iobroker.eos-admin 7.10.0 → 7.10.1

package/tools/nexowatt-password-write-selftest.cjs

@@ -1,18 +1,48 @@
 #!/usr/bin/env node
 'use strict';
-const assert=require('node:assert/strict');
-const {normalizeEosPasswordTarget,setEosUserPasswordWithVerification,verifyEosUserPasswordCredential}=require('../build/lib/eosPassword.js');
-function adapter({canonicalFails=false, optionsFail=false, verify=true}={}){
- const user={_id:'system.user.user',common:{password:'$old'},native:{}};let accepted='old';const calls=[];
- const set=async(target,password,options)=>{calls.push({target,password,options});if(canonicalFails&&target==='system.user.user')throw new Error('canonicalRejected');if(optionsFail&&options)throw new Error('optionsRejected');user.common.password=`$${Date.now()}:${password}`;accepted=password};
- return {calls,getForeignObjectAsync:async id=>id==='system.user.user'?user:null,setPasswordAsync:set,checkPasswordAsync:async(target,password)=>[verify&&['system.user.user','user'].includes(target)&&password===accepted,'system.user.user']};
-}
-(async()=>{
- assert.deepEqual(normalizeEosPasswordTarget('user'),{userId:'system.user.user',userName:'user'});
- const normal=adapter();const a=await setEosUserPasswordWithVerification(normal,'system.user.user','Strong!2026');assert.equal(a.apiTarget,'system.user.user');
- await verifyEosUserPasswordCredential(normal,'system.user.user','Strong!2026');
- const legacy=adapter({canonicalFails:true});const b=await setEosUserPasswordWithVerification(legacy,'system.user.user','Legacy!2026');assert.equal(b.apiTarget,'user');
- const noOptions=adapter({optionsFail:true});const c=await setEosUserPasswordWithVerification(noOptions,'system.user.user','NoOptions!2026');assert.ok(['system.user.user','user'].includes(c.apiTarget));assert.ok(noOptions.calls.some(call=>call.options===null));
- await assert.rejects(()=>setEosUserPasswordWithVerification(adapter({verify:false}),'user','Fail!2026'),/passwordVerificationFailed/);
- console.log('[NexoWatt EOS password write v7100] OK');
-})().catch(error=>{console.error(error.stack||error);process.exit(1)});
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const root = path.resolve(__dirname, '..');
+const built = fs.readFileSync(path.join(root, 'build/lib/web.js'), 'utf8');
+const source = fs.readFileSync(path.join(root, 'src/lib/web.ts'), 'utf8');
+const begin = built.indexOf('    getEosPasswordUserName(userId) {');
+const end = built.indexOf('    async destroyEosRequestSessions', begin);
+assert(begin >= 0 && end > begin, 'password methods not found in built backend');
+const methods = built.slice(begin, end);
+const sandbox = { module: { exports: null }, EOS_PASSWORD_SERVICE_USER: 'system.user.admin' };
+vm.runInNewContext(`module.exports = class Harness {\nconstructor(adapter){this.adapter=adapter;}\n${methods}\n}`, sandbox);
+const Harness = sandbox.module.exports;
+(async () => {
+  const calls = [];
+  const userObject = { _id: 'system.user.user', common: { password: '$2b$hash' }, native: { keep: true } };
+  const adapter = {
+    setPasswordAsync: async (user, password, options) => calls.push(['set', user, password, options]),
+    checkPasswordAsync: async (user, password, options) => { calls.push(['check', user, password, options]); return [true, `system.user.${user}`]; },
+    getForeignObjectAsync: async id => { calls.push(['get', id]); return JSON.parse(JSON.stringify(userObject)); },
+    extendForeignObjectAsync: async (id, patch, options) => calls.push(['extend', id, patch, options]),
+    setForeignObjectAsync: async () => { throw new Error('full user object replacement must not be used'); },
+  };
+  const harness = new Harness(adapter);
+  await harness.setEosUserPassword('system.user.user', 'NexoWatt2025!');
+  assert.deepEqual(calls[0].slice(0, 3), ['set', 'user', 'NexoWatt2025!']);
+  assert.deepEqual(calls[1].slice(0, 3), ['check', 'user', 'NexoWatt2025!']);
+  await harness.updateEosAccountMetadata('system.user.user', (native, account) => {
+    account.passwordInitialized = true;
+    native.nexowattPasswordChangeRequired = false;
+  });
+  const extend = calls.find(row => row[0] === 'extend');
+  assert(extend, 'native metadata was not extended');
+  assert.equal(extend[1], 'system.user.user');
+  assert.equal(extend[2].native.keep, true);
+  assert.equal(extend[2].native.nexowattEosAccount.passwordInitialized, true);
+  assert(!Object.prototype.hasOwnProperty.call(extend[2], 'common'), 'password/common must not be overwritten by metadata update');
+  for (const code of [source, built]) {
+    assert.match(code, /setPasswordAsync\(userName, password/);
+    assert.match(code, /checkPasswordAsync\(userName, password/);
+    assert.match(code, /extendForeignObjectAsync/);
+    assert.match(code, /passwordVerificationFailed/);
+  }
+  console.log('[NexoWatt EOS password write] OK: real account name, verified password API and metadata-only update');
+})().catch(error => { console.error(error.stack || error); process.exit(1); });

