iobroker.eos-admin 7.10.5 → 7.10.7

package/INSTALL_TEST_V7.10.7.md

@@ -0,0 +1,9 @@
+# Installation test 7.10.7
+
+- Install/update EOS Admin 7.10.7 and verify port 8081 remains reachable.
+- Sign in as Admin: all previous functions, datapoint writes, expert mode, Admin and XTerm remain available.
+- Sign in as Installer: **EMS Apps öffnen** is visible and opens the EMS App-Center.
+- Installer: Simulation and License remain hidden/blocked; expert head, ioBroker Admin, XTerm and Users/Rights remain unavailable.
+- Sign in as End User: EMS App-Center, Simulation and License remain hidden/blocked; datapoints remain read-only.
+- Confirm an End User cannot inherit an existing UI/Admin session on port 8188.
+- Confirm navigation editing and backup visibility behavior remain restart-safe.

package/MERGE_UPDATE_README_V7.10.7.md

@@ -0,0 +1,7 @@
+# Merge/update note 7.10.7
+
+Always replace the previous repository with the complete 7.10.7 repository. Do not merge old `adminWww` role runtime files back into this release.
+
+The authoritative role policy in 7.10.7 allows the Installer to use the EMS App-Center, while Simulation and License remain Admin-only and the End User remains blocked.
+
+After a merge, run package validation, stability checks, role-security checks and `npm publish --dry-run` before publishing.

package/NEXOWATT_EOS_BUILD_INFO.json

@@ -1,32 +1,28 @@
 {
-  "version": "7.10.5",
+  "version": "7.10.7",
   "channel": "stable-latest",
-  "baseFrontend": "validated v84 runtime with authoritative RBAC, restored administrator rights and restart-safe navigation layout",
+  "baseFrontend": "validated v84 runtime with authoritative RBAC, End User read-only UI and Installer EMS App-Center access",
   "runtimeEntry": "v84",
-  "releaseType": "stable-admin-rights-rbac-navigation",
-  "release": "stable-admin-rights-rbac-navigation",
-  "label": "v7-10-5",
+  "releaseType": "stable-installer-ems-appcenter",
+  "release": "stable-installer-ems-appcenter",
+  "label": "v7-10-7",
   "notes": [
-    "Administrator authority is derived only from the authenticated backend security context; DOM text is never used to classify a role.",
-    "Admin keeps full datapoint write access, all overview cards and reversible expert mode.",
-    "Installer and End User do not see ioBroker Admin, XTerm, App Center, License, Simulation or account administration.",
-    "End User can open Datapoints in read-only mode; backend socket writes are denied independently of the browser.",
-    "Navigation visibility/order is stored in eos-admin.0.info.uiTabsVisible and no longer modifies system.config or restarts the adapter.",
-    "Backup navigation is shown only while a supported backup instance is enabled."
+    "Administrator authority and all Admin controls remain unchanged.",
+    "Installer may open and use the EMS App-Center.",
+    "Simulation and License remain Administrator-only.",
+    "End User App-Center blocking, read-only datapoints and port 8188 session scrubbing remain active."
   ],
   "changes": [
-    "Removed the legacy DOM-text role heuristic that could downgrade system.user.admin to End User.",
-    "Added explicit Admin bypass regression guards in source, backend runtime and frontend bundles.",
-    "Added End User-only ObjectBrowser read-only wiring while retaining Admin/Installer native write controls.",
-    "Moved menu layout persistence away from system.config into a dedicated adapter state.",
-    "Hid Admin/XTerm cards only for restricted roles and forced them visible for Admin.",
-    "Protected App Center, License and Simulation in the authenticated role layer and cleared inherited UI-admin sessions for non-admin roles."
+    "Split privileged UI actions into EMS, Simulation and License categories.",
+    "Allowed EMS App-Center actions for Admin and Installer only.",
+    "Kept Simulation and License actions Administrator-only.",
+    "Raised the release and browser cache identity to 7.10.7 / 7107."
   ],
-  "brandingCacheVersion": 7105,
-  "shellCacheVersion": 7105,
-  "nativeShellVersion": 7105,
-  "shellCacheTag": "7105",
-  "repositoryEntry": "nexowatt-eos-admin-repository-entry-v7-10-5.json",
+  "brandingCacheVersion": 7107,
+  "shellCacheVersion": 7107,
+  "nativeShellVersion": 7107,
+  "shellCacheTag": "7107",
+  "repositoryEntry": "nexowatt-eos-admin-repository-entry-v7-10-7.json",
   "autoUpdateCacheVersion": 7103,
   "autoUpdateCacheTag": "7103"
 }

