iobroker.eos-admin 7.10.0 → 7.10.2

package/tools/nexowatt-auto-update-selftest.cjs

@@ -1,34 +1,146 @@
 #!/usr/bin/env node
 'use strict';
-const assert=require('node:assert/strict');
-const {NexoWattStableUpdateManager,isNexoWattRepositoryEntry}=require('../build/lib/eosAutoUpdate.js');
-const objects=new Map();
-objects.set('system.adapter.eos-admin.0',{_id:'system.adapter.eos-admin.0',common:{name:'eos-admin',version:'7.10.0'},native:{eosNexoWattAutoUpdate:true}});
-objects.set('system.config',{_id:'system.config',common:{activeRepo:['stable'],adapterAutoUpgrade:{repositories:{stable:false},defaultPolicy:'none'}},native:{}});
-objects.set('system.repositories',{_id:'system.repositories',native:{repositories:{stable:{json:{'eos-admin':{name:'eos-admin',version:'7.10.0',meta:'https://github.com/NexoWatt/ioBroker.eos-admin'},'nexowatt-ui':{name:'nexowatt-ui',version:'0.8.198',publisher:'NexoWatt'},'nexowatt-beta':{name:'nexowatt-beta',version:'1.0.0-beta.1',publisher:'NexoWatt'},admin:{name:'admin',version:'7.7.0',publisher:'ioBroker'}}}}}});
-objects.set('system.adapter.eos-admin',{_id:'system.adapter.eos-admin',common:{name:'eos-admin',version:'7.10.0',automaticUpgrade:'patch'},native:{}});
-objects.set('system.adapter.nexowatt-ui',{_id:'system.adapter.nexowatt-ui',common:{name:'nexowatt-ui',version:'0.8.197'},native:{}});
-objects.set('system.adapter.admin',{_id:'system.adapter.admin',common:{name:'admin',version:'7.7.0',automaticUpgrade:'minor'},native:{}});
-const copy=v=>JSON.parse(JSON.stringify(v));
-const refresh=[];
-const adapter={namespace:'eos-admin.0',host:'eos-host',log:{debug(){},info(){},warn(){},error(){}},getForeignObjectAsync:async id=>copy(objects.get(id)||null),setForeignObjectAsync:async(id,obj)=>{objects.set(id,copy(obj));},extendForeignObjectAsync:async(id,part)=>{const base=copy(objects.get(id)||{_id:id,common:{},native:{}});base.native={...(base.native||{}),...(part.native||{})};base.common={...(base.common||{}),...(part.common||{})};objects.set(id,base);},getObjectViewAsync:async()=>({rows:[...objects.entries()].filter(([id])=>/^system\.adapter\.[^.]+$/.test(id)).map(([id,value])=>({id,value:copy(value)}))}),sendToHostAsync:async(...args)=>{refresh.push(args);}};
-(async()=>{
- assert.equal(isNexoWattRepositoryEntry('nexowatt-ui',{publisher:'NexoWatt'}),true);
- assert.equal(isNexoWattRepositoryEntry('admin',{publisher:'ioBroker'}),false);
- const manager=new NexoWattStableUpdateManager(adapter);
- const enabled=await manager.reconcile('test');
- assert.equal(enabled.enabled,true);assert.equal(enabled.repository,'stable');assert.deepEqual(enabled.managedAdapters,['eos-admin','nexowatt-ui']);
- assert.equal(objects.get('system.adapter.eos-admin').common.automaticUpgrade,'major');
- assert.equal(objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade,'major');
- assert.equal(objects.get('system.adapter.admin').common.automaticUpgrade,'minor');
- assert.equal(objects.get('system.config').common.adapterAutoUpgrade.repositories.stable,true);
- // A manual user change while EOS management is active must not be overwritten on disable.
- objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade='minor';
- const disabled=await manager.setEnabled(false);assert.equal(disabled.enabled,false);
- assert.equal(objects.get('system.adapter.eos-admin').common.automaticUpgrade,'patch');
- assert.equal(objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade,'minor');
- assert.equal(objects.get('system.adapter.admin').common.automaticUpgrade,'minor');