package/tools/nexowatt-release-defaults-selftest.cjs

@@ -13,7 +13,7 @@ const unsafe = {
         eosHideLegacyAdminFromNonAdmins: false,
         eosHideLegacyBackupFromNonAdmins: false,
         nexowattHideLegacyBackupFromNonAdmins: false,
-        eosRequireFirstLoginPassword: false,
+        eosRequireFirstLoginPassword: true,
     },
 };
 const repaired = ensureReleaseDefaults(unsafe);

package/tools/nexowatt-runtime-cleanup-selftest.cjs

@@ -15,15 +15,15 @@ try {
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'static', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'adminWww', 'static', 'js'), { recursive: true });
-  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 7100 }));
+  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 98 }));
 
   const keep = [
     'adminWww/assets/bootstrap-current-v82.js',
     'adminWww/assets/Objects-current-v82.js',
     'adminWww/remoteEntry-v82.js',
     'adminWww/remoteEntry.js',
-    'adminWww/static/js/nexowatt-stable-v7100.js',
-    'src-admin/public/static/js/nexowatt-stable-v7100.js',
+    'adminWww/static/js/nexowatt-stable-v98.js',
+    'src-admin/public/static/js/nexowatt-stable-v98.js',
     'adminWww/static/js/nexowatt-stable-login.js',
   ];
   const remove = [
@@ -34,10 +34,8 @@ try {
     'adminWww/js/eos-branding.js',
     'adminWww/css/eos-branding.css',
     'src-admin/public/js/eos-security-ui.js',
-    'adminWww/static/js/nexowatt-stable-v100.js',
-    'src-admin/public/static/js/nexowatt-stable-v99.js',
-    'adminWww/static/js/nexowatt-stable-v98.js',
-    'src-admin/public/static/js/nexowatt-stable-v97.js',
+    'adminWww/static/js/nexowatt-stable-v97.js',
+    'src-admin/public/static/js/nexowatt-stable-v95.js',
   ];
   for (const rel of [...keep, ...remove]) {
     const file = path.join(temp, rel);
@@ -47,7 +45,7 @@ try {
 
   const result = cleanLegacyRuntime({ root: temp, quiet: true, silent: true });
   assert.strictEqual(result.activeRuntime, 82);
-  assert.strictEqual(result.activeShell, 7100);
+  assert.strictEqual(result.activeShell, 98);
   assert.strictEqual(result.removed.length, remove.length);
   for (const rel of keep) assert.ok(fs.existsSync(path.join(temp, rel)), `current runtime removed: ${rel}`);
   for (const rel of remove) assert.ok(!fs.existsSync(path.join(temp, rel)), `legacy file remained: ${rel}`);

package/tools/nexowatt-stable-v7101-selftest.cjs

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('node:fs'),path=require('node:path');const root=path.resolve(__dirname,'..');const read=r=>fs.readFileSync(path.join(root,r),'utf8');const j=r=>JSON.parse(read(r));const must=(v,m)=>{if(!v){console.error('[NexoWatt EOS stable v7101] '+m);process.exit(1)}};
+const p=j('package.json'),io=j('io-package.json'),info=j('NEXOWATT_EOS_BUILD_INFO.json'),main=read('src/main.ts'),boot=read('adminWww/js/eos-role-bootstrap.js'),role=read('adminWww/js/eos-role-ui.js'),css=read('adminWww/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),ems=read('adminWww/js/eos-ems-overview.js'),intro=read('src-admin/src/tabs/Intro.tsx'),bundle=read('adminWww/assets/Intro-DkwRiz1n-v84.js'),stable=read('adminWww/static/js/nexowatt-stable-v7101.js'),auto=read('src/lib/eosAutoUpdate.ts');
+must(p.version==='7.10.1'&&io.version==='7.10.1'&&io.common.version==='7.10.1'&&info.version==='7.10.1','version drift');
+must(io.native.eosRequireFirstLoginPassword===false&&io.native.eosRequireFirstLoginPasswordChange===false,'forced first password still enabled');
+must(!index.includes('eos-account-management.js'),'custom reset UI still loaded');
+must(!boot.includes('installIntegratedFirstLogin(base);')&&!boot.includes('showFirstLoginPassword(resolved, base);'),'forced first-login UI still active');
+must(main.includes('standardPasswordMode: true')&&main.includes('nexowattPasswordChangeRequired: false'),'account migration missing');
+must(role.includes("route === 'tab-users'")&&main.includes("command === 'changePassword'"),'role-aware native password editing missing');
+must(css.includes('persistent native overview scrolling')&&stable.includes("overflow-y','scroll"),'persistent scroll missing');
+must(intro.includes('eos-overview-edit-controls')&&bundle.includes('eos-overview-edit-controls'),'edit control not in bottom grid');
+must(!ems.includes('Vollständige EMS-Diagnose öffnen'),'unsupported EMS link remains');
+must(index.includes('eos-auto-update.js?v=7101')&&auto.includes("const POLICY: NexoWattAutoUpdatePolicy = 'major'"),'auto update missing');
+console.log('[NexoWatt EOS stable v7101] OK');

package/tools/nexowatt-sync-release-version.cjs

@@ -19,6 +19,14 @@ function setValue(changes, label, object, key, value) {
     }
 }
 
