iobroker.eos-admin 7.9.89 → 7.9.93

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.9.89",
+    "version": "7.9.93",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,6 +18,21 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
+      "7.9.93": {
+        "de": "Testkandidat 7.9.93 entfernt den unnötigen Scrollbalken aus der kompakten Anmeldung, zeigt in der Modulinstallation NexoWatt als sichtbaren Herausgeber und ersetzt die statischen EOS-Assist-Texte durch einen authentifizierten, rollenabhängigen und schreibgeschützten Systemassistenten. EOS Assist kann – nach einmaliger Konfiguration durch Admin/Service – reale Module, Dienste, Einstellungen, Geräte, Datenpunkte, Struktur, Logs, Historie und Sicherungsstatus über die freigegebenen Systemwerkzeuge prüfen. Technische Paketkennungen bleiben intern kompatibel.",
+        "en": "Test candidate 7.9.93 removes the unnecessary scrollbar from the compact login, shows NexoWatt as the visible publisher in module installation, and replaces static EOS Assist texts with an authenticated, role-aware, read-only system assistant. Once configured by Admin/Service, EOS Assist can inspect real modules, services, settings, devices, datapoints, structure, logs, history and backup status through the permitted system tools. Technical package identifiers remain internally compatible.",
+        "nl": "Testkandidaat 7.9.93 verwijdert de overbodige schuifbalk uit de compacte aanmelding, toont NexoWatt als zichtbare uitgever bij module-installatie en vervangt statische EOS Assist-teksten door een geauthenticeerde, rolafhankelijke en alleen-lezen systeemassistent. Na eenmalige configuratie door Admin/Service kan EOS Assist echte modules, diensten, instellingen, apparaten, datapunten, structuur, logs, historie en back-upstatus controleren via de toegestane systeemtools. Technische pakket-ID’s blijven intern compatibel."
+      },
+      "7.9.92": {
+        "de": "Stable 7.9.92 korrigiert die Release-Vorbereitung: Vor Paketprüfung und npm-Veröffentlichung werden die verbindlichen Verkaufsstandardwerte für Authentifizierung, Port 8081 sowie die ausschließlich für Admin/Service sichtbaren internen Admin- und BackItUp-Notfallreserven automatisch normalisiert. Dadurch kann ein gemischter lokaler Arbeitsordner die Sicherheitsprüfung nicht mehr durch einen fehlenden Standardwert abbrechen. Rollen-, Login-, Übersichts- und Dienstefilter aus 7.9.91 bleiben unverändert.",
+        "en": "Stable 7.9.92 hardens release preparation: before package validation and npm publishing, the mandatory sales defaults for authentication, port 8081 and the Admin/Service-only internal admin and BackItUp emergency reserves are normalized automatically. A mixed local working tree can therefore no longer abort the security check merely because a required default value is missing. Role, login, overview and service filtering from 7.9.91 remain unchanged.",
+        "nl": "Stable 7.9.92 verhardt de releasevoorbereiding: vóór pakketcontrole en npm-publicatie worden de verplichte verkoopstandaarden voor authenticatie, poort 8081 en de uitsluitend voor Admin/Service zichtbare interne admin- en BackItUp-noodreserve automatisch genormaliseerd. Een gemengde lokale werkmap kan de veiligheidscontrole daardoor niet meer laten stoppen door een ontbrekende standaardwaarde. Rollen-, login-, overzichts- en dienstenfilters uit 7.9.91 blijven ongewijzigd."
+      },
+      "7.9.90": {
+        "de": "Stable 7.9.90 korrigiert die produktive Rollenoberfläche: Die Übersichtskacheln sind für Installateur und Gast/Endkunde zuverlässig bedienbar. Interner Admin und interne BackItUp-Notfallreserve werden in Dienste auch bei verzögert gerenderten Tabellen ausschließlich für Admin/Service angezeigt. Die Erstanmeldung prüft serverseitig, ob Installer, Guest oder User noch keinen persönlichen Zugang besitzen: Nur dann wird die normale Anmeldeschaltfläche bei leerem Passwort aktiv und öffnet die verpflichtende Passwortvergabe; nach abgeschlossener Aktivierung bleibt sie ohne Passwort gesperrt. NexoWatt Sicherung bleibt für freigegebene Rollen erreichbar, EOS Assist im Header und Standardport 8081 bleiben unverändert.",
+        "en": "Stable 7.9.90 fixes the production role interface: overview tiles are reliably clickable for Installer and Guest/End User. The internal admin and internal BackItUp emergency reserve are shown only to Admin/Service, including tables rendered asynchronously. First activation now checks eligibility on the server before enabling empty-password sign-in for Installer, Guest or User. Only an uninitialized/reset account gets an active sign-in button and mandatory password setup; after activation, empty-password sign-in remains disabled. NexoWatt Backup stays available to approved roles, while EOS Assist remains in the header and the default port remains 8081.",
+        "nl": "Stable 7.9.90 corrigeert de productie-rolinterface: overzichtstegels zijn betrouwbaar klikbaar voor installateur en gast/eindgebruiker. De interne admin en BackItUp-noodreserve zijn uitsluitend zichtbaar voor Admin/Service, ook in vertraagd gerenderde tabellen. Eerste activering controleert server-side of Installer, Guest of User nog geen persoonlijk wachtwoord heeft. Alleen dan wordt aanmelden met leeg wachtwoord actief en volgt verplichte wachtwoordinstelling; na activering blijft aanmelden zonder wachtwoord geblokkeerd. NexoWatt Backup blijft beschikbaar voor vrijgegeven rollen, EOS Assist blijft in de kop en standaardpoort 8081 blijft behouden."
+      },
       "7.9.89": {