- assert.equal(objects.get('system.config').common.adapterAutoUpgrade.repositories.stable,false);
- manager.stop();
- console.log('[NexoWatt EOS auto update] OK (native policy, stable-only scope, third-party isolation and restore)');
-})().catch(e=>{console.error(e.stack||e);process.exit(1)});
+
+const assert = require('node:assert/strict');
+const { NexoWattStableUpdateManager, isNexoWattRepositoryEntry } = require('../build/lib/eosAutoUpdate.js');
+
+const copy = value => JSON.parse(JSON.stringify(value));
+
+function createFixture() {
+    const objects = new Map();
+    const states = new Map();
+    const objectWrites = [];
+    const stateWrites = [];
+    const refresh = [];
+
+    objects.set('system.adapter.eos-admin.0', {
+        _id: 'system.adapter.eos-admin.0',
+        common: { name: 'eos-admin', version: '7.10.2' },
+        native: {
+            eosNexoWattAutoUpdate: true,
+            eosNexoWattAutoUpdateState: {
+                previousPolicies: {},
+                lastSync: 1,
+            },
+        },
+    });
+    objects.set('system.config', {
+        _id: 'system.config',
+        common: {
+            activeRepo: ['stable'],
+            adapterAutoUpgrade: { repositories: { stable: false }, defaultPolicy: 'none' },
+        },
+        native: {},
+    });
+    objects.set('system.repositories', {
+        _id: 'system.repositories',
+        native: {
+            repositories: {
+                stable: {
+                    json: {
+                        'eos-admin': { name: 'eos-admin', version: '7.10.2', meta: 'https://github.com/NexoWatt/ioBroker.eos-admin' },
+                        'nexowatt-ui': { name: 'nexowatt-ui', version: '0.8.202', publisher: 'NexoWatt' },
+                        'nexowatt-beta': { name: 'nexowatt-beta', version: '1.0.0-beta.1', publisher: 'NexoWatt' },
+                        admin: { name: 'admin', version: '7.7.0', publisher: 'ioBroker' },
+                    },
+                },
+            },
+        },
+    });
+    objects.set('system.adapter.eos-admin', {
+        _id: 'system.adapter.eos-admin',
+        common: { name: 'eos-admin', version: '7.10.2', automaticUpgrade: 'patch' },
+        native: {},
+    });
+    objects.set('system.adapter.nexowatt-ui', {
+        _id: 'system.adapter.nexowatt-ui',
+        common: { name: 'nexowatt-ui', version: '0.8.202' },
+        native: {},
+    });
+    objects.set('system.adapter.admin', {
+        _id: 'system.adapter.admin',
+        common: { name: 'admin', version: '7.7.0', automaticUpgrade: 'minor' },
+        native: {},
+    });
+
+    const adapter = {
+        namespace: 'eos-admin.0',
+        host: 'eos-host',
+        log: { debug() {}, info() {}, warn() {}, error() {} },
+        getForeignObjectAsync: async id => copy(objects.get(id) || null),
+        setForeignObjectAsync: async (id, object) => {
+            objectWrites.push(id);
+            objects.set(id, copy(object));
+        },
+        getObjectViewAsync: async () => ({
+            rows: [...objects.entries()]
+                .filter(([id]) => /^system\.adapter\.[^.]+$/.test(id))
+                .map(([id, value]) => ({ id, value: copy(value) })),
+        }),
+        getStateAsync: async id => copy(states.get(id) || null),
+        setStateAsync: async (id, value, ack) => {
+            const state = value && typeof value === 'object' && Object.prototype.hasOwnProperty.call(value, 'val')
+                ? { ...value }
