iobroker.eos-admin 7.10.1 → 7.10.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin – stable baseline with native account passwords, persistent cockpit scrolling and optional NexoWatt stable auto-updates.",
-  "version": "7.10.1",
+  "description": "NexoWatt EOS Admin – repaired stable baseline with restart-safe automatic updates, native account passwords and persistent cockpit scrolling.",
+  "version": "7.10.3",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -118,24 +118,28 @@
     "tools/nexowatt-version-sync-selftest.cjs",
     "tools/nexowatt-merge-update-selftest.cjs",
     "tools/nexowatt-ems-overview-selftest.cjs",
-    "README_STABILITY_V7.10.1.md",
-    "RELEASE_NOTES_V7.10.1.md",
-    "PUBLISH_STABLE_V7.10.1.md",
-    "INSTALL_TEST_V7.10.1.md",
-    "RELEASE_ACCEPTANCE_V7.10.1.md",
-    "MERGE_UPDATE_README_V7.10.1.md",
     "README_EMS_OVERVIEW_MERGE.md",
     "RC73_EOS_ADMIN_MERGE_VALIDATION.md",
     "VALIDATION_EMS_OVERVIEW_MERGE.md",
     "NexoWatt_EOS_Admin_EMS_OVERVIEW_MERGE_VALIDATION.md",
     "tools/nexowatt-apply-ems-overview.cjs",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs",
-    "tools/nexowatt-stable-v7101-selftest.cjs",
     "tools/nexowatt-password-write-selftest.cjs",
     "tools/nexowatt-account-password-flow-selftest.cjs",
     "tools/nexowatt-auto-update-selftest.cjs",
     "adminWww/css/eos-auto-update.css",
-    "adminWww/js/eos-auto-update.js"
+    "adminWww/js/eos-auto-update.js",
+    "tools/nexowatt-backend-runtime-selftest.cjs",
+    "NEXOWATT_EOS_PREBUILT_MANIFEST.json",
+    "tools/nexowatt-prebuilt-release-selftest.cjs",
+    "tools/nexowatt-stable-v7103-selftest.cjs",
+    "README_STABILITY_V7.10.3.md",
+    "RELEASE_NOTES_V7.10.3.md",
+    "PUBLISH_STABLE_V7.10.3.md",
+    "INSTALL_TEST_V7.10.3.md",
+    "RELEASE_ACCEPTANCE_V7.10.3.md",
+    "MERGE_UPDATE_README_V7.10.3.md",
+    "tools/nexowatt-auto-update-placement-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -146,8 +150,8 @@
     "test:integration": "mocha test/integration --exit && npm run test:gui && npm run test:rule && npm run test:unit",
     "test:rule": "mocha test/rule --exit",
     "test:gui": "mocha test/*.gui.js --exit",
-    "prepublishOnly": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
-    "build": "npm run build:frontend && npm run build:backend && npm run clean:eos-runtime",
+    "prepublishOnly": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability",
+    "build": "npm run build:frontend && npm run build:backend && npm run clean:eos-runtime && npm run seal:eos-prebuilt-release",
     "build:backend": "tsc -p tsconfig.build.json && tsx tasks.mts --backend-i18n",
     "build:frontend": "tsx tasks.mts",
     "clean": "rimraf src-admin/build",
@@ -170,12 +174,12 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7101 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-backend-runtime-selftest.cjs && node tools/nexowatt-prebuilt-release-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v7103 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs && node tools/nexowatt-auto-update-selftest.cjs && node tools/nexowatt-auto-update-placement-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
     "precheck:eos-stability": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
-    "prepack": "node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-clean-legacy-runtime.cjs --quiet",
+    "prepack": "node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-ensure-release-defaults.cjs && node tools/nexowatt-clean-legacy-runtime.cjs --quiet && node tools/nexowatt-prebuilt-release-selftest.cjs",
     "check:eos-esm": "node tools/nexowatt-esm-syntax-selftest.cjs",
     "check:eos-imports": "node tools/nexowatt-import-integrity-selftest.cjs",