package/NEXOWATT_EOS_PREBUILT_MANIFEST.json

@@ -1,9 +1,9 @@
 {
   "format": 1,
   "package": "iobroker.eos-admin",
-  "version": "7.10.5",
+  "version": "7.10.7",
   "algorithm": "sha256",
-  "fileCount": 1389,
+  "fileCount": 1391,
   "trackedRoots": [
     "src",
     "build",
@@ -552,7 +552,7 @@
     "adminWww/img/le.png": "ef5ebb7112926f646e781a326b639f56888fafe0891b9b000178091b4f8ed9dd",
     "adminWww/img/logo.svg": "1167118074ff84d8cef82ad80c38609719dacfde9417126e46966c1ec986534b",
     "adminWww/img/no-image.svg": "25fc382f4ad3a36f8a637cd966b9107368e1f11906d706102ad5f37db6f57f34",
-    "adminWww/index.html": "9358ac35e93087ed79e3c00ec54899fde92938c438eb86231328d5f08d3ea965",
+    "adminWww/index.html": "4ab35f356321beb1b578ceb42c0c441569822c05c50a94cf09896b77ece9cfd9",
     "adminWww/js/adapter-settings.js": "fb2e538a3385899f7fd47275ec588051c735d8f778a44b89f40f5eb820a31dbc",
     "adminWww/js/eos-account-management.js": "dbba398605b2391ac1a7ec97cf7eb84da7f929ea16bfb6761750cd700a687fbe",
     "adminWww/js/eos-assistant.js": "be43f49fd5310d2962365035556c37109d4868856e874e1f964c4b2f05bb6beb",
@@ -563,11 +563,11 @@
     "adminWww/js/eos-manual-write-policy.js": "3c93487146b4fd5f681aa45a6bb137d9a91c3fa145ebfa94ec5ccb6b15498e8b",
     "adminWww/js/eos-native-security.js": "33098b98164623fc133314658bca2f622d19971795dd8bd3c90aca68598aab90",
     "adminWww/js/eos-policy-client.js": "5ffd32270307137fbec69a9b9bea57ca1d2e27ede987ce1eb37ff1df6677d8d2",
-    "adminWww/js/eos-role-bootstrap.js": "f7f6f4c816cbf694f8e24d812a2aa8e7c84a42af6ad2274f44bf24debcfec63f",
-    "adminWww/js/eos-role-ui.js": "93424c5959159dd44421365a277b26c2c941f7d418eac4eae36547364cc10afb",
+    "adminWww/js/eos-role-bootstrap.js": "74dbc9246cbfd977d95be5af959686a71e439ac016ab70a9f5c62384792c2833",
+    "adminWww/js/eos-role-ui.js": "b4aa21c0664efd4b7ecd2a439f24547317162b4985abdd17f13df0d8d1c6c82d",
     "adminWww/js/license.js": "13798e577c82d7a5549b07a244b8b8453ef43e53fc7789f565c35b56e6654007",
     "adminWww/js/listHeader.js": "ed336a68a64e16a062d1af2269428fd20a08a4b695f17635f55a18bc1ef693a4",
-    "adminWww/js/nexowatt-native-shell.js": "c0d327669ba12ba3b8e6fc4d1a17eb7092e59a0b23a2852161714c2b214dde15",
+    "adminWww/js/nexowatt-native-shell.js": "9fe37b190543d070f99d838a0833e1428ff430deafab371208aec697eceaddb4",
     "adminWww/js/tableEditor.js": "5508044619fec70071895d0ae3ab6ff75dd03bd936e7b133f98d098d4245ec20",
     "adminWww/js/translate.js": "264442c0f42a10148057125532bf55b7672c4cc051c28e7cbb922984a558f8d3",
     "adminWww/js/treeTable.js": "8abde0b7880a89f6f927a87bb041945dea1502f51bc9870d8ba0be9d3dd9eed8",
@@ -747,7 +747,7 @@
     "adminWww/static/js/html.js": "159b7192459d73d92761dab8c4d48e138e94e4d8e7bf99004bac257e403a0c3b",
     "adminWww/static/js/javascript.js": "6287a6b820c8707a0cd7b9e4545bcb023a8b9228569cfd21be6635d1409aabf4",
     "adminWww/static/js/nexowatt-stable-login.js": "ff0c6d4dc2086f3ab4be8ef455e5891a2ccb5f534bddfacbef2f5cd6ce65489e",
-    "adminWww/static/js/nexowatt-stable-v7105.js": "35d329e37a698a71d2825fe1bcbcee4e1073249a59aa56a3c645cf9623461600",
+    "adminWww/static/js/nexowatt-stable-v7107.js": "3ba5e1587b3e0129afe054fbbdd321b80cbde050ce1b75d0e42889fd2ffede19",
     "adminWww/static/js/worker-css.js": "83c767cacd6b190e2f083b139cb3f124d1b560afbd7a6dbb74bf5539aa4cadee",
     "adminWww/static/js/worker-html.js": "661d2448443c0089fba31d2829d77761a5fc042035c38433eff0e20707f17457",
     "adminWww/static/js/worker-javascript.js": "73fcf007e2d19eacba8f365719ee92d14345505b03f9cf66e6338aef02fccd21",
@@ -793,7 +793,7 @@
     "build/lib/translations.js.map": "c74bcf48d2dd6ec58c48d48a7fb39c59a84fd58c25095bc0cb5bb46c88cfe24f",
     "build/lib/utils.js": "b013a5df06f95ed5bfcb851bb87c0617f61f70e6fe7f1fbf2402fd4d0aadec9b",
     "build/lib/utils.js.map": "74238d0d82cc28d41c4f627b73793f6cda26b338ef1bd97916b6417783949e29",
-    "build/lib/web.js": "8de94dffdd7c70be6b537c111691c831116338b311f7569739de57f9a32e071f",
+    "build/lib/web.js": "f7d0adebfe5b7890f09d3b5eff986cd564724cc7a8497048dc670b43d69b1d90",
     "build/lib/web.js.map": "5fb9f337f3a27c04bb4303cb61ffa5f0da857299a7d2890609eb5f55f24f1789",
     "build/main.js": "7578ee14ea840950ad5164b0063c091c983528ebc32689dec5dc499062fbc92e",
     "build/main.js.map": "1cd3887da9b3d4061c59b6ad497c536c6c9a79938b10bbddf7128a1e7930dfbd",
@@ -850,11 +850,11 @@
     "src-admin/public/js/eos-manual-write-policy.js": "3c93487146b4fd5f681aa45a6bb137d9a91c3fa145ebfa94ec5ccb6b15498e8b",
     "src-admin/public/js/eos-native-security.js": "33098b98164623fc133314658bca2f622d19971795dd8bd3c90aca68598aab90",
     "src-admin/public/js/eos-policy-client.js": "5ffd32270307137fbec69a9b9bea57ca1d2e27ede987ce1eb37ff1df6677d8d2",
-    "src-admin/public/js/eos-role-bootstrap.js": "f7f6f4c816cbf694f8e24d812a2aa8e7c84a42af6ad2274f44bf24debcfec63f",
-    "src-admin/public/js/eos-role-ui.js": "93424c5959159dd44421365a277b26c2c941f7d418eac4eae36547364cc10afb",
+    "src-admin/public/js/eos-role-bootstrap.js": "74dbc9246cbfd977d95be5af959686a71e439ac016ab70a9f5c62384792c2833",
+    "src-admin/public/js/eos-role-ui.js": "b4aa21c0664efd4b7ecd2a439f24547317162b4985abdd17f13df0d8d1c6c82d",
     "src-admin/public/js/license.js": "13798e577c82d7a5549b07a244b8b8453ef43e53fc7789f565c35b56e6654007",
     "src-admin/public/js/listHeader.js": "ed336a68a64e16a062d1af2269428fd20a08a4b695f17635f55a18bc1ef693a4",
-    "src-admin/public/js/nexowatt-native-shell.js": "c0d327669ba12ba3b8e6fc4d1a17eb7092e59a0b23a2852161714c2b214dde15",
+    "src-admin/public/js/nexowatt-native-shell.js": "9fe37b190543d070f99d838a0833e1428ff430deafab371208aec697eceaddb4",
     "src-admin/public/js/tableEditor.js": "5508044619fec70071895d0ae3ab6ff75dd03bd936e7b133f98d098d4245ec20",
     "src-admin/public/js/translate.js": "264442c0f42a10148057125532bf55b7672c4cc051c28e7cbb922984a558f8d3",
     "src-admin/public/js/treeTable.js": "8abde0b7880a89f6f927a87bb041945dea1502f51bc9870d8ba0be9d3dd9eed8",
@@ -975,7 +975,7 @@
     "src-admin/public/manifest.json": "15244d5d50f08420fc5d4793e5699e99c7b900b6908cfbc00a7182f4d4db55bd",
     "src-admin/public/robots.txt": "90d24bc3bf698ac1e173739502298ccca72adf1f564fab05f484b8c48d1cadd2",
     "src-admin/public/static/js/nexowatt-stable-login.js": "ff0c6d4dc2086f3ab4be8ef455e5891a2ccb5f534bddfacbef2f5cd6ce65489e",
-    "src-admin/public/static/js/nexowatt-stable-v7105.js": "35d329e37a698a71d2825fe1bcbcee4e1073249a59aa56a3c645cf9623461600",
+    "src-admin/public/static/js/nexowatt-stable-v7107.js": "3ba5e1587b3e0129afe054fbbdd321b80cbde050ce1b75d0e42889fd2ffede19",
     "src-admin/src/App.tsx": "8ab367389c604d5face72cc71da49b08021ffa2e566db4d32df9ad98f9fe762a",
     "src-admin/src/Workers/AdaptersWorker.tsx": "3a2cdeb8010598c901df0e3cffcdae913e62e7ac7c84fcadf15cb7f961dc6ed9",
     "src-admin/src/Workers/GenericWorker.tsx": "3b3c6e7856602477c54d1dc085aa23b5cfcac7784cc73710b00622ac04ed5a97",
@@ -1323,7 +1323,7 @@
     "src-admin/src/tabs/Objects.tsx": "2b87a8a7e771e10e1cce49019c4be62578f10096eee5abd17d2685f5f41cc67c",
     "src-admin/src/tabs/Users.tsx": "45ed37e57b66f7e23eb465aef9ad9db55613b40bf44530ab81d6206806de102d",
     "src-admin/src/types.d.ts": "3cfac48af5f8416b55b89c0daca78499dbbd402c0b44cc661112b76953ba3344",
-    "src-admin/src/version.json": "13b5e66c3cd1fe6ee1f5f2cf0c4f921660dea2013644d05822ded200018dd14a",
+    "src-admin/src/version.json": "b2da994816631b24508b9ecde47e77ea9d9463a8ff1afdeda0500219343f75fa",
     "src/i18n/de.json": "85d4ecfedf15d78984922b05377063b808ae8c5a75944af323e72a2c3a483d50",
     "src/i18n/en.json": "6a0156a1b026903821d395ef2ceef845e90531f323a218f97f5abefaabb46a23",
     "src/i18n/es.json": "54369f8044dfa222779849d2f158eb100188a43816d6c42a64575122cb528a30",
@@ -1350,7 +1350,7 @@
     "src/lib/testPassword.ts": "c627432e64b6ed40081e2828af207238bc9e9e1f8b823eaf20c7d3e059c5e938",
     "src/lib/translations.ts": "8fdb51d81c3f98e17e0231f6773381886eb1c68068a3f53dd5e32bf6b58f9d16",
     "src/lib/utils.ts": "5398da6c6a660c4300e2679aa5e001e05297d684cc39bdfab091375768169f30",
-    "src/lib/web.ts": "8eae6cc8dc6eb42bc7be5498f91e4064f35564355d7538cfa4d791e7b323ca5e",
+    "src/lib/web.ts": "c4683adc8e32e23280bf6fead41cc7c67ff41982d33e388119b18a7ac9997fb7",
     "src/main.ts": "e9eb8013a229d9616be923850075e8cb5475bde32c882008721225ed37a85a8c",
     "src/types.d.ts": "12117a644a45cb0b551555184126563e80bf909726aa378c7d72327a30c61054",
     "tasks.mts": "84a396f8581e7e3ca499a1c4ce01d22ea29f81700520f804b48a95fb54d72408",
@@ -1375,10 +1375,11 @@
     "tools/nexowatt-generate-eos-admin-repo-entry.cjs": "a8b55d6001b0ed6d97221448b194748945f2e8382cdaf0b11ea91c63fb517139",
     "tools/nexowatt-generate-repo-entry.cjs": "4e98acc7db74546bd942cfa36d57015673c6f1514758494753e7339068f7eb68",
     "tools/nexowatt-import-integrity-selftest.cjs": "f46951126a237a6010c3c0949c25e2415ebe9af568d29411d10691951cb3ed87",
+    "tools/nexowatt-installer-ems-selftest.cjs": "65bbc30d60b4a7e24a7aa599eda256b4361f66c1dd9437c989d549185c43bc79",
     "tools/nexowatt-internal-reserve-selftest.cjs": "f027a2272a4277d65167d68d4ca4428cd0c28a6c6c2b610eda575abd3f2bc90a",
     "tools/nexowatt-login-layout-selftest.cjs": "7d4baae82f1d53fc14446b8ef80aaffa39b0b3529821599f4a6e2c27fbc7a7f2",
     "tools/nexowatt-manual-write-policy-selftest.cjs": "a41057610972d681120bf35e0321029facc08b098c79da9b131980f80bd3fdce",
-    "tools/nexowatt-merge-update-selftest.cjs": "66d250def2c372cceb0fda42b0dc756557d8cdcf268f73a2ff7c68de4522e36a",
+    "tools/nexowatt-merge-update-selftest.cjs": "f8abe1505e4dd8ade64577825e8c67ae3828892493c613a566ea353b668bfaaf",
     "tools/nexowatt-modern-ui-selftest.cjs": "0145adc4b7d84e996f227dee02c09f767ab9a29bb2151041a50b88bb27a5b93a",
     "tools/nexowatt-module-popup-selftest.cjs": "31f02e8cf0bfd61d7769e1095c93887a34cfbbd76a9805ef4931cea6dff53ddf",
     "tools/nexowatt-native-shell-selftest.cjs": "13aabd3a19f0c0422bbc1c676718685b77c88a526167a7b511fa6c9ab2ac860c",
@@ -1391,20 +1392,21 @@
     "tools/nexowatt-publish-channel-selftest.cjs": "c4efd1104ebe471ce1dc63195f322cffe760af295bf60f13b9766491acd0280e",
     "tools/nexowatt-release-defaults-selftest.cjs": "3e3c96ca774200461978c546d1a937cbae18d7f11497ed84dda639c2358f6e16",
     "tools/nexowatt-repair-eos-admin-update.cjs": "f28c1999b0f75139e582770ad649d17d11f9e909ac49d13c31be5fa5b36253e3",
-    "tools/nexowatt-role-access-selftest.cjs": "b855b69cb74a5124c9a5a22b811a5209f70f32979a776401897f7fe910f794e9",
-    "tools/nexowatt-role-security-selftest.cjs": "b5b21f3c80f69b03f9c95fb26e11b2706aac86534048ac7251a5275dfcbde6e2",
+    "tools/nexowatt-role-access-selftest.cjs": "50e972f331b2c54640964b5dcf0eb0becc51439cf78d24fd76be45cf5a7db3be",
+    "tools/nexowatt-role-security-selftest.cjs": "9dc69a6154b86f2fd3b7d28f4f7ae3b97bcb50e652d97fb6c7d090ba82ea2e84",
     "tools/nexowatt-runtime-cleanup-selftest.cjs": "f317b09aa0c51ffe7e1b5eaf10c52c886804ec6e8084967cd88e4ebece6ecfb5",
-    "tools/nexowatt-stability-check.cjs": "087c74c3f050ebfe3b092cc74a4b99b6e66813d57b0d2065f92fbddcb9e2ed9e",
+    "tools/nexowatt-stability-check.cjs": "f9b79766c54f6b47a2ef475206180d9895045a4adb794d8eeab1e1de49113d51",
     "tools/nexowatt-stable-v7101-selftest.cjs": "817d09861ef29c52a67f64ec5b8f4ad4654ce7e6486eded786bb16f3c773eaf8",
     "tools/nexowatt-stable-v7102-selftest.cjs": "75baab5f8069569ad4896e5018f3c5ccbbda2c2297aca5c5146bce94f9cf795d",
-    "tools/nexowatt-stable-v7103-selftest.cjs": "80491789e636375c21e22335de08c8b4892c056e3fb703f1d5368e81105074b0",
+    "tools/nexowatt-stable-v7103-selftest.cjs": "c2ba0387363fcc6de164b28df1d6c0d1eabc4636b6e6a734ed3a76a0fff1d78c",
     "tools/nexowatt-stable-v94-selftest.cjs": "5226881b3ad8918c67921ffb37716490f053ec88e7c0f24827a5eda7c75d4019",
     "tools/nexowatt-stable-v95-selftest.cjs": "0b15fcd329eb2994e64c407ab04eaafab7c38c4688136c197bf9601e1c35ee07",
     "tools/nexowatt-stable-v97-selftest.cjs": "4f50ad6e53b8de7eb045d56657cccd846883eacd8a877d51240d78153ba53d80",
     "tools/nexowatt-sync-release-version.cjs": "2478d714533ece21a275071ef6e5467f73c2fa33d0a63d76f408dc048a86c6f6",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs": "83255e5d3c9a548013f6e9a74706644d15d98450d0bfa2eb3da83c740d8618ea",
     "tools/nexowatt-update-selftest.cjs": "c38c454135f98de683de8fa15fc4b9032063823f0f55fcfc8b675f551fd342f5",
-    "tools/nexowatt-validate-package.cjs": "4995d6db92d59ba4cdb1ed6481304deae348f644064e86fbf81384405e36b851",
+    "tools/nexowatt-user-area-selftest.cjs": "0936141466414f020a7d4df60d81ee1d1cfc9bd3a8d4aa9bb361a71b7bdf5b45",
+    "tools/nexowatt-validate-package.cjs": "956ed5a7b00a8d908c12d396b28eee879560dcb6155fde8540d7fc502416fb2f",
     "tools/nexowatt-value-column-selftest.cjs": "29d0a9bbea05a87dcf8ee09c86cc81acb6c59e1e34801890768f5e342083871a",
     "tools/nexowatt-version-sync-selftest.cjs": "65d7c8634b6d5581f337365e13a1a9432c7d47dbf5aebc237886730c32ba5e94",
     "tsconfig.build.json": "d3a31263975a13de77b97af9ff246d89931f3abb594047be2739cf11378b97f5",

