iobroker.eos-admin 7.9.92 → 7.9.95

package/{INSTALL_TEST_V7.9.92.md → INSTALL_TEST_V7.9.95.md}

@@ -1,10 +1,9 @@
-# Installation und Test 7.9.92
+# Installationstest 7.9.95
 
 ```bash
 cd /opt/iobroker
-iobroker backup
 iobroker stop eos-admin.0
-npm install --no-save --omit=dev iobroker.eos-admin@latest
+npm install --no-save --omit=dev iobroker.eos-admin@7.9.95
 iobroker upload eos-admin
 iobroker restart eos-admin.0
 ```
@@ -14,5 +13,3 @@ Version prüfen:
 ```bash
 node -p "require('/opt/iobroker/node_modules/iobroker.eos-admin/package.json').version"
 ```
-
-Erwartet: `7.9.92`.

package/NEXOWATT_EOS_BUILD_INFO.json

@@ -1,27 +1,31 @@
 {
-  "version": "7.9.92",
+  "version": "7.9.95",
   "channel": "stable-latest",
   "baseFrontend": "validated Admin 7 runtime with NexoWatt EOS compact login, role, overview and service-reserve hardening",
   "runtimeEntry": "v84",
-  "releaseType": "stable-sales-product-release-default-normalization",
-  "release": "stable-sales-product-release-default-normalization",
-  "label": "v92",
+  "releaseType": "stable-merge-safe-packaging",
+  "release": "stable-merge-safe-packaging",
+  "label": "v95",
   "notes": [
-    "7.9.92 is the accepted stable sales-product release and is intended for npm dist-tag latest.",
-    "Mandatory sales defaults are normalized before package validation and npm publication.",
-    "Internal admin and BackItUp emergency reserves default to Admin/Service-only visibility.",
-    "Authentication remains enabled and the EOS Admin default port remains 8081.",
-    "The compact login, first activation, clickable overview and role-safe services from 7.9.91 are unchanged."
+    "7.9.95 is the merge-safe NexoWatt EOS Admin release for npm dist-tag latest.",
+    "The flat update ZIP can be extracted directly over an existing repository folder.",
+    "All version-bearing release files are synchronized automatically before validation and npm publishing.",
+    "The 7.9.94 login, roles, password bootstrap, port 8081 and disabled EOS Assist remain functionally unchanged."
   ],
   "changes": [
-    "Adds a deterministic release-default normalizer that repairs missing canonical native defaults.",
-    "Runs normalization before package checks, stability checks and npm publication.",
-    "Adds an isolated self-test proving that missing or unsafe defaults are corrected.",
-    "Keeps frontend runtime and cache assets unchanged because this release only hardens packaging."
+    "Adds deterministic synchronization for package, io-package, lockfiles, frontend version, build info and repository entry.",
+    "Adds guarded Windows merge verification scripts without deleting .git or node_modules.",
+    "Adds a regression test proving that a stale 7.9.92 io-package is repaired before publication.",
+    "Adds a flat merge ZIP intended for direct extraction into the existing working folder.",
+    "Cleans the npm files manifest and rejects missing distribution entries before publication.",
+    "Aligns account-management and modern-UI self-tests with the documented stable initial-password and disabled-assistant contracts.",
+    "Synchronizes package-lock root scripts and release policy with package.json and validates lock metadata drift.",
+    "Builds a genuinely flat merge ZIP with repository files at archive root.",
+    "Keeps source-only validation helpers out of the installed npm runtime while retaining the supported update-repair helper."
   ],
   "brandingCacheVersion": 91,
   "shellCacheVersion": 91,
   "nativeShellVersion": 91,
   "shellCacheTag": "91",
-  "repositoryEntry": "nexowatt-eos-admin-repository-entry-v92.json"
+  "repositoryEntry": "nexowatt-eos-admin-repository-entry-v95.json"
 }