+                : { val: value, ack: Boolean(ack) };
+            stateWrites.push(id);
+            states.set(id, copy(state));
+        },
+        sendToHostAsync: async (...args) => { refresh.push(args); },
+    };
+
+    return { adapter, objects, states, objectWrites, stateWrites, refresh };
+}
+
+(async () => {
+    assert.equal(isNexoWattRepositoryEntry('nexowatt-ui', { publisher: 'NexoWatt' }), true);
+    assert.equal(isNexoWattRepositoryEntry('admin', { publisher: 'ioBroker' }), false);
+
+    const fixture = createFixture();
+    const manager = new NexoWattStableUpdateManager(fixture.adapter);
+
+    const enabled = await manager.reconcile('test');
+    assert.equal(enabled.enabled, true);
+    assert.equal(enabled.repository, 'stable');
+    assert.deepEqual(enabled.managedAdapters, ['eos-admin', 'nexowatt-ui']);
+    assert.equal(fixture.objects.get('system.adapter.eos-admin').common.automaticUpgrade, 'major');
+    assert.equal(fixture.objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade, 'major');
+    assert.equal(fixture.objects.get('system.adapter.admin').common.automaticUpgrade, 'minor');
+    assert.equal(fixture.objects.get('system.config').common.adapterAutoUpgrade.repositories.stable, true);
+    assert.equal(fixture.states.get('info.nexowattStableUpdatesEnabled').val, true);
+    assert.ok(JSON.parse(fixture.states.get('info.nexowattStableUpdatesState').val).lastSync > 1);
+
+    // Regression guard for 7.10.1: runtime status must never be persisted into
+    // system.adapter.eos-admin.0.native, because that restarts the running adapter.
+    assert.equal(fixture.objectWrites.includes('system.adapter.eos-admin.0'), false);
+
+    // A second reconciliation may refresh state timestamps, but must not rewrite
+    // unchanged adapter policies or system.config.
+    const objectWriteCount = fixture.objectWrites.length;
+    await manager.reconcile('repeat');
+    assert.equal(fixture.objectWrites.length, objectWriteCount);
+
+    // A manual user change while EOS management is active must not be overwritten on disable.
+    fixture.objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade = 'minor';
+    const disabled = await manager.setEnabled(false);
+    assert.equal(disabled.enabled, false);
+    assert.equal(fixture.objects.get('system.adapter.eos-admin').common.automaticUpgrade, 'patch');
+    assert.equal(fixture.objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade, 'minor');
+    assert.equal(fixture.objects.get('system.adapter.admin').common.automaticUpgrade, 'minor');
+    assert.equal(fixture.objects.get('system.config').common.adapterAutoUpgrade.repositories.stable, false);
+    assert.equal(fixture.states.get('info.nexowattStableUpdatesEnabled').val, false);
+    assert.equal(fixture.objectWrites.includes('system.adapter.eos-admin.0'), false);
+    manager.stop();
+
+    // Startup must only schedule reconciliation. It must not modify repository or
+    // adapter objects while the HTTP server is serving the first browser assets.
+    const startupFixture = createFixture();
+    const startupManager = new NexoWattStableUpdateManager(startupFixture.adapter);
+    await startupManager.start();
+    assert.deepEqual(startupFixture.objectWrites, []);
+    startupManager.stop();
+
+    console.log('[NexoWatt EOS auto update] OK (restart-safe state persistence, delayed startup, stable-only scope, third-party isolation and restore)');
+})().catch(error => {
+    console.error(error.stack || error);
+    process.exit(1);
+});