         "de": "Stable 7.9.89 finalisiert die rollenbasierte NexoWatt-EOS-Verkaufsoberfläche: Admin/Service behält Vollzugriff und Expertenmodus, Installateure erhalten Inbetriebnahme und Fehlersuche, Gast/Endkunde die freigegebene Smart-Home-Bedienung. Die Erstanmeldung ist direkt in die normale Anmeldung integriert: Installer und Guest wählen ihre Ebene und lassen das Passwort einmalig leer, danach wird zwingend ein persönliches Passwort vergeben. EOS Assist sitzt kollisionsfrei im Kopfbereich; Zugangsverwaltung liegt ausschließlich unter „Zugänge & Rechte“. Die aktuelle Übersicht wurde modernisiert, die Easy-Übersicht wird nicht verwendet. Interner Admin und interne BackItUp-Notfallreserve sind nur für Admin/Service sichtbar; die NexoWatt-Sicherung bleibt für die freigegebenen Rollen nutzbar. Standardport ist 8081.",
         "en": "Stable 7.9.89 finalizes the role-based NexoWatt EOS sales interface: Admin/Service retains full access and expert mode, installers receive commissioning and troubleshooting functions, and Guest/End User receives the approved smart-home controls. First activation is integrated into the normal sign-in card: Installer and Guest select their level and leave the password empty once, then must create a personal password. EOS Assist is positioned safely in the header; account management exists only under “Access & Rights”. The current overview was modernized and the Easy overview is not used. The internal admin and internal BackItUp emergency reserve are visible only to Admin/Service, while NexoWatt Backup remains available to approved roles. Default port is 8081.",
@@ -304,7 +319,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.89/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.93/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -315,10 +330,9 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.89/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.93/README.md",
     "authors": [
-      "bluefox <bluefox@ccu.io>",
-      "hobbyquaker <hq@ccu.io>"
+      "NexoWatt"
     ],
     "dependencies": [
       {
@@ -384,9 +398,10 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.89/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.93/io-package.json",
     "npmPackage": "iobroker.eos-admin",
-    "packetName": "iobroker.eos-admin"
+    "packetName": "iobroker.eos-admin",
+    "publisher": "NexoWatt"
   },
   "native": {
     "autoUpdate": 24,
@@ -1088,5 +1103,5 @@
       }
     }
   },
-  "version": "7.9.89"
+  "version": "7.9.93"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin stable product release with integrated role login, modern overview and protected service reserves",
-  "version": "7.9.89",
+  "description": "NexoWatt EOS Admin test candidate with compact login, visible NexoWatt publisher and live role-aware EOS Assist",
+  "version": "7.9.93",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -110,11 +110,15 @@
     "tools/nexowatt-runtime-cleanup-selftest.cjs",
     "tools/nexowatt-account-management-selftest.cjs",
     "tools/nexowatt-modern-ui-selftest.cjs",
-    "README_STABILITY_V7.9.89.md",
-    "PUBLISH_STABLE_V7.9.89.md",
-    "INSTALL_TEST_V7.9.89.md",
-    "RELEASE_ACCEPTANCE_V7.9.89.md",
-    "tools/nexowatt-internal-reserve-selftest.cjs"
+    "tools/nexowatt-login-layout-selftest.cjs",
+    "tools/nexowatt-internal-reserve-selftest.cjs",
+    "tools/nexowatt-ensure-release-defaults.cjs",
+    "tools/nexowatt-release-defaults-selftest.cjs",
+    "README_STABILITY_V7.9.93.md",
+    "RELEASE_NOTES_V7.9.93.md",
+    "PUBLISH_STABLE_V7.9.93.md",
+    "INSTALL_TEST_V7.9.93.md",
+    "RELEASE_ACCEPTANCE_V7.9.93.md"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -125,7 +129,7 @@
     "test:integration": "mocha test/integration --exit && npm run test:gui && npm run test:rule && npm run test:unit",
     "test:rule": "mocha test/rule --exit",
     "test:gui": "mocha test/*.gui.js --exit",
-    "prepublishOnly": "npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
+    "prepublishOnly": "npm run prepare:eos-release-defaults && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
     "build": "npm run build:frontend && npm run build:backend && npm run clean:eos-runtime",
     "build:backend": "tsc -p tsconfig.build.json && tsx tasks.mts --backend-i18n",
     "build:frontend": "tsx tasks.mts",
@@ -149,11 +153,11 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
-    "precheck:eos-package": "npm run clean:eos-runtime",
-    "precheck:eos-stability": "npm run clean:eos-runtime",
+    "precheck:eos-package": "npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
+    "precheck:eos-stability": "npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
     "prepack": "node tools/nexowatt-clean-legacy-runtime.cjs --quiet",
     "check:eos-esm": "node tools/nexowatt-esm-syntax-selftest.cjs",
     "check:eos-imports": "node tools/nexowatt-import-integrity-selftest.cjs",
@@ -165,7 +169,11 @@
     "test:eos-default-port": "node tools/nexowatt-default-port-selftest.cjs",
     "test:eos-account-management": "node tools/nexowatt-account-management-selftest.cjs",
     "test:eos-modern-ui": "node tools/nexowatt-modern-ui-selftest.cjs",
-    "test:eos-internal-reserve": "node tools/nexowatt-internal-reserve-selftest.cjs"
+    "test:eos-internal-reserve": "node tools/nexowatt-internal-reserve-selftest.cjs",
+    "test:eos-login-layout": "node tools/nexowatt-login-layout-selftest.cjs",
+    "test:eos-release-defaults": "node tools/nexowatt-release-defaults-selftest.cjs",
+    "prepare:eos-release-defaults": "node tools/nexowatt-ensure-release-defaults.cjs",
+    "normalize:eos-release": "npm run prepare:eos-release-defaults"
   },
   "author": "NexoWatt",
   "private": false,
@@ -176,6 +184,6 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.89"
+    "purpose": "test candidate for accepted stable NexoWatt EOS sales-product release 7.9.93"
   }
 }