+function setJsonValue(changes, label, object, key, value) {
+    const previous = object[key];
+    if (JSON.stringify(previous) !== JSON.stringify(value)) {
+        changes.push({ label, previous, value });
+        object[key] = value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+    }
+}
+
 function syncReleaseVersion(rootDir) {
     const root = path.resolve(rootDir);
     const packageFile = path.join(root, 'package.json');
@@ -32,10 +40,7 @@ function syncReleaseVersion(rootDir) {
         throw new Error(`Invalid package.json version: ${version || '<missing>'}`);
     }
 
-    const parsed = version.match(/^(\d+)\.(\d+)\.(\d+)/);
-    const releaseNo = parsed
-        ? (parsed[1] === '7' && parsed[2] === '9' ? parsed[3] : `${parsed[1]}${parsed[2]}${parsed[3]}`)
-        : version.replace(/[^0-9A-Za-z]+/g, '-');
+    const releaseNo = version.match(/^7\.9\.(\d+)/)?.[1] || version.replace(/[^0-9A-Za-z]+/g, '-');
     const expectedBase = `https://unpkg.com/iobroker.eos-admin@${version}`;
     const changes = [];
 
@@ -65,7 +70,40 @@ function syncReleaseVersion(rootDir) {
             update(json) {
                 setValue(changes, 'package-lock.json version', json, 'version', version);
                 if (json.packages?.['']) {
-                    setValue(changes, 'package-lock.json packages[""] version', json.packages[''], 'version', version);
+                    const rootPackage = json.packages[''];
+                    setValue(changes, 'package-lock.json packages[""] version', rootPackage, 'version', version);
+                    // A merge archive can update package.json while leaving stale release scripts,
+                    // files and policy metadata in package-lock.json. npm reads the lock root during
+                    // packaging, so keep every release-critical root field canonical as well.
+                    for (const key of [
+                        'name',
+                        'description',
+                        'license',
+                        'author',
+                        'private',
+                        'engines',
+                        'main',
+                        'files',
+                        'scripts',
+                        'dependencies',
+                        'devDependencies',
+                        'overrides',
+                        'keywords',
+                        'publishConfig',
+                        'nexowattReleasePolicy',
+                        'publisher',
+                        'copyright',
+                    ]) {
+                        if (Object.prototype.hasOwnProperty.call(pkg, key)) {
+                            setJsonValue(
+                                changes,
+                                `package-lock.json packages[""] ${key}`,
+                                rootPackage,
+                                key,
+                                pkg[key],
+                            );
+                        }
+                    }
                 }
             },
         },

package/tools/nexowatt-ui-overview-runtime-selftest.cjs

@@ -3,11 +3,10 @@
 const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const fail=msg=>{console.error(`[NexoWatt EOS UI overview runtime] ${msg}`);process.exit(1)};
 const runtime=read('adminWww/js/eos-ems-overview.js');const source=read('src-admin/public/js/eos-ems-overview.js');const css=read('adminWww/css/eos-ems-overview.css');const index=read('adminWww/index.html');const role=read('adminWww/js/eos-role-ui.js');const shell=read('adminWww/js/nexowatt-native-shell.js');const intro=read('src-admin/src/tabs/Intro.tsx');const introBundle=read('adminWww/assets/Intro-DkwRiz1n-v84.js');const bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js');const generic=read('adminWww/assets/index-D2ymscJA-v84.js');
 if(runtime!==source)fail('runtime source/build drift');
+if(runtime.includes('Vollständige EMS-Diagnose öffnen'))fail('unsupported EMS link remains');
 for(const marker of ['nexowatt-ems-overview-v1','nexowatt-ui.*.info.adminOverview.*','system.adapter.nexowatt-ui.*.alive','POLL_MS = 5000','STALE_MS = 20000',"REQUIRED_UI_VERSION = '0.8.198'",'getForeignStates','Keine Kachel besitzt Schreibhoheit','currentDecisions','§14a-Fallback','nexowatt-eos-admin-socket-ready','readUiAdapterInfo','socketFromReact'])if(!runtime.includes(marker))fail(`runtime marker missing: ${marker}`);
 for(const forbidden of ['setForeignState','setState(','sendToHost','writeFile','extendObject'])if(runtime.includes(forbidden))fail(`read-only runtime contains ${forbidden}`);
-for(const marker of ['eos-ems-overview.css?v=7100','eos-ems-overview.js?v=7100','nexowatt-stable-v7100.js?v=7100','eos-release-watch.js?v=7100'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
-if(runtime.includes('Vollständige EMS-Diagnose öffnen'))fail('unsupported EMS destination remains visible');
-if(!intro.includes('eos-overview-edit-controls')||!introBundle.includes('eos-overview-edit-controls'))fail('edit control is not inside bottom card grid');
+for(const marker of ['eos-ems-overview.css?v=7101','eos-ems-overview.js?v=7101','nexowatt-stable-v7101.js?v=7101'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
 if(!css.includes('#eos-ems-overview-runtime')||!css.includes('.eos-ems-overview-metrics')||!css.includes('startup and compatibility messages stay compact'))fail('EMS card CSS incomplete');
 if(role.includes('overview.innerHTML = `')||!role.includes('never cover the real Admin Intro'))fail('obsolete role overview still active');
 if(!shell.includes("label: 'Installateur'")||!shell.includes("label: 'Endkunde'")||!shell.includes('eosNativeReactOverview'))fail('native overview role bridge incomplete');