package/NEXOWATT_EOS_STABLE_7.9.94.md

@@ -0,0 +1,16 @@
+# NexoWatt EOS Admin 7.9.94 – Stable candidate
+
+## Stable scope
+
+- Standard port 8081 and authentication enabled.
+- Initial commissioning credentials for `installer`, `guest`, and `user`: password `nexowatt`.
+- A personal password is mandatory immediately after the first successful login.
+- The old passwordless activation flow is disabled.
+- Admin/Service credentials are never changed by the bootstrap.
+- EOS Assist is disabled in this stable release and will return only after its separate read-only redesign and acceptance.
+- The login card remains fully usable when validation or authentication errors are shown.
+- Customer-visible publisher: NexoWatt; technical npm identity remains `iobroker.eos-admin` for update compatibility.
+
+## Security note
+
+The shared commissioning password is only an initial credential. Commissioning is not complete until installer and customer accounts have replaced it with personal passwords. Shipping a system with the initial credential still active is not permitted.

package/PUBLISH_STABLE_V7.9.95.md

@@ -0,0 +1,16 @@
+# npm-Veröffentlichung 7.9.95
+
+Nach dem Entpacken der Merge-ZIP zuerst `MERGE_UPDATE.cmd` ausführen. Danach:
+
+```powershell
+npm login
+npm whoami
+npm publish --dry-run --tag latest
+npm publish --tag latest
+```
+
+Kontrolle:
+
+```powershell
+npm view iobroker.eos-admin@latest version
+```

package/README_STABILITY_V7.9.95.md

@@ -0,0 +1,12 @@
+# NexoWatt EOS Admin 7.9.95 – Stabilität
+
+Version 7.9.95 ist ein packaging-only Stable-Update. Die produktive Laufzeit, Rollenlogik, Erstanmeldung mit dem Startpasswort `nexowatt`, Standardport 8081 und die Deaktivierung des EOS Assist bleiben gegenüber 7.9.94 unverändert.
+
+Neu ist die mergesichere Release-Vorbereitung: Alle versionsführenden Dateien werden vor Prüfung, Packen und npm-Veröffentlichung automatisch an `package.json` angeglichen.
+
+Die npm-Dateiliste wird nun zusätzlich gegen das reale Dateisystem geprüft. Nicht vorhandene oder nicht gepackte Pflichtdateien brechen die Veröffentlichung vor dem Upload ab.
+
+
+Zusätzlich werden die Rootmetadaten der Lockdateien gegen die zugehörigen `package.json`-Dateien geprüft. Dadurch können veraltete `prepublishOnly`-, `prepack`- oder Stabilitätsskripte nicht mehr unbemerkt in einer gemischten Arbeitskopie verbleiben.
+
+Die Merge-Datei für bestehende Arbeitsordner wird ohne übergeordneten Versionsordner erzeugt. `package.json`, `io-package.json` und `MERGE_UPDATE.cmd` liegen unmittelbar auf der ersten ZIP-Ebene.

package/RELEASE_ACCEPTANCE_V7.9.95.md

@@ -0,0 +1,11 @@
+# Release-Abnahme 7.9.95
+
+- [ ] Merge-ZIP direkt über einen alten Arbeitsordner entpackt
+- [ ] `MERGE_UPDATE.cmd` vollständig grün
+- [ ] Alle Versionsdateien melden 7.9.95
+- [ ] `npm publish --dry-run --tag latest` erfolgreich
+- [ ] Installation über npm erfolgreich
+- [ ] Admin-Login unverändert
+- [ ] Installer/User-Erstlogin mit Startpasswort `nexowatt` geprüft
+- [ ] EOS Assist in Stable deaktiviert
+- [ ] EOS Admin auf Port 8081 erreichbar