package/tools/nexowatt-account-management-selftest.cjs

@@ -41,7 +41,7 @@ for (const code of [webSource, webBuilt]) {
 }
 
 for (const marker of [
-  'v89-account-management-under-access-rights', "['admin', 'installer']", 'nexowatt/account/manage',
+  'v93-account-management-under-access-rights', "['admin', 'installer']", 'nexowatt/account/manage',
   'nexowatt/account/reset', 'X-NexoWatt-EOS-Account-Reset', 'data.canResetInstaller === true',
   "account.role === 'enduser'", 'Admin/Service', 'Installateure', 'NEXOWATT_EOS_ACCOUNT_MANAGEMENT',
   'ensureEntrySurface', "currentRoute() !== 'tab-users'", 'eos-account-management-entry',

package/tools/nexowatt-ensure-release-defaults.cjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const CANONICAL_NATIVE_DEFAULTS = Object.freeze({
+    auth: true,
+    port: 8081,
+    eosLockLegacyAdmin: true,
+    eosHideLegacyAdminFromNonAdmins: true,
+    eosHideLegacyBackupFromNonAdmins: true,
+    nexowattHideLegacyBackupFromNonAdmins: true,
+    eosRequireFirstLoginPassword: true,
+});
+
+/**
+ * Enforce mandatory source defaults for every NexoWatt EOS sales release.
+ * This normalizes the repository io-package.json only. Existing installed
+ * instance configuration is not overwritten during adapter startup.
+ */
+function ensureReleaseDefaults(ioPackage) {
+    if (!ioPackage || typeof ioPackage !== 'object' || Array.isArray(ioPackage)) {
+        throw new TypeError('io-package.json must contain a JSON object');
+    }
+    const native = ioPackage.native && typeof ioPackage.native === 'object' && !Array.isArray(ioPackage.native)
+        ? ioPackage.native
+        : (ioPackage.native = {});
+    const changes = [];
+    for (const [key, value] of Object.entries(CANONICAL_NATIVE_DEFAULTS)) {
+        if (native[key] !== value) {
+            changes.push({ key, previous: native[key], value });
+            native[key] = value;
+        }
+    }
+    return {
+        ioPackage,
+        changed: changes.length > 0,
+        fields: changes.map(change => `native.${change.key}`),
+        changes,
+    };
+}
+
+function ensureFile(filePath) {
+    const absolute = path.resolve(filePath);
+    const parsed = JSON.parse(fs.readFileSync(absolute, 'utf8'));
+    const result = ensureReleaseDefaults(parsed);
+    if (result.changed) {
+        fs.writeFileSync(absolute, `${JSON.stringify(result.ioPackage, null, 2)}\n`, 'utf8');
+    }
+    return { file: absolute, ...result };
+}
+
+if (require.main === module) {
+    const root = path.resolve(__dirname, '..');
+    const target = process.argv[2] || path.join(root, 'io-package.json');
+    try {
+        const result = ensureFile(target);
+        if (result.changed) {
+            console.log(
+                `[NexoWatt EOS release defaults] repaired ${result.changes.length} canonical value(s): ${result.changes.map(change => change.key).join(', ')}`,
+            );
+        } else {
+            console.log('[NexoWatt EOS release defaults] OK (canonical sales defaults already present)');
+        }
+    } catch (error) {
+        console.error(`[NexoWatt EOS release defaults] ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
+    }
+}
+
+module.exports = { CANONICAL_NATIVE_DEFAULTS, ensureReleaseDefaults, ensureFile };