     "check:eos-release": "npm run check:eos-package && npm run check:eos-stability && npm pack --dry-run",
@@ -194,7 +198,11 @@
     "sync:eos-version": "node tools/nexowatt-sync-release-version.cjs",
     "test:eos-version-sync": "node tools/nexowatt-version-sync-selftest.cjs",
     "verify:eos-merge": "node tools/nexowatt-merge-update-selftest.cjs",
-    "check:eos-stable-v7101": "node tools/nexowatt-stable-v7101-selftest.cjs"
+    "check:eos-backend-runtime": "node tools/nexowatt-backend-runtime-selftest.cjs",
+    "check:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs",
+    "seal:eos-prebuilt-release": "node tools/nexowatt-prebuilt-release-selftest.cjs --write",
+    "check:eos-stable-v7103": "node tools/nexowatt-stable-v7103-selftest.cjs",
+    "test:eos-auto-update-placement": "node tools/nexowatt-auto-update-placement-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -205,7 +213,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.1"
+    "purpose": "accepted stable NexoWatt EOS sales-product candidate 7.10.3"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-auto-update-placement-selftest.cjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const root = path.resolve(__dirname, '..');
+const read = relative => fs.readFileSync(path.join(root, relative), 'utf8');
+const json = relative => JSON.parse(read(relative));
+const fail = message => {
+    console.error(`[NexoWatt EOS auto-update placement] ${message}`);
+    process.exit(1);
+};
+const must = (value, message) => value || fail(message);
+
+const sourceJs = read('src-admin/public/js/eos-auto-update.js');
+const builtJs = read('adminWww/js/eos-auto-update.js');
+const sourceCss = read('src-admin/public/css/eos-auto-update.css');
+const builtCss = read('adminWww/css/eos-auto-update.css');
+const index = read('adminWww/index.html');
+const info = json('NEXOWATT_EOS_BUILD_INFO.json');
+const cacheTag = String(info.autoUpdateCacheTag || info.autoUpdateCacheVersion || info.shellCacheTag || info.shellCacheVersion);
+
+must(sourceJs === builtJs, 'JavaScript source/build drift');
+must(sourceCss === builtCss, 'CSS source/build drift');
+must(sourceJs.includes("const VERSION = 'v7103-system-settings-only'"), 'v7103 placement marker missing');
+must(sourceJs.includes('[role="dialog"][aria-labelledby="system-settings-dialog-title"]'), 'System Settings dialog selector missing');
+must(sourceJs.includes("root.dataset.context = 'system-settings'"), 'System Settings context marker missing');
+must(sourceJs.includes("root.setAttribute('data-eos-system-settings-only', 'true')"), 'system-settings-only marker missing');
+must(sourceJs.includes('mount.content.insertBefore(root, mount.appBar.nextSibling)'), 'card is not inserted below the System Settings app bar');
+must(sourceJs.includes("location: 'system-settings'"), 'public UI location contract missing');
+
+for (const forbidden of [
+    'introActive',
+    'eos-native-overview-hero',
+    'eos-ems-overview-runtime',
+    "document.getElementById('app-paper')",
+]) {
+    must(!sourceJs.includes(forbidden), `global page placement remains active: ${forbidden}`);
+}
+
+must(index.includes(`eos-auto-update.js?v=${cacheTag}`), `auto-update JavaScript cache key ${cacheTag} missing`);
+must(index.includes(`eos-auto-update.css?v=${cacheTag}`), `auto-update CSS cache key ${cacheTag} missing`);
+must(sourceCss.includes('visible only inside the System Settings dialog'), 'CSS ownership comment missing');
+must(sourceCss.includes('[data-context="system-settings"]'), 'System Settings CSS scope marker missing');
+
+console.log('[NexoWatt EOS auto-update placement] OK (System Settings only; no Overview/Modules injection)');

