keywords": [
     "attraccess-plugin",