package/tools/nexowatt-backend-runtime-selftest.cjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const root = path.resolve(__dirname, '..');
+const entry = path.join(root, 'build', 'main.js');
+const packageFile = path.join(root, 'package.json');
+const failures = [];
+const visited = new Set();
+const runtimeFiles = new Set();
+
+function fail(message) {
+    failures.push(message);
+}
+
+function normalize(relative) {
+    return String(relative).replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+function resolveLocal(fromFile, specifier) {
+    const base = path.resolve(path.dirname(fromFile), specifier);
+    const candidates = [base, `${base}.js`, `${base}.json`, path.join(base, 'index.js')];
+    if (fs.existsSync(base) && fs.statSync(base).isDirectory()) {
+        const packageJsonFile = path.join(base, 'package.json');
+        if (fs.existsSync(packageJsonFile)) {
+            try {
+                const packageJson = JSON.parse(fs.readFileSync(packageJsonFile, 'utf8'));
+                if (packageJson.main) candidates.unshift(path.resolve(base, packageJson.main));
+            } catch (error) {
+                fail(`${normalize(path.relative(root, packageJsonFile))} is invalid JSON: ${error.message}`);
+            }
+        }
+    }
+    return candidates.find(candidate => fs.existsSync(candidate) && fs.statSync(candidate).isFile()) || null;
+}
+
+function inspect(file) {
+    const absolute = path.resolve(file);
+    if (visited.has(absolute)) return;
+    visited.add(absolute);
+    runtimeFiles.add(absolute);
+
+    if (!fs.existsSync(absolute)) {
+        fail(`missing runtime file ${normalize(path.relative(root, absolute))}`);
+        return;
+    }
+    if (!absolute.endsWith('.js')) return;
+
+    const text = fs.readFileSync(absolute, 'utf8');
+    const patterns = [
+        /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g,
+        /\brequire\.resolve\(\s*['"]([^'"]+)['"]\s*\)/g,
+        /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g,
+    ];
+    for (const pattern of patterns) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(text))) {
+            const specifier = match[1];
+            if (!specifier.startsWith('.')) continue;
+            const target = resolveLocal(absolute, specifier);
+            if (!target) {
+                fail(`${normalize(path.relative(root, absolute))} -> ${specifier} cannot be resolved`);
+                continue;
+            }
+            inspect(target);
+        }
+    }
+}
+
+function packageRules() {
+    if (!fs.existsSync(packageFile)) {
+        fail('package.json is missing');
+        return [];
+    }
+    try {
+        const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+        if (!Array.isArray(pkg.files) || pkg.files.length === 0) {
+            fail('package.json files whitelist is missing');
+            return [];
+        }
+        return pkg.files
+            .map(rule => normalize(rule).replace(/\/+$/, ''))
+            .filter(Boolean);
+    } catch (error) {
+        fail(`package.json is invalid JSON: ${error.message}`);
+        return [];
+    }
+}
+
+function isDeclaredForPackage(relative, rules) {
+    const value = normalize(relative);
+    return rules.some(rule => value === rule || value.startsWith(`${rule}/`));
+}
+
+if (!fs.existsSync(entry)) fail('build/main.js is missing');
+else inspect(entry);
+
+for (const file of runtimeFiles) {
+    if (!file.endsWith('.js')) continue;
+    const result = spawnSync(process.execPath, ['--check', file], {
+        encoding: 'utf8',
+        windowsHide: true,
+    });
+    if (result.error) {
+        fail(`${normalize(path.relative(root, file))} syntax check could not start: ${result.error.message}`);
+    } else if (result.status !== 0) {
+        fail(`${normalize(path.relative(root, file))} does not parse: ${(result.stderr || result.stdout || '').trim()}`);
+    }
+}
+
+// Do not start a nested `npm pack` process here. This self-test runs from
+// prepublishOnly, and spawning npm.cmd from a Node child process is unreliable
+// on Windows and can also re-enter npm lifecycle hooks. The final npm artifact
+// is still verified externally by `npm publish --dry-run`; this check proves
+// that every reachable local backend dependency is covered by package.json's
+// explicit files whitelist without requiring npm, tsc, tsx or node_modules.
+const rules = packageRules();
+for (const file of runtimeFiles) {
+    const relative = normalize(path.relative(root, file));
+    if (!isDeclaredForPackage(relative, rules)) {
+        fail(`runtime dependency is not declared for the npm package: ${relative}`);
+    }
+}
+
+for (const required of [
+    'build/main.js',
+    'build/lib/web.js',
+    'build/lib/eosAutoUpdate.js',
+    'build/lib/eosRequestSecurity.js',
+]) {
+    if (!runtimeFiles.has(path.join(root, required))) {
+        fail(`entrypoint closure does not include required module ${required}`);
+    }
+}
+
+if (failures.length) {
+    console.error(`[NexoWatt EOS backend runtime] ${failures.length} failure(s):\n${failures.join('\n')}`);
+    process.exit(1);
+}
+
+console.log(
+    `[NexoWatt EOS backend runtime] OK (${runtimeFiles.size} local runtime files resolve, parse and are declared by the npm files whitelist; dependency-free on Windows)`,
+);

