iobroker.eos-admin 7.9.89 → 7.9.92

package/build/lib/web.js

@@ -893,6 +893,39 @@ class Web {
             && account?.passwordlessFirstLoginAllowed === true;
         return { eligible, role: access.role, user, minLength: setup.minLength };
     }
+    async getEosPasswordlessFirstLoginStatus(req, res) {
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+        if (!this.settings.auth
+            || !this.isEosPasswordlessFirstLoginEnabled()
+            || !this.isEosSameOriginWrite(req)
+            || req.headers['x-nexowatt-eos-passwordless-status'] !== '1') {
+            res.status(403).json({ error: 'statusUnavailable' });
+            return;
+        }
+        if (!this.isEosPasswordlessRequestNetworkAllowed(req)) {
+            res.status(403).json({ error: 'privateNetworkRequired' });
+            return;
+        }
+        const requested = String(req.body?.user || '')
+            .trim()
+            .toLowerCase()
+            .replace(/^system\.user\./, '');
+        const managed = requested === 'installer' || requested === 'guest' || requested === 'user';
+        const userId = managed ? this.normalizeEosUserId(requested) : '';
+        if (!userId) {
+            res.status(200).json({ success: true, eligible: false, userName: requested });
+            return;
+        }
+        const eligibility = await this.getEosPasswordlessClaimEligibility(userId);
+        const eligible = eligibility.eligible && (eligibility.role === 'installer' || eligibility.role === 'enduser');
+        res.status(200).json({
+            success: true,
+            eligible,
+            role: eligibility.role,
+            userName: requested,
+            minLength: eligibility.minLength,
+        });
+    }
     invalidateEosPasswordClaimsForUser(userId) {
         for (const [key, claim] of this.eosPasswordClaims.entries()) {
             if (claim.userId === userId) {
@@ -1606,6 +1639,12 @@ class Web {
                 // Passwordless first activation is not a normal authenticated session. The two
                 // narrow routes below only issue/consume a short-lived HttpOnly claim and are registered
                 // before the general login middleware. They never expose the EOS application itself.
+                this.server.app.post('/nexowatt/account/passwordless-status', (req, res) => {
+                    void this.getEosPasswordlessFirstLoginStatus(req, res).catch(e => {
+                        this.adapter.log.debug(`Cannot read EOS passwordless activation status: ${e instanceof Error ? e.message : e}`);
+                        res.status(200).json({ success: true, eligible: false });
+                    });
+                });
                 this.server.app.post('/nexowatt/account/passwordless-claim', (req, res) => {
                     void this.startEosPasswordlessFirstLogin(req, res).catch(e => {
                         this.adapter.log.warn(`Cannot start EOS passwordless activation: ${e instanceof Error ? e.message : e}`);