package/tools/nexowatt-validate-package.cjs

@@ -41,20 +41,23 @@ if (pkg.scripts['test:eos-version-sync'] !== 'node tools/nexowatt-version-sync-s
 if (pkg.scripts['verify:eos-merge'] !== 'node tools/nexowatt-merge-update-selftest.cjs') fail('merge update selftest script is missing or incorrect');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-version-sync-selftest.cjs')) fail('version sync selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-merge-update-selftest.cjs')) fail('merge update selftest is not part of check:eos-stability');
-if (pkg.scripts['check:eos-stable-v7100'] !== 'node tools/nexowatt-stable-v7100-selftest.cjs') fail('stable v7100 selftest script is missing or incorrect');
-if (pkg.scripts['test:eos-password-write'] !== 'node tools/nexowatt-password-write-selftest.cjs') fail('password write selftest script is missing');
-if (pkg.scripts['test:eos-request-security'] !== 'node tools/nexowatt-request-security-selftest.cjs') fail('request security selftest script is missing');
-if (pkg.scripts['test:eos-cache-update'] !== 'node tools/nexowatt-cache-update-selftest.cjs') fail('cache update selftest script is missing');
-for (const marker of ['nexowatt-password-write-selftest.cjs','nexowatt-request-security-selftest.cjs','nexowatt-cache-update-selftest.cjs']) if (!pkg.scripts['check:eos-stability']?.includes(marker)) fail(`stability check must execute ${marker}`);
+if (pkg.scripts['check:eos-stable-v7101'] !== 'node tools/nexowatt-stable-v7101-selftest.cjs') fail('stable v7101 selftest script is missing or incorrect');
 if (!pkg.scripts.prepublishOnly?.startsWith('npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run check:eos-publish-channel')) fail('prepublishOnly must synchronize versions and normalize release defaults before the publish channel guard');
 if (pkg.scripts['precheck:eos-package'] !== 'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-package must synchronize versions, normalize release defaults and clean stale runtime files');
 if (pkg.scripts['precheck:eos-stability'] !== 'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-stability must synchronize versions, normalize release defaults and clean stale runtime files');
 if (pkg.scripts['test:eos-publish-channel'] !== 'node tools/nexowatt-publish-channel-selftest.cjs') fail('publish channel selftest script is missing');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-publish-channel-selftest.cjs')) fail('stability check must execute the publish channel selftest');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-release-defaults-selftest.cjs')) fail('stability check must execute the release-default selftest');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-password-write-selftest.cjs')) fail('password-write selftest is not part of check:eos-stability');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-password-flow-selftest.cjs')) fail('account-password flow selftest is not part of check:eos-stability');
 if (io.native?.auth !== true) fail('fresh sales installations must default to authenticated access');
 if (io.native?.eosHideLegacyBackupFromNonAdmins !== true) fail('internal BackItUp reserve must default to Admin/Service visibility');
 if (io.native?.nexowattHideLegacyBackupFromNonAdmins !== true) fail('NexoWatt backup visibility compatibility flag must default to true');
+for (const key of ['description', 'files', 'scripts', 'nexowattReleasePolicy']) {
+  if (JSON.stringify(pkgLock.packages?.['']?.[key]) !== JSON.stringify(pkg[key])) {
+    fail(`package-lock root ${key} must match package.json`);
+  }
+}
 for (const [label, value] of [
   ['io-package common.version', io.common?.version],
   ['io-package top-level version', io.version],
@@ -104,7 +107,6 @@ for (const file of [
   'adminWww/js/eos-basic-settings.js',
   'adminWww/js/eos-role-ui.js',
   'adminWww/js/eos-account-management.js',
-  'adminWww/js/eos-release-watch.js',
   'adminWww/js/eos-assistant.js',
   'adminWww/css/nexowatt-native-shell.css',
   'adminWww/img/eos/nexowatt-192.png',
@@ -115,14 +117,14 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.10.0.md',
-  'RELEASE_NOTES_V7.10.0.md',
-  'PUBLISH_STABLE_V7.10.0.md',
-  'INSTALL_TEST_V7.10.0.md',
-  'RELEASE_ACCEPTANCE_V7.10.0.md',
+  'README_STABILITY_V7.10.1.md',
+  'RELEASE_NOTES_V7.10.1.md',
+  'PUBLISH_STABLE_V7.10.1.md',
+  'INSTALL_TEST_V7.10.1.md',
+  'RELEASE_ACCEPTANCE_V7.10.1.md',
   'MERGE_UPDATE.ps1',
   'MERGE_UPDATE.cmd',
-  'MERGE_UPDATE_README_V7.10.0.md',
+  'MERGE_UPDATE_README_V7.10.1.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -133,9 +135,6 @@ for (const file of [
   'tools/nexowatt-role-access-selftest.cjs',
   'tools/nexowatt-first-login-selftest.cjs',
   'tools/nexowatt-account-management-selftest.cjs',
-  'tools/nexowatt-password-write-selftest.cjs',
-  'tools/nexowatt-request-security-selftest.cjs',
-  'tools/nexowatt-cache-update-selftest.cjs',
   'tools/nexowatt-modern-ui-selftest.cjs',
   'tools/nexowatt-login-layout-selftest.cjs',
   'tools/nexowatt-internal-reserve-selftest.cjs',
@@ -143,12 +142,14 @@ for (const file of [
   'tools/nexowatt-sync-release-version.cjs',
   'tools/nexowatt-version-sync-selftest.cjs',
   'tools/nexowatt-merge-update-selftest.cjs',
-  'tools/nexowatt-stable-v7100-selftest.cjs',
+  'tools/nexowatt-stable-v7101-selftest.cjs',
+  'tools/nexowatt-password-write-selftest.cjs',
+  'tools/nexowatt-account-password-flow-selftest.cjs',
   'tools/nexowatt-ems-overview-selftest.cjs',
   'tools/nexowatt-ui-overview-runtime-selftest.cjs',
   'adminWww/js/eos-ems-overview.js',
   'adminWww/css/eos-ems-overview.css',
