iobroker.eos-admin 7.10.6 → 7.10.7

package/INSTALL_TEST_V7.10.7.md

@@ -0,0 +1,9 @@
+# Installation test 7.10.7
+
+- Install/update EOS Admin 7.10.7 and verify port 8081 remains reachable.
+- Sign in as Admin: all previous functions, datapoint writes, expert mode, Admin and XTerm remain available.
+- Sign in as Installer: **EMS Apps öffnen** is visible and opens the EMS App-Center.
+- Installer: Simulation and License remain hidden/blocked; expert head, ioBroker Admin, XTerm and Users/Rights remain unavailable.
+- Sign in as End User: EMS App-Center, Simulation and License remain hidden/blocked; datapoints remain read-only.
+- Confirm an End User cannot inherit an existing UI/Admin session on port 8188.
+- Confirm navigation editing and backup visibility behavior remain restart-safe.

package/MERGE_UPDATE_README_V7.10.7.md

@@ -0,0 +1,7 @@
+# Merge/update note 7.10.7
+
+Always replace the previous repository with the complete 7.10.7 repository. Do not merge old `adminWww` role runtime files back into this release.
+
+The authoritative role policy in 7.10.7 allows the Installer to use the EMS App-Center, while Simulation and License remain Admin-only and the End User remains blocked.
+
+After a merge, run package validation, stability checks, role-security checks and `npm publish --dry-run` before publishing.

package/NEXOWATT_EOS_BUILD_INFO.json

@@ -1,29 +1,28 @@
 {
-  "version": "7.10.6",
+  "version": "7.10.7",
   "channel": "stable-latest",
-  "baseFrontend": "validated v84 runtime with authoritative RBAC and End User read-only UI correction",
+  "baseFrontend": "validated v84 runtime with authoritative RBAC, End User read-only UI and Installer EMS App-Center access",
   "runtimeEntry": "v84",
-  "releaseType": "stable-enduser-readonly-system-info",
-  "release": "stable-enduser-readonly-system-info",
-  "label": "v7-10-6",
+  "releaseType": "stable-installer-ems-appcenter",
+  "release": "stable-installer-ems-appcenter",
+  "label": "v7-10-7",
   "notes": [
     "Administrator authority and all Admin controls remain unchanged.",
-    "End User datapoints remain visible but all edit, delete and settings actions are hidden.",
-    "End User datapoint writes remain denied by the backend role guard.",
-    "The End User system card receives read-only platform, RAM, Node.js and NPM information from an authenticated endpoint.",
-    "The restricted End User system-card info popup is removed to prevent permissionError dialogs."
+    "Installer may open and use the EMS App-Center.",
+    "Simulation and License remain Administrator-only.",
+    "End User App-Center blocking, read-only datapoints and port 8188 session scrubbing remain active."
   ],
   "changes": [
-    "Added an authenticated read-only system information endpoint for restricted roles.",
-    "Added End User-only action-column suppression in the ObjectBrowser.",
-    "Kept the system.user.admin full-rights bypass untouched.",
-    "Raised the release and browser cache identity to 7.10.6 / 7106."
+    "Split privileged UI actions into EMS, Simulation and License categories.",
+    "Allowed EMS App-Center actions for Admin and Installer only.",
+    "Kept Simulation and License actions Administrator-only.",
+    "Raised the release and browser cache identity to 7.10.7 / 7107."
   ],
-  "brandingCacheVersion": 7106,
-  "shellCacheVersion": 7106,
-  "nativeShellVersion": 7106,
-  "shellCacheTag": "7106",
-  "repositoryEntry": "nexowatt-eos-admin-repository-entry-v7-10-6.json",
+  "brandingCacheVersion": 7107,
+  "shellCacheVersion": 7107,
+  "nativeShellVersion": 7107,
+  "shellCacheTag": "7107",
+  "repositoryEntry": "nexowatt-eos-admin-repository-entry-v7-10-7.json",
   "autoUpdateCacheVersion": 7103,
   "autoUpdateCacheTag": "7103"
 }