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.9.89",
+    "version": "7.9.92",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,6 +18,16 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
+      "7.9.92": {
+        "de": "Stable 7.9.92 korrigiert die Release-Vorbereitung: Vor Paketprüfung und npm-Veröffentlichung werden die verbindlichen Verkaufsstandardwerte für Authentifizierung, Port 8081 sowie die ausschließlich für Admin/Service sichtbaren internen Admin- und BackItUp-Notfallreserven automatisch normalisiert. Dadurch kann ein gemischter lokaler Arbeitsordner die Sicherheitsprüfung nicht mehr durch einen fehlenden Standardwert abbrechen. Rollen-, Login-, Übersichts- und Dienstefilter aus 7.9.91 bleiben unverändert.",
+        "en": "Stable 7.9.92 hardens release preparation: before package validation and npm publishing, the mandatory sales defaults for authentication, port 8081 and the Admin/Service-only internal admin and BackItUp emergency reserves are normalized automatically. A mixed local working tree can therefore no longer abort the security check merely because a required default value is missing. Role, login, overview and service filtering from 7.9.91 remain unchanged.",
+        "nl": "Stable 7.9.92 verhardt de releasevoorbereiding: vóór pakketcontrole en npm-publicatie worden de verplichte verkoopstandaarden voor authenticatie, poort 8081 en de uitsluitend voor Admin/Service zichtbare interne admin- en BackItUp-noodreserve automatisch genormaliseerd. Een gemengde lokale werkmap kan de veiligheidscontrole daardoor niet meer laten stoppen door een ontbrekende standaardwaarde. Rollen-, login-, overzichts- en dienstenfilters uit 7.9.91 blijven ongewijzigd."
+      },
+      "7.9.90": {
+        "de": "Stable 7.9.90 korrigiert die produktive Rollenoberfläche: Die Übersichtskacheln sind für Installateur und Gast/Endkunde zuverlässig bedienbar. Interner Admin und interne BackItUp-Notfallreserve werden in Dienste auch bei verzögert gerenderten Tabellen ausschließlich für Admin/Service angezeigt. Die Erstanmeldung prüft serverseitig, ob Installer, Guest oder User noch keinen persönlichen Zugang besitzen: Nur dann wird die normale Anmeldeschaltfläche bei leerem Passwort aktiv und öffnet die verpflichtende Passwortvergabe; nach abgeschlossener Aktivierung bleibt sie ohne Passwort gesperrt. NexoWatt Sicherung bleibt für freigegebene Rollen erreichbar, EOS Assist im Header und Standardport 8081 bleiben unverändert.",
+        "en": "Stable 7.9.90 fixes the production role interface: overview tiles are reliably clickable for Installer and Guest/End User. The internal admin and internal BackItUp emergency reserve are shown only to Admin/Service, including tables rendered asynchronously. First activation now checks eligibility on the server before enabling empty-password sign-in for Installer, Guest or User. Only an uninitialized/reset account gets an active sign-in button and mandatory password setup; after activation, empty-password sign-in remains disabled. NexoWatt Backup stays available to approved roles, while EOS Assist remains in the header and the default port remains 8081.",
+        "nl": "Stable 7.9.90 corrigeert de productie-rolinterface: overzichtstegels zijn betrouwbaar klikbaar voor installateur en gast/eindgebruiker. De interne admin en BackItUp-noodreserve zijn uitsluitend zichtbaar voor Admin/Service, ook in vertraagd gerenderde tabellen. Eerste activering controleert server-side of Installer, Guest of User nog geen persoonlijk wachtwoord heeft. Alleen dan wordt aanmelden met leeg wachtwoord actief en volgt verplichte wachtwoordinstelling; na activering blijft aanmelden zonder wachtwoord geblokkeerd. NexoWatt Backup blijft beschikbaar voor vrijgegeven rollen, EOS Assist blijft in de kop en standaardpoort 8081 blijft behouden."
+      },
       "7.9.89": {
         "de": "Stable 7.9.89 finalisiert die rollenbasierte NexoWatt-EOS-Verkaufsoberfläche: Admin/Service behält Vollzugriff und Expertenmodus, Installateure erhalten Inbetriebnahme und Fehlersuche, Gast/Endkunde die freigegebene Smart-Home-Bedienung. Die Erstanmeldung ist direkt in die normale Anmeldung integriert: Installer und Guest wählen ihre Ebene und lassen das Passwort einmalig leer, danach wird zwingend ein persönliches Passwort vergeben. EOS Assist sitzt kollisionsfrei im Kopfbereich; Zugangsverwaltung liegt ausschließlich unter „Zugänge & Rechte“. Die aktuelle Übersicht wurde modernisiert, die Easy-Übersicht wird nicht verwendet. Interner Admin und interne BackItUp-Notfallreserve sind nur für Admin/Service sichtbar; die NexoWatt-Sicherung bleibt für die freigegebenen Rollen nutzbar. Standardport ist 8081.",