package/PUBLISH_STABLE_V7.10.7.md

@@ -0,0 +1,9 @@
+# NPM publication 7.10.7
+
+1. Use a freshly extracted repository ZIP.
+2. Run `npm publish --dry-run`.
+3. Confirm version `7.10.7`, complete `build/` runtime and all active `adminWww` runtime files.
+4. Verify the Installer EMS self-test and role-security self-test are successful.
+5. Publish with `npm publish` only after the dry run succeeds.
+
+No `npm install`, `npm ci`, `tsc` or `tsx` is required for the sealed prebuilt release.

package/README_STABILITY_V7.10.7.md

@@ -0,0 +1,7 @@
+# NexoWatt EOS Admin 7.10.7 – stability and RBAC baseline
+
+This release retains the validated crash, package, update-placement, Admin-rights and End User read-only fixes from 7.10.2–7.10.6.
+
+Role decisions continue to come exclusively from the authenticated `/nexowatt/security/context` response. Administrator remains the unconditional full-rights path. End User datapoints remain read-only in frontend and backend. Installer receives EMS App-Center access, while Simulation, License, expert mode, ioBroker Admin, XTerm and account administration remain restricted.
+
+Menu edits continue to use the adapter state and must never write `system.config`.

package/RELEASE_ACCEPTANCE_V7.10.7.md

@@ -0,0 +1,12 @@
+# Release Acceptance 7.10.7
+
+- [ ] Admin retains unrestricted access and all existing controls.
+- [ ] Installer can open and use the EMS App-Center.
+- [ ] Installer cannot open Simulation or License.
+- [ ] Installer does not see expert mode, ioBroker Admin, XTerm or Users/Rights.
+- [ ] End User cannot open EMS App-Center, Simulation or License.
+- [ ] End User datapoints remain read-only and action icons remain hidden.
+- [ ] End User session scrubbing on port 8188 remains active.
+- [ ] Pencil navigation edits do not restart EOS Admin.
+- [ ] Backup navigation follows the enabled state of the backup instance.
+- [ ] `npm publish --dry-run` succeeds from a fresh extraction.

package/RELEASE_NOTES_V7.10.7.md

@@ -0,0 +1,19 @@
+# NexoWatt EOS Admin 7.10.7
+
+## Installateurbereich
+
+- Der Installateur kann **EMS Apps öffnen** und das EMS App-Center wie der Administrator verwenden.
+- Die Freigabe gilt ausschließlich für das EMS App-Center.
+- Simulation und Lizenzverwaltung bleiben ausschließlich für Administratoren verfügbar.
+- Der Installateur erhält weiterhin keinen Expertenmodus, keinen ioBroker-Admin-Zugang, kein XTerm und keine Benutzer-/Rechteverwaltung.
+
+## Bestehende Rollen bleiben unverändert
+
+- Administrator: vollständige Rechte und alle bisherigen Funktionen.
+- Endkunde: Datenpunkte nur lesend; App-Center, Simulation und Lizenz bleiben vollständig gesperrt.
+- Der Endkunden-Sitzungsschutz auf Port 8188 bleibt aktiv; nur der Installateur wird davon für die EMS-Nutzung ausgenommen.
+
+## Veröffentlichung
+
+- Neue npm-Version 7.10.7, da 7.10.6 bereits veröffentlicht ist.
+- Release-Dateien, Browser-Cache-Tags, Repository-Eintrag und Prebuilt-Manifest sind auf 7.10.7 synchronisiert.