package/NEXOWATT_EOS_PREBUILT_MANIFEST.json

@@ -1,9 +1,9 @@
 {
   "format": 1,
   "package": "iobroker.eos-admin",
-  "version": "7.10.6",
+  "version": "7.10.7",
   "algorithm": "sha256",
-  "fileCount": 1390,
+  "fileCount": 1391,
   "trackedRoots": [
     "src",
     "build",
@@ -552,7 +552,7 @@
     "adminWww/img/le.png": "ef5ebb7112926f646e781a326b639f56888fafe0891b9b000178091b4f8ed9dd",
     "adminWww/img/logo.svg": "1167118074ff84d8cef82ad80c38609719dacfde9417126e46966c1ec986534b",
     "adminWww/img/no-image.svg": "25fc382f4ad3a36f8a637cd966b9107368e1f11906d706102ad5f37db6f57f34",
-    "adminWww/index.html": "d0346434c12041cd85b105ef70afb347a2e4913ca116ce46551dd36ad319767a",
+    "adminWww/index.html": "4ab35f356321beb1b578ceb42c0c441569822c05c50a94cf09896b77ece9cfd9",
     "adminWww/js/adapter-settings.js": "fb2e538a3385899f7fd47275ec588051c735d8f778a44b89f40f5eb820a31dbc",
     "adminWww/js/eos-account-management.js": "dbba398605b2391ac1a7ec97cf7eb84da7f929ea16bfb6761750cd700a687fbe",
     "adminWww/js/eos-assistant.js": "be43f49fd5310d2962365035556c37109d4868856e874e1f964c4b2f05bb6beb",
@@ -563,11 +563,11 @@
     "adminWww/js/eos-manual-write-policy.js": "3c93487146b4fd5f681aa45a6bb137d9a91c3fa145ebfa94ec5ccb6b15498e8b",
     "adminWww/js/eos-native-security.js": "33098b98164623fc133314658bca2f622d19971795dd8bd3c90aca68598aab90",
     "adminWww/js/eos-policy-client.js": "5ffd32270307137fbec69a9b9bea57ca1d2e27ede987ce1eb37ff1df6677d8d2",
-    "adminWww/js/eos-role-bootstrap.js": "4cc1da40837606c0176c50c2bb4561bae8e6733b7561e00e9b19ac10111463f2",
-    "adminWww/js/eos-role-ui.js": "d31b2ffbd6367bb8837ef139d44fb4091d644d2d18191ad3b28a17fbbadf7739",
+    "adminWww/js/eos-role-bootstrap.js": "74dbc9246cbfd977d95be5af959686a71e439ac016ab70a9f5c62384792c2833",
+    "adminWww/js/eos-role-ui.js": "b4aa21c0664efd4b7ecd2a439f24547317162b4985abdd17f13df0d8d1c6c82d",
     "adminWww/js/license.js": "13798e577c82d7a5549b07a244b8b8453ef43e53fc7789f565c35b56e6654007",
     "adminWww/js/listHeader.js": "ed336a68a64e16a062d1af2269428fd20a08a4b695f17635f55a18bc1ef693a4",
-    "adminWww/js/nexowatt-native-shell.js": "5ebd9504d08764f48e926790fc1f187a45bf70b9cd8686897a53a1c3721e834f",
+    "adminWww/js/nexowatt-native-shell.js": "9fe37b190543d070f99d838a0833e1428ff430deafab371208aec697eceaddb4",
     "adminWww/js/tableEditor.js": "5508044619fec70071895d0ae3ab6ff75dd03bd936e7b133f98d098d4245ec20",
     "adminWww/js/translate.js": "264442c0f42a10148057125532bf55b7672c4cc051c28e7cbb922984a558f8d3",
     "adminWww/js/treeTable.js": "8abde0b7880a89f6f927a87bb041945dea1502f51bc9870d8ba0be9d3dd9eed8",
@@ -747,7 +747,7 @@
     "adminWww/static/js/html.js": "159b7192459d73d92761dab8c4d48e138e94e4d8e7bf99004bac257e403a0c3b",
     "adminWww/static/js/javascript.js": "6287a6b820c8707a0cd7b9e4545bcb023a8b9228569cfd21be6635d1409aabf4",
     "adminWww/static/js/nexowatt-stable-login.js": "ff0c6d4dc2086f3ab4be8ef455e5891a2ccb5f534bddfacbef2f5cd6ce65489e",
-    "adminWww/static/js/nexowatt-stable-v7106.js": "a4a3e460cac1e028cc6a6a889e0a56c303df98cfa556a427cb5b47e0e3794496",
+    "adminWww/static/js/nexowatt-stable-v7107.js": "3ba5e1587b3e0129afe054fbbdd321b80cbde050ce1b75d0e42889fd2ffede19",
     "adminWww/static/js/worker-css.js": "83c767cacd6b190e2f083b139cb3f124d1b560afbd7a6dbb74bf5539aa4cadee",
     "adminWww/static/js/worker-html.js": "661d2448443c0089fba31d2829d77761a5fc042035c38433eff0e20707f17457",
     "adminWww/static/js/worker-javascript.js": "73fcf007e2d19eacba8f365719ee92d14345505b03f9cf66e6338aef02fccd21",
@@ -793,7 +793,7 @@
     "build/lib/translations.js.map": "c74bcf48d2dd6ec58c48d48a7fb39c59a84fd58c25095bc0cb5bb46c88cfe24f",
     "build/lib/utils.js": "b013a5df06f95ed5bfcb851bb87c0617f61f70e6fe7f1fbf2402fd4d0aadec9b",
     "build/lib/utils.js.map": "74238d0d82cc28d41c4f627b73793f6cda26b338ef1bd97916b6417783949e29",
-    "build/lib/web.js": "172f19ea7ccffada720f03271ff52d00457aaa44cbd7ce4dfe924013535a9ae6",
+    "build/lib/web.js": "f7d0adebfe5b7890f09d3b5eff986cd564724cc7a8497048dc670b43d69b1d90",
     "build/lib/web.js.map": "5fb9f337f3a27c04bb4303cb61ffa5f0da857299a7d2890609eb5f55f24f1789",
     "build/main.js": "7578ee14ea840950ad5164b0063c091c983528ebc32689dec5dc499062fbc92e",
     "build/main.js.map": "1cd3887da9b3d4061c59b6ad497c536c6c9a79938b10bbddf7128a1e7930dfbd",
@@ -850,11 +850,11 @@
     "src-admin/public/js/eos-manual-write-policy.js": "3c93487146b4fd5f681aa45a6bb137d9a91c3fa145ebfa94ec5ccb6b15498e8b",
     "src-admin/public/js/eos-native-security.js": "33098b98164623fc133314658bca2f622d19971795dd8bd3c90aca68598aab90",
     "src-admin/public/js/eos-policy-client.js": "5ffd32270307137fbec69a9b9bea57ca1d2e27ede987ce1eb37ff1df6677d8d2",
-    "src-admin/public/js/eos-role-bootstrap.js": "4cc1da40837606c0176c50c2bb4561bae8e6733b7561e00e9b19ac10111463f2",
-    "src-admin/public/js/eos-role-ui.js": "d31b2ffbd6367bb8837ef139d44fb4091d644d2d18191ad3b28a17fbbadf7739",
+    "src-admin/public/js/eos-role-bootstrap.js": "74dbc9246cbfd977d95be5af959686a71e439ac016ab70a9f5c62384792c2833",
+    "src-admin/public/js/eos-role-ui.js": "b4aa21c0664efd4b7ecd2a439f24547317162b4985abdd17f13df0d8d1c6c82d",
     "src-admin/public/js/license.js": "13798e577c82d7a5549b07a244b8b8453ef43e53fc7789f565c35b56e6654007",
     "src-admin/public/js/listHeader.js": "ed336a68a64e16a062d1af2269428fd20a08a4b695f17635f55a18bc1ef693a4",
-    "src-admin/public/js/nexowatt-native-shell.js": "5ebd9504d08764f48e926790fc1f187a45bf70b9cd8686897a53a1c3721e834f",
+    "src-admin/public/js/nexowatt-native-shell.js": "9fe37b190543d070f99d838a0833e1428ff430deafab371208aec697eceaddb4",
     "src-admin/public/js/tableEditor.js": "5508044619fec70071895d0ae3ab6ff75dd03bd936e7b133f98d098d4245ec20",
     "src-admin/public/js/translate.js": "264442c0f42a10148057125532bf55b7672c4cc051c28e7cbb922984a558f8d3",
     "src-admin/public/js/treeTable.js": "8abde0b7880a89f6f927a87bb041945dea1502f51bc9870d8ba0be9d3dd9eed8",
@@ -975,7 +975,7 @@
     "src-admin/public/manifest.json": "15244d5d50f08420fc5d4793e5699e99c7b900b6908cfbc00a7182f4d4db55bd",
     "src-admin/public/robots.txt": "90d24bc3bf698ac1e173739502298ccca72adf1f564fab05f484b8c48d1cadd2",
     "src-admin/public/static/js/nexowatt-stable-login.js": "ff0c6d4dc2086f3ab4be8ef455e5891a2ccb5f534bddfacbef2f5cd6ce65489e",
-    "src-admin/public/static/js/nexowatt-stable-v7106.js": "a4a3e460cac1e028cc6a6a889e0a56c303df98cfa556a427cb5b47e0e3794496",
+    "src-admin/public/static/js/nexowatt-stable-v7107.js": "3ba5e1587b3e0129afe054fbbdd321b80cbde050ce1b75d0e42889fd2ffede19",