         "en": "Stable 7.9.89 finalizes the role-based NexoWatt EOS sales interface: Admin/Service retains full access and expert mode, installers receive commissioning and troubleshooting functions, and Guest/End User receives the approved smart-home controls. First activation is integrated into the normal sign-in card: Installer and Guest select their level and leave the password empty once, then must create a personal password. EOS Assist is positioned safely in the header; account management exists only under “Access & Rights”. The current overview was modernized and the Easy overview is not used. The internal admin and internal BackItUp emergency reserve are visible only to Admin/Service, while NexoWatt Backup remains available to approved roles. Default port is 8081.",
@@ -304,7 +314,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.89/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.92/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -315,7 +325,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.89/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.92/README.md",
     "authors": [
       "bluefox <bluefox@ccu.io>",
       "hobbyquaker <hq@ccu.io>"
@@ -384,7 +394,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.89/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.92/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin"
   },
@@ -1088,5 +1098,5 @@
       }
     }
   },
-  "version": "7.9.89"
+  "version": "7.9.92"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin stable product release with integrated role login, modern overview and protected service reserves",
-  "version": "7.9.89",
+  "description": "NexoWatt EOS Admin stable product release with compact login, role-safe services and self-healing sales defaults",
+  "version": "7.9.92",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -110,11 +110,15 @@
     "tools/nexowatt-runtime-cleanup-selftest.cjs",
     "tools/nexowatt-account-management-selftest.cjs",
     "tools/nexowatt-modern-ui-selftest.cjs",
-    "README_STABILITY_V7.9.89.md",
-    "PUBLISH_STABLE_V7.9.89.md",
-    "INSTALL_TEST_V7.9.89.md",
-    "RELEASE_ACCEPTANCE_V7.9.89.md",
-    "tools/nexowatt-internal-reserve-selftest.cjs"
+    "tools/nexowatt-login-layout-selftest.cjs",
+    "README_STABILITY_V7.9.92.md",
+    "RELEASE_NOTES_V7.9.92.md",
+    "PUBLISH_STABLE_V7.9.92.md",
+    "INSTALL_TEST_V7.9.92.md",
+    "RELEASE_ACCEPTANCE_V7.9.92.md",
+    "tools/nexowatt-internal-reserve-selftest.cjs",
+    "tools/nexowatt-ensure-release-defaults.cjs",
+    "tools/nexowatt-release-defaults-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -125,7 +129,7 @@
     "test:integration": "mocha test/integration --exit && npm run test:gui && npm run test:rule && npm run test:unit",
     "test:rule": "mocha test/rule --exit",
     "test:gui": "mocha test/*.gui.js --exit",
-    "prepublishOnly": "npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
+    "prepublishOnly": "npm run prepare:eos-release-defaults && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
     "build": "npm run build:frontend && npm run build:backend && npm run clean:eos-runtime",
     "build:backend": "tsc -p tsconfig.build.json && tsx tasks.mts --backend-i18n",
     "build:frontend": "tsx tasks.mts",
@@ -149,11 +153,11 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
-    "precheck:eos-package": "npm run clean:eos-runtime",
-    "precheck:eos-stability": "npm run clean:eos-runtime",
+    "precheck:eos-package": "npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
+    "precheck:eos-stability": "npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
     "prepack": "node tools/nexowatt-clean-legacy-runtime.cjs --quiet",
     "check:eos-esm": "node tools/nexowatt-esm-syntax-selftest.cjs",
     "check:eos-imports": "node tools/nexowatt-import-integrity-selftest.cjs",
@@ -165,7 +169,11 @@
     "test:eos-default-port": "node tools/nexowatt-default-port-selftest.cjs",
     "test:eos-account-management": "node tools/nexowatt-account-management-selftest.cjs",
     "test:eos-modern-ui": "node tools/nexowatt-modern-ui-selftest.cjs",
-    "test:eos-internal-reserve": "node tools/nexowatt-internal-reserve-selftest.cjs"
+    "test:eos-internal-reserve": "node tools/nexowatt-internal-reserve-selftest.cjs",
+    "test:eos-login-layout": "node tools/nexowatt-login-layout-selftest.cjs",
+    "test:eos-release-defaults": "node tools/nexowatt-release-defaults-selftest.cjs",
+    "prepare:eos-release-defaults": "node tools/nexowatt-ensure-release-defaults.cjs",
+    "normalize:eos-release": "npm run prepare:eos-release-defaults"
   },
   "author": "NexoWatt",
   "private": false,
@@ -176,6 +184,6 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.89"
+    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.92"
   }
 }