package/RELEASE_NOTES_V7.9.95.md

@@ -0,0 +1,12 @@
+# Release Notes – 7.9.95
+
+- Flache Merge-ZIP für das direkte Entpacken in einen vorhandenen Repository-Ordner.
+- Automatischer Versionsabgleich für `io-package.json`, Lockdateien, Frontend-Version, Build-Info und Repository-Eintrag.
+- Selbsttest mit absichtlich veraltetem Stand 7.9.92.
+- Windows-Helfer `MERGE_UPDATE.cmd` und `MERGE_UPDATE.ps1`.
+- Keine funktionale Änderung an Login, Rollen, Port oder EOS-Assist-Sperre.
+- npm-Dateiliste bereinigt: keine nicht vorhandenen 7.9.94-Dateien mehr; aktuelle Stable-, Merge- und Prüfscripte werden vollständig gepackt.
+- Selbsttests an den dokumentierten Stable-Vertrag angeglichen: Startpasswort `nexowatt` mit Pflichtwechsel; EOS Assist bleibt deaktiviert.
+- `package-lock.json`-Rootmetadaten (Skripte und Release-Policy) werden gemeinsam mit `package.json` synchronisiert und validiert.
+- Die veröffentlichte npm-Tarball-Dateiliste enthält nur Runtime-Dateien, aktuelle Release-Dokumente und den installierten Update-Reparaturhelfer; Source-only-Prüfwerkzeuge bleiben in der Merge-/Repository-ZIP.
+- Die ausgelieferte Merge-ZIP wird tatsächlich flach erzeugt, damit `package.json` direkt im bestehenden Repository-Ordner landet.

package/adminWww/css/nexowatt-native-shell.css

@@ -856,7 +856,7 @@ html.eos-modern-login body::before {
 
 
 /* ========================================================================== 
-   NexoWatt EOS 7.9.92 – stable product layout
+   NexoWatt EOS 7.9.94 – stable product layout
    Integrated first login, header assistant, role-safe overview and account
    management exclusively below "Zugänge & Rechte".
    ========================================================================== */
@@ -1193,7 +1193,7 @@ html.eos-role-enduser [data-instance-id^="backitup."] { display: none !important
 
 
 
-/* Final 7.9.92 interaction guards. */
+/* Final 7.9.94 interaction guards. */
 html.eos-safe-overview-active #app-paper { position: relative !important; }
 html.eos-safe-overview-active #app-paper > :not(#eos-role-safe-overview):not(.MuiSnackbar-root):not([role="presentation"]) {
     pointer-events: none !important;

package/adminWww/index.html

@@ -171,5 +171,7 @@
     <body>
         <noscript>Für NexoWatt EOS muss JavaScript aktiviert sein.</noscript>
         <div id="root"></div>
+<script defer src="static/js/nexowatt-stable-login.js?v=95"></script>
+<script defer src="static/js/nexowatt-stable-v95.js?v=95"></script>
 </body>
 </html>