     "src-admin/src/App.tsx": "8ab367389c604d5face72cc71da49b08021ffa2e566db4d32df9ad98f9fe762a",
     "src-admin/src/Workers/AdaptersWorker.tsx": "3a2cdeb8010598c901df0e3cffcdae913e62e7ac7c84fcadf15cb7f961dc6ed9",
     "src-admin/src/Workers/GenericWorker.tsx": "3b3c6e7856602477c54d1dc085aa23b5cfcac7784cc73710b00622ac04ed5a97",
@@ -1323,7 +1323,7 @@
     "src-admin/src/tabs/Objects.tsx": "2b87a8a7e771e10e1cce49019c4be62578f10096eee5abd17d2685f5f41cc67c",
     "src-admin/src/tabs/Users.tsx": "45ed37e57b66f7e23eb465aef9ad9db55613b40bf44530ab81d6206806de102d",
     "src-admin/src/types.d.ts": "3cfac48af5f8416b55b89c0daca78499dbbd402c0b44cc661112b76953ba3344",
-    "src-admin/src/version.json": "8333ad3db33a8616fc0d4e5990a1a4fd0b1504868d5ec252550520ed5e5001b1",
+    "src-admin/src/version.json": "b2da994816631b24508b9ecde47e77ea9d9463a8ff1afdeda0500219343f75fa",
     "src/i18n/de.json": "85d4ecfedf15d78984922b05377063b808ae8c5a75944af323e72a2c3a483d50",
     "src/i18n/en.json": "6a0156a1b026903821d395ef2ceef845e90531f323a218f97f5abefaabb46a23",
     "src/i18n/es.json": "54369f8044dfa222779849d2f158eb100188a43816d6c42a64575122cb528a30",
@@ -1350,7 +1350,7 @@
     "src/lib/testPassword.ts": "c627432e64b6ed40081e2828af207238bc9e9e1f8b823eaf20c7d3e059c5e938",
     "src/lib/translations.ts": "8fdb51d81c3f98e17e0231f6773381886eb1c68068a3f53dd5e32bf6b58f9d16",
     "src/lib/utils.ts": "5398da6c6a660c4300e2679aa5e001e05297d684cc39bdfab091375768169f30",
-    "src/lib/web.ts": "ca2a04d1bb1e2cd51bea6fc0f70355c963b9251121cfca539be97068b9f94187",
+    "src/lib/web.ts": "c4683adc8e32e23280bf6fead41cc7c67ff41982d33e388119b18a7ac9997fb7",
     "src/main.ts": "e9eb8013a229d9616be923850075e8cb5475bde32c882008721225ed37a85a8c",
     "src/types.d.ts": "12117a644a45cb0b551555184126563e80bf909726aa378c7d72327a30c61054",
     "tasks.mts": "84a396f8581e7e3ca499a1c4ce01d22ea29f81700520f804b48a95fb54d72408",
@@ -1375,10 +1375,11 @@
     "tools/nexowatt-generate-eos-admin-repo-entry.cjs": "a8b55d6001b0ed6d97221448b194748945f2e8382cdaf0b11ea91c63fb517139",
     "tools/nexowatt-generate-repo-entry.cjs": "4e98acc7db74546bd942cfa36d57015673c6f1514758494753e7339068f7eb68",
     "tools/nexowatt-import-integrity-selftest.cjs": "f46951126a237a6010c3c0949c25e2415ebe9af568d29411d10691951cb3ed87",
+    "tools/nexowatt-installer-ems-selftest.cjs": "65bbc30d60b4a7e24a7aa599eda256b4361f66c1dd9437c989d549185c43bc79",
     "tools/nexowatt-internal-reserve-selftest.cjs": "f027a2272a4277d65167d68d4ca4428cd0c28a6c6c2b610eda575abd3f2bc90a",
     "tools/nexowatt-login-layout-selftest.cjs": "7d4baae82f1d53fc14446b8ef80aaffa39b0b3529821599f4a6e2c27fbc7a7f2",
     "tools/nexowatt-manual-write-policy-selftest.cjs": "a41057610972d681120bf35e0321029facc08b098c79da9b131980f80bd3fdce",
-    "tools/nexowatt-merge-update-selftest.cjs": "a029a368a8d1363b3a9a120ac19105ac28986d159fce93e6ebc1c3deb0ee18ac",
+    "tools/nexowatt-merge-update-selftest.cjs": "f8abe1505e4dd8ade64577825e8c67ae3828892493c613a566ea353b668bfaaf",
     "tools/nexowatt-modern-ui-selftest.cjs": "0145adc4b7d84e996f227dee02c09f767ab9a29bb2151041a50b88bb27a5b93a",
     "tools/nexowatt-module-popup-selftest.cjs": "31f02e8cf0bfd61d7769e1095c93887a34cfbbd76a9805ef4931cea6dff53ddf",
     "tools/nexowatt-native-shell-selftest.cjs": "13aabd3a19f0c0422bbc1c676718685b77c88a526167a7b511fa6c9ab2ac860c",
@@ -1391,21 +1392,21 @@
     "tools/nexowatt-publish-channel-selftest.cjs": "c4efd1104ebe471ce1dc63195f322cffe760af295bf60f13b9766491acd0280e",
     "tools/nexowatt-release-defaults-selftest.cjs": "3e3c96ca774200461978c546d1a937cbae18d7f11497ed84dda639c2358f6e16",
     "tools/nexowatt-repair-eos-admin-update.cjs": "f28c1999b0f75139e582770ad649d17d11f9e909ac49d13c31be5fa5b36253e3",
-    "tools/nexowatt-role-access-selftest.cjs": "51a25973a41d066f421c9517515db4eb9abf737a5da6ee839089ae3e59688bb7",
-    "tools/nexowatt-role-security-selftest.cjs": "a7ab0513d8d7fc232561962554db27ce00e32d4a6b04af088ba5baef6d2f6dd5",
+    "tools/nexowatt-role-access-selftest.cjs": "50e972f331b2c54640964b5dcf0eb0becc51439cf78d24fd76be45cf5a7db3be",
+    "tools/nexowatt-role-security-selftest.cjs": "9dc69a6154b86f2fd3b7d28f4f7ae3b97bcb50e652d97fb6c7d090ba82ea2e84",
     "tools/nexowatt-runtime-cleanup-selftest.cjs": "f317b09aa0c51ffe7e1b5eaf10c52c886804ec6e8084967cd88e4ebece6ecfb5",
-    "tools/nexowatt-stability-check.cjs": "2df8d43fa2b5b78b72c71781a85bfc2583e716654b7f23c985dae238dcc04092",
+    "tools/nexowatt-stability-check.cjs": "f9b79766c54f6b47a2ef475206180d9895045a4adb794d8eeab1e1de49113d51",
     "tools/nexowatt-stable-v7101-selftest.cjs": "817d09861ef29c52a67f64ec5b8f4ad4654ce7e6486eded786bb16f3c773eaf8",
     "tools/nexowatt-stable-v7102-selftest.cjs": "75baab5f8069569ad4896e5018f3c5ccbbda2c2297aca5c5146bce94f9cf795d",
-    "tools/nexowatt-stable-v7103-selftest.cjs": "20e0be31811dfa61772a2438085ae1a83d6e009330b01fcea5a4320f15586406",
+    "tools/nexowatt-stable-v7103-selftest.cjs": "c2ba0387363fcc6de164b28df1d6c0d1eabc4636b6e6a734ed3a76a0fff1d78c",
     "tools/nexowatt-stable-v94-selftest.cjs": "5226881b3ad8918c67921ffb37716490f053ec88e7c0f24827a5eda7c75d4019",
     "tools/nexowatt-stable-v95-selftest.cjs": "0b15fcd329eb2994e64c407ab04eaafab7c38c4688136c197bf9601e1c35ee07",
     "tools/nexowatt-stable-v97-selftest.cjs": "4f50ad6e53b8de7eb045d56657cccd846883eacd8a877d51240d78153ba53d80",
     "tools/nexowatt-sync-release-version.cjs": "2478d714533ece21a275071ef6e5467f73c2fa33d0a63d76f408dc048a86c6f6",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs": "83255e5d3c9a548013f6e9a74706644d15d98450d0bfa2eb3da83c740d8618ea",
     "tools/nexowatt-update-selftest.cjs": "c38c454135f98de683de8fa15fc4b9032063823f0f55fcfc8b675f551fd342f5",
-    "tools/nexowatt-user-area-selftest.cjs": "8c1c86c0b3de59f09ad866bbda0e2d8702896f56a4593bbbdb540d3eceef673b",
-    "tools/nexowatt-validate-package.cjs": "97de7ed0308d88d9db0401136acde98136907fb2ae4481a5e08ed57dbb6b6a34",
+    "tools/nexowatt-user-area-selftest.cjs": "0936141466414f020a7d4df60d81ee1d1cfc9bd3a8d4aa9bb361a71b7bdf5b45",
+    "tools/nexowatt-validate-package.cjs": "956ed5a7b00a8d908c12d396b28eee879560dcb6155fde8540d7fc502416fb2f",
     "tools/nexowatt-value-column-selftest.cjs": "29d0a9bbea05a87dcf8ee09c86cc81acb6c59e1e34801890768f5e342083871a",
     "tools/nexowatt-version-sync-selftest.cjs": "65d7c8634b6d5581f337365e13a1a9432c7d47dbf5aebc237886730c32ba5e94",
     "tsconfig.build.json": "d3a31263975a13de77b97af9ff246d89931f3abb594047be2739cf11378b97f5",