package/tools/nexowatt-account-management-selftest.cjs

@@ -41,7 +41,7 @@ for (const code of [webSource, webBuilt]) {
 }
 
 for (const marker of [
-  'v89-account-management-under-access-rights', "['admin', 'installer']", 'nexowatt/account/manage',
+  'v91-account-management-under-access-rights', "['admin', 'installer']", 'nexowatt/account/manage',
   'nexowatt/account/reset', 'X-NexoWatt-EOS-Account-Reset', 'data.canResetInstaller === true',
   "account.role === 'enduser'", 'Admin/Service', 'Installateure', 'NEXOWATT_EOS_ACCOUNT_MANAGEMENT',
   'ensureEntrySurface', "currentRoute() !== 'tab-users'", 'eos-account-management-entry',

package/tools/nexowatt-ensure-release-defaults.cjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const CANONICAL_NATIVE_DEFAULTS = Object.freeze({
+    auth: true,
+    port: 8081,
+    eosLockLegacyAdmin: true,
+    eosHideLegacyAdminFromNonAdmins: true,
+    eosHideLegacyBackupFromNonAdmins: true,
+    nexowattHideLegacyBackupFromNonAdmins: true,
+    eosRequireFirstLoginPassword: true,
+});
+
+/**
+ * Enforce mandatory source defaults for every NexoWatt EOS sales release.
+ * This normalizes the repository io-package.json only. Existing installed
+ * instance configuration is not overwritten during adapter startup.
+ */
+function ensureReleaseDefaults(ioPackage) {
+    if (!ioPackage || typeof ioPackage !== 'object' || Array.isArray(ioPackage)) {
+        throw new TypeError('io-package.json must contain a JSON object');
+    }
+    const native = ioPackage.native && typeof ioPackage.native === 'object' && !Array.isArray(ioPackage.native)
+        ? ioPackage.native
+        : (ioPackage.native = {});
+    const changes = [];
+    for (const [key, value] of Object.entries(CANONICAL_NATIVE_DEFAULTS)) {
+        if (native[key] !== value) {
+            changes.push({ key, previous: native[key], value });
+            native[key] = value;
+        }
+    }
+    return {
+        ioPackage,
+        changed: changes.length > 0,
+        fields: changes.map(change => `native.${change.key}`),
+        changes,
+    };
+}
+
+function ensureFile(filePath) {
+    const absolute = path.resolve(filePath);
+    const parsed = JSON.parse(fs.readFileSync(absolute, 'utf8'));
+    const result = ensureReleaseDefaults(parsed);
+    if (result.changed) {
+        fs.writeFileSync(absolute, `${JSON.stringify(result.ioPackage, null, 2)}\n`, 'utf8');
+    }
+    return { file: absolute, ...result };
+}
+
+if (require.main === module) {
+    const root = path.resolve(__dirname, '..');
+    const target = process.argv[2] || path.join(root, 'io-package.json');
+    try {
+        const result = ensureFile(target);
+        if (result.changed) {
+            console.log(
+                `[NexoWatt EOS release defaults] repaired ${result.changes.length} canonical value(s): ${result.changes.map(change => change.key).join(', ')}`,
+            );
+        } else {
+            console.log('[NexoWatt EOS release defaults] OK (canonical sales defaults already present)');
+        }
+    } catch (error) {
+        console.error(`[NexoWatt EOS release defaults] ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
+    }
+}
+
+module.exports = { CANONICAL_NATIVE_DEFAULTS, ensureReleaseDefaults, ensureFile };

package/tools/nexowatt-internal-reserve-selftest.cjs

@@ -36,6 +36,7 @@ for (const code of [webSource, webBuilt]) {
 for (const marker of [
   'isOfficialAdminTab', 'isOfficialBackupTab', 'isOfficialReserveTab', 'isCustomerBackupTab',
   'system.adapter.backitup', 'tab-backitup', 'nexowatt-backup', 'eos-backup',
+  'exact visible instance ID', 'data-eos-official-reserve-hidden', 'Reused virtual rows must be unhidden',
 ]) if (!role.includes(marker)) fail(`role UI reserve marker missing: ${marker}`);
 for (const marker of ['isOfficialReserveTab', 'isCustomerBackupTab', 'backitup', 'nexowatt-backup']) {
   if (!boot.includes(marker)) fail(`bootstrap reserve marker missing: ${marker}`);