package/tools/nexowatt-clean-legacy-runtime.cjs

@@ -74,7 +74,7 @@ function isLegacyVersionedRuntime(file, activeRuntime, activeShell) {
   // Stable product overlays use the product release number in their filename,
   // while the compiled React runtime can intentionally remain on v84. Keep
   // only the active stable overlay and remove stale release assets left behind
-  // by a flat ZIP update (for example v98 when installing v99).
+  // by a flat ZIP update (for example v96 when installing v97).
   const stableMatch = name.match(/^nexowatt-stable-v(\d+)\.js$/i);
   if (stableMatch) return Number(stableMatch[1]) !== activeShell;
   const versionMatch = name.match(/-v(\d+)\.(?:js|js\.map|css|css\.map)$/i);

package/tools/nexowatt-ems-overview-selftest.cjs

@@ -21,9 +21,9 @@ for (const marker of [
     'Diagnose ist rein lesend',
     'system.adapter.nexowatt-ui.*.alive',
 ]) if (!component.includes(marker)) fail(`Komponenten-Vertrag fehlt: ${marker}`);
+if (component.includes('Vollständige EMS-Diagnose öffnen')) fail('Nicht vorhandener Diagnose-Link ist noch aktiv.');
 if ((component.match(/NexoWatt EMS · Live-Diagnose/g) || []).length !== 1) fail('EMS-Überschrift ist doppelt oder fehlt.');
 if (!css.includes('/* nexowatt-ems-overview-v1 */')) fail('Responsive EMS-CSS fehlt.');
-if (component.includes('Vollständige EMS-Diagnose öffnen')) fail('Nicht vorhandener Diagnose-Link darf nicht angeboten werden.');
 if (/setState\(|setForeignState\(|sendToHost\(/.test(component)) fail('EMS-Overview darf keine ioBroker-Schreiboperation enthalten.');
 const assetDir = path.join(root, 'admin', 'assets');
 if (fs.existsSync(assetDir)) {

package/tools/nexowatt-ensure-release-defaults.cjs

@@ -11,7 +11,7 @@ const CANONICAL_NATIVE_DEFAULTS = Object.freeze({
     eosHideLegacyAdminFromNonAdmins: true,
     eosHideLegacyBackupFromNonAdmins: true,
     nexowattHideLegacyBackupFromNonAdmins: true,
-    eosRequireFirstLoginPassword: true,
+    eosRequireFirstLoginPassword: false,
 });
 
 /**

package/tools/nexowatt-login-layout-selftest.cjs

@@ -1,15 +1,11 @@
 #!/usr/bin/env node
 'use strict';
-const fs=require('node:fs'),path=require('node:path');const root=path.resolve(__dirname,'..');const read=r=>fs.readFileSync(path.join(root,r),'utf8');const fail=m=>{console.error(`[NexoWatt EOS login layout] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
-const css=read('adminWww/css/nexowatt-native-shell.css'),sourceCss=read('src-admin/public/css/nexowatt-native-shell.css'),login=read('src-admin/src/login/Login.tsx'),bundle=read('adminWww/assets/bootstrap-COulQZax-v84.js'),boot=read('adminWww/js/eos-role-bootstrap.js'),stableLogin=read('adminWww/static/js/nexowatt-stable-login.js'),stable=read('adminWww/static/js/nexowatt-stable-v7100.js'),index=read('adminWww/index.html'),info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));
-must(css===sourceCss,'login CSS source/build drift');
-for(const marker of ['NexoWatt EOS 7.10.0 – restored clean login geometry','NexoWatt EOS 7.10.0 final – static labels above login fields','width: min(424px, calc(100vw - 20px)) !important','width: min(372px, calc(100vw - 48px)) !important','position: static !important','transform: none !important','display: none !important','overflow: visible !important'])must(css.includes(marker),`login marker missing: ${marker}`);