package/tools/nexowatt-internal-reserve-selftest.cjs

@@ -16,6 +16,7 @@ const role = read('adminWww/js/eos-role-ui.js');
 const boot = read('adminWww/js/eos-role-bootstrap.js');
 const drawer = read('src-admin/src/components/Drawer.tsx');
 const assist = read('adminWww/js/eos-assistant.js');
+const knowledge = read('src/lib/chat/assistantKnowledge.ts');
 const io = json('io-package.json');
 
 for (const code of [mainSource, mainBuilt]) {
@@ -36,6 +37,7 @@ for (const code of [webSource, webBuilt]) {
 for (const marker of [
   'isOfficialAdminTab', 'isOfficialBackupTab', 'isOfficialReserveTab', 'isCustomerBackupTab',
   'system.adapter.backitup', 'tab-backitup', 'nexowatt-backup', 'eos-backup',
+  'exact visible instance ID', 'data-eos-official-reserve-hidden', 'Reused virtual rows must be unhidden',
 ]) if (!role.includes(marker)) fail(`role UI reserve marker missing: ${marker}`);
 for (const marker of ['isOfficialReserveTab', 'isCustomerBackupTab', 'backitup', 'nexowatt-backup']) {
   if (!boot.includes(marker)) fail(`bootstrap reserve marker missing: ${marker}`);
@@ -43,7 +45,8 @@ for (const marker of ['isOfficialReserveTab', 'isCustomerBackupTab', 'backitup',
 for (const marker of ['System-Notfallsicherung', 'NexoWatt Sicherung', '^tab-backitup', 'nexowatt-backup|eos-backup']) {
   if (!drawer.includes(marker)) fail(`Drawer reserve marker missing: ${marker}`);
 }
-if (!assist.includes('NexoWatt Sicherung') || !assist.includes('System-Notfallsicherung')) fail('EOS Assist backup explanation is incomplete');
+if (!assist.includes('NexoWatt Backup') && !assist.includes('Sicherungsstatus')) fail('EOS Assist runtime lacks backup-system context');
+if (!knowledge.includes('NexoWatt Backup') || !knowledge.includes('Admin/Service')) fail('EOS Assist knowledge lacks role-aware backup context');
 if (io.native?.eosHideLegacyBackupFromNonAdmins !== true) fail('eosHideLegacyBackupFromNonAdmins must default to true');
 if (io.native?.nexowattHideLegacyBackupFromNonAdmins !== true) fail('nexowattHideLegacyBackupFromNonAdmins must default to true');
 const reserve = (io.native?.eosProtectedAdapters || []).find(entry => entry.adapter === 'backitup');