package/tools/nexowatt-login-layout-selftest.cjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const root = path.resolve(__dirname, '..');
+const read = rel => fs.readFileSync(path.join(root, rel), 'utf8');
+let bad = false;
+const fail = message => {
+    console.error(`[NexoWatt EOS login layout] ${message}`);
+    bad = true;
+};
+
+const css = read('adminWww/css/nexowatt-native-shell.css');
+const sourceCss = read('src-admin/public/css/nexowatt-native-shell.css');
+const login = read('src-admin/src/login/Login.tsx');
+const bootstrap = read('adminWww/js/eos-role-bootstrap.js');
+const index = read('adminWww/index.html');
+const buildInfo = JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));
+const shellTag = String(buildInfo.shellCacheTag || buildInfo.shellCacheVersion || '');
+
+if (css !== sourceCss) fail('login CSS source/build drift');
+if (!css.includes('outer frame is decorative only')) fail('decorative compact-frame contract is missing');
+if (css.includes('html.eos-login .MuiPaper-root:has(#username)')) {
+    fail('broad :has selector still styles the outer login Paper');
+}
+
+const outer = css.match(/html\.eos-login main\.MuiPaper-root\s*\{([\s\S]*?)\n\}/)?.[1] || '';
+for (const marker of [
+    'position: relative',
+    'width: 100%',
+    'min-height: 100vh',
+    'place-items: center',
+    'background: transparent !important',
+    'box-shadow: none !important',
+]) {
+    if (!outer.includes(marker)) fail(`transparent viewport host rule missing: ${marker}`);
+}
+
+const decorative = css.match(/html\.eos-login main\.MuiPaper-root::before\s*\{([\s\S]*?)\n\}/)?.[1] || '';
+for (const marker of [
+    "content: ''",
+    'width: min(390px, calc(100vw - 24px))',
+    'height: min(480px, calc(100vh - 24px))',
+    'transform: translate(-50%, -50%)',
+    'pointer-events: none',
+]) {
+    if (!decorative.includes(marker)) fail(`decorative rear frame rule missing: ${marker}`);
+}
+
+for (const marker of [
+    'html.eos-login main.MuiPaper-root > .eos-login-card-modern',
+    'html.eos-login main.MuiPaper-root > .MuiPaper-root:has(#username)',
+    'html.eos-login main.MuiPaper-root > .MuiPaper-root:has(#password)',
+    'width: min(334px, calc(100vw - 56px)) !important',
+    'height: min(424px, calc(100vh - 56px)) !important',
+    'max-height: none !important',
+]) {
+    if (!css.includes(marker)) fail(`inner compact card rule missing: ${marker}`);
+}
+if (!css.includes('.eos-login-first-status:empty { display: none; min-height: 0; margin: 0; }')) {
+    fail('empty first-login status still reserves vertical space');
+}
+
+if (!login.includes('Keep the familiar compact login page')) fail('native Login source lacks compact-page contract');
+if (login.includes('eos-login-role-selector-native') || login.includes('data-eos-account=')) {
+    fail('native Login source still renders role-selector buttons');
+}
+if (!bootstrap.includes('compact normal-login first activation')) fail('runtime compact first-login contract missing');
+if (!bootstrap.includes("card.querySelectorAll('.eos-login-role-selector').forEach(element => element.remove())")) {
+    fail('runtime does not remove stale role-selector surfaces');
+}
+if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('runtime still injects a second role-selector panel');
+
+if (!shellTag || !index.includes(`nexowatt-native-shell.css?v=${shellTag}`)) {
+    fail('login CSS cache key is not aligned with build information');
+}
+
+if (bad) process.exit(1);
+console.log('[NexoWatt EOS login layout] OK');

package/tools/nexowatt-modern-ui-selftest.cjs

@@ -19,8 +19,8 @@ for (const marker of [
   '--nx-shadow-soft', '--nx-shadow-float', 'backdrop-filter: blur', '#app-paper', '.MuiDialog-paper',
   '.MuiButton-root', '.MuiTableRow-root', ':focus-visible', 'border-radius: 24px', 'linear-gradient',
   '@media (max-width: 720px)', '.eos-activation-steps', '.eos-account-row:hover',
-  '.eos-login-role-selector', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
-  '.eos-account-management-entry', 'overflow: visible',
+  'main.MuiPaper-root::before', 'width: min(334px, calc(100vw - 56px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
+  '.eos-account-management-entry', 'pointer-events: auto !important', 'touch-action: manipulation', 'overflow: visible',
 ]) if (!css.includes(marker)) fail(`modern styling marker missing: ${marker}`);
 if (sourceCss !== css) fail('modern CSS source/build drift');
 for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','eos-role-bootstrap.js','eos-assistant.js']) {
@@ -29,12 +29,14 @@ for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','e
 for (const marker of ['NexoWatt EOS', 'Zugänge & Rollen', 'Endkunden-Zugänge', 'ensureEntrySurface']) {
   if (!accountUi.includes(marker)) fail(`modern account surface missing label: ${marker}`);
 }
-for (const marker of ['installIntegratedFirstLogin','eos-login-role-selector','eos-login-role-buttons','eos-passwordless-card']) {
+for (const marker of ['installIntegratedFirstLogin','v91 compact normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
   if (!bootstrap.includes(marker)) fail(`integrated first-activation surface missing: ${marker}`);
 }
+if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('compact login still injects role buttons or a second panel');
 if (bootstrap.includes("launcher.className = 'eos-passwordless-launcher'")) fail('old bottom first-login launcher is still rendered');
 if (!shell.includes('ensureModernOverview') || !shell.includes("currentTab() !== 'tab-intro'")) fail('current overview is not modernized');
-if (!role.includes('eos-role-safe-overview') || !role.includes("currentRoute() !== 'tab-intro'")) fail('role-safe current overview is missing');
+if (!role.includes('eos-role-safe-overview') || !role.includes("currentRoute() !== 'tab-intro'") || !role.includes('navigateToTab') || !role.includes("overview.querySelectorAll('a[data-eos-role-tab]')")) fail('role-safe current overview is missing or not directly clickable');
+if (!role.includes('ensureReserveObserver') || !role.includes('state.reserveObserver.observe(paper')) fail('scoped delayed-row reserve filter is missing');
 if (!assist.includes('eos-assist-header-root') || !assist.includes('insertBefore(root, userAnchor)')) fail('EOS Assist is not integrated in the header');
 if (assist.includes('position:fixed;bottom') || assist.includes('bottom:')) fail('EOS Assist still uses a bottom floating position');
 