package/adminWww/js/eos-assistant.js

@@ -1,127 +1,8 @@
 (() => {
     'use strict';
-
-    const VERSION = 'v91-header-eos-assist';
-    const previous = window.NEXOWATT_EOS_ASSIST;
-    if (previous?.version === VERSION) return;
-    previous?.destroy?.();
-
-    const scriptUrl = document.currentScript?.src || document.querySelector('script[src*="eos-assistant.js"]')?.src || location.href;
-    const logoUrl = new URL('../img/eos/nexowatt-192.png', scriptUrl).href;
-    const abort = new AbortController();
-    let unsubscribeDom = null;
-    let timer = 0;
-    let destroyed = false;
-
-    const currentContext = () => {
-        const hash = String(location.hash || '').toLowerCase();
-        if (hash.includes('tab-adapters')) return ['Module', 'Module suchen, Version prüfen, Instanz konfigurieren und Datenpunkte kontrollieren.'];
-        if (hash.includes('tab-instances')) return ['Dienste', 'Status, Log und Abhängigkeiten prüfen, bevor ein Dienst neu gestartet wird.'];
-        if (hash.includes('tab-objects')) return ['Datenpunkte', 'Read-DPs bleiben lesend. Write-DPs lassen sich typgerecht bedienen; sicherheitsrelevante Writes benötigen Admin/Service.'];
-        if (hash.includes('tab-users')) return ['Zugänge & Rechte', 'Zugänge einer EOS-Rolle zuordnen und persönliche Passwörter sicher zurücksetzen.'];
-        if (hash.includes('tab-intro')) return ['Übersicht', 'Anlagenstatus, Module, Dienste und die für deine Rolle freigegebenen Bereiche im Blick behalten.'];
-        return ['EOS Assist', 'NexoWatt EOS unterstützt dich beim Einrichten, Prüfen und Absichern des Systems.'];
-    };
-
-    const answer = query => {
-        const text = String(query || '').toLowerCase();
-        if (/datenpunkt|write|schreib|wert|state/.test(text)) return 'Prüfe Schreibfreigabe, Datentyp und EOS-Rolle. Boolean und Trigger werden direkt bedient; Zahlen, Texte und Auswahlwerte öffnen den nativen Wertdialog.';
-        if (/update|aktualis/.test(text)) return 'Warte, bis Module und Verbindung vollständig geladen sind. Danach das Update starten und den Befehlsdialog bis zum Abschluss geöffnet lassen.';
-        if (/wallbox|ocpp|lade/.test(text)) return 'Für Ladepunkte zuerst Status und Frische der OCPP-Daten prüfen. Schreibbefehle nur über die vorgesehenen Steuerdatenpunkte senden.';
-        if (/rechte|benutzer|rolle|passwort/.test(text)) return 'Admin/Service besitzt Vollzugriff. Installateur erhält Inbetriebnahme und Fehlersuche sowie Endkunden-Reset. Endkunde erhält freigegebene Bedien- und Smart-Home-Funktionen.';
-        if (/backup|sicherung/.test(text)) return 'Für den normalen Betrieb die NexoWatt Sicherung verwenden. Die interne System-Notfallsicherung ist ausschließlich für Admin/Service sichtbar.';
-        return 'Beschreibe Gerät, Datenpunkt oder Fehlerbild genauer. EOS Assist grenzt danach Oberfläche, Modul, Protokoll oder Gerätekommunikation ein.';
-    };
-
-    const findToolbar = () => document.querySelector('.eos-top-toolbar, #root > .MuiPaper-root > .MuiAppBar-root .MuiToolbar-root, .MuiAppBar-root .MuiToolbar-root');
-    const findUserAnchor = toolbar => Array.from(toolbar?.children || []).find(child => child.querySelector?.('.MuiAvatar-root') || /\b(admin|installer|guest|endkunde|service)\b/i.test(child.textContent || '')) || null;
-
-    const remove = () => document.getElementById('eos-assist-root')?.remove();
-    const ensure = () => {
-        if (destroyed) return;
-        const hasApp = !!document.getElementById('app-paper');
-        const login = document.documentElement.classList.contains('eos-login');
-        const toolbar = findToolbar();
-        if (!hasApp || login || !toolbar) {
-            remove();
-            return;
-        }
-        toolbar.classList.add('eos-top-toolbar');
-        let root = document.getElementById('eos-assist-root');
-        if (!root) {
-            root = document.createElement('section');
-            root.id = 'eos-assist-root';
-            root.className = 'eos-assist-root eos-assist-header-root';
-            root.innerHTML = `
-                <button class="eos-assist-button" type="button" aria-expanded="false" title="EOS Assist">
-                    <span class="eos-assist-dot"></span><strong>EOS Assist</strong><small>Hilfe</small>