package/tools/nexowatt-login-layout-selftest.cjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const root = path.resolve(__dirname, '..');
+const read = rel => fs.readFileSync(path.join(root, rel), 'utf8');
+let bad = false;
+const fail = message => {
+    console.error(`[NexoWatt EOS login layout] ${message}`);
+    bad = true;
+};
+
+const css = read('adminWww/css/nexowatt-native-shell.css');
+const sourceCss = read('src-admin/public/css/nexowatt-native-shell.css');
+const login = read('src-admin/src/login/Login.tsx');
+const bootstrap = read('adminWww/js/eos-role-bootstrap.js');
+const index = read('adminWww/index.html');
+const buildInfo = JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));
+const shellTag = String(buildInfo.shellCacheTag || buildInfo.shellCacheVersion || '');
+
+if (css !== sourceCss) fail('login CSS source/build drift');
+if (!css.includes('outer frame is decorative only')) fail('decorative compact-frame contract is missing');
+if (css.includes('html.eos-login .MuiPaper-root:has(#username)')) fail('broad :has selector still styles the outer login Paper');
+
+const outer = css.match(/html\.eos-login main\.MuiPaper-root\s*\{([\s\S]*?)\n\}/)?.[1] || '';
+for (const marker of ['position: relative', 'width: 100%', 'min-height: 100vh', 'place-items: center', 'background: transparent !important', 'box-shadow: none !important']) {
+    if (!outer.includes(marker)) fail(`transparent viewport host rule missing: ${marker}`);
+}
+const decorative = css.match(/html\.eos-login main\.MuiPaper-root::before\s*\{([\s\S]*?)\n\}/)?.[1] || '';
+for (const marker of ["content: ''", 'width: min(390px, calc(100vw - 24px))', 'height: min(480px, calc(100vh - 24px))', 'transform: translate(-50%, -50%)', 'pointer-events: none']) {
+    if (!decorative.includes(marker)) fail(`decorative rear frame rule missing: ${marker}`);
+}
+const compactBlocks = [...css.matchAll(/html\.eos-login[^\{]*eos-login-card-modern[^\{]*\{([\s\S]*?)\n\}/g)].map(match => match[1]);
+if (!compactBlocks.length) fail('compact login card CSS block missing');
+for (const block of compactBlocks) {
+    if (/overflow\s*:\s*auto\s*!important/.test(block) || /overflow-y\s*:\s*(?:auto|scroll)/.test(block)) {
+        fail('compact login card still creates an internal scrollbar');
+    }
+}
+for (const marker of [
+    'html.eos-login main.MuiPaper-root > .eos-login-card-modern',
+    'html.eos-login main.MuiPaper-root > .MuiPaper-root:has(#username)',
+    'html.eos-login main.MuiPaper-root > .MuiPaper-root:has(#password)',
+    'width: min(334px, calc(100vw - 56px)) !important',
+    'height: min(424px, calc(100vh - 56px)) !important',
+    'max-height: none !important',
+    'overflow: hidden !important',
+    'scrollbar-width: none !important',
+    '::-webkit-scrollbar',
+]) if (!css.includes(marker)) fail(`inner compact card rule missing: ${marker}`);
+if (!css.includes('.eos-login-first-status:empty { display: none; min-height: 0; margin: 0; }')) fail('empty first-login status still reserves vertical space');
+if (!login.includes('Keep the familiar compact login page')) fail('native Login source lacks compact-page contract');
+if (!login.includes("overflowY: 'hidden'")) fail('native Login paper still enables vertical scrolling');
+if (login.includes('eos-login-role-selector-native') || login.includes('data-eos-account=')) fail('native Login source still renders role-selector buttons');
+if (!bootstrap.includes('compact normal-login first activation')) fail('runtime compact first-login contract missing');
+if (!bootstrap.includes("card.querySelectorAll('.eos-login-role-selector').forEach(element => element.remove())")) fail('runtime does not remove stale role-selector surfaces');
+if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('runtime still injects a second role-selector panel');
+if (!shellTag || !index.includes(`nexowatt-native-shell.css?v=${shellTag}`)) fail('login CSS cache key is not aligned with build information');
+if (bad) process.exit(1);
+console.log('[NexoWatt EOS login layout] OK');

package/tools/nexowatt-modern-ui-selftest.cjs

@@ -19,8 +19,8 @@ for (const marker of [
   '--nx-shadow-soft', '--nx-shadow-float', 'backdrop-filter: blur', '#app-paper', '.MuiDialog-paper',
   '.MuiButton-root', '.MuiTableRow-root', ':focus-visible', 'border-radius: 24px', 'linear-gradient',
   '@media (max-width: 720px)', '.eos-activation-steps', '.eos-account-row:hover',
-  '.eos-login-role-selector', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
-  '.eos-account-management-entry', 'overflow: visible',
+  'main.MuiPaper-root::before', 'width: min(334px, calc(100vw - 56px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
+  '.eos-account-management-entry', 'pointer-events: auto !important', 'touch-action: manipulation', 'overflow: visible',
 ]) if (!css.includes(marker)) fail(`modern styling marker missing: ${marker}`);
 if (sourceCss !== css) fail('modern CSS source/build drift');
 for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','eos-role-bootstrap.js','eos-assistant.js']) {
@@ -29,12 +29,14 @@ for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','e
 for (const marker of ['NexoWatt EOS', 'Zugänge & Rollen', 'Endkunden-Zugänge', 'ensureEntrySurface']) {
   if (!accountUi.includes(marker)) fail(`modern account surface missing label: ${marker}`);
 }
-for (const marker of ['installIntegratedFirstLogin','eos-login-role-selector','eos-login-role-buttons','eos-passwordless-card']) {
+for (const marker of ['installIntegratedFirstLogin','v93 compact normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
   if (!bootstrap.includes(marker)) fail(`integrated first-activation surface missing: ${marker}`);
 }
+if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('compact login still injects role buttons or a second panel');
 if (bootstrap.includes("launcher.className = 'eos-passwordless-launcher'")) fail('old bottom first-login launcher is still rendered');
 if (!shell.includes('ensureModernOverview') || !shell.includes("currentTab() !== 'tab-intro'")) fail('current overview is not modernized');
-if (!role.includes('eos-role-safe-overview') || !role.includes("currentRoute() !== 'tab-intro'")) fail('role-safe current overview is missing');
+if (!role.includes('eos-role-safe-overview') || !role.includes("currentRoute() !== 'tab-intro'") || !role.includes('navigateToTab') || !role.includes("overview.querySelectorAll('a[data-eos-role-tab]')")) fail('role-safe current overview is missing or not directly clickable');
+if (!role.includes('ensureReserveObserver') || !role.includes('state.reserveObserver.observe(paper')) fail('scoped delayed-row reserve filter is missing');
 if (!assist.includes('eos-assist-header-root') || !assist.includes('insertBefore(root, userAnchor)')) fail('EOS Assist is not integrated in the header');
 if (assist.includes('position:fixed;bottom') || assist.includes('bottom:')) fail('EOS Assist still uses a bottom floating position');
 