@@ -42,7 +44,7 @@ const observerCount = [
   'eos-policy-client.js', 'eos-branding-sanitizer.js', 'nexowatt-native-shell.js', 'eos-native-security.js',
   'eos-basic-settings.js', 'eos-role-ui.js', 'eos-account-management.js', 'eos-assistant.js',
 ].reduce((count, file) => count + (read(`adminWww/js/${file}`).match(/new MutationObserver/g) || []).length, 0);
-if (observerCount !== 1) fail(`expected exactly one shared broad MutationObserver, found ${observerCount}`);
+if (observerCount !== 2) fail(`expected one shared observer plus one scoped reserve-row observer, found ${observerCount}`);
 
 if (bad) process.exit(1);
 console.log('[NexoWatt EOS modern UI] OK');

package/tools/nexowatt-release-defaults-selftest.cjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const { CANONICAL_NATIVE_DEFAULTS, ensureReleaseDefaults } = require('./nexowatt-ensure-release-defaults.cjs');
+
+const unsafe = {
+    common: { name: 'eos-admin' },
+    native: {
+        auth: false,
+        port: 8091,
+        eosLockLegacyAdmin: false,
+        eosHideLegacyAdminFromNonAdmins: false,
+        eosHideLegacyBackupFromNonAdmins: false,
+        nexowattHideLegacyBackupFromNonAdmins: false,
+        eosRequireFirstLoginPassword: false,
+    },
+};
+const repaired = ensureReleaseDefaults(unsafe);
+assert.ok(repaired.changes.length >= 7, 'unsafe defaults must be repaired');
+for (const [key, expected] of Object.entries(CANONICAL_NATIVE_DEFAULTS)) {
+    assert.equal(repaired.ioPackage.native[key], expected, `${key} must be normalized`);
+}
+
+const canonical = { native: { ...CANONICAL_NATIVE_DEFAULTS } };
+const unchanged = ensureReleaseDefaults(canonical);
+assert.equal(unchanged.changes.length, 0, 'canonical defaults must remain unchanged');
+
+console.log('[NexoWatt EOS release defaults selftest] OK');