-                </button>
-                <div class="eos-assist-panel" role="dialog" aria-label="EOS Assist">
-                    <div class="eos-assist-head"><img src="${logoUrl}" alt="NexoWatt EOS"><div><strong class="eos-assist-title"></strong><span class="eos-assist-text"></span></div><button class="eos-assist-close" type="button" aria-label="Schließen">×</button></div>
-                    <div class="eos-assist-input-row"><input class="eos-assist-input" placeholder="Frage zu EOS, Modul oder Datenpunkt"><button class="eos-assist-send" type="button">Fragen</button></div>
-                    <div class="eos-assist-answer">Beschreibe kurz, was geprüft oder eingerichtet werden soll.</div>
-                </div>`;
-            const userAnchor = findUserAnchor(toolbar);
-            toolbar.insertBefore(root, userAnchor);
-            root.addEventListener('click', event => {
-                const button = event.target?.closest?.('button');
-                if (!button) return;
-                if (button.classList.contains('eos-assist-button')) {
-                    const open = !root.classList.contains('eos-assist-open');
-                    root.classList.toggle('eos-assist-open', open);
-                    button.setAttribute('aria-expanded', open ? 'true' : 'false');
-                    if (open) setTimeout(() => root.querySelector('.eos-assist-input')?.focus(), 30);
-                } else if (button.classList.contains('eos-assist-close')) {
-                    root.classList.remove('eos-assist-open');
-                    root.querySelector('.eos-assist-button')?.setAttribute('aria-expanded', 'false');
-                } else if (button.classList.contains('eos-assist-send')) {
-                    const input = root.querySelector('.eos-assist-input');
-                    root.querySelector('.eos-assist-answer').textContent = answer(input?.value || '');
-                }
-            }, { signal: abort.signal });
-            root.addEventListener('keydown', event => {
-                if (event.key === 'Enter' && event.target?.classList?.contains('eos-assist-input')) {
-                    root.querySelector('.eos-assist-answer').textContent = answer(event.target.value || '');
-                }
-                if (event.key === 'Escape') {
-                    root.classList.remove('eos-assist-open');
-                    root.querySelector('.eos-assist-button')?.setAttribute('aria-expanded', 'false');
-                }
-            }, { signal: abort.signal });
-        } else if (root.parentElement !== toolbar) {
-            const userAnchor = findUserAnchor(toolbar);
-            toolbar.insertBefore(root, userAnchor);
-        }
-        const [title, text] = currentContext();
-        root.querySelector('.eos-assist-title').textContent = title;
-        root.querySelector('.eos-assist-text').textContent = text;
-    };
-
-    const connect = () => {
-        const coordinator = window.NEXOWATT_EOS_DOM_COORDINATOR;
-        if (!coordinator?.subscribe) {
-            timer = setTimeout(connect, 250);
-            return;
-        }
-        unsubscribeDom = coordinator.subscribe(ensure);
-    };
-
-    window.addEventListener('hashchange', ensure, { signal: abort.signal });
-    window.addEventListener('resize', ensure, { signal: abort.signal });
-    if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', ensure, { once: true, signal: abort.signal });
-    else ensure();
-    connect();
-    [250, 800, 1600].forEach(delay => setTimeout(ensure, delay));
-
-    window.NEXOWATT_EOS_ASSIST = {
-        version: VERSION,
-        refresh: ensure,
-        destroy() {
-            destroyed = true;
-            abort.abort();
-            unsubscribeDom?.();
-            if (timer) clearTimeout(timer);
-            remove();
-        },
-    };
+    // NexoWatt EOS stable 7.9.95: EOS Assist remains disabled until the
+    // read-only system assistant is rebuilt and accepted separately.
+    window.NEXOWATT_EOS_ASSIST_DISABLED = true;
+    document.documentElement.classList.add('eos-assist-disabled');
+    document.querySelectorAll('.eos-assist-root,.eos-assist-header-root,[data-eos-assist-root]').forEach(element => element.remove());
 })();