package/{SECURITY_ROLE_MATRIX_V7.10.5.md → SECURITY_ROLE_MATRIX_V7.10.7.md}

@@ -1,12 +1,14 @@
-# NexoWatt EOS role matrix 7.10.5
+# NexoWatt EOS role matrix 7.10.7
 
 | Capability | Admin | Installer | End User |
 |---|---:|---:|---:|
 | Datapoints read | Yes | Yes | Yes |
 | Datapoints write/edit | Yes | Yes | No |
+| EMS App-Center | Yes | Yes | No |
+| Simulation | Yes | No | No |
+| License administration | Yes | No | No |
 | Expert mode | Yes | No | No |
 | ioBroker Admin / XTerm | Yes | No | No |
-| App Center / License / Simulation | Yes | No | No |
 | Users, groups, passwords | Yes | No | No |
 | Smart Home structure | Yes | Yes | Yes |
 | Navigation layout editing | Yes | No | No |

package/adminWww/index.html

@@ -8,7 +8,7 @@
         <meta http-equiv="Cache-Control" content="no-store, no-cache, must-revalidate" />
         <meta http-equiv="Pragma" content="no-cache" />
         <meta http-equiv="Expires" content="0" />
-          <script src="./js/eos-manual-write-policy.js?v=7105"></script>
+          <script src="./js/eos-manual-write-policy.js?v=7107"></script>
           <script type="module" src="./assets/hostInit-v84.js?v=84"></script>
         
         <meta charset="utf-8" />
@@ -36,8 +36,8 @@
             rel="stylesheet"
             href="css/leaflet.css"
         />
-        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7105" />
-        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7105" />
+        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7107" />
+        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7107" />
         <link rel="stylesheet" href="./css/eos-auto-update.css?v=7103" />
         <link
             rel="manifest"
@@ -160,22 +160,22 @@
         </script>
       <link rel="modulepreload" crossorigin href="./assets/preload-helper-BDBacUwf.js">
       <link rel="modulepreload" crossorigin href="./assets/iobroker_admin__mf_v__runtimeInit__mf_v__-g2X2zhAf.js">
-            <script defer src="./js/eos-role-bootstrap.js?v=7105" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
-            <script defer src="./js/eos-policy-client.js?v=7105"></script>
-            <script defer src="./js/eos-branding-sanitizer.js?v=7105"></script>
-            <script defer src="./js/nexowatt-native-shell.js?v=7105"></script>
-            <script defer src="./js/eos-native-security.js?v=7105"></script>
-            <script defer src="./js/eos-basic-settings.js?v=7105"></script>
-            <script defer src="./js/eos-role-ui.js?v=7105"></script>
-            <script defer src="./js/eos-ems-overview.js?v=7105"></script>
+            <script defer src="./js/eos-role-bootstrap.js?v=7107" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
+            <script defer src="./js/eos-policy-client.js?v=7107"></script>
+            <script defer src="./js/eos-branding-sanitizer.js?v=7107"></script>
+            <script defer src="./js/nexowatt-native-shell.js?v=7107"></script>
+            <script defer src="./js/eos-native-security.js?v=7107"></script>
+            <script defer src="./js/eos-basic-settings.js?v=7107"></script>
+            <script defer src="./js/eos-role-ui.js?v=7107"></script>
+            <script defer src="./js/eos-ems-overview.js?v=7107"></script>
             
             <script defer src="./js/eos-auto-update.js?v=7103"></script>
-            <script defer src="./js/eos-assistant.js?v=7105"></script>
+            <script defer src="./js/eos-assistant.js?v=7107"></script>
     </head>
     <body>
         <noscript>Für NexoWatt EOS muss JavaScript aktiviert sein.</noscript>
         <div id="root"></div>
-<script defer src="static/js/nexowatt-stable-login.js?v=7105"></script>
-<script defer src="static/js/nexowatt-stable-v7105.js?v=7105"></script>
+<script defer src="static/js/nexowatt-stable-login.js?v=7107"></script>
+<script defer src="static/js/nexowatt-stable-v7107.js?v=7107"></script>
 </body>
 </html>

package/adminWww/js/eos-role-bootstrap.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7105-admin-authoritative-rbac';
+    const VERSION = 'v7107-admin-authoritative-rbac';
     const script = document.currentScript || document.querySelector('script[src*="eos-role-bootstrap.js"]');
     const entry = script?.dataset?.eosEntry || '';
     let launched = false;

package/adminWww/js/eos-role-ui.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7105-admin-authoritative-rbac';
+    const VERSION = 'v7107-installer-ems-rbac';
     window.NEXOWATT_EOS_ROLE_UI_VERSION = VERSION;
 
     const state = {
@@ -15,10 +15,13 @@
         reserveObserver: null,
         reservePaper: null,
         reserveScheduled: false,
+        readonlySystemInfo: null,
+        readonlySystemInfoPromise: null,
     };
     const abort = new AbortController();
 
     const safe = fn => { try { return fn(); } catch (_) { return undefined; } };
+    const escapeHtml = value => String(value ?? '').replace(/[&<>"']/g, match => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[match] || match));
     const normalize = value => String(value || '')
         .toLowerCase().normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/ß/g, 'ss')
         .replace(/[^a-z0-9#/_:.-]+/g, ' ').trim();
@@ -268,6 +271,55 @@
             role.setAttribute('data-nexowatt-overview-role', state.role);
         }
     };
+
+    const fetchReadonlySystemInfo = () => {
+        if (state.readonlySystemInfo) return Promise.resolve(state.readonlySystemInfo);
+        if (state.readonlySystemInfoPromise) return state.readonlySystemInfoPromise;
+        state.readonlySystemInfoPromise = fetch('/nexowatt/readonly/system-info', {
+            credentials: 'same-origin',
+            cache: 'no-store',
+            headers: { Accept: 'application/json' },
+        })
+            .then(response => (response.ok ? response.json() : null))
+            .then(data => {
+                state.readonlySystemInfo = data && typeof data === 'object' ? data : null;
+                return state.readonlySystemInfo;
+            })
+            .catch(() => null)
+            .finally(() => {
+                state.readonlySystemInfoPromise = null;
+                scheduleApply();
+            });
+        return state.readonlySystemInfoPromise;
+    };
+    const applyReadonlySystemInfoCard = () => safe(() => {
+        if (state.role !== 'enduser' || currentRoute() !== 'tab-intro') return;
+        const paper = appPaper();
+        if (!paper) return;
+        const title = Array.from(paper.querySelectorAll('h1,h2,h3,h4,h5,h6')).find(node => normalize(node.textContent || '') === 'nexowatt');
+        const card = title?.closest?.('.MuiCard-root');
+        if (!card || !/platform|ram|node\.js|npm/i.test(String(card.textContent || ''))) return;
+        Array.from(card.querySelectorAll('button')).forEach(button => {
+            if (/info/i.test(textOf(button))) {
+                button.classList.add('eos-role-hidden');
+                button.setAttribute('aria-hidden', 'true');
+                button.disabled = true;
+            }
+        });
+        if (!state.readonlySystemInfo && !state.readonlySystemInfoPromise) {
+            void fetchReadonlySystemInfo();
+            return;
+        }
+        const data = state.readonlySystemInfo;
+        const list = card.querySelector('ul');
+        if (!data || !list) return;
+        list.innerHTML = `
+            <li><span><span style="font-weight:600">Platform: </span>${escapeHtml(data.platform || '--')}</span></li>
+            <li><span><span style="font-weight:600">RAM: </span>${escapeHtml(Number.isFinite(Number(data.ramMb)) ? `${Math.round(Number(data.ramMb))} MB` : '--')}</span></li>
+            <li><span><span style="font-weight:600">Node.js: </span>${escapeHtml(data.nodejs || '--')}</span></li>
+            <li><span><span style="font-weight:600">NPM: </span>${escapeHtml(data.npm || '--')}</span></li>`;
+    });
+
     const hideIntroEditControls = () => {
         const paper = appPaper();
         if (!paper) return;
@@ -431,12 +483,26 @@
 