@@ -42,7 +44,7 @@ const observerCount = [
   'eos-policy-client.js', 'eos-branding-sanitizer.js', 'nexowatt-native-shell.js', 'eos-native-security.js',
   'eos-basic-settings.js', 'eos-role-ui.js', 'eos-account-management.js', 'eos-assistant.js',
 ].reduce((count, file) => count + (read(`adminWww/js/${file}`).match(/new MutationObserver/g) || []).length, 0);
-if (observerCount !== 1) fail(`expected exactly one shared broad MutationObserver, found ${observerCount}`);
+if (observerCount !== 2) fail(`expected one shared observer plus one scoped reserve-row observer, found ${observerCount}`);
 
 if (bad) process.exit(1);
 console.log('[NexoWatt EOS modern UI] OK');

package/tools/nexowatt-release-defaults-selftest.cjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const { CANONICAL_NATIVE_DEFAULTS, ensureReleaseDefaults } = require('./nexowatt-ensure-release-defaults.cjs');
+
+const unsafe = {
+    common: { name: 'eos-admin' },
+    native: {
+        auth: false,
+        port: 8091,
+        eosLockLegacyAdmin: false,
+        eosHideLegacyAdminFromNonAdmins: false,
+        eosHideLegacyBackupFromNonAdmins: false,
+        nexowattHideLegacyBackupFromNonAdmins: false,
+        eosRequireFirstLoginPassword: false,
+    },
+};
+const repaired = ensureReleaseDefaults(unsafe);
+assert.ok(repaired.changes.length >= 7, 'unsafe defaults must be repaired');
+for (const [key, expected] of Object.entries(CANONICAL_NATIVE_DEFAULTS)) {
+    assert.equal(repaired.ioPackage.native[key], expected, `${key} must be normalized`);
+}
+
+const canonical = { native: { ...CANONICAL_NATIVE_DEFAULTS } };
+const unchanged = ensureReleaseDefaults(canonical);
+assert.equal(unchanged.changes.length, 0, 'canonical defaults must remain unchanged');
+
+console.log('[NexoWatt EOS release defaults selftest] OK');