package/adminWww/static/js/nexowatt-stable-login.js

@@ -0,0 +1,79 @@
+/* NexoWatt EOS stable runtime v94 */
+(() => {
+  'use strict';
+  const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
+  const ASSIST_TEXT = /EOS\s*Assist/i;
+  const PASSWORDLESS_TEXT = /Erstanmeldung\s+ohne\s+Passwort|first\s+sign-?in\s+without\s+password/i;
+  const isLogin = () => /(?:\?|&)login(?:[=&]|$)/i.test(location.search) || /\/login(?:[/?#]|$)/i.test(location.pathname + location.hash);
+  const visible = el => !!el && el.getClientRects().length > 0;
+  const findInput = kind => {
+    const inputs = [...document.querySelectorAll('input')].filter(visible);
+    if (kind === 'password') return inputs.find(i => i.type === 'password');
+    return inputs.find(i => i.type !== 'password' && /user|login|name/i.test(`${i.name} ${i.id} ${i.autocomplete} ${i.getAttribute('aria-label')||''}`)) || inputs.find(i => i.type !== 'password');
+  };
+  const findSubmit = () => [...document.querySelectorAll('button,input[type="submit"]')].find(el => visible(el) && (/anmelden|login|sign in/i.test((el.textContent||el.value||'').trim()) || el.type === 'submit'));
+  const commonAncestor = (a,b) => {
+    if (!a || !b) return null;
+    const parents = new Set(); let n=a;
+    while(n){parents.add(n);n=n.parentElement;}
+    n=b; while(n&&!parents.has(n))n=n.parentElement;
+    return n;
+  };
+  const markLogin = () => {
+    if (!isLogin()) return;
+    document.documentElement.classList.add('nw-eos-login-v94');
+    document.body?.classList.add('nw-eos-login-v94');
+    const u=findInput('user'), p=findInput('password'), submit=findSubmit();
+    if (u && p) {
+      let card=commonAncestor(u,p);
+      while(card && card.parentElement && card.querySelectorAll('input').length < 2) card=card.parentElement;
+      if (card) {
+        card.setAttribute('data-nw-login-card','true');
+        let outer=card.parentElement;
+        for(let i=0;i<3 && outer?.parentElement;i++){
+          if(outer.getBoundingClientRect().width > card.getBoundingClientRect().width+20) break;
+          outer=outer.parentElement;
+        }
+        outer?.setAttribute('data-nw-login-shell','true');
+      }
+      const sync=()=>{
+        const name=(u.value||'').trim().toLowerCase();
+        const pass=p.value||'';
+        if(submit && MANAGED_USERS.has(name) && !pass){
+          submit.disabled=true;
+          submit.setAttribute('aria-disabled','true');
+        }
+      };
+      if(!u.dataset.nwV94){u.dataset.nwV94='1';u.addEventListener('input',sync);p.addEventListener('input',sync);sync();}
+    }
+  };
+  const hideLegacyUi = () => {
+    for (const el of document.querySelectorAll('button,a,[role="button"],div,span')) {
+      const text=(el.textContent||'').trim();
+      if(!text || text.length>100) continue;
+      if(ASSIST_TEXT.test(text) || PASSWORDLESS_TEXT.test(text)){
+        const target=el.closest('button,a,[role="button"],[data-eos-assist],.eos-assist') || el;
+        target.style.setProperty('display','none','important');
+        target.setAttribute('aria-hidden','true');
+      }
+    }
+  };
+  const apply=()=>{markLogin();hideLegacyUi();};
+  const style=document.createElement('style');
+  style.id='nw-eos-stable-v94-css';
+  style.textContent=`
+    html.nw-eos-login-v94,body.nw-eos-login-v94{min-height:100%;overflow-x:hidden!important;overflow-y:auto!important}
+    .nw-eos-login-v94 [data-nw-login-shell="true"]{width:min(410px,calc(100vw - 28px))!important;min-height:540px!important;height:auto!important;max-height:none!important;overflow:visible!important;box-sizing:border-box!important;padding:22px!important}
+    .nw-eos-login-v94 [data-nw-login-card="true"]{width:min(354px,calc(100vw - 56px))!important;min-height:474px!important;height:auto!important;max-height:none!important;overflow:visible!important;box-sizing:border-box!important;padding-bottom:26px!important}
+    .nw-eos-login-v94 [data-nw-login-card="true"] *{scrollbar-width:none}
+    .nw-eos-login-v94 [data-nw-login-card="true"] *::-webkit-scrollbar{display:none!important;width:0!important;height:0!important}
+    .nw-eos-login-v94 [data-nw-login-card="true"] [role="alert"]{position:static!important;max-height:none!important;overflow:visible!important;white-space:normal!important}
+    [data-eos-assist],.eos-assist,.nexowatt-eos-assist{display:none!important}
+    @media(max-height:620px){.nw-eos-login-v94 [data-nw-login-shell="true"]{min-height:0!important;margin:16px auto!important}.nw-eos-login-v94 [data-nw-login-card="true"]{min-height:0!important}}
+  `;
+  (document.head||document.documentElement).appendChild(style);
+  const observer=new MutationObserver(()=>requestAnimationFrame(apply));
+  observer.observe(document.documentElement,{subtree:true,childList:true,attributes:true,attributeFilter:['class','style']});
+  if(document.readyState==='loading')document.addEventListener('DOMContentLoaded',apply,{once:true});else apply();
+  setInterval(apply,1500);
+})();