package/PUBLISH_STABLE_V7.10.7.md

@@ -0,0 +1,9 @@
+# NPM publication 7.10.7
+
+1. Use a freshly extracted repository ZIP.
+2. Run `npm publish --dry-run`.
+3. Confirm version `7.10.7`, complete `build/` runtime and all active `adminWww` runtime files.
+4. Verify the Installer EMS self-test and role-security self-test are successful.
+5. Publish with `npm publish` only after the dry run succeeds.
+
+No `npm install`, `npm ci`, `tsc` or `tsx` is required for the sealed prebuilt release.

package/README_STABILITY_V7.10.7.md

@@ -0,0 +1,7 @@
+# NexoWatt EOS Admin 7.10.7 – stability and RBAC baseline
+
+This release retains the validated crash, package, update-placement, Admin-rights and End User read-only fixes from 7.10.2–7.10.6.
+
+Role decisions continue to come exclusively from the authenticated `/nexowatt/security/context` response. Administrator remains the unconditional full-rights path. End User datapoints remain read-only in frontend and backend. Installer receives EMS App-Center access, while Simulation, License, expert mode, ioBroker Admin, XTerm and account administration remain restricted.
+
+Menu edits continue to use the adapter state and must never write `system.config`.

package/RELEASE_ACCEPTANCE_V7.10.7.md

@@ -0,0 +1,12 @@
+# Release Acceptance 7.10.7
+
+- [ ] Admin retains unrestricted access and all existing controls.
+- [ ] Installer can open and use the EMS App-Center.
+- [ ] Installer cannot open Simulation or License.
+- [ ] Installer does not see expert mode, ioBroker Admin, XTerm or Users/Rights.
+- [ ] End User cannot open EMS App-Center, Simulation or License.
+- [ ] End User datapoints remain read-only and action icons remain hidden.
+- [ ] End User session scrubbing on port 8188 remains active.
+- [ ] Pencil navigation edits do not restart EOS Admin.
+- [ ] Backup navigation follows the enabled state of the backup instance.
+- [ ] `npm publish --dry-run` succeeds from a fresh extraction.

package/RELEASE_NOTES_V7.10.7.md

@@ -0,0 +1,19 @@
+# NexoWatt EOS Admin 7.10.7
+
+## Installateurbereich
+
+- Der Installateur kann **EMS Apps öffnen** und das EMS App-Center wie der Administrator verwenden.
+- Die Freigabe gilt ausschließlich für das EMS App-Center.
+- Simulation und Lizenzverwaltung bleiben ausschließlich für Administratoren verfügbar.
+- Der Installateur erhält weiterhin keinen Expertenmodus, keinen ioBroker-Admin-Zugang, kein XTerm und keine Benutzer-/Rechteverwaltung.
+
+## Bestehende Rollen bleiben unverändert
+
+- Administrator: vollständige Rechte und alle bisherigen Funktionen.
+- Endkunde: Datenpunkte nur lesend; App-Center, Simulation und Lizenz bleiben vollständig gesperrt.
+- Der Endkunden-Sitzungsschutz auf Port 8188 bleibt aktiv; nur der Installateur wird davon für die EMS-Nutzung ausgenommen.
+
+## Veröffentlichung
+
+- Neue npm-Version 7.10.7, da 7.10.6 bereits veröffentlicht ist.
+- Release-Dateien, Browser-Cache-Tags, Repository-Eintrag und Prebuilt-Manifest sind auf 7.10.7 synchronisiert.

package/{SECURITY_ROLE_MATRIX_V7.10.6.md → SECURITY_ROLE_MATRIX_V7.10.7.md}

@@ -1,12 +1,14 @@
-# NexoWatt EOS role matrix 7.10.6
+# NexoWatt EOS role matrix 7.10.7
 
 | Capability | Admin | Installer | End User |
 |---|---:|---:|---:|
 | Datapoints read | Yes | Yes | Yes |
 | Datapoints write/edit | Yes | Yes | No |
+| EMS App-Center | Yes | Yes | No |
+| Simulation | Yes | No | No |
+| License administration | Yes | No | No |
 | Expert mode | Yes | No | No |
 | ioBroker Admin / XTerm | Yes | No | No |
-| App Center / License / Simulation | Yes | No | No |
 | Users, groups, passwords | Yes | No | No |
 | Smart Home structure | Yes | Yes | Yes |
 | Navigation layout editing | Yes | No | No |

package/adminWww/index.html

@@ -8,7 +8,7 @@
         <meta http-equiv="Cache-Control" content="no-store, no-cache, must-revalidate" />
         <meta http-equiv="Pragma" content="no-cache" />
         <meta http-equiv="Expires" content="0" />
-          <script src="./js/eos-manual-write-policy.js?v=7106"></script>
+          <script src="./js/eos-manual-write-policy.js?v=7107"></script>
           <script type="module" src="./assets/hostInit-v84.js?v=84"></script>
         
         <meta charset="utf-8" />
@@ -36,8 +36,8 @@
             rel="stylesheet"
             href="css/leaflet.css"
         />
-        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7106" />
-        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7106" />
+        <link rel="stylesheet" href="./css/nexowatt-native-shell.css?v=7107" />
+        <link rel="stylesheet" href="./css/eos-ems-overview.css?v=7107" />
         <link rel="stylesheet" href="./css/eos-auto-update.css?v=7103" />
         <link
             rel="manifest"
@@ -160,22 +160,22 @@
         </script>
       <link rel="modulepreload" crossorigin href="./assets/preload-helper-BDBacUwf.js">
       <link rel="modulepreload" crossorigin href="./assets/iobroker_admin__mf_v__runtimeInit__mf_v__-g2X2zhAf.js">
-            <script defer src="./js/eos-role-bootstrap.js?v=7106" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
-            <script defer src="./js/eos-policy-client.js?v=7106"></script>
-            <script defer src="./js/eos-branding-sanitizer.js?v=7106"></script>
-            <script defer src="./js/nexowatt-native-shell.js?v=7106"></script>
-            <script defer src="./js/eos-native-security.js?v=7106"></script>
-            <script defer src="./js/eos-basic-settings.js?v=7106"></script>
-            <script defer src="./js/eos-role-ui.js?v=7106"></script>
-            <script defer src="./js/eos-ems-overview.js?v=7106"></script>
+            <script defer src="./js/eos-role-bootstrap.js?v=7107" data-eos-entry="./assets/index-CQZugZ1z-v84.js?v=84"></script>
+            <script defer src="./js/eos-policy-client.js?v=7107"></script>
+            <script defer src="./js/eos-branding-sanitizer.js?v=7107"></script>
+            <script defer src="./js/nexowatt-native-shell.js?v=7107"></script>
+            <script defer src="./js/eos-native-security.js?v=7107"></script>
+            <script defer src="./js/eos-basic-settings.js?v=7107"></script>
+            <script defer src="./js/eos-role-ui.js?v=7107"></script>
+            <script defer src="./js/eos-ems-overview.js?v=7107"></script>
             