 
     const privilegedFrameObservers = new WeakMap();
-    const privilegedActionPattern = /^(?:ems apps?(?: offnen| öffnen)?|app center|app-center|appcenter|simulation|simulator|lizenz|license)$/;
-    const isPrivilegedAction = element => {
+    const privilegedActionKind = element => {
         const signature = normalize(textOf(element));
         const href = normalize(element?.getAttribute?.('href') || element?.href || element?.getAttribute?.('data-href') || '');
-        return privilegedActionPattern.test(signature)
-            || /(?:^|[\/#?&_.-])(?:appcenter|app-center|simulation|simulator|license|lizenz)(?:$|[\/#?&=_.-])/.test(href);
+        if (/^(?:ems apps?(?: offnen| öffnen)?|app center|app-center|appcenter)$/.test(signature)
+            || /(?:^|[\/#?&_.-])(?:appcenter|app-center)(?:$|[\/#?&=_.-])/.test(href)) return 'ems';
+        if (/^(?:simulation|simulator)$/.test(signature)
+            || /(?:^|[\/#?&_.-])(?:simulation|simulator)(?:$|[\/#?&=_.-])/.test(href)) return 'simulation';
+        if (/^(?:lizenz|license)$/.test(signature)
+            || /(?:^|[\/#?&_.-])(?:license|lizenz)(?:$|[\/#?&=_.-])/.test(href)) return 'license';
+        return '';
+    };
+    const isPrivilegedAction = element => !!privilegedActionKind(element);
+    const canUsePrivilegedAction = element => {
+        const action = privilegedActionKind(element);
+        if (!action) return true;
+        if (action === 'ems') {
+            return state.role === 'admin'
+                || (state.role === 'installer' && state.policy?.capabilities?.emsAppCenter !== false);
+        }
+        return state.role === 'admin';
     };
     const setPrivilegedActionHidden = (element, hidden) => {
         if (!element) return;
@@ -455,19 +521,18 @@
     };
     const applyPrivilegedActionsInDocument = doc => safe(() => {
         if (!doc?.documentElement) return;
-        const admin = state.role === 'admin';
         doc.querySelectorAll('[data-eos-privileged-action-hidden="1"]').forEach(element => {
-            if (admin || !isPrivilegedAction(element)) setPrivilegedActionHidden(element, false);
+            if (!isPrivilegedAction(element) || canUsePrivilegedAction(element)) setPrivilegedActionHidden(element, false);
         });
         for (const element of doc.querySelectorAll('a,button,[role="button"],[role="tab"],.MuiButtonBase-root')) {
-            if (isPrivilegedAction(element)) setPrivilegedActionHidden(element, !admin);
+            if (isPrivilegedAction(element)) setPrivilegedActionHidden(element, !canUsePrivilegedAction(element));
         }
         if (!doc.documentElement.dataset.eosPrivilegedClickGuard) {
             doc.documentElement.dataset.eosPrivilegedClickGuard = '1';
             doc.addEventListener('click', event => {
-                if (state.role === 'admin' || state.role === 'unknown') return;
+                if (state.role === 'unknown') return;
                 const target = event.target?.closest?.('a,button,[role="button"],[role="tab"],.MuiButtonBase-root');
-                if (!target || !isPrivilegedAction(target)) return;
+                if (!target || !isPrivilegedAction(target) || canUsePrivilegedAction(target)) return;
                 event.preventDefault();
                 event.stopImmediatePropagation();
             }, true);
@@ -492,9 +557,9 @@
         });
     });
     const scrubInheritedUiAdminSession = () => safe(() => {
-        if (state.role === 'admin' || state.role === 'unknown') return;
+        if (state.role !== 'enduser') return;
         const user = String(state.policy?.user || state.policy?.userId || '').replace(/^system\.user\./, '') || state.role;
-        const key = `eosUiAdminSessionScrubbed:v7105:${user}:${state.role}`;
+        const key = `eosUiAdminSessionScrubbed:v7107:${user}:${state.role}`;
         if (sessionStorage.getItem(key) === '1') return;
         sessionStorage.setItem(key, '1');
         const frame = document.createElement('iframe');
@@ -511,11 +576,38 @@
         if (!paper) return;
         const readonly = state.role === 'enduser' && currentRoute() === 'tab-objects';
         paper.toggleAttribute('data-eos-datapoints-readonly', readonly);
+        const clearControl = control => {
+            if (!control) return;
+            control.removeAttribute('aria-disabled');
+            control.removeAttribute('data-eos-enduser-write-blocked');
+            control.removeAttribute('data-eos-enduser-action-hidden');
+            control.classList.remove('eos-role-hidden');
+            control.removeAttribute('aria-hidden');
+            if ('disabled' in control) control.disabled = false;
+        };
+        paper.querySelectorAll('[data-eos-enduser-write-blocked="1"],[data-eos-enduser-action-hidden="1"]').forEach(clearControl);
         if (!readonly) return;
-        paper.querySelectorAll('[data-eos-object-writable="1"],button[title*="edit" i],button[title*="delete" i],button[aria-label*="edit" i],button[aria-label*="delete" i]').forEach(control => {
+        const blockControl = control => {
+            if (!control) return;
             control.setAttribute('aria-disabled', 'true');
             control.setAttribute('data-eos-enduser-write-blocked', '1');
-        });
+        };
+        const hideControl = control => {
+            if (!control) return;
+            control.setAttribute('aria-disabled', 'true');
+            control.setAttribute('data-eos-enduser-action-hidden', '1');
+            control.classList.add('eos-role-hidden');
+            control.setAttribute('aria-hidden', 'true');
+            if ('disabled' in control) control.disabled = true;
+        };
+        paper.querySelectorAll('[data-eos-object-writable="1"]').forEach(blockControl);
+        paper.querySelectorAll([
+            'button[title*="edit" i]','button[title*="delete" i]','button[title*="remove" i]','button[title*="setting" i]','button[title*="einstell" i]',
+            'button[aria-label*="edit" i]','button[aria-label*="delete" i]','button[aria-label*="remove" i]','button[aria-label*="setting" i]','button[aria-label*="einstell" i]',
+            '[role="button"][title*="edit" i]','[role="button"][title*="delete" i]','[role="button"][title*="setting" i]',
+            '[role="button"][aria-label*="edit" i]','[role="button"][aria-label*="delete" i]','[role="button"][aria-label*="setting" i]'
+        ].join(',')).forEach(hideControl);
+        paper.querySelectorAll('svg[data-testid*="Edit"],svg[data-testid*="Delete"],svg[data-testid*="Settings"],svg[data-testid*="Tune"],svg[data-testid*="Build"]').forEach(icon => hideControl(icon.closest('button,[role="button"]')));
     });
     const clearLegacyHeuristicRestrictionsForAdmin = () => safe(() => {
         if (state.role !== 'admin') return;
@@ -524,9 +616,10 @@
             element.removeAttribute('aria-hidden');
             element.style.removeProperty('display');
         });
-        document.querySelectorAll('[data-eos-readonly],[data-eos-enduser-write-blocked]').forEach(element => {
+        document.querySelectorAll('[data-eos-readonly],[data-eos-enduser-write-blocked],[data-eos-enduser-action-hidden]').forEach(element => {
             element.removeAttribute('data-eos-readonly');
             element.removeAttribute('data-eos-enduser-write-blocked');
+            element.removeAttribute('data-eos-enduser-action-hidden');
             element.removeAttribute('aria-disabled');
             element.style.removeProperty('pointer-events');
             element.style.removeProperty('opacity');
@@ -544,6 +637,7 @@
         clearLegacyHeuristicRestrictionsForAdmin();
         redirectIfNeeded();
         ensureSafeOverview();
+        applyReadonlySystemInfoCard();
         filterNativeUsersPage();
         hideOfficialReserveSurfaces();
         applyEndUserDatapointPolicy();

package/adminWww/js/nexowatt-native-shell.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7105-nexowatt-native-shell-native-overview';
+    const VERSION = 'v7107-nexowatt-native-shell-native-overview';
     const previous = window.NEXOWATT_NATIVE_SHELL;
     if (previous?.version === VERSION) return;
     previous?.destroy?.();

package/adminWww/static/js/{nexowatt-stable-v7105.js → nexowatt-stable-v7107.js}

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v7105-scroll-standard-password';
+    const VERSION = 'v7107-scroll-standard-password';
     const ensureScroll = () => {
         const root = document.documentElement;
         const paper = document.getElementById('app-paper');
@@ -23,5 +23,5 @@
     const schedule=()=>{if(scheduled)return;scheduled=true;requestAnimationFrame(()=>{scheduled=false;apply();});};
     const start=()=>{apply();new MutationObserver(schedule).observe(document.documentElement,{subtree:true,childList:true});window.addEventListener('hashchange',schedule);window.addEventListener('resize',schedule,{passive:true});};
     document.readyState==='loading'?document.addEventListener('DOMContentLoaded',start,{once:true}):start();
-    window.NEXOWATT_EOS_STABLE_V7101=Object.freeze({version:VERSION,refresh:apply,ensureScroll});
+    window.NEXOWATT_EOS_STABLE_V7107=Object.freeze({version:VERSION,refresh:apply,ensureScroll});
 })();