package/tools/nexowatt-validate-package.cjs

@@ -32,10 +32,15 @@ if (prerelease) {
 } else if (pkg.nexowattReleasePolicy?.acceptedPrerelease) {
   fail(`stable package must remove stale acceptedPrerelease ${pkg.nexowattReleasePolicy.acceptedPrerelease}`);
 }
+if (pkg.scripts['prepare:eos-release-defaults'] !== 'node tools/nexowatt-ensure-release-defaults.cjs') fail('release-default preparation script is missing');
+if (pkg.scripts['test:eos-release-defaults'] !== 'node tools/nexowatt-release-defaults-selftest.cjs') fail('release-default selftest script is missing');
 if (pkg.scripts['check:eos-publish-channel'] !== 'node tools/nexowatt-publish-channel-guard.cjs') fail('publish channel guard script is missing');
-if (!pkg.scripts.prepublishOnly?.startsWith('npm run check:eos-publish-channel')) fail('prepublishOnly must execute the publish channel guard first');
+if (!pkg.scripts.prepublishOnly?.startsWith('npm run prepare:eos-release-defaults && npm run check:eos-publish-channel')) fail('prepublishOnly must normalize release defaults before the publish channel guard');
+if (pkg.scripts['precheck:eos-package'] !== 'npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-package must normalize release defaults and clean stale runtime files');
+if (pkg.scripts['precheck:eos-stability'] !== 'npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-stability must normalize release defaults and clean stale runtime files');
 if (pkg.scripts['test:eos-publish-channel'] !== 'node tools/nexowatt-publish-channel-selftest.cjs') fail('publish channel selftest script is missing');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-publish-channel-selftest.cjs')) fail('stability check must execute the publish channel selftest');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-release-defaults-selftest.cjs')) fail('stability check must execute the release-default selftest');
 if (io.native?.auth !== true) fail('fresh sales installations must default to authenticated access');
 if (io.native?.eosHideLegacyBackupFromNonAdmins !== true) fail('internal BackItUp reserve must default to Admin/Service visibility');
 if (io.native?.nexowattHideLegacyBackupFromNonAdmins !== true) fail('NexoWatt backup visibility compatibility flag must default to true');
@@ -98,10 +103,10 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.9.89.md',
-  'PUBLISH_STABLE_V7.9.89.md',
-  'INSTALL_TEST_V7.9.89.md',
-  'RELEASE_ACCEPTANCE_V7.9.89.md',
+  'README_STABILITY_V7.9.92.md',
+  'PUBLISH_STABLE_V7.9.92.md',
+  'INSTALL_TEST_V7.9.92.md',
+  'RELEASE_ACCEPTANCE_V7.9.92.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -113,10 +118,13 @@ for (const file of [
   'tools/nexowatt-first-login-selftest.cjs',
   'tools/nexowatt-account-management-selftest.cjs',
   'tools/nexowatt-modern-ui-selftest.cjs',
+  'tools/nexowatt-login-layout-selftest.cjs',
   'tools/nexowatt-internal-reserve-selftest.cjs',
   'tools/nexowatt-branding-selftest.cjs',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',
+  'tools/nexowatt-ensure-release-defaults.cjs',
+  'tools/nexowatt-release-defaults-selftest.cjs',
   'tools/nexowatt-default-port-selftest.cjs',
   '.npmrc',
   repositoryEntryFile,
@@ -195,7 +203,9 @@ if (accountManagement.includes("launcher.className = 'eos-account-management-lau
 if (accountManagement.includes('new MutationObserver')) fail('account-management runtime adds a second broad DOM observer');
 if (read('src-admin/public/js/eos-account-management.js') !== accountManagement) fail('account-management source/build drift');
 const roleBootstrap = read('adminWww/js/eos-role-bootstrap.js');
-if (!roleBootstrap.includes('installIntegratedFirstLogin') || !roleBootstrap.includes('eos-login-role-selector')) fail('integrated first-login is incomplete');
+if (!roleBootstrap.includes('installIntegratedFirstLogin') || !roleBootstrap.includes('v91 compact normal-login first activation')) fail('compact integrated first-login is incomplete');
+if (/data-eos-account=|selector\.innerHTML/.test(roleBootstrap)) fail('login role buttons must not enlarge the normal login card');
+if (!roleBootstrap.includes('nexowatt/account/passwordless-status') || !roleBootstrap.includes('eligibility.allowed')) fail('server-checked first-login eligibility is incomplete');
 if (roleBootstrap.includes('installPasswordlessFirstLoginLauncher')) fail('old first-login launcher remains active');
 const assistant = read('adminWww/js/eos-assistant.js');
 if (!assistant.includes('eos-assist-header-root') || !assistant.includes('insertBefore(root, userAnchor)')) fail('EOS Assist is not header-integrated');
@@ -217,14 +227,14 @@ if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-esm-syntax-selftest.
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-import-integrity-selftest.cjs')) fail('import integrity selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-entrypoint-smoke-selftest.cjs')) fail('entrypoint smoke selftest is not part of check:eos-stability');
 if (pkg.scripts['clean:eos-runtime'] !== 'node tools/nexowatt-clean-legacy-runtime.cjs') fail('clean:eos-runtime script is missing or incorrect');
-if (pkg.scripts['precheck:eos-package'] !== 'npm run clean:eos-runtime') fail('precheck:eos-package must clean stale runtime files');
-if (pkg.scripts['precheck:eos-stability'] !== 'npm run clean:eos-runtime') fail('precheck:eos-stability must clean stale runtime files');
 if (pkg.scripts.prepack !== 'node tools/nexowatt-clean-legacy-runtime.cjs --quiet') fail('prepack must silently clean stale runtime files');
 if (!pkg.scripts.build?.includes('npm run clean:eos-runtime')) fail('build must finish with runtime cleanup');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-role-access-selftest.cjs')) fail('role access selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-first-login-selftest.cjs')) fail('first-login selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-management-selftest.cjs')) fail('account-management selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-modern-ui-selftest.cjs')) fail('modern-UI selftest is not part of check:eos-stability');
+if (pkg.scripts['test:eos-login-layout'] !== 'node tools/nexowatt-login-layout-selftest.cjs') fail('login-layout selftest script is missing or incorrect');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-login-layout-selftest.cjs')) fail('login-layout selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-internal-reserve-selftest.cjs')) fail('internal reserve selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-branding-selftest.cjs')) fail('branding selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-native-shell-selftest.cjs')) fail('native shell selftest is not part of check:eos-stability');