             <script defer src="./js/eos-auto-update.js?v=7103"></script>
-            <script defer src="./js/eos-assistant.js?v=7106"></script>
+            <script defer src="./js/eos-assistant.js?v=7107"></script>
     </head>
     <body>
         <noscript>Für NexoWatt EOS muss JavaScript aktiviert sein.</noscript>
         <div id="root"></div>
-<script defer src="static/js/nexowatt-stable-login.js?v=7106"></script>
-<script defer src="static/js/nexowatt-stable-v7106.js?v=7106"></script>
+<script defer src="static/js/nexowatt-stable-login.js?v=7107"></script>
+<script defer src="static/js/nexowatt-stable-v7107.js?v=7107"></script>
 </body>
 </html>

package/adminWww/js/eos-role-bootstrap.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7106-admin-authoritative-rbac';
+    const VERSION = 'v7107-admin-authoritative-rbac';
     const script = document.currentScript || document.querySelector('script[src*="eos-role-bootstrap.js"]');
     const entry = script?.dataset?.eosEntry || '';
     let launched = false;

package/adminWww/js/eos-role-ui.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7106-admin-authoritative-rbac';
+    const VERSION = 'v7107-installer-ems-rbac';
     window.NEXOWATT_EOS_ROLE_UI_VERSION = VERSION;
 
     const state = {
@@ -483,12 +483,26 @@
 
 
     const privilegedFrameObservers = new WeakMap();
-    const privilegedActionPattern = /^(?:ems apps?(?: offnen| öffnen)?|app center|app-center|appcenter|simulation|simulator|lizenz|license)$/;
-    const isPrivilegedAction = element => {
+    const privilegedActionKind = element => {
         const signature = normalize(textOf(element));
         const href = normalize(element?.getAttribute?.('href') || element?.href || element?.getAttribute?.('data-href') || '');
-        return privilegedActionPattern.test(signature)
-            || /(?:^|[\/#?&_.-])(?:appcenter|app-center|simulation|simulator|license|lizenz)(?:$|[\/#?&=_.-])/.test(href);
+        if (/^(?:ems apps?(?: offnen| öffnen)?|app center|app-center|appcenter)$/.test(signature)
+            || /(?:^|[\/#?&_.-])(?:appcenter|app-center)(?:$|[\/#?&=_.-])/.test(href)) return 'ems';
+        if (/^(?:simulation|simulator)$/.test(signature)
+            || /(?:^|[\/#?&_.-])(?:simulation|simulator)(?:$|[\/#?&=_.-])/.test(href)) return 'simulation';
+        if (/^(?:lizenz|license)$/.test(signature)
+            || /(?:^|[\/#?&_.-])(?:license|lizenz)(?:$|[\/#?&=_.-])/.test(href)) return 'license';
+        return '';
+    };
+    const isPrivilegedAction = element => !!privilegedActionKind(element);
+    const canUsePrivilegedAction = element => {
+        const action = privilegedActionKind(element);
+        if (!action) return true;
+        if (action === 'ems') {
+            return state.role === 'admin'
+                || (state.role === 'installer' && state.policy?.capabilities?.emsAppCenter !== false);
+        }
+        return state.role === 'admin';
     };
     const setPrivilegedActionHidden = (element, hidden) => {
         if (!element) return;
@@ -507,19 +521,18 @@
     };
     const applyPrivilegedActionsInDocument = doc => safe(() => {
         if (!doc?.documentElement) return;
-        const admin = state.role === 'admin';
         doc.querySelectorAll('[data-eos-privileged-action-hidden="1"]').forEach(element => {
-            if (admin || !isPrivilegedAction(element)) setPrivilegedActionHidden(element, false);
+            if (!isPrivilegedAction(element) || canUsePrivilegedAction(element)) setPrivilegedActionHidden(element, false);
         });
         for (const element of doc.querySelectorAll('a,button,[role="button"],[role="tab"],.MuiButtonBase-root')) {
-            if (isPrivilegedAction(element)) setPrivilegedActionHidden(element, !admin);
+            if (isPrivilegedAction(element)) setPrivilegedActionHidden(element, !canUsePrivilegedAction(element));
         }
         if (!doc.documentElement.dataset.eosPrivilegedClickGuard) {
             doc.documentElement.dataset.eosPrivilegedClickGuard = '1';
             doc.addEventListener('click', event => {
-                if (state.role === 'admin' || state.role === 'unknown') return;
+                if (state.role === 'unknown') return;
                 const target = event.target?.closest?.('a,button,[role="button"],[role="tab"],.MuiButtonBase-root');
-                if (!target || !isPrivilegedAction(target)) return;
+                if (!target || !isPrivilegedAction(target) || canUsePrivilegedAction(target)) return;
                 event.preventDefault();
                 event.stopImmediatePropagation();
             }, true);
@@ -544,9 +557,9 @@
         });
     });
     const scrubInheritedUiAdminSession = () => safe(() => {
-        if (state.role === 'admin' || state.role === 'unknown') return;
+        if (state.role !== 'enduser') return;
         const user = String(state.policy?.user || state.policy?.userId || '').replace(/^system\.user\./, '') || state.role;
-        const key = `eosUiAdminSessionScrubbed:v7106:${user}:${state.role}`;
+        const key = `eosUiAdminSessionScrubbed:v7107:${user}:${state.role}`;
         if (sessionStorage.getItem(key) === '1') return;
         sessionStorage.setItem(key, '1');
         const frame = document.createElement('iframe');

package/adminWww/js/nexowatt-native-shell.js

@@ -1,7 +1,7 @@
 (() => {
     'use strict';
 
-    const VERSION = 'v7106-nexowatt-native-shell-native-overview';
+    const VERSION = 'v7107-nexowatt-native-shell-native-overview';
     const previous = window.NEXOWATT_NATIVE_SHELL;
     if (previous?.version === VERSION) return;
     previous?.destroy?.();

package/adminWww/static/js/{nexowatt-stable-v7106.js → nexowatt-stable-v7107.js}

@@ -1,6 +1,6 @@
 (() => {
     'use strict';
-    const VERSION = 'v7106-scroll-standard-password';
+    const VERSION = 'v7107-scroll-standard-password';
     const ensureScroll = () => {
         const root = document.documentElement;
         const paper = document.getElementById('app-paper');
@@ -23,5 +23,5 @@
     const schedule=()=>{if(scheduled)return;scheduled=true;requestAnimationFrame(()=>{scheduled=false;apply();});};
     const start=()=>{apply();new MutationObserver(schedule).observe(document.documentElement,{subtree:true,childList:true});window.addEventListener('hashchange',schedule);window.addEventListener('resize',schedule,{passive:true});};
     document.readyState==='loading'?document.addEventListener('DOMContentLoaded',start,{once:true}):start();
-    window.NEXOWATT_EOS_STABLE_V7101=Object.freeze({version:VERSION,refresh:apply,ensureScroll});
+    window.NEXOWATT_EOS_STABLE_V7107=Object.freeze({version:VERSION,refresh:apply,ensureScroll});
 })();

package/build/lib/web.js

@@ -650,6 +650,9 @@ class Web {
             objectDiagnostics: technical,
             logDiagnostics: technical,
             basicSystemSettings: technical,
+            emsAppCenter: technical,
+            simulation: role === 'admin',
+            licenseAdministration: role === 'admin',
             fullSystemSettings: role === 'admin',
             expertMode: role === 'admin',
             userManagement: role === 'admin',