-  'adminWww/static/js/nexowatt-stable-v7100.js',
+  'adminWww/static/js/nexowatt-stable-v7101.js',
   'src-admin/src/components/Intro/NexoWattEmsOverview.tsx',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',
@@ -176,8 +177,8 @@ const shellTag = String(buildInfo.shellCacheTag || shellCache);
 if (!runtime || !Number.isFinite(runtimeNumber)) fail(`invalid runtimeEntry ${runtime}`);
 if (!Number.isFinite(shellCache)) fail(`invalid shellCacheVersion ${buildInfo.shellCacheVersion}`);
 for (const marker of [
-  `hostInit-${runtime}.js?v=${shellTag}`,
-  `index-CQZugZ1z-${runtime}.js?v=${shellTag}`,
+  `hostInit-${runtime}.js?v=${runtimeNumber}`,
+  `index-CQZugZ1z-${runtime}.js?v=${runtimeNumber}`,
   `eos-manual-write-policy.js?v=${shellTag}`,
   `nexowatt-native-shell.css?v=${shellTag}`,
   `nexowatt-native-shell.js?v=${shellTag}`,
@@ -187,13 +188,13 @@ for (const marker of [
 if (!index.includes(`eos-role-bootstrap.js?v=${shellTag}`)) fail('role bootstrap cache key mismatch');
 if (!index.includes(`eos-branding-sanitizer.js?v=${shellTag}`)) fail('branding sanitizer cache key mismatch');
 if (!index.includes(`eos-role-ui.js?v=${shellTag}`)) fail('role UI cache key mismatch');
-if (!index.includes(`eos-account-management.js?v=${shellTag}`)) fail('account management cache key mismatch');
+if (index.includes('eos-account-management.js')) fail('custom account-management runtime must not be loaded in standard password mode');
+if (!index.includes(`eos-auto-update.js?v=${shellTag}`)) fail('auto-update cache key mismatch');
 if (!index.includes(`eos-assistant.js?v=${shellTag}`)) fail('EOS Assist cache key mismatch');
 if (!index.includes(`eos-ems-overview.js?v=${shellTag}`)) fail('EMS overview cache key mismatch');
 if (!index.includes(`eos-ems-overview.css?v=${shellTag}`)) fail('EMS overview CSS cache key mismatch');
-if (!index.includes(`nexowatt-stable-v7100.js?v=${shellTag}`)) fail('stable v7100 cache key mismatch');
-if (!index.includes(`eos-release-watch.js?v=${shellTag}`)) fail('release watcher cache key mismatch');
-if (index.indexOf(`eos-manual-write-policy.js?v=${shellTag}`) > index.indexOf(`hostInit-${runtime}.js?v=${shellTag}`)) fail('manual-write policy must load before the React runtime');
+if (!index.includes(`nexowatt-stable-v7101.js?v=${shellTag}`)) fail('stable v98 cache key mismatch');
+if (index.indexOf(`eos-manual-write-policy.js?v=${shellTag}`) > index.indexOf(`hostInit-${runtime}.js?v=${runtimeNumber}`)) fail('manual-write policy must load before the React runtime');
 if (!index.includes('class="eos-native-shell"')) fail('native NexoWatt shell class missing');
 for (const legacy of ['eos-branding.js', 'eos-security-ui.js', 'eos-console-quiet.js', 'eos-objects-state-tools.js']) {
   if (index.includes(legacy)) fail(`legacy browser overlay still loaded: ${legacy}`);
@@ -241,7 +242,7 @@ if (accountManagement.includes("launcher.className = 'eos-account-management-lau
 if (accountManagement.includes('new MutationObserver')) fail('account-management runtime adds a second broad DOM observer');
 if (read('src-admin/public/js/eos-account-management.js') !== accountManagement) fail('account-management source/build drift');
 const roleBootstrap = read('adminWww/js/eos-role-bootstrap.js');
-if (!roleBootstrap.includes('installIntegratedFirstLogin') || !roleBootstrap.includes('v7100 normal-login first activation')) fail('compact integrated first-login is incomplete');
+if (roleBootstrap.includes('installIntegratedFirstLogin(base);') || roleBootstrap.includes('showFirstLoginPassword(resolved, base);')) fail('forced first-login UI must be disabled');
 if (/data-eos-account=|selector\.innerHTML/.test(roleBootstrap)) fail('login role buttons must not enlarge the normal login card');
 if (!roleBootstrap.includes('nexowatt/account/passwordless-status') || !roleBootstrap.includes('eligibility.allowed')) fail('server-checked first-login eligibility is incomplete');
 if (roleBootstrap.includes('installPasswordlessFirstLoginLauncher')) fail('old first-login launcher remains active');
@@ -268,8 +269,8 @@ if (pkg.scripts['clean:eos-runtime'] !== 'node tools/nexowatt-clean-legacy-runti
 if (pkg.scripts.prepack !== 'node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-clean-legacy-runtime.cjs --quiet') fail('prepack must silently synchronize versions and clean stale runtime files');
 if (!pkg.scripts.build?.includes('npm run clean:eos-runtime')) fail('build must finish with runtime cleanup');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-role-access-selftest.cjs')) fail('role access selftest is not part of check:eos-stability');
-if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-first-login-selftest.cjs')) fail('first-login selftest is not part of check:eos-stability');
-if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-management-selftest.cjs')) fail('account-management selftest is not part of check:eos-stability');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-password-flow-selftest.cjs')) fail('standard account-password flow selftest is not part of check:eos-stability');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-password-flow-selftest.cjs')) fail('standard account-password management selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-modern-ui-selftest.cjs')) fail('modern-UI selftest is not part of check:eos-stability');
 if (pkg.scripts['test:eos-login-layout'] !== 'node tools/nexowatt-login-layout-selftest.cjs') fail('login-layout selftest script is missing or incorrect');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-login-layout-selftest.cjs')) fail('login-layout selftest is not part of check:eos-stability');