-must(!css.includes('width: min(520px, calc(100vw - 24px))')&&!css.includes('width: min(460px, calc(100vw - 56px))'),'oversized v96 geometry remains');
-must(stableLogin.includes('normalizeGeometry')&&stableLogin.includes('MuiInputLabel-shrink')&&stableLogin.includes("removeAttribute('data-nw-login-card')")&&stableLogin.includes("removeAttribute('aria-hidden')"),'login cleanup/static-label runtime missing');
-must(!/setAttribute\(['"]data-nw-login-card|createElement\(['"]style/.test(stableLogin),'stable-login runtime creates geometry attributes/styles');
-must(!/width:min\(460px|min-height:540px|createElement\(['"]style/.test(stable),'stable runtime injects login geometry');
-must(boot.includes("const card = form?.closest?.('.MuiPaper-root')")&&!boot.includes("closest?.('.MuiPaper-root,form,main,section')"),'login Paper ownership incorrect');
-must(login.includes('minHeight: 0')&&login.includes('maxWidth: 372')&&login.includes("marginTop: 18")&&login.includes('width: 90')&&(login.match(/inputLabel: \{ shrink: true \}/g)||[]).length>=2,'native Login source does not match product contract');
-for(const marker of ['p:"26px 28px 24px"','width:"calc(100% - 48px)"','maxWidth:372','width:90,height:90','marginTop:18','inputLabel:{shrink:!0}'])must(bundle.includes(marker),`productive login bundle marker missing: ${marker}`);
-must(index.includes(`nexowatt-native-shell.css?v=${info.shellCacheTag}`)&&index.includes('nexowatt-stable-v7100.js?v=7100'),'v7100 login assets not active');
-console.log('[NexoWatt EOS login layout] OK (single Paper, static labels, compact responsive geometry)');
+const fs=require('node:fs'),path=require('node:path');const root=path.resolve(__dirname,'..');const read=r=>fs.readFileSync(path.join(root,r),'utf8');const fail=m=>{console.error('[NexoWatt EOS login layout] '+m);process.exit(1)};const must=(v,m)=>{if(!v)fail(m)};
+const css=read('adminWww/css/nexowatt-native-shell.css'),source=read('src-admin/public/css/nexowatt-native-shell.css'),login=read('src-admin/src/login/Login.tsx'),stableLogin=read('adminWww/static/js/nexowatt-stable-login.js'),stable=read('adminWww/static/js/nexowatt-stable-v7101.js'),index=read('adminWww/index.html');
+must(css===source,'CSS mirror drift');
+for(const marker of ['NexoWatt EOS 7.9.98 – stable scrolling','width: min(456px','width: min(400px','overflow: visible !important'])must(css.includes(marker),`base stable login marker missing: ${marker}`);
+must(login.includes('placeholder={`${I18n.t(\'enterLogin\')} *`}')&&login.includes('placeholder={`${I18n.t(\'enterPassword\')} *`}'),'clean placeholder login missing');
+must(!/data-nw-login-card|createElement\(['"]style/.test(stableLogin),'stable login runtime mutates geometry');
+must(stable.includes("VERSION = 'v7101-scroll-standard-password'")&&!stable.includes('first-password'),'stable v7101 runtime incorrect');
+must(index.includes('nexowatt-stable-v7101.js?v=7101'),'v7101 login runtime not active');
+console.log('[NexoWatt EOS login layout] OK');