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.10.6",
+    "version": "7.10.7",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,6 +18,11 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
+      "7.10.7": {
+        "de": "Stable 7.10.7 gibt dem Installateur den Zugriff auf „EMS Apps öffnen“ und das EMS App-Center frei. Simulation und Lizenzverwaltung bleiben ausschließlich dem Administrator vorbehalten. Endkundenbereich, Nur-Lese-Datenpunkte und Adminrechte bleiben unverändert.",
+        "en": "Stable 7.10.7 grants the Installer access to “Open EMS Apps” and the EMS App-Center. Simulation and license administration remain Administrator-only. End User read-only datapoints and all Administrator rights remain unchanged.",
+        "nl": "Stable 7.10.7 geeft de installateur toegang tot “EMS Apps openen” en het EMS App-Center. Simulatie en licentiebeheer blijven uitsluitend voor beheerders. Alleen-lezen datapunten voor eindgebruikers en alle beheerdersrechten blijven ongewijzigd."
+      },
       "7.10.6": {
         "de": "Stable 7.10.6 bereinigt ausschließlich den Endkundenbereich: Datenpunkte bleiben sichtbar und nur lesbar, Bearbeiten-/Löschen-/Einstellungsaktionen werden ausgeblendet, und die Systeminfokarte erhält Plattform, RAM, Node.js und NPM über einen authentifizierten Nur-Lese-Endpunkt. Die Administratoroberfläche und sämtliche Adminrechte bleiben unverändert.",
         "en": "Stable 7.10.6 cleans up the End User area only: datapoints stay visible and read-only, edit/delete/settings actions are hidden, and the system information card receives platform, RAM, Node.js and NPM through an authenticated read-only endpoint. The administrator UI and all Admin rights remain unchanged.",
@@ -359,7 +364,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.6/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.10.7/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -370,7 +375,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.6/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.10.7/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -438,7 +443,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.6/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.10.7/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -1215,5 +1220,5 @@
       }
     }
   },
-  "version": "7.10.6"
+  "version": "7.10.7"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
   "description": "NexoWatt EOS Admin – repaired stable baseline with restart-safe automatic updates, native account passwords and persistent cockpit scrolling.",
-  "version": "7.10.6",
+  "version": "7.10.7",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -133,16 +133,17 @@
     "NEXOWATT_EOS_PREBUILT_MANIFEST.json",
     "tools/nexowatt-prebuilt-release-selftest.cjs",
     "tools/nexowatt-stable-v7103-selftest.cjs",
-    "README_STABILITY_V7.10.6.md",
-    "RELEASE_NOTES_V7.10.6.md",
-    "PUBLISH_STABLE_V7.10.6.md",
-    "INSTALL_TEST_V7.10.6.md",
-    "RELEASE_ACCEPTANCE_V7.10.6.md",
-    "MERGE_UPDATE_README_V7.10.6.md",
+    "README_STABILITY_V7.10.7.md",
+    "RELEASE_NOTES_V7.10.7.md",
+    "PUBLISH_STABLE_V7.10.7.md",
+    "INSTALL_TEST_V7.10.7.md",
+    "RELEASE_ACCEPTANCE_V7.10.7.md",
+    "MERGE_UPDATE_README_V7.10.7.md",
     "tools/nexowatt-auto-update-placement-selftest.cjs",
     "tools/nexowatt-role-security-selftest.cjs",
-    "SECURITY_ROLE_MATRIX_V7.10.6.md",
-    "tools/nexowatt-user-area-selftest.cjs"
+    "SECURITY_ROLE_MATRIX_V7.10.7.md",
+    "tools/nexowatt-user-area-selftest.cjs",
+    "tools/nexowatt-installer-ems-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -177,7 +178,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs && node tools/nexowatt-role-security-selftest.cjs && node tools/nexowatt-user-area-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs && node tools/nexowatt-role-security-selftest.cjs && node tools/nexowatt-user-area-selftest.cjs && node tools/nexowatt-installer-ems-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -206,7 +207,8 @@
     "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write",
     "check:eos-stable-v7103": "node tools/nexowatt-stable-v7103-selftest.cjs",
     "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs",
-    "check:eos-role-security": "node tools/nexowatt-role-security-selftest.cjs"
+    "check:eos-role-security": "node tools/nexowatt-role-security-selftest.cjs",
+    "test:eos-installer-ems": "node tools/nexowatt-installer-ems-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -217,7 +219,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS End User read-only UI and system information correction 7.10.6"
+    "purpose": "accepted stable NexoWatt EOS Installer EMS App-Center access correction 7.10.7"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-installer-ems-selftest.cjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const root = path.resolve(__dirname, '..');
+const read = file => fs.readFileSync(path.join(root, file), 'utf8');
+const json = file => JSON.parse(read(file));
+
+const pkg = json('package.json');
+const sourceRole = read('src-admin/public/js/eos-role-ui.js');
+const runtimeRole = read('adminWww/js/eos-role-ui.js');
+const sourceWeb = read('src/lib/web.ts');
+const runtimeWeb = read('build/lib/web.js');
+
+assert.equal(pkg.version, '7.10.7', 'Installer EMS release must use npm version 7.10.7');
+assert.equal(runtimeRole, sourceRole, 'built and source role runtimes must be identical');
+
+for (const code of [sourceRole, runtimeRole]) {
+    assert.match(code, /const privilegedActionKind = element =>/, 'privileged action classifier missing');
+    assert.match(code, /return 'ems';/, 'EMS action classification missing');
+    assert.match(code, /return 'simulation';/, 'Simulation action classification missing');
+    assert.match(code, /return 'license';/, 'License action classification missing');
+    assert.match(code, /action === 'ems'/, 'EMS-specific access branch missing');
+    assert.match(
+        code,
+        /state\.role === 'installer' && state\.policy\?\.capabilities\?\.emsAppCenter !== false/,
+        'Installer is not allowed to open EMS App-Center',
+    );
+    assert.match(code, /return state\.role === 'admin';/, 'Simulation and License must remain Admin-only');
+    assert.match(code, /!canUsePrivilegedAction\(element\)/, 'UI visibility does not use the role-aware action permission');
+    assert.match(code, /\|\| canUsePrivilegedAction\(target\)\) return;/, 'click guard does not use the role-aware action permission');
+    assert.match(code, /if \(state\.role !== 'enduser'\) return;/, 'port 8188 session scrubbing must apply only to End User');
+}
+
+for (const code of [sourceWeb, runtimeWeb]) {
+    assert.match(code, /emsAppCenter: technical/, 'backend capability must grant EMS App-Center to Admin and Installer');
+    assert.match(code, /simulation: role === 'admin'/, 'Simulation capability must remain Admin-only');
+    assert.match(code, /licenseAdministration: role === 'admin'/, 'License capability must remain Admin-only');
+}
+
+console.log('[NexoWatt EOS installer EMS] OK (Installer may use EMS App-Center; Simulation/License remain Admin-only; End User remains blocked)');