package/tools/nexowatt-version-sync-selftest.cjs

@@ -24,7 +24,19 @@ try {
     const currentPkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
     const version = currentPkg.version;
     writeJson('package.json', currentPkg);
-    writeJson('package-lock.json', { name: currentPkg.name, version: '7.9.92', packages: { '': { version: '7.9.92' } } });
+    writeJson('package-lock.json', {
+        name: currentPkg.name,
+        version: '7.9.92',
+        packages: {
+            '': {
+                version: '7.9.92',
+                description: 'stale description',
+                files: ['README_STABILITY_V7.9.92.md'],
+                scripts: { 'check:eos-stable-v92': 'node stale.js' },
+                nexowattReleasePolicy: { distTag: 'latest', purpose: 'stale 7.9.92 policy' },
+            },
+        },
+    });
     writeJson('io-package.json', {
         version: '7.9.92',
         common: {
@@ -75,6 +87,11 @@ try {
     ]) {
         if (actual !== version) fail(`${label} was not synchronized: ${actual}`);
     }
+    for (const key of ['description', 'files', 'scripts', 'nexowattReleasePolicy']) {
+        if (JSON.stringify(lock.packages[''][key]) !== JSON.stringify(currentPkg[key])) {
+            fail(`package-lock root ${key} was not synchronized`);
+        }
+    }
     if (io.common.meta !== `${expectedBase}/io-package.json`) fail('io-package URL was not synchronized');
     if (entry.meta !== `${expectedBase}/io-package.json`) fail('repository entry URL was not synchronized');
     if (!fs.existsSync(path.join(temp, build.repositoryEntry))) fail('current repository entry was not created');

package/INSTALL_TEST_V7.10.0.md

@@ -1,11 +0,0 @@
-# Installationstest 7.10.0
-
-```bash
-cd /opt/iobroker
-iobroker stop eos-admin.0
-npm install --no-save --omit=dev iobroker.eos-admin@7.10.0
-iobroker upload eos-admin
-iobroker restart eos-admin.0
-```
-
-Danach Browser mit `Strg + F5` vollständig neu laden. Für EMS-Livedaten muss `iobroker.nexowatt-ui` mindestens `0.8.198` installiert und gestartet sein.