package/build/lib/web.js

@@ -8,6 +8,7 @@ const node_util_1 = require("node:util");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_stream_1 = require("node:stream");
+const node_child_process_1 = require("node:child_process");
 const compression = require("compression");
 const mime_1 = require("mime");
 const node_zlib_1 = require("node:zlib");
@@ -649,6 +650,9 @@ class Web {
             objectDiagnostics: technical,
             logDiagnostics: technical,
             basicSystemSettings: technical,
+            emsAppCenter: technical,
+            simulation: role === 'admin',
+            licenseAdministration: role === 'admin',
             fullSystemSettings: role === 'admin',
             expertMode: role === 'admin',
             userManagement: role === 'admin',
@@ -1371,6 +1375,35 @@ class Web {
         this.adapter.log.info(`EOS installer basic settings updated by ${access.userId || 'unknown user'}`);
         await this.sendEosBasicSettings(req, res);
     }
+
+    getEosReadonlySystemInfo() {
+        let npm = '--';
+        try {
+            const binary = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+            npm = (0, node_child_process_1.execFileSync)(binary, ['-v'], { encoding: 'utf8', timeout: 1500 }).trim() || '--';
+        }
+        catch {
+            // ignore
+        }
+        return {
+            platform: process.platform || '--',
+            ramMb: Math.round((0, node_os_1.totalmem)() / 1024 / 1024),
+            nodejs: process.version || '--',
+            npm,
+            active: true,
+        };
+    }
+    async sendEosReadonlySystemInfo(req, res) {
+        const access = await this.getEosRequestAccess(req);
+        const authenticated = !this.settings.auth || !!access.userId;
+        if (!authenticated) {
+            res.status(401).json({ error: 'authenticationRequired' });
+            return;
+        }
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.status(200).json(this.getEosReadonlySystemInfo());
+    }
     async sendEosSecuritySession(req, res) {
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
@@ -1806,6 +1839,10 @@ class Web {
             this.server.app.get('/eos/security/status', sendSecuritySession);
             this.server.app.get('/nexowatt/security/session', sendSecuritySession);
             this.server.app.get('/nexowatt/security/context', sendSecuritySession);
+            this.server.app.get('/nexowatt/readonly/system-info', (req, res) => { void this.sendEosReadonlySystemInfo(req, res).catch(e => {
+                this.adapter.log.warn(`Cannot read EOS readonly system info: ${e instanceof Error ? e.message : e}`);
+                res.status(500).json({ error: 'readonlySystemInfoFailed' });
+            }); });
             this.server.app.get('/nexowatt/role-settings/basic', (req, res) => {
                 void this.sendEosBasicSettings(req, res).catch(e => {
                     this.adapter.log.warn(`Cannot read EOS basic settings: ${e instanceof Error ? e.message : e}`);

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.10.5",
+    "version": "7.10.7",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,6 +18,16 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
+      "7.10.7": {
+        "de": "Stable 7.10.7 gibt dem Installateur den Zugriff auf „EMS Apps öffnen“ und das EMS App-Center frei. Simulation und Lizenzverwaltung bleiben ausschließlich dem Administrator vorbehalten. Endkundenbereich, Nur-Lese-Datenpunkte und Adminrechte bleiben unverändert.",
+        "en": "Stable 7.10.7 grants the Installer access to “Open EMS Apps” and the EMS App-Center. Simulation and license administration remain Administrator-only. End User read-only datapoints and all Administrator rights remain unchanged.",
+        "nl": "Stable 7.10.7 geeft de installateur toegang tot “EMS Apps openen” en het EMS App-Center. Simulatie en licentiebeheer blijven uitsluitend voor beheerders. Alleen-lezen datapunten voor eindgebruikers en alle beheerdersrechten blijven ongewijzigd."
+      },
+      "7.10.6": {
+        "de": "Stable 7.10.6 bereinigt ausschließlich den Endkundenbereich: Datenpunkte bleiben sichtbar und nur lesbar, Bearbeiten-/Löschen-/Einstellungsaktionen werden ausgeblendet, und die Systeminfokarte erhält Plattform, RAM, Node.js und NPM über einen authentifizierten Nur-Lese-Endpunkt. Die Administratoroberfläche und sämtliche Adminrechte bleiben unverändert.",
+        "en": "Stable 7.10.6 cleans up the End User area only: datapoints stay visible and read-only, edit/delete/settings actions are hidden, and the system information card receives platform, RAM, Node.js and NPM through an authenticated read-only endpoint. The administrator UI and all Admin rights remain unchanged.",
+        "nl": "Stable 7.10.6 ruimt uitsluitend het eindgebruikersgedeelte op: datapunten blijven zichtbaar en alleen-lezen, bewerk-/verwijder-/instellingsacties worden verborgen en de systeeminformatiekaart ontvangt platform, RAM, Node.js en NPM via een geauthenticeerd alleen-lezen eindpunt. De beheerdersinterface en alle beheerdersrechten blijven ongewijzigd."
+      },
       "7.10.5": {
         "de": "Stable 7.10.5 stellt die vollständigen Administratorrechte wieder her und trennt die Rollen verbindlich über den authentifizierten Backend-Kontext. Admin darf Datenpunkte schreiben, den Expertenmodus in beide Richtungen schalten und sieht Admin-/XTerm-Kacheln. Endkunden sehen Datenpunkte ausschließlich lesend; App-Center, Lizenz, Simulation, Benutzerverwaltung, ioBroker Admin, XTerm und Expertenmodus bleiben für Installateur und Endkunde gesperrt. Navigationsänderungen werden neustartsicher im Adapter-State gespeichert; Sicherung erscheint nur bei aktiver Backup-Instanz.",
         "en": "Stable 7.10.5 restores full administrator authority and binds roles exclusively to the authenticated backend context. Admin can write datapoints, toggle expert mode in both directions and sees the Admin/XTerm cards. End users can view datapoints read-only; App Center, License, Simulation, account management, ioBroker Admin, XTerm and expert mode remain blocked for Installer and End User. Navigation changes are stored restart-safely in an adapter state, and Backup is shown only for an enabled backup instance.",
@@ -354,7 +364,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.5/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.7/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -365,7 +375,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.5/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.7/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -433,7 +443,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.5/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.7/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1210,5 +1220,5 @@
       }
     }
   },
-  "version": "7.10.5"
+  "version": "7.10.7"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
   "description": "NexoWatt EOS Admin – repaired stable baseline with restart-safe automatic updates, native account passwords and persistent cockpit scrolling.",
-  "version": "7.10.5",
+  "version": "7.10.7",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -133,15 +133,17 @@
     "NEXOWATT_EOS_PREBUILT_MANIFEST.json",
     "tools/nexowatt-prebuilt-release-selftest.cjs",
     "tools/nexowatt-stable-v7103-selftest.cjs",
-    "README_STABILITY_V7.10.5.md",
-    "RELEASE_NOTES_V7.10.5.md",
-    "PUBLISH_STABLE_V7.10.5.md",
-    "INSTALL_TEST_V7.10.5.md",
-    "RELEASE_ACCEPTANCE_V7.10.5.md",
-    "MERGE_UPDATE_README_V7.10.5.md",
+    "README_STABILITY_V7.10.7.md",
+    "RELEASE_NOTES_V7.10.7.md",
+    "PUBLISH_STABLE_V7.10.7.md",
+    "INSTALL_TEST_V7.10.7.md",
+    "RELEASE_ACCEPTANCE_V7.10.7.md",
+    "MERGE_UPDATE_README_V7.10.7.md",
     "tools/nexowatt-auto-update-placement-selftest.cjs",
     "tools/nexowatt-role-security-selftest.cjs",
-    "SECURITY_ROLE_MATRIX_V7.10.5.md"
+    "SECURITY_ROLE_MATRIX_V7.10.7.md",
+    "tools/nexowatt-user-area-selftest.cjs",
+    "tools/nexowatt-installer-ems-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -176,7 +178,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs && node tools/nexowatt-role-security-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs && node tools/nexowatt-role-security-selftest.cjs && node tools/nexowatt-user-area-selftest.cjs && node tools/nexowatt-installer-ems-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -205,7 +207,8 @@
     "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write",
     "check:eos-stable-v7103": "node tools/nexowatt-stable-v7103-selftest.cjs",
     "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs",
-    "check:eos-role-security": "node tools/nexowatt-role-security-selftest.cjs"
+    "check:eos-role-security": "node tools/nexowatt-role-security-selftest.cjs",
+    "test:eos-installer-ems": "node tools/nexowatt-installer-ems-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -216,7 +219,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS admin-rights and RBAC correction 7.10.5"
+    "purpose": "accepted stable NexoWatt EOS Installer EMS App-Center access correction 7.10.7"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-installer-ems-selftest.cjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const root = path.resolve(__dirname, '..');
+const read = file => fs.readFileSync(path.join(root, file), 'utf8');
+const json = file => JSON.parse(read(file));
+
+const pkg = json('package.json');
+const sourceRole = read('src-admin/public/js/eos-role-ui.js');
+const runtimeRole = read('adminWww/js/eos-role-ui.js');
+const sourceWeb = read('src/lib/web.ts');
+const runtimeWeb = read('build/lib/web.js');
+
+assert.equal(pkg.version, '7.10.7', 'Installer EMS release must use npm version 7.10.7');
+assert.equal(runtimeRole, sourceRole, 'built and source role runtimes must be identical');
+
+for (const code of [sourceRole, runtimeRole]) {
+    assert.match(code, /const privilegedActionKind = element =>/, 'privileged action classifier missing');
+    assert.match(code, /return 'ems';/, 'EMS action classification missing');
+    assert.match(code, /return 'simulation';/, 'Simulation action classification missing');
+    assert.match(code, /return 'license';/, 'License action classification missing');
+    assert.match(code, /action === 'ems'/, 'EMS-specific access branch missing');
+    assert.match(
+        code,
+        /state\.role === 'installer' && state\.policy\?\.capabilities\?\.emsAppCenter !== false/,
+        'Installer is not allowed to open EMS App-Center',
+    );
+    assert.match(code, /return state\.role === 'admin';/, 'Simulation and License must remain Admin-only');
+    assert.match(code, /!canUsePrivilegedAction\(element\)/, 'UI visibility does not use the role-aware action permission');
+    assert.match(code, /\|\| canUsePrivilegedAction\(target\)\) return;/, 'click guard does not use the role-aware action permission');
+    assert.match(code, /if \(state\.role !== 'enduser'\) return;/, 'port 8188 session scrubbing must apply only to End User');
+}
+
+for (const code of [sourceWeb, runtimeWeb]) {
+    assert.match(code, /emsAppCenter: technical/, 'backend capability must grant EMS App-Center to Admin and Installer');
+    assert.match(code, /simulation: role === 'admin'/, 'Simulation capability must remain Admin-only');
+    assert.match(code, /licenseAdministration: role === 'admin'/, 'License capability must remain Admin-only');
+}
+
+console.log('[NexoWatt EOS installer EMS] OK (Installer may use EMS App-Center; Simulation/License remain Admin-only; End User remains blocked)');