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.10.6.md',
+    'MERGE_UPDATE_README_V7.10.7.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',

package/tools/nexowatt-role-security-selftest.cjs

@@ -32,9 +32,9 @@ const cleanupSource = read('tools/nexowatt-clean-legacy-runtime.cjs');
 // visible header happened to contain "user". Only authenticated backend policy may define the role.
 for (const html of [index, sourceIndex]) {
     assert.doesNotMatch(html, /nexowatt-role-security\.js/i, 'legacy heuristic role guard is still loaded');
-    assert.match(html, /eos-role-bootstrap\.js\?v=7106/, 'authoritative role bootstrap cache tag is missing');
-    assert.match(html, /eos-policy-client\.js\?v=7106/, 'authoritative policy client cache tag is missing');
-    assert.match(html, /eos-role-ui\.js\?v=7106/, 'authoritative role UI cache tag is missing');
+    assert.match(html, /eos-role-bootstrap\.js\?v=7107/, 'authoritative role bootstrap cache tag is missing');
+    assert.match(html, /eos-policy-client\.js\?v=7107/, 'authoritative policy client cache tag is missing');
+    assert.match(html, /eos-role-ui\.js\?v=7107/, 'authoritative role UI cache tag is missing');
 }
 assert.equal(fs.existsSync(path.join(root, 'adminWww/nexowatt-role-security.js')), false, 'legacy runtime still exists');
 assert.equal(fs.existsSync(path.join(root, 'build/lib/eosRoleSecurity.js')), false, 'legacy backend heuristic still exists');
@@ -100,10 +100,23 @@ assert.match(introBundle, /_forceAdmin=_eosAdmin/);
 assert.doesNotMatch(introSource, /NEXOWATT_EOS_ACCESS_ROLE \|\| 'admin'/, 'Intro source must fail closed while role is unresolved');
 assert.doesNotMatch(introBundle, /NEXOWATT_EOS_ACCESS_ROLE\|\|"admin"/, 'Intro runtime must fail closed while role is unresolved');
 
-// App Center, License, Simulation and normal account administration are not available to Installer/End User.
+// Installer receives EMS App-Center access only. Simulation and License remain Admin-only;
+// End User remains blocked from all three actions and from inherited port-8188 sessions.
 for (const token of ['app center', 'app-center', 'appcenter', 'simulation', 'simulator', 'lizenz', 'license']) {
     assert.ok(roleUi.toLowerCase().includes(token), `role UI is missing protected action ${token}`);
 }
+for (const code of [roleUi, sourceRoleUi]) {
+    assert.match(code, /const privilegedActionKind = element =>/, 'privileged actions are not separated by capability');
+    assert.match(code, /if \(action === 'ems'\)/, 'EMS action branch is missing');
+    assert.match(code, /state\.role === 'installer' && state\.policy\?\.capabilities\?\.emsAppCenter !== false/, 'Installer EMS App-Center allowance is missing');
+    assert.match(code, /return state\.role === 'admin';/, 'Simulation and License must remain Admin-only');
+    assert.match(code, /if \(state\.role !== 'enduser'\) return;/, 'port 8188 session scrubbing must be End User-only');
+}
+for (const code of [webSource, webBuilt]) {
+    assert.match(code, /emsAppCenter: technical/, 'backend role capabilities do not grant Installer EMS access');
+    assert.match(code, /simulation: role === 'admin'/, 'Simulation capability must remain Admin-only');
+    assert.match(code, /licenseAdministration: role === 'admin'/, 'License capability must remain Admin-only');
+}
 assert.match(roleUi, /applyPrivilegedIframePolicy/);
 assert.match(roleUi, /:8188\/logout\?/);
 assert.match(roleUi, /route !== 'tab-users'/);
@@ -130,7 +143,7 @@ assert.ok((io.instanceObjects || []).some(object => object?._id === 'info.uiTabs
 assert.match(drawerSource, /backupAdapters\.has\(adapterName\) && instance\.enabled !== true/);
 assert.match(builtDrawer, /o\.has\(A\)&&d\.enabled!==!0/);
 
-// 7.10.6 End User cleanup: system information is read-only and object actions disappear only for End User.
+// 7.10.7 End User cleanup: system information is read-only and object actions disappear only for End User.
 for (const code of [webSource, webBuilt]) {
     assert.match(code, /nexowatt\/readonly\/system-info/, 'authenticated read-only system-info route is missing');
     assert.match(code, /authenticationRequired/, 'read-only system-info route must require an authenticated session');
@@ -146,4 +159,4 @@ for (const code of [roleUi, sourceRoleUi]) {
 }
 assert.match(sourceMain, /role === 'enduser' && \['readLogs', 'sendToHost'\]\.includes\(command\)/, 'End User technical diagnostics must remain denied');
 
-console.log('[NexoWatt EOS role security] OK (authoritative Admin rights, End User read-only datapoints, protected tools, restart-safe menu storage)');
+console.log('[NexoWatt EOS role security] OK (Admin full rights, Installer EMS App-Center access, End User read-only datapoints, protected Admin tools)');

package/tools/nexowatt-stable-v7103-selftest.cjs

@@ -31,7 +31,7 @@ const autoUi = read('adminWww/js/eos-auto-update.js');
 const autoCss = read('adminWww/css/eos-auto-update.css');
 const autoTag = String(info.autoUpdateCacheTag || info.autoUpdateCacheVersion || info.shellCacheTag || info.shellCacheVersion);
 
-must(pkg.version === '7.10.6' && io.version === '7.10.6' && io.common.version === '7.10.6' && info.version === '7.10.6', 'version drift');
+must(pkg.version === '7.10.7' && io.version === '7.10.7' && io.common.version === '7.10.7' && info.version === '7.10.7', 'version drift');
 must(io.native.eosRequireFirstLoginPassword === false && io.native.eosRequireFirstLoginPasswordChange === false, 'forced first password still enabled');
 must(!index.includes('eos-account-management.js'), 'custom reset UI still loaded');
 must(!boot.includes('installIntegratedFirstLogin(base);') && !boot.includes('showFirstLoginPassword(resolved, base);'), 'forced first-login UI still active');
@@ -49,7 +49,7 @@ must(!autoBackend.includes('extendForeignObjectAsync(this.instanceId'), 'runtime
 must(web.includes('this.nexowattStableUpdateManager?.stop();'), 'auto-update manager is not stopped with the web server');
 must(fs.existsSync(path.join(root, 'build/lib/eosRequestSecurity.js')), 'eosRequestSecurity runtime module missing');
 
-// 7.10.4 placement acceptance remains mandatory in 7.10.6: System Settings only.
+// 7.10.4 placement acceptance remains mandatory in 7.10.7: System Settings only.
 must(index.includes(`eos-auto-update.js?v=${autoTag}`), 'auto-update JavaScript cache key missing');
 must(index.includes(`eos-auto-update.css?v=${autoTag}`), 'auto-update CSS cache key missing');
 must(autoUi.includes('[role="dialog"][aria-labelledby="system-settings-dialog-title"]'), 'System Settings selector missing');

package/tools/nexowatt-user-area-selftest.cjs

@@ -13,7 +13,7 @@ const runtimeRole = read('adminWww/js/eos-role-ui.js');
 const sourceMain = read('src/main.ts');
 const builtMain = read('build/main.js');
 