package/MERGE_UPDATE_README_V7.10.0.md

@@ -1,5 +0,0 @@
-# NexoWatt EOS Admin 7.10.0 – Merge-Update
-
-Die flache Merge-ZIP direkt in den vorhandenen Repository-Ordner entpacken und anschließend `MERGE_UPDATE.cmd` ausführen.
-
-Enthalten sind alle Änderungen aus 7.9.96 einschließlich nativer Rollenübersicht, persönlicher Erstkennwortvergabe und EMS-Diagnose sowie die Korrekturen für Login-Geometrie und produktive AdminConnection.

package/PUBLISH_STABLE_V7.10.0.md

@@ -1,15 +0,0 @@
-# Stable-Veröffentlichung 7.10.0
-
-```powershell
-npm login
-npm whoami
-npm run check:eos-release
-npm publish --dry-run --tag latest
-npm publish --tag latest
-```
-
-Das geprüfte Tarball kann alternativ direkt veröffentlicht werden:
-
-```powershell
-npm publish .\iobroker.eos-admin-7.10.0.tgz --tag latest
-```

package/README_STABILITY_V7.10.0.md

@@ -1,3 +0,0 @@
-# NexoWatt EOS Admin 7.10.0 – Stabilität
-
-Die native NexoWatt-Autoaktualisierung ist standardmäßig aktiv und kann im Admin-Cockpit deaktiviert werden. Sie setzt ausschließlich für installierte NexoWatt-Adapter aus dem erkannten Stable-Repository die ioBroker-Richtlinie `major`. Fremdadapter bleiben unverändert. Beim Abschalten werden vorherige Richtlinien wiederhergestellt.

package/RELEASE_ACCEPTANCE_V7.10.0.md

@@ -1,11 +0,0 @@
-# Release-Abnahme 7.10.0
-
-- [ ] Login-Karte ist ordentlich proportioniert und nur moderat größer als vor 7.9.96.
-- [ ] Normale Anmeldung, falsches Passwort und persönliche Erstkennwortvergabe erzeugen keine innere Scrollleiste.
-- [ ] Erstkennwort `nexowatt` führt zur verpflichtenden persönlichen Kennwortvergabe.
-- [ ] Native Adapterkarten sind bei Admin, Installateur und Endkunde sichtbar, soweit die Rolle sie freigibt.
-- [ ] NexoWatt-UI-Karte ist in der Übersicht vorhanden.
-- [ ] EMS-Kachel zeigt nach Verbindungsaufbau Livewerte aus `nexowatt-ui.*.info.adminOverview.*`.
-- [ ] UI-Version unter `0.8.198` wird verständlich gemeldet.
-- [ ] Die EMS-Kachel enthält keinen Schreibpfad.
-- [ ] `npm run check:eos-release` und `npm publish --dry-run --tag latest` sind vollständig grün.

package/RELEASE_NOTES_V7.10.0.md

@@ -1,17 +0,0 @@
-# NexoWatt EOS Admin 7.10.0
-
-## Korrekturen
-
-- Dauerhafter vertikaler Scrollbalken in der Cockpit-/Übersichtsfläche.
-- Login wieder kompakt und sauber ausgerichtet; keine überlappenden Feldbeschriftungen.
-- Erstpasswort und Passwort-Reset verwenden die native ioBroker-Passwortverwaltung mit kanonischer Benutzer-ID und Kompatibilitäts-Fallback.
-- Passwort-Metadaten werden erst nach Hash- und Credential-Prüfung freigegeben.
-- Präzise Fehlermeldungen für nicht gespeicherte oder nicht verifizierte Passwörter.
-- Cache-Tag 7100 und automatische Release-Überwachung gegen gemischte Browserstände.
-- Automatische Stable-Updates für installierte NexoWatt-Adapter bleiben standardmäßig aktiv und abschaltbar.
-
-## Unverändert
-
-- EMS-Diagnose bleibt rein lesend.
-- Der nicht vorhandene Link zur vollständigen EMS-Diagnose bleibt entfernt.
-- Der Bearbeitungsstift bleibt im unteren Kartenbereich.