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.10.5.md',
+    'MERGE_UPDATE_README_V7.10.7.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',

package/tools/nexowatt-role-security-selftest.cjs

@@ -16,6 +16,8 @@ const roleUi = read('adminWww/js/eos-role-ui.js');
 const sourceRoleUi = read('src-admin/public/js/eos-role-ui.js');
 const sourceMain = read('src/main.ts');
 const builtMain = read('build/main.js');
+const webSource = read('src/lib/web.ts');
+const webBuilt = read('build/lib/web.js');
 const appSource = read('src-admin/src/App.tsx');
 const objectsSource = read('src-admin/src/tabs/Objects.tsx');
 const introSource = read('src-admin/src/tabs/Intro.tsx');
@@ -30,9 +32,9 @@ const cleanupSource = read('tools/nexowatt-clean-legacy-runtime.cjs');
 // visible header happened to contain "user". Only authenticated backend policy may define the role.
 for (const html of [index, sourceIndex]) {
     assert.doesNotMatch(html, /nexowatt-role-security\.js/i, 'legacy heuristic role guard is still loaded');
-    assert.match(html, /eos-role-bootstrap\.js\?v=7105/, 'authoritative role bootstrap cache tag is missing');
-    assert.match(html, /eos-policy-client\.js\?v=7105/, 'authoritative policy client cache tag is missing');
-    assert.match(html, /eos-role-ui\.js\?v=7105/, 'authoritative role UI cache tag is missing');
+    assert.match(html, /eos-role-bootstrap\.js\?v=7107/, 'authoritative role bootstrap cache tag is missing');
+    assert.match(html, /eos-policy-client\.js\?v=7107/, 'authoritative policy client cache tag is missing');
+    assert.match(html, /eos-role-ui\.js\?v=7107/, 'authoritative role UI cache tag is missing');
 }
 assert.equal(fs.existsSync(path.join(root, 'adminWww/nexowatt-role-security.js')), false, 'legacy runtime still exists');
 assert.equal(fs.existsSync(path.join(root, 'build/lib/eosRoleSecurity.js')), false, 'legacy backend heuristic still exists');
@@ -98,10 +100,23 @@ assert.match(introBundle, /_forceAdmin=_eosAdmin/);
 assert.doesNotMatch(introSource, /NEXOWATT_EOS_ACCESS_ROLE \|\| 'admin'/, 'Intro source must fail closed while role is unresolved');
 assert.doesNotMatch(introBundle, /NEXOWATT_EOS_ACCESS_ROLE\|\|"admin"/, 'Intro runtime must fail closed while role is unresolved');
 
-// App Center, License, Simulation and normal account administration are not available to Installer/End User.
+// Installer receives EMS App-Center access only. Simulation and License remain Admin-only;
+// End User remains blocked from all three actions and from inherited port-8188 sessions.
 for (const token of ['app center', 'app-center', 'appcenter', 'simulation', 'simulator', 'lizenz', 'license']) {
     assert.ok(roleUi.toLowerCase().includes(token), `role UI is missing protected action ${token}`);
 }
+for (const code of [roleUi, sourceRoleUi]) {
+    assert.match(code, /const privilegedActionKind = element =>/, 'privileged actions are not separated by capability');
+    assert.match(code, /if \(action === 'ems'\)/, 'EMS action branch is missing');
+    assert.match(code, /state\.role === 'installer' && state\.policy\?\.capabilities\?\.emsAppCenter !== false/, 'Installer EMS App-Center allowance is missing');
+    assert.match(code, /return state\.role === 'admin';/, 'Simulation and License must remain Admin-only');
+    assert.match(code, /if \(state\.role !== 'enduser'\) return;/, 'port 8188 session scrubbing must be End User-only');
+}
+for (const code of [webSource, webBuilt]) {
+    assert.match(code, /emsAppCenter: technical/, 'backend role capabilities do not grant Installer EMS access');
+    assert.match(code, /simulation: role === 'admin'/, 'Simulation capability must remain Admin-only');
+    assert.match(code, /licenseAdministration: role === 'admin'/, 'License capability must remain Admin-only');
+}
 assert.match(roleUi, /applyPrivilegedIframePolicy/);
 assert.match(roleUi, /:8188\/logout\?/);
 assert.match(roleUi, /route !== 'tab-users'/);
@@ -128,4 +143,20 @@ assert.ok((io.instanceObjects || []).some(object => object?._id === 'info.uiTabs
 assert.match(drawerSource, /backupAdapters\.has\(adapterName\) && instance\.enabled !== true/);
 assert.match(builtDrawer, /o\.has\(A\)&&d\.enabled!==!0/);
 
-console.log('[NexoWatt EOS role security] OK (authoritative Admin rights, End User read-only datapoints, protected tools, restart-safe menu storage)');
+// 7.10.7 End User cleanup: system information is read-only and object actions disappear only for End User.
+for (const code of [webSource, webBuilt]) {
+    assert.match(code, /nexowatt\/readonly\/system-info/, 'authenticated read-only system-info route is missing');
+    assert.match(code, /authenticationRequired/, 'read-only system-info route must require an authenticated session');
+    assert.match(code, /ramMb/, 'read-only system-info payload is incomplete');
+}
+for (const code of [roleUi, sourceRoleUi]) {
+    assert.match(code, /state\.role !== 'enduser' \|\| currentRoute\(\) !== 'tab-intro'/, 'system-info hydration is not End User-only');
+    assert.match(code, /data-eos-enduser-action-hidden/, 'End User object action hiding marker is missing');
+    assert.match(code, /svg\[data-testid\*="Edit"\]/, 'Edit icon fallback selector is missing');
+    assert.match(code, /svg\[data-testid\*="Settings"\]/, 'Settings icon fallback selector is missing');
+    assert.match(code, /svg\[data-testid\*="Delete"\]/, 'Delete icon fallback selector is missing');
+    assert.match(code, /state\.role !== 'admin'/, 'Admin restriction guard is missing');
+}
+assert.match(sourceMain, /role === 'enduser' && \['readLogs', 'sendToHost'\]\.includes\(command\)/, 'End User technical diagnostics must remain denied');
+
+console.log('[NexoWatt EOS role security] OK (Admin full rights, Installer EMS App-Center access, End User read-only datapoints, protected Admin tools)');

package/tools/nexowatt-stable-v7103-selftest.cjs

@@ -31,7 +31,7 @@ const autoUi = read('adminWww/js/eos-auto-update.js');
 const autoCss = read('adminWww/css/eos-auto-update.css');
 const autoTag = String(info.autoUpdateCacheTag || info.autoUpdateCacheVersion || info.shellCacheTag || info.shellCacheVersion);
 
-must(pkg.version === '7.10.5' && io.version === '7.10.5' && io.common.version === '7.10.5' && info.version === '7.10.5', 'version drift');
+must(pkg.version === '7.10.7' && io.version === '7.10.7' && io.common.version === '7.10.7' && info.version === '7.10.7', 'version drift');
 must(io.native.eosRequireFirstLoginPassword === false && io.native.eosRequireFirstLoginPasswordChange === false, 'forced first password still enabled');
 must(!index.includes('eos-account-management.js'), 'custom reset UI still loaded');
 must(!boot.includes('installIntegratedFirstLogin(base);') && !boot.includes('showFirstLoginPassword(resolved, base);'), 'forced first-login UI still active');
@@ -49,7 +49,7 @@ must(!autoBackend.includes('extendForeignObjectAsync(this.instanceId'), 'runtime
 must(web.includes('this.nexowattStableUpdateManager?.stop();'), 'auto-update manager is not stopped with the web server');
 must(fs.existsSync(path.join(root, 'build/lib/eosRequestSecurity.js')), 'eosRequestSecurity runtime module missing');
 