package/build/lib/nexowattStableAuth.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startNexowattStableAuth = startNexowattStableAuth;
+const START_PASSWORD = 'nexowatt';
+const MARKER_KEYS = ["eosFirstLoginPending", "eosMustChangePassword", "eosPasswordSetupRequired", "firstLoginRequired", "mustChangePassword", "nexowattFirstLoginPending", "nexowattMustChangePassword", "nexowattPasswordSetupRequired", "passwordChangeRequired"];
+const timers = new WeakMap();
+function pendingByNative(native) {
+    if (!native || typeof native !== 'object') return false;
+    return MARKER_KEYS.some(key => native[key] === true || native[key] === 'pending' || native[key] === 'required' || native[key] === 'starter');
+}
+async function setPassword(adapter, user, password) {
+    if (typeof adapter.setPasswordAsync === 'function') return adapter.setPasswordAsync(user, password, { user: 'system.user.admin' });
+    return new Promise((resolve, reject) => adapter.setPassword(user, password, { user: 'system.user.admin' }, err => err ? reject(err) : resolve()));
+}
+async function ensureGroupMembership(adapter, userId, groupId) {
+    const group = await adapter.getForeignObjectAsync(groupId);
+    if (!group || group.type !== 'group') return;
+    group.common = group.common || { name: groupId.split('.').pop(), members: [] };
+    group.common.members = Array.isArray(group.common.members) ? group.common.members : [];
+    if (!group.common.members.includes(userId)) {
+        group.common.members.push(userId);
+        await adapter.setForeignObjectAsync(groupId, group, { user: 'system.user.admin' });
+    }
+}
+async function createUser(adapter, name) {
+    const id = `system.user.${name}`;
+    await adapter.setForeignObjectAsync(id, {
+        _id: id, type: 'user',
+        common: { name, enabled: true, password: '' },
+        native: { nexowattManagedAccount: true, nexowattMustChangePassword: true, nexowattPasswordState: 'starter' }
+    }, { user: 'system.user.admin' });
+    return adapter.getForeignObjectAsync(id);
+}
+async function prepareOne(adapter, name, group, createMissing) {
+    const id = `system.user.${name}`;
+    let obj = await adapter.getForeignObjectAsync(id);
+    let created = false;
+    if (!obj && createMissing) { obj = await createUser(adapter, name); created = true; }
+    if (!obj || obj.type !== 'user') return;
+    obj.native = obj.native || {};
+    const empty = !obj.common || !obj.common.password;
+    const pending = created || empty || pendingByNative(obj.native) || obj.native.nexowattPasswordState === 'starter';
+    if (pending) {
+        await setPassword(adapter, name, START_PASSWORD);
+        obj = await adapter.getForeignObjectAsync(id) || obj;
+        obj.native = obj.native || {};
+        obj.native.nexowattManagedAccount = true;
+        obj.native.nexowattStarterPasswordActive = true;
+        obj.native.nexowattMustChangePassword = true;
+        obj.native.nexowattPasswordState = 'starter';
+        obj.native.nexowattStarterPasswordUpdatedAt = new Date().toISOString();
+        for (const key of MARKER_KEYS) {
+            if (/required|must|pending|first/i.test(key)) obj.native[key] = true;
+        }
+        await adapter.setForeignObjectAsync(id, obj, { user: 'system.user.admin' });
+    }
+    await ensureGroupMembership(adapter, id, group);
+}
+async function reconcile(adapter) {
+    try {
+        await prepareOne(adapter, 'installer', 'system.group.installer', true);
+        const guest = await adapter.getForeignObjectAsync('system.user.guest');
+        const user = await adapter.getForeignObjectAsync('system.user.user');
+        if (guest || !user) await prepareOne(adapter, 'guest', 'system.group.endkunden', true);
+        if (user) await prepareOne(adapter, 'user', 'system.group.endkunden', false);
+    } catch (e) { adapter.log.warn(`[NexoWatt EOS login] Starter-account reconciliation failed: ${e && e.message || e}`); }
+}
+function startNexowattStableAuth(adapter) {
+    if (timers.has(adapter)) return;
+    void reconcile(adapter);
+    const timer = setInterval(() => void reconcile(adapter), 5000);
+    if (timer.unref) timer.unref();
+    timers.set(adapter, timer);
+}