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.10.0.md',
+    'MERGE_UPDATE_README_V7.10.2.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',
@@ -67,5 +67,11 @@ if (!pkg.scripts['precheck:eos-package']?.startsWith('npm run sync:eos-version')
 if (!pkg.scripts.prepublishOnly?.startsWith('npm run sync:eos-version')) {
     fail('npm publishing does not self-heal stale merged version files');
 }
+if (/\b(?:tsc|tsx)\b|build:(?:backend|frontend)|\bnpx\b|npm\s+(?:i|install|ci)\b/i.test(pkg.scripts.prepublishOnly || '')) {
+    fail('npm publishing must not require local development dependencies');
+}
+if (!pkg.scripts.prepack?.includes('nexowatt-prebuilt-release-selftest.cjs')) {
+    fail('npm packaging does not verify the sealed prebuilt release');
+}
 
 console.log('[NexoWatt EOS merge update selftest] OK (flat overwrite + EMS merge + version repair + guarded verification)');

package/tools/nexowatt-modern-ui-selftest.cjs

@@ -1,49 +1,13 @@
 #!/usr/bin/env node
 'use strict';
-const fs = require('fs');
-const path = require('path');
-const root = path.resolve(__dirname, '..');
-const read = rel => fs.readFileSync(path.join(root, rel), 'utf8');
-let bad = false;
-const fail = msg => { console.error(`[NexoWatt EOS modern UI] ${msg}`); bad = true; };
-const css = read('adminWww/css/nexowatt-native-shell.css');
-const sourceCss = read('src-admin/public/css/nexowatt-native-shell.css');
-const index = read('adminWww/index.html');
-const accountUi = read('adminWww/js/eos-account-management.js');
-const bootstrap = read('adminWww/js/eos-role-bootstrap.js');
-const shell = read('adminWww/js/nexowatt-native-shell.js');
-const role = read('adminWww/js/eos-role-ui.js');
-const assist = read('adminWww/js/eos-assistant.js');
-
-for (const marker of [
-  '--nx-shadow-soft', '--nx-shadow-float', 'backdrop-filter: blur', '#app-paper', '.MuiDialog-paper',
-  '.MuiButton-root', '.MuiTableRow-root', ':focus-visible', 'border-radius: 24px', 'linear-gradient',
-  '@media (max-width: 720px)', '.eos-activation-steps', '.eos-account-row:hover',
-  'main.MuiPaper-root::before', 'width: min(380px, calc(100vw - 52px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
-  '.eos-account-management-entry', 'pointer-events: auto !important', 'touch-action: manipulation', 'overflow: visible',
-]) if (!css.includes(marker)) fail(`modern styling marker missing: ${marker}`);
-if (sourceCss !== css) fail('modern CSS source/build drift');
-for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','eos-role-bootstrap.js','eos-assistant.js']) {
-  if (!index.includes(marker)) fail(`modern UI asset not active: ${marker}`);
-}
-for (const marker of ['NexoWatt EOS', 'Zugänge & Rollen', 'Endkunden-Zugänge', 'ensureEntrySurface']) {
-  if (!accountUi.includes(marker)) fail(`modern account surface missing label: ${marker}`);
-}
-for (const marker of ['installIntegratedFirstLogin','v7100 normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
-  if (!bootstrap.includes(marker)) fail(`integrated first-activation surface missing: ${marker}`);
-}
-if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('compact login still injects role buttons or a second panel');
-if (bootstrap.includes("launcher.className = 'eos-passwordless-launcher'")) fail('old bottom first-login launcher is still rendered');
-if (!shell.includes('ensureModernOverview') || !shell.includes("currentTab() !== 'tab-intro'")) fail('current overview is not modernized');
-if (!role.includes('never cover the real Admin Intro') || role.includes('overview.innerHTML = `') || !role.includes('navigateToTab')) fail('native role overview contract is missing');
-if (!role.includes('ensureReserveObserver') || !role.includes('state.reserveObserver.observe(paper')) fail('scoped delayed-row reserve filter is missing');
-if (!assist.includes('NEXOWATT_EOS_ASSIST_DISABLED') || !assist.includes('element.remove()')) fail('EOS Assist stable-disable guard is missing');
-
-const observerCount = [
-  'eos-policy-client.js', 'eos-branding-sanitizer.js', 'nexowatt-native-shell.js', 'eos-native-security.js',
-  'eos-basic-settings.js', 'eos-role-ui.js', 'eos-account-management.js', 'eos-assistant.js',
-].reduce((count, file) => count + (read(`adminWww/js/${file}`).match(/new MutationObserver/g) || []).length, 0);
-if (observerCount !== 2) fail(`expected one shared observer plus one scoped reserve-row observer, found ${observerCount}`);
-
-if (bad) process.exit(1);
+const fs=require('node:fs'),path=require('node:path');const root=path.resolve(__dirname,'..');const read=r=>fs.readFileSync(path.join(root,r),'utf8');const fail=m=>{console.error('[NexoWatt EOS modern UI] '+m);process.exit(1)};const must=(v,m)=>{if(!v)fail(m)};
+const css=read('adminWww/css/nexowatt-native-shell.css'),sourceCss=read('src-admin/public/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),boot=read('adminWww/js/eos-role-bootstrap.js'),shell=read('adminWww/js/nexowatt-native-shell.js'),role=read('adminWww/js/eos-role-ui.js'),assist=read('adminWww/js/eos-assistant.js');
+must(css===sourceCss,'CSS source/build drift');
+for(const marker of ['#app-paper','.MuiDialog-paper','.MuiButton-root',':focus-visible','persistent native overview scrolling','eos-overview-edit-controls'])must(css.includes(marker),`CSS marker missing: ${marker}`);
+for(const marker of ['nexowatt-native-shell.css','eos-role-bootstrap.js','eos-auto-update.js','nexowatt-stable-v7101.js'])must(index.includes(marker),`active asset missing: ${marker}`);
+must(!index.includes('eos-account-management.js'),'custom reset asset active');
+must(boot.includes('NEXOWATT_EOS_STANDARD_PASSWORD_MODE')&&!boot.includes('installIntegratedFirstLogin(base);'),'standard login mode missing');
+must(shell.includes('ensureModernOverview'),'modern overview missing');
+must(role.includes('never cover the real Admin Intro')&&role.includes('filterNativeUsersPage'),'role UI contract missing');
+must(assist.includes('NEXOWATT_EOS_ASSIST_DISABLED'),'assist disable guard missing');
 console.log('[NexoWatt EOS modern UI] OK');