package/INSTALL_TEST_V7.9.89.md

@@ -1,73 +0,0 @@
-# Installation und Abnahme – NexoWatt EOS Admin 7.9.89
-
-## Installation aus npm
-
-```bash
-cd /opt/iobroker
-iobroker backup
-iobroker stop eos-admin.0
-npm install --no-save --omit=dev iobroker.eos-admin@7.9.89
-iobroker upload eos-admin
-iobroker restart eos-admin.0
-```
-
-## Portbelegung
-
-```bash
-iobroker set admin.0 --port 18081 --ip 127.0.0.1 --enabled false
-iobroker set eos-admin.0 --port 8081 --ip 0.0.0.0 --enabled true
-iobroker restart eos-admin.0
-```
-
-Aufruf:
-
-```text
-http://SYSTEM-IP:8081
-```
-
-## Pflichtabnahme
-
-### Admin / Service
-
-- Anmeldung mit dem fest eingerichteten Passwort.
-- Kein erzwungener Erstkennwortdialog.
-- Expertenmodus verfügbar.
-- Interner Admin und System-Notfallsicherung sichtbar.
-- Vollständige Zugangs- und Rechteverwaltung.
-
-### Installateur
-
-- Erste Aktivierung: Ebene **Installateur**, Benutzer `installer`, Passwort leer, danach persönliches Passwort setzen.
-- Kein Expertenmodus.
-- Inbetriebnahme, Module, Dienste, Datenpunkte und Diagnose erreichbar.
-- **Zugänge & Rechte** erreichbar; nur Endkunden-Reset möglich.
-- Interner Admin und interne BackItUp-Notfallreserve nicht sichtbar.
-- NexoWatt Sicherung nutzbar, sofern installiert und freigegeben.
-
-### Gast / Endkunde
-
-- Erste Aktivierung: Ebene **Gast / Endkunde**, Benutzer `guest`, Passwort leer, danach persönliches Passwort setzen.
-- Kein Expertenmodus.
-- Freigegebenes Smart Home, Räume, Funktionen und Bedienoberflächen erreichbar.
-- Keine technischen System-, Repository-, Zertifikats- oder Rohdiagnosebereiche.
-- Interner Admin und interne BackItUp-Notfallreserve nicht sichtbar.
-- NexoWatt Sicherung nutzbar, sofern freigegeben.
-
-### Bedienoberfläche
-
-- EOS Assist sitzt im Kopfbereich und überlappt keine Inhalte.
-- Zugangsverwaltung erscheint nur unter **Zugänge & Rechte**.
-- Startseite ist **Übersicht**, nicht Easy.
-- Keine `permissionError`-Leerseite.
-- Dialoge, Popups und Schließen-Schaltflächen funktionieren.
-- Schreibbare Datenpunkte sind entsprechend Rolle bedienbar.
-
-## Rückfall auf 7.9.86
-
-```bash
-cd /opt/iobroker
-iobroker stop eos-admin.0
-npm install --no-save --omit=dev iobroker.eos-admin@7.9.86
-iobroker upload eos-admin
-iobroker restart eos-admin.0
-```

package/PUBLISH_STABLE_V7.9.89.md

@@ -1,33 +0,0 @@
-# npm-Veröffentlichung – NexoWatt EOS Admin 7.9.89 Stable
-
-## Vorprüfung
-
-```powershell
-npm run check:eos-publish-channel
-npm run check:eos-package
-npm run check:eos-stability
-npm publish --dry-run --tag latest
-```
-
-## Veröffentlichung
-
-```powershell
-npm login
-npm whoami
-npm publish --tag latest
-```
-
-## Kontrolle
-
-```powershell
-npm view iobroker.eos-admin@latest version
-npm dist-tag ls iobroker.eos-admin
-```
-
-Erwartet:
-
-```text
-latest: 7.9.89
-```
-
-Bereits veröffentlichte Paketversionen dürfen nicht mit verändertem Inhalt erneut veröffentlicht werden. Jede spätere Änderung benötigt eine höhere Versionsnummer.