-assert.equal(pkg.version, '7.10.6', 'release must use a new npm version');
+assert.equal(pkg.version, '7.10.7', 'release must use a new npm version');
 for (const web of [sourceWeb, builtWeb]) {
     assert.match(web, /nexowatt\/readonly\/system-info/, 'read-only system information endpoint missing');
     assert.match(web, /sendEosReadonlySystemInfo/, 'read-only system information handler missing');

package/tools/nexowatt-validate-package.cjs

@@ -45,6 +45,8 @@ if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-version-sync-selftes
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-merge-update-selftest.cjs')) fail('merge update selftest is not part of check:eos-stability');
 if (pkg.scripts['check:eos-stable-v7103'] !== 'node tools/nexowatt-stable-v7103-selftest.cjs') fail('stable v7103 selftest script is missing or incorrect');
 if (pkg.scripts['test:eos-auto-update-placement'] !== 'node tools/nexowatt-auto-update-placement-selftest.cjs') fail('auto-update placement selftest script is missing or incorrect');
+if (pkg.scripts['test:eos-installer-ems'] !== 'node tools/nexowatt-installer-ems-selftest.cjs') fail('Installer EMS selftest script is missing or incorrect');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-installer-ems-selftest.cjs')) fail('Installer EMS selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-auto-update-placement-selftest.cjs')) fail('auto-update placement selftest is not part of check:eos-stability');
 if (pkg.scripts.prepublishOnly !== canonicalPrepublishOnly) fail('prepublishOnly must use the dependency-free direct-publish workflow');
 if (/\b(?:tsc|tsx)\b|build:(?:backend|frontend)|\bnpx\b|npm\s+(?:i|install|ci)\b/i.test(pkg.scripts.prepublishOnly || '')) fail('prepublishOnly must not require local development dependencies');
@@ -134,14 +136,14 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.10.6.md',
-  'RELEASE_NOTES_V7.10.6.md',
-  'PUBLISH_STABLE_V7.10.6.md',
-  'INSTALL_TEST_V7.10.6.md',
-  'RELEASE_ACCEPTANCE_V7.10.6.md',
+  'README_STABILITY_V7.10.7.md',
+  'RELEASE_NOTES_V7.10.7.md',
+  'PUBLISH_STABLE_V7.10.7.md',
+  'INSTALL_TEST_V7.10.7.md',
+  'RELEASE_ACCEPTANCE_V7.10.7.md',
   'MERGE_UPDATE.ps1',
   'MERGE_UPDATE.cmd',
-  'MERGE_UPDATE_README_V7.10.6.md',
+  'MERGE_UPDATE_README_V7.10.7.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -174,7 +176,7 @@ for (const file of [
   'tools/nexowatt-ui-overview-runtime-selftest.cjs',
   'adminWww/js/eos-ems-overview.js',
   'adminWww/css/eos-ems-overview.css',
-  'adminWww/static/js/nexowatt-stable-v7106.js',
+  'adminWww/static/js/nexowatt-stable-v7107.js',
   'src-admin/src/components/Intro/NexoWattEmsOverview.tsx',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',

package/INSTALL_TEST_V7.10.6.md

@@ -1,8 +0,0 @@
-# Installation test 7.10.6
-
-- Install/update EOS Admin 7.10.6 and verify port 8081 remains reachable.
-- Sign in as Admin: datapoints are writable; expert mode can be enabled and disabled; Admin and XTerm overview cards are visible.
-- Sign in as Installer: no expert head, ioBroker Admin, XTerm, App Center, License, Simulation or Users/Rights page.
-- Sign in as End User: Datapoints tab is visible but every write/edit/delete action is disabled; restricted tools are absent.
-- Toggle a navigation item with the pencil: EOS Admin must not restart and `system.config` must remain untouched.
-- Disable the backup adapter: its navigation item disappears; re-enable it and the item returns.

package/MERGE_UPDATE_README_V7.10.6.md

@@ -1,7 +0,0 @@
-# Merge/update note 7.10.6
-
-Always replace the previous repository with the complete 7.10.6 repository. Do not merge old `adminWww` bundles or deleted role-security files back into this release. In particular, `nexowatt-role-security.js` and `build/lib/eosRoleSecurity.js` are obsolete and must stay absent.
-
-After a merge, run the package, stability, role-security and publish dry-run checks before publishing.
-
-The 7.10.6 publish workflow now removes all three obsolete 7.10.4 role-security files automatically before sealing and packaging, including when the ZIP was extracted over an existing working directory.

package/PUBLISH_STABLE_V7.10.6.md

@@ -1,8 +0,0 @@
-# NPM publication 7.10.6
-
-1. Use a freshly extracted repository ZIP.
-2. Run `npm publish --dry-run`.
-3. Confirm version `7.10.6`, complete `build/` runtime and all active `adminWww/assets/*-v84.js` files.
-4. Publish with `npm publish` only after the dry run succeeds.
-
-No `npm install`, `npm ci`, `tsc` or `tsx` is required for the sealed prebuilt release.

package/README_STABILITY_V7.10.6.md

@@ -1,5 +0,0 @@
-# NexoWatt EOS Admin 7.10.6 – stability and RBAC baseline
-
-This release retains the validated 7.10.2–7.10.4 crash, package and update-placement fixes. Role decisions now come exclusively from the authenticated `/nexowatt/security/context` response. The removed heuristic must never be restored.
-
-Administrator is an unconditional full-rights path. End User datapoints are read-only in both frontend and backend. Menu edits are persisted in an adapter state and must never write `system.config`.

package/RELEASE_ACCEPTANCE_V7.10.6.md

@@ -1,11 +0,0 @@
-# Release Acceptance 7.10.6
-
-- [ ] Admin can write every normally writable datapoint.
-- [ ] Admin can enable and disable expert mode repeatedly.
-- [ ] Admin sees ioBroker Admin and XTerm overview cards.
-- [ ] Installer and End User never see expert mode, ioBroker Admin or XTerm.
-- [ ] App Center, License, Simulation and account administration are unavailable to Installer/End User.
-- [ ] End User sees Datapoints but cannot write, edit, create or delete.
-- [ ] Pencil navigation edits do not restart EOS Admin.
-- [ ] Backup navigation follows the enabled state of the backup instance.
-- [ ] `npm publish --dry-run` succeeds from a fresh extraction.

package/RELEASE_NOTES_V7.10.6.md

@@ -1,14 +0,0 @@
-# NexoWatt EOS Admin 7.10.6
-
-## Endkundenbereich
-
-- Die Datenpunktansicht bleibt für Endkunden lesbar, blendet aber Bearbeiten-, Löschen- und Einstellungsaktionen vollständig aus.
-- Schreibbefehle bleiben zusätzlich serverseitig gesperrt.
-- Die Systeminformationskarte erhält Plattform, RAM, Node.js und NPM über einen authentifizierten Nur-Lese-Endpunkt.
-- Der fehlerhafte Info-Dialog mit `permissionError` wird für Endkunden nicht mehr angeboten.
-- Administratorrechte und die bestehende Admin-Oberfläche bleiben unverändert und vollständig verfügbar.
-
-## Veröffentlichung
-
-- Neue npm-Version 7.10.6, da 7.10.5 bereits veröffentlicht wurde.
-- Release-Dateien, Cache-Tags, Repository-Eintrag und versiegeltes Prebuilt-Artefakt sind auf 7.10.6 synchronisiert.