package/tools/nexowatt-password-write-selftest.cjs

@@ -1,18 +1,48 @@
 #!/usr/bin/env node
 'use strict';
-const assert=require('node:assert/strict');
-const {normalizeEosPasswordTarget,setEosUserPasswordWithVerification,verifyEosUserPasswordCredential}=require('../build/lib/eosPassword.js');
-function adapter({canonicalFails=false, optionsFail=false, verify=true}={}){
- const user={_id:'system.user.user',common:{password:'$old'},native:{}};let accepted='old';const calls=[];
- const set=async(target,password,options)=>{calls.push({target,password,options});if(canonicalFails&&target==='system.user.user')throw new Error('canonicalRejected');if(optionsFail&&options)throw new Error('optionsRejected');user.common.password=`$${Date.now()}:${password}`;accepted=password};
- return {calls,getForeignObjectAsync:async id=>id==='system.user.user'?user:null,setPasswordAsync:set,checkPasswordAsync:async(target,password)=>[verify&&['system.user.user','user'].includes(target)&&password===accepted,'system.user.user']};
-}
-(async()=>{
- assert.deepEqual(normalizeEosPasswordTarget('user'),{userId:'system.user.user',userName:'user'});
- const normal=adapter();const a=await setEosUserPasswordWithVerification(normal,'system.user.user','Strong!2026');assert.equal(a.apiTarget,'system.user.user');
- await verifyEosUserPasswordCredential(normal,'system.user.user','Strong!2026');
- const legacy=adapter({canonicalFails:true});const b=await setEosUserPasswordWithVerification(legacy,'system.user.user','Legacy!2026');assert.equal(b.apiTarget,'user');
- const noOptions=adapter({optionsFail:true});const c=await setEosUserPasswordWithVerification(noOptions,'system.user.user','NoOptions!2026');assert.ok(['system.user.user','user'].includes(c.apiTarget));assert.ok(noOptions.calls.some(call=>call.options===null));
- await assert.rejects(()=>setEosUserPasswordWithVerification(adapter({verify:false}),'user','Fail!2026'),/passwordVerificationFailed/);
- console.log('[NexoWatt EOS password write v7100] OK');
-})().catch(error=>{console.error(error.stack||error);process.exit(1)});
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const root = path.resolve(__dirname, '..');
+const built = fs.readFileSync(path.join(root, 'build/lib/web.js'), 'utf8');
+const source = fs.readFileSync(path.join(root, 'src/lib/web.ts'), 'utf8');
+const begin = built.indexOf('    getEosPasswordUserName(userId) {');
+const end = built.indexOf('    async destroyEosRequestSessions', begin);
+assert(begin >= 0 && end > begin, 'password methods not found in built backend');
+const methods = built.slice(begin, end);
+const sandbox = { module: { exports: null }, EOS_PASSWORD_SERVICE_USER: 'system.user.admin' };
+vm.runInNewContext(`module.exports = class Harness {\nconstructor(adapter){this.adapter=adapter;}\n${methods}\n}`, sandbox);
+const Harness = sandbox.module.exports;
+(async () => {
+  const calls = [];
+  const userObject = { _id: 'system.user.user', common: { password: '$2b$hash' }, native: { keep: true } };
+  const adapter = {
+    setPasswordAsync: async (user, password, options) => calls.push(['set', user, password, options]),
+    checkPasswordAsync: async (user, password, options) => { calls.push(['check', user, password, options]); return [true, `system.user.${user}`]; },
+    getForeignObjectAsync: async id => { calls.push(['get', id]); return JSON.parse(JSON.stringify(userObject)); },
+    extendForeignObjectAsync: async (id, patch, options) => calls.push(['extend', id, patch, options]),
+    setForeignObjectAsync: async () => { throw new Error('full user object replacement must not be used'); },
+  };
+  const harness = new Harness(adapter);
+  await harness.setEosUserPassword('system.user.user', 'NexoWatt2025!');
+  assert.deepEqual(calls[0].slice(0, 3), ['set', 'user', 'NexoWatt2025!']);
+  assert.deepEqual(calls[1].slice(0, 3), ['check', 'user', 'NexoWatt2025!']);
+  await harness.updateEosAccountMetadata('system.user.user', (native, account) => {
+    account.passwordInitialized = true;
+    native.nexowattPasswordChangeRequired = false;
+  });
+  const extend = calls.find(row => row[0] === 'extend');
+  assert(extend, 'native metadata was not extended');
+  assert.equal(extend[1], 'system.user.user');
+  assert.equal(extend[2].native.keep, true);
+  assert.equal(extend[2].native.nexowattEosAccount.passwordInitialized, true);
+  assert(!Object.prototype.hasOwnProperty.call(extend[2], 'common'), 'password/common must not be overwritten by metadata update');
+  for (const code of [source, built]) {
+    assert.match(code, /setPasswordAsync\(userName, password/);
+    assert.match(code, /checkPasswordAsync\(userName, password/);
+    assert.match(code, /extendForeignObjectAsync/);
+    assert.match(code, /passwordVerificationFailed/);
+  }
+  console.log('[NexoWatt EOS password write] OK: real account name, verified password API and metadata-only update');
+})().catch(error => { console.error(error.stack || error); process.exit(1); });