package/tools/nexowatt-validate-package.cjs

@@ -32,10 +32,15 @@ if (prerelease) {
 } else if (pkg.nexowattReleasePolicy?.acceptedPrerelease) {
   fail(`stable package must remove stale acceptedPrerelease ${pkg.nexowattReleasePolicy.acceptedPrerelease}`);
 }
+if (pkg.scripts['prepare:eos-release-defaults'] !== 'node tools/nexowatt-ensure-release-defaults.cjs') fail('release-default preparation script is missing');
+if (pkg.scripts['test:eos-release-defaults'] !== 'node tools/nexowatt-release-defaults-selftest.cjs') fail('release-default selftest script is missing');
 if (pkg.scripts['check:eos-publish-channel'] !== 'node tools/nexowatt-publish-channel-guard.cjs') fail('publish channel guard script is missing');
-if (!pkg.scripts.prepublishOnly?.startsWith('npm run check:eos-publish-channel')) fail('prepublishOnly must execute the publish channel guard first');
+if (!pkg.scripts.prepublishOnly?.startsWith('npm run prepare:eos-release-defaults && npm run check:eos-publish-channel')) fail('prepublishOnly must normalize release defaults before the publish channel guard');
+if (pkg.scripts['precheck:eos-package'] !== 'npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-package must normalize release defaults and clean stale runtime files');
+if (pkg.scripts['precheck:eos-stability'] !== 'npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-stability must normalize release defaults and clean stale runtime files');
 if (pkg.scripts['test:eos-publish-channel'] !== 'node tools/nexowatt-publish-channel-selftest.cjs') fail('publish channel selftest script is missing');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-publish-channel-selftest.cjs')) fail('stability check must execute the publish channel selftest');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-release-defaults-selftest.cjs')) fail('stability check must execute the release-default selftest');
 if (io.native?.auth !== true) fail('fresh sales installations must default to authenticated access');
 if (io.native?.eosHideLegacyBackupFromNonAdmins !== true) fail('internal BackItUp reserve must default to Admin/Service visibility');
 if (io.native?.nexowattHideLegacyBackupFromNonAdmins !== true) fail('NexoWatt backup visibility compatibility flag must default to true');
@@ -98,10 +103,10 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.9.89.md',
-  'PUBLISH_STABLE_V7.9.89.md',
-  'INSTALL_TEST_V7.9.89.md',
-  'RELEASE_ACCEPTANCE_V7.9.89.md',
+  'README_STABILITY_V7.9.93.md',
+  'PUBLISH_STABLE_V7.9.93.md',
+  'INSTALL_TEST_V7.9.93.md',
+  'RELEASE_ACCEPTANCE_V7.9.93.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -113,10 +118,13 @@ for (const file of [
   'tools/nexowatt-first-login-selftest.cjs',
   'tools/nexowatt-account-management-selftest.cjs',
   'tools/nexowatt-modern-ui-selftest.cjs',
+  'tools/nexowatt-login-layout-selftest.cjs',
   'tools/nexowatt-internal-reserve-selftest.cjs',
   'tools/nexowatt-branding-selftest.cjs',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',
+  'tools/nexowatt-ensure-release-defaults.cjs',
+  'tools/nexowatt-release-defaults-selftest.cjs',
   'tools/nexowatt-default-port-selftest.cjs',
   '.npmrc',
   repositoryEntryFile,
@@ -195,7 +203,9 @@ if (accountManagement.includes("launcher.className = 'eos-account-management-lau
 if (accountManagement.includes('new MutationObserver')) fail('account-management runtime adds a second broad DOM observer');
 if (read('src-admin/public/js/eos-account-management.js') !== accountManagement) fail('account-management source/build drift');
 const roleBootstrap = read('adminWww/js/eos-role-bootstrap.js');
-if (!roleBootstrap.includes('installIntegratedFirstLogin') || !roleBootstrap.includes('eos-login-role-selector')) fail('integrated first-login is incomplete');
+if (!roleBootstrap.includes('installIntegratedFirstLogin') || !roleBootstrap.includes('v93 compact normal-login first activation')) fail('compact integrated first-login is incomplete');
+if (/data-eos-account=|selector\.innerHTML/.test(roleBootstrap)) fail('login role buttons must not enlarge the normal login card');
+if (!roleBootstrap.includes('nexowatt/account/passwordless-status') || !roleBootstrap.includes('eligibility.allowed')) fail('server-checked first-login eligibility is incomplete');
 if (roleBootstrap.includes('installPasswordlessFirstLoginLauncher')) fail('old first-login launcher remains active');
 const assistant = read('adminWww/js/eos-assistant.js');
 if (!assistant.includes('eos-assist-header-root') || !assistant.includes('insertBefore(root, userAnchor)')) fail('EOS Assist is not header-integrated');
@@ -217,14 +227,14 @@ if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-esm-syntax-selftest.
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-import-integrity-selftest.cjs')) fail('import integrity selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-entrypoint-smoke-selftest.cjs')) fail('entrypoint smoke selftest is not part of check:eos-stability');
 if (pkg.scripts['clean:eos-runtime'] !== 'node tools/nexowatt-clean-legacy-runtime.cjs') fail('clean:eos-runtime script is missing or incorrect');
-if (pkg.scripts['precheck:eos-package'] !== 'npm run clean:eos-runtime') fail('precheck:eos-package must clean stale runtime files');
-if (pkg.scripts['precheck:eos-stability'] !== 'npm run clean:eos-runtime') fail('precheck:eos-stability must clean stale runtime files');
 if (pkg.scripts.prepack !== 'node tools/nexowatt-clean-legacy-runtime.cjs --quiet') fail('prepack must silently clean stale runtime files');
 if (!pkg.scripts.build?.includes('npm run clean:eos-runtime')) fail('build must finish with runtime cleanup');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-role-access-selftest.cjs')) fail('role access selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-first-login-selftest.cjs')) fail('first-login selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-management-selftest.cjs')) fail('account-management selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-modern-ui-selftest.cjs')) fail('modern-UI selftest is not part of check:eos-stability');
+if (pkg.scripts['test:eos-login-layout'] !== 'node tools/nexowatt-login-layout-selftest.cjs') fail('login-layout selftest script is missing or incorrect');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-login-layout-selftest.cjs')) fail('login-layout selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-internal-reserve-selftest.cjs')) fail('internal reserve selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-branding-selftest.cjs')) fail('branding selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-native-shell-selftest.cjs')) fail('native shell selftest is not part of check:eos-stability');