-// 7.10.4 placement acceptance remains mandatory in 7.10.5: System Settings only.
+// 7.10.4 placement acceptance remains mandatory in 7.10.7: System Settings only.
 must(index.includes(`eos-auto-update.js?v=${autoTag}`), 'auto-update JavaScript cache key missing');
 must(index.includes(`eos-auto-update.css?v=${autoTag}`), 'auto-update CSS cache key missing');
 must(autoUi.includes('[role="dialog"][aria-labelledby="system-settings-dialog-title"]'), 'System Settings selector missing');

package/tools/nexowatt-user-area-selftest.cjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const root = path.resolve(__dirname, '..');
+const read = file => fs.readFileSync(path.join(root, file), 'utf8');
+const pkg = JSON.parse(read('package.json'));
+const sourceWeb = read('src/lib/web.ts');
+const builtWeb = read('build/lib/web.js');
+const sourceRole = read('src-admin/public/js/eos-role-ui.js');
+const runtimeRole = read('adminWww/js/eos-role-ui.js');
+const sourceMain = read('src/main.ts');
+const builtMain = read('build/main.js');
+
+assert.equal(pkg.version, '7.10.7', 'release must use a new npm version');
+for (const web of [sourceWeb, builtWeb]) {
+    assert.match(web, /nexowatt\/readonly\/system-info/, 'read-only system information endpoint missing');
+    assert.match(web, /sendEosReadonlySystemInfo/, 'read-only system information handler missing');
+    assert.match(web, /platform/, 'platform value missing');
+    assert.match(web, /ramMb/, 'RAM value missing');
+    assert.match(web, /nodejs/, 'Node.js value missing');
+    assert.match(web, /npm/, 'NPM value missing');
+}
+for (const role of [sourceRole, runtimeRole]) {
+    assert.match(role, /state\.role !== 'enduser' \|\| currentRoute\(\) !== 'tab-intro'/, 'system-card correction must be End User-only');
+    assert.match(role, /applyReadonlySystemInfoCard/, 'End User system-card correction missing');
+    assert.match(role, /data-eos-enduser-action-hidden/, 'End User action-column suppression missing');
+    assert.match(role, /Edit.*Delete.*Settings.*Tune.*Build/s, 'edit/delete/settings icon suppression missing');
+    assert.match(role, /const readonly = state\.role === 'enduser' && currentRoute\(\) === 'tab-objects'/, 'datapoint restriction must be End User-only');
+}
+for (const main of [sourceMain, builtMain]) {
+    assert.match(main, /if \(role === 'admin'\)/, 'Admin full-rights bypass missing');
+    assert.match(main, /end-user datapoints are read-only in EOS Admin/, 'backend End User write denial missing');
+}
+console.log('[NexoWatt EOS user area] OK (End User read-only actions and system info; Admin unchanged)');

package/tools/nexowatt-validate-package.cjs

@@ -45,6 +45,8 @@ if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-version-sync-selftes
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-merge-update-selftest.cjs')) fail('merge update selftest is not part of check:eos-stability');
 if (pkg.scripts['check:eos-stable-v7103'] !== 'node tools/nexowatt-stable-v7103-selftest.cjs') fail('stable v7103 selftest script is missing or incorrect');
 if (pkg.scripts['test:eos-auto-update-placement'] !== 'node tools/nexowatt-auto-update-placement-selftest.cjs') fail('auto-update placement selftest script is missing or incorrect');
+if (pkg.scripts['test:eos-installer-ems'] !== 'node tools/nexowatt-installer-ems-selftest.cjs') fail('Installer EMS selftest script is missing or incorrect');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-installer-ems-selftest.cjs')) fail('Installer EMS selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-auto-update-placement-selftest.cjs')) fail('auto-update placement selftest is not part of check:eos-stability');
 if (pkg.scripts.prepublishOnly !== canonicalPrepublishOnly) fail('prepublishOnly must use the dependency-free direct-publish workflow');
 if (/\b(?:tsc|tsx)\b|build:(?:backend|frontend)|\bnpx\b|npm\s+(?:i|install|ci)\b/i.test(pkg.scripts.prepublishOnly || '')) fail('prepublishOnly must not require local development dependencies');
@@ -134,14 +136,14 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.10.5.md',
-  'RELEASE_NOTES_V7.10.5.md',
-  'PUBLISH_STABLE_V7.10.5.md',
-  'INSTALL_TEST_V7.10.5.md',
-  'RELEASE_ACCEPTANCE_V7.10.5.md',
+  'README_STABILITY_V7.10.7.md',
+  'RELEASE_NOTES_V7.10.7.md',
+  'PUBLISH_STABLE_V7.10.7.md',
+  'INSTALL_TEST_V7.10.7.md',
+  'RELEASE_ACCEPTANCE_V7.10.7.md',
   'MERGE_UPDATE.ps1',
   'MERGE_UPDATE.cmd',
-  'MERGE_UPDATE_README_V7.10.5.md',
+  'MERGE_UPDATE_README_V7.10.7.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -174,7 +176,7 @@ for (const file of [
   'tools/nexowatt-ui-overview-runtime-selftest.cjs',
   'adminWww/js/eos-ems-overview.js',
   'adminWww/css/eos-ems-overview.css',
-  'adminWww/static/js/nexowatt-stable-v7105.js',
+  'adminWww/static/js/nexowatt-stable-v7107.js',
   'src-admin/src/components/Intro/NexoWattEmsOverview.tsx',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',

package/INSTALL_TEST_V7.10.5.md

@@ -1,8 +0,0 @@
-# Installation test 7.10.5
-
-- Install/update EOS Admin 7.10.5 and verify port 8081 remains reachable.
-- Sign in as Admin: datapoints are writable; expert mode can be enabled and disabled; Admin and XTerm overview cards are visible.
-- Sign in as Installer: no expert head, ioBroker Admin, XTerm, App Center, License, Simulation or Users/Rights page.
-- Sign in as End User: Datapoints tab is visible but every write/edit/delete action is disabled; restricted tools are absent.
-- Toggle a navigation item with the pencil: EOS Admin must not restart and `system.config` must remain untouched.
-- Disable the backup adapter: its navigation item disappears; re-enable it and the item returns.

package/MERGE_UPDATE_README_V7.10.5.md

@@ -1,7 +0,0 @@
-# Merge/update note 7.10.5
-
-Always replace the previous repository with the complete 7.10.5 repository. Do not merge old `adminWww` bundles or deleted role-security files back into this release. In particular, `nexowatt-role-security.js` and `build/lib/eosRoleSecurity.js` are obsolete and must stay absent.
-
-After a merge, run the package, stability, role-security and publish dry-run checks before publishing.
-
-The 7.10.5 publish workflow now removes all three obsolete 7.10.4 role-security files automatically before sealing and packaging, including when the ZIP was extracted over an existing working directory.

package/PUBLISH_STABLE_V7.10.5.md

@@ -1,8 +0,0 @@
-# NPM publication 7.10.5
-
-1. Use a freshly extracted repository ZIP.
-2. Run `npm publish --dry-run`.
-3. Confirm version `7.10.5`, complete `build/` runtime and all active `adminWww/assets/*-v84.js` files.
-4. Publish with `npm publish` only after the dry run succeeds.
-
-No `npm install`, `npm ci`, `tsc` or `tsx` is required for the sealed prebuilt release.

package/README_STABILITY_V7.10.5.md

@@ -1,5 +0,0 @@
-# NexoWatt EOS Admin 7.10.5 – stability and RBAC baseline
-
-This release retains the validated 7.10.2–7.10.4 crash, package and update-placement fixes. Role decisions now come exclusively from the authenticated `/nexowatt/security/context` response. The removed heuristic must never be restored.
-
-Administrator is an unconditional full-rights path. End User datapoints are read-only in both frontend and backend. Menu edits are persisted in an adapter state and must never write `system.config`.

package/RELEASE_ACCEPTANCE_V7.10.5.md

@@ -1,11 +0,0 @@
-# Release Acceptance 7.10.5
-
-- [ ] Admin can write every normally writable datapoint.
-- [ ] Admin can enable and disable expert mode repeatedly.
-- [ ] Admin sees ioBroker Admin and XTerm overview cards.
-- [ ] Installer and End User never see expert mode, ioBroker Admin or XTerm.
-- [ ] App Center, License, Simulation and account administration are unavailable to Installer/End User.
-- [ ] End User sees Datapoints but cannot write, edit, create or delete.
-- [ ] Pencil navigation edits do not restart EOS Admin.
-- [ ] Backup navigation follows the enabled state of the backup instance.
-- [ ] `npm publish --dry-run` succeeds from a fresh extraction.

package/RELEASE_NOTES_V7.10.5.md

@@ -1,11 +0,0 @@
-# Release Notes 7.10.5
-
-Version 7.10.5 is the administrator-rights and RBAC correction for NexoWatt EOS Admin.
-
-- Restores unrestricted administrator datapoint writes and reversible expert mode.
-- Removes the legacy DOM-text role classifier that could misclassify `system.user.admin`.
-- Keeps ioBroker Admin and XTerm visible for administrators only.
-- Exposes Datapoints to End Users as read-only and denies End User state writes in the backend.
-- Blocks App Center, License, Simulation and normal account administration for Installer/End User.
-- Stores navigation visibility/order in `eos-admin.0.info.uiTabsVisible` instead of `system.config`, avoiding adapter restarts.
-- Shows backup navigation only for enabled backup instances.