package/adminWww/static/js/nexowatt-stable-v7100.js

@@ -1,111 +0,0 @@
-(() => {
-    'use strict';
-    const VERSION = 'v7100-scroll-login-auto-update';
-    const MANAGED_USERS = new Set(['installer', 'guest', 'user']);
-    const normalizeUser = value => String(value || '').trim().toLowerCase().replace(/^system\.user\./, '');
-    const INTRO_STYLE_PROPERTIES = [
-        'position', 'top', 'right', 'bottom', 'left', 'width', 'height', 'min-height', 'max-height',
-        'margin', 'overflow-x', 'overflow-y', 'overscroll-behavior', 'scrollbar-gutter',
-    ];
-    const isIntroRoute = () => {
-        const hash = decodeURIComponent(window.location.hash || '').toLowerCase();
-        const explicitTab = hash.match(/(?:^|[#/])(tab-[a-z0-9_-]+)(?:[/?&]|$)/)?.[1] || '';
-        if (explicitTab) return explicitTab === 'tab-intro';
-        return document.documentElement.classList.contains('eos-route-intro')
-            || !hash
-            || hash === '#'
-            || hash === '#/';
-    };
-    const bindScrollInput = paper => {
-        if (paper.dataset.nexowattScrollBound === 'true') return;
-        paper.dataset.nexowattScrollBound = 'true';
-        paper.addEventListener('wheel', event => {
-            if (!event.deltaY || paper.scrollHeight <= paper.clientHeight + 1) return;
-            const before = paper.scrollTop;
-            paper.scrollTop += event.deltaY;
-            if (paper.scrollTop !== before) event.preventDefault();
-        }, { passive: false });
-        paper.addEventListener('keydown', event => {
-            if (paper.scrollHeight <= paper.clientHeight + 1) return;
-            const step = Math.max(120, Math.round(paper.clientHeight * .78));
-            if (event.key === 'PageDown') paper.scrollTop += step;
-            else if (event.key === 'PageUp') paper.scrollTop -= step;
-            else if (event.key === 'Home' && event.ctrlKey) paper.scrollTop = 0;
-            else if (event.key === 'End' && event.ctrlKey) paper.scrollTop = paper.scrollHeight;
-            else return;
-            event.preventDefault();
-        });
-    };
-    const disableCockpitScroll = () => {
-        const root = document.documentElement;
-        root.classList.remove('eos-intro-scroll-enabled');
-        const paper = document.getElementById('app-paper');
-        if (!paper || paper.dataset.nexowattScrollable !== 'true') return;
-        delete paper.dataset.nexowattScrollable;
-        for (const property of INTRO_STYLE_PROPERTIES) paper.style.removeProperty(property);
-    };
-    const ensureCockpitScroll = () => {
-        const root = document.documentElement;
-        const paper = document.getElementById('app-paper');
-        if (!paper || !root.classList.contains('eos-app')) return;
-        if (!isIntroRoute()) {
-            disableCockpitScroll();
-            return;
-        }
-        // eos-route-* is owned by the native shell; only add our dedicated scroll flag.
-        root.classList.add('eos-intro-scroll-enabled');
-        paper.dataset.nexowattScrollable = 'true';
-        if (paper.tabIndex < 0) paper.tabIndex = 0;
-        const styles = {
-            position: 'fixed',
-            top: 'var(--nx-content-top, 154px)',
-            right: 'var(--nx-page-x, 12px)',
-            bottom: '8px',
-            left: 'var(--nx-page-x, 12px)',
-            width: 'auto',
-            height: 'auto',
-            minHeight: '0',
-            maxHeight: 'none',
-            margin: '0',
-            overflowX: 'hidden',
-            overflowY: 'scroll',
-            overscrollBehavior: 'contain',
-            scrollbarGutter: 'stable',
-        };
-        for (const [name, value] of Object.entries(styles)) {
-            paper.style.setProperty(name.replace(/[A-Z]/g, char => `-${char.toLowerCase()}`), value, 'important');
-        }
-        bindScrollInput(paper);
-    };
-    const apply = () => {
-        document.documentElement.classList.add('eos-assist-disabled');
-        document.querySelectorAll('.eos-assist-root,.eos-assist-header-root,[data-eos-assist-root],.eos-passwordless-launcher')
-            .forEach(element => element.remove());
-        const username = document.querySelector('input#username,input[name="username"]');
-        const password = document.querySelector('input#password,input[name="password"]');
-        const submit = document.querySelector('button[type="submit"],input[type="submit"]');
-        if (submit && MANAGED_USERS.has(normalizeUser(username?.value)) && !String(password?.value || '')) {
-            submit.disabled = true;
-            submit.classList.add('Mui-disabled');
-            submit.setAttribute('aria-disabled', 'true');
-        }
-        ensureCockpitScroll();
-    };
-    let scheduled = false;
-    const schedule = () => {
-        if (scheduled) return;
-        scheduled = true;
-        requestAnimationFrame(() => { scheduled = false; apply(); });
-    };
-    const start = () => {
-        apply();
-        new MutationObserver(schedule).observe(document.documentElement, { subtree: true, childList: true });
-        document.addEventListener('input', schedule, true);
-        document.addEventListener('change', schedule, true);
-        window.addEventListener('hashchange', schedule);
-        window.addEventListener('resize', schedule, { passive: true });
-        window.setInterval(ensureCockpitScroll, 750);
-    };
-    document.readyState === 'loading' ? document.addEventListener('DOMContentLoaded', start, { once: true }) : start();
-    window.NEXOWATT_EOS_STABLE_V7100 = Object.freeze({ version: VERSION, refresh: apply, ensureCockpitScroll, disableCockpitScroll });
-})();