package/build/lib/web.js

@@ -675,7 +675,11 @@ class Web {
             const account = (native.nexowattEosAccount || {});
             const initialized = account.passwordInitialized === true
                 || Number(account.passwordSetupVersion || account.passwordInitializationVersion || 0) >= 1;
-            const forced = account.forcePasswordChange === true;
+            const stableForced = native.nexowattPasswordChangeRequired === true
+                || native.eosPasswordChangeRequired === true
+                || native.nexowattFirstLoginPending === true
+                || native.eosFirstLoginRequired === true;
+            const forced = account.forcePasswordChange === true || stableForced;
             return { required: forced || !initialized, initialized: initialized && !forced, minLength, version: 1 };
         }
         catch (e) {
@@ -789,6 +793,12 @@ class Web {
         account.firstLoginCompletedAt = now;
         account.forcePasswordChange = false;
         account.passwordlessFirstLoginAllowed = false;
+        native.nexowattPasswordChangeRequired = false;
+        native.eosPasswordChangeRequired = false;
+        native.nexowattFirstLoginPending = false;
+        native.eosFirstLoginRequired = false;
+        native.nexowattInitialPasswordApplied = false;
+        native.nexowattPasswordChangedAt = now;
         await this.adapter.setForeignObjectAsync(access.userId, userObject);
         await this.destroyEosRequestSessions(req);
         for (const cookie of ['access_token', 'refresh_token', 'connect.sid']) {
@@ -1133,8 +1143,7 @@ class Web {
             res.status(409).json({ error: 'accountDisabled' });
             return;
         }
-        const bootstrapSecret = `${(0, node_crypto_1.randomBytes)(48).toString('base64url')}!aA1`;
-        await this.setEosUserPassword(targetUserId, bootstrapSecret);
+        await this.setEosUserPassword(targetUserId, 'nexowatt');
         const user = (await this.adapter.getForeignObjectAsync(targetUserId));
         if (!user) {
             throw new Error('userObjectUnavailableAfterPasswordReset');
@@ -1146,21 +1155,29 @@ class Web {
         account.passwordSetupVersion = 0;
         account.passwordInitializationVersion = 0;
         account.forcePasswordChange = true;
-        account.passwordlessFirstLoginAllowed = true;
+        account.passwordlessFirstLoginAllowed = false;
         account.passwordResetAt = now;
         account.passwordResetBy = access.userId;
-        account.passwordResetMode = 'passwordless-first-activation';
+        account.passwordResetMode = 'initial-password';
+        native.nexowattPasswordChangeRequired = true;
+        native.eosPasswordChangeRequired = true;
+        native.nexowattFirstLoginPending = true;
+        native.eosFirstLoginRequired = true;
+        native.nexowattInitialPasswordApplied = true;
+        native.nexowattInitialPasswordVersion = 1;
+        native.nexowattStableInitialCredentialVersion = 1;
         delete account.passwordSetAt;
         delete account.firstLoginCompletedAt;
         await this.adapter.setForeignObjectAsync(targetUserId, user);
         this.invalidateEosPasswordClaimsForUser(targetUserId);
-        this.adapter.log.warn(`EOS account ${targetUserId} was reset for passwordless first activation by ${access.userId}`);
+        this.adapter.log.warn(`EOS account ${targetUserId} was reset to the mandatory initial-password flow by ${access.userId}`);
         res.status(200).json({
             success: true,
             user: targetUserId,
             role: explicitlyManagedRole,
             firstLoginRequired: true,
-            passwordlessFirstLoginAllowed: true,
+            passwordlessFirstLoginAllowed: false,
+            initialPasswordRequired: true,
         });
     }
     async getEosHistoryInstances() {