package/INSTALL_TEST_V7.9.89.md

@@ -1,73 +0,0 @@
-# Installation und Abnahme – NexoWatt EOS Admin 7.9.89
-
-## Installation aus npm
-
-```bash
-cd /opt/iobroker
-iobroker backup
-iobroker stop eos-admin.0
-npm install --no-save --omit=dev iobroker.eos-admin@7.9.89
-iobroker upload eos-admin
-iobroker restart eos-admin.0
-```
-
-## Portbelegung
-
-```bash
-iobroker set admin.0 --port 18081 --ip 127.0.0.1 --enabled false
-iobroker set eos-admin.0 --port 8081 --ip 0.0.0.0 --enabled true
-iobroker restart eos-admin.0
-```
-
-Aufruf:
-
-```text
-http://SYSTEM-IP:8081
-```
-
-## Pflichtabnahme
-
-### Admin / Service
-
-- Anmeldung mit dem fest eingerichteten Passwort.
-- Kein erzwungener Erstkennwortdialog.
-- Expertenmodus verfügbar.
-- Interner Admin und System-Notfallsicherung sichtbar.
-- Vollständige Zugangs- und Rechteverwaltung.
-
-### Installateur
-
-- Erste Aktivierung: Ebene **Installateur**, Benutzer `installer`, Passwort leer, danach persönliches Passwort setzen.
-- Kein Expertenmodus.
-- Inbetriebnahme, Module, Dienste, Datenpunkte und Diagnose erreichbar.
-- **Zugänge & Rechte** erreichbar; nur Endkunden-Reset möglich.
-- Interner Admin und interne BackItUp-Notfallreserve nicht sichtbar.
-- NexoWatt Sicherung nutzbar, sofern installiert und freigegeben.
-
-### Gast / Endkunde
-
-- Erste Aktivierung: Ebene **Gast / Endkunde**, Benutzer `guest`, Passwort leer, danach persönliches Passwort setzen.
-- Kein Expertenmodus.
-- Freigegebenes Smart Home, Räume, Funktionen und Bedienoberflächen erreichbar.
-- Keine technischen System-, Repository-, Zertifikats- oder Rohdiagnosebereiche.
-- Interner Admin und interne BackItUp-Notfallreserve nicht sichtbar.
-- NexoWatt Sicherung nutzbar, sofern freigegeben.
-
-### Bedienoberfläche
-
-- EOS Assist sitzt im Kopfbereich und überlappt keine Inhalte.
-- Zugangsverwaltung erscheint nur unter **Zugänge & Rechte**.
-- Startseite ist **Übersicht**, nicht Easy.
-- Keine `permissionError`-Leerseite.
-- Dialoge, Popups und Schließen-Schaltflächen funktionieren.
-- Schreibbare Datenpunkte sind entsprechend Rolle bedienbar.
-
-## Rückfall auf 7.9.86
-
-```bash
-cd /opt/iobroker
-iobroker stop eos-admin.0
-npm install --no-save --omit=dev iobroker.eos-admin@7.9.86
-iobroker upload eos-admin
-iobroker restart eos-admin.0
-```

package/PUBLISH_STABLE_V7.9.89.md

@@ -1,33 +0,0 @@
-# npm-Veröffentlichung – NexoWatt EOS Admin 7.9.89 Stable
-
-## Vorprüfung
-
-```powershell
-npm run check:eos-publish-channel
-npm run check:eos-package
-npm run check:eos-stability
-npm publish --dry-run --tag latest
-```
-
-## Veröffentlichung
-
-```powershell
-npm login
-npm whoami
-npm publish --tag latest
-```
-
-## Kontrolle
-
-```powershell
-npm view iobroker.eos-admin@latest version
-npm dist-tag ls iobroker.eos-admin
-```
-
-Erwartet:
-
-```text
-latest: 7.9.89
-```
-
-Bereits veröffentlichte Paketversionen dürfen nicht mit verändertem Inhalt erneut veröffentlicht werden. Jede spätere Änderung benötigt eine höhere Versionsnummer.

package/README_STABILITY_V7.9.89.md

@@ -1,26 +0,0 @@
-# NexoWatt EOS Admin 7.9.89 – Stable
-
-Version 7.9.89 ist die freigegebene Produktlinie für NexoWatt-EOS-Verkaufssysteme auf Basis der bewährten Admin-7-Laufzeit.
-
-## Produktfunktionen
-
-- Rollenmodell **Admin / Service**, **Installateur** und **Gast / Endkunde**.
-- Expertenmodus ausschließlich für Admin / Service.
-- Installateurzugriff für Inbetriebnahme, Konfiguration und Fehlersuche.
-- Endkundenzugriff für freigegebenes Smart Home, Räume, Funktionen und NexoWatt-Bedienbereiche.
-- Erstanmeldung von `installer` und `guest` direkt in der normalen Anmeldekarte: Benutzerstufe wählen, Passwort einmalig leer lassen und anschließend zwingend ein persönliches Passwort vergeben.
-- Passwort-Reset: Admin / Service darf Installateur und Endkunde zurücksetzen; Installateur ausschließlich Endkunde.
-- EOS Assist im Kopfbereich ohne Überlagerung der Inhaltsfläche.
-- Zugangsverwaltung ausschließlich unter **Zugänge & Rechte**.
-- Moderne aktuelle **Übersicht**; die Easy-Übersicht wird nicht als Produktstartseite verwendet.
-- Interner System-Admin und interne BackItUp-Notfallreserve nur für Admin / Service sichtbar.
-- NexoWatt Sicherung für die dafür freigegebenen Rollen nutzbar.
-- Standardport 8081; interne Admin-Reserve auf 127.0.0.1:18081.
-
-## Sicherheitsprinzip
-
-Ausgeblendete Bedienelemente sind nicht die einzige Schutzschicht. Kritische Aktionen werden zusätzlich über Rollenprüfung, Socket-Guard und Objekt-ACLs abgesichert. Fehlende oder unbekannte Rollen fallen auf die geringsten Endkundenrechte zurück.
-
-## Rückfallstand
-
-Die vorherige Stable 7.9.86 bleibt als dokumentierter Rückfallstand erhalten. Vor einem Produktupdate ist ein vollständiges Backup vorgeschrieben.