package/tools/nexowatt-auto-update-selftest.cjs

@@ -1,34 +1,146 @@
 #!/usr/bin/env node
 'use strict';
-const assert=require('node:assert/strict');
-const {NexoWattStableUpdateManager,isNexoWattRepositoryEntry}=require('../build/lib/eosAutoUpdate.js');
-const objects=new Map();
-objects.set('system.adapter.eos-admin.0',{_id:'system.adapter.eos-admin.0',common:{name:'eos-admin',version:'7.10.0'},native:{eosNexoWattAutoUpdate:true}});
-objects.set('system.config',{_id:'system.config',common:{activeRepo:['stable'],adapterAutoUpgrade:{repositories:{stable:false},defaultPolicy:'none'}},native:{}});
-objects.set('system.repositories',{_id:'system.repositories',native:{repositories:{stable:{json:{'eos-admin':{name:'eos-admin',version:'7.10.0',meta:'https://github.com/NexoWatt/ioBroker.eos-admin'},'nexowatt-ui':{name:'nexowatt-ui',version:'0.8.198',publisher:'NexoWatt'},'nexowatt-beta':{name:'nexowatt-beta',version:'1.0.0-beta.1',publisher:'NexoWatt'},admin:{name:'admin',version:'7.7.0',publisher:'ioBroker'}}}}}});
-objects.set('system.adapter.eos-admin',{_id:'system.adapter.eos-admin',common:{name:'eos-admin',version:'7.10.0',automaticUpgrade:'patch'},native:{}});
-objects.set('system.adapter.nexowatt-ui',{_id:'system.adapter.nexowatt-ui',common:{name:'nexowatt-ui',version:'0.8.197'},native:{}});
-objects.set('system.adapter.admin',{_id:'system.adapter.admin',common:{name:'admin',version:'7.7.0',automaticUpgrade:'minor'},native:{}});
-const copy=v=>JSON.parse(JSON.stringify(v));
-const refresh=[];
-const adapter={namespace:'eos-admin.0',host:'eos-host',log:{debug(){},info(){},warn(){},error(){}},getForeignObjectAsync:async id=>copy(objects.get(id)||null),setForeignObjectAsync:async(id,obj)=>{objects.set(id,copy(obj));},extendForeignObjectAsync:async(id,part)=>{const base=copy(objects.get(id)||{_id:id,common:{},native:{}});base.native={...(base.native||{}),...(part.native||{})};base.common={...(base.common||{}),...(part.common||{})};objects.set(id,base);},getObjectViewAsync:async()=>({rows:[...objects.entries()].filter(([id])=>/^system\.adapter\.[^.]+$/.test(id)).map(([id,value])=>({id,value:copy(value)}))}),sendToHostAsync:async(...args)=>{refresh.push(args);}};
-(async()=>{
- assert.equal(isNexoWattRepositoryEntry('nexowatt-ui',{publisher:'NexoWatt'}),true);
- assert.equal(isNexoWattRepositoryEntry('admin',{publisher:'ioBroker'}),false);
- const manager=new NexoWattStableUpdateManager(adapter);
- const enabled=await manager.reconcile('test');
- assert.equal(enabled.enabled,true);assert.equal(enabled.repository,'stable');assert.deepEqual(enabled.managedAdapters,['eos-admin','nexowatt-ui']);
- assert.equal(objects.get('system.adapter.eos-admin').common.automaticUpgrade,'major');
- assert.equal(objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade,'major');
- assert.equal(objects.get('system.adapter.admin').common.automaticUpgrade,'minor');
- assert.equal(objects.get('system.config').common.adapterAutoUpgrade.repositories.stable,true);
- // A manual user change while EOS management is active must not be overwritten on disable.
- objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade='minor';
- const disabled=await manager.setEnabled(false);assert.equal(disabled.enabled,false);
- assert.equal(objects.get('system.adapter.eos-admin').common.automaticUpgrade,'patch');
- assert.equal(objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade,'minor');
- assert.equal(objects.get('system.adapter.admin').common.automaticUpgrade,'minor');
- assert.equal(objects.get('system.config').common.adapterAutoUpgrade.repositories.stable,false);
- manager.stop();
- console.log('[NexoWatt EOS auto update] OK (native policy, stable-only scope, third-party isolation and restore)');
-})().catch(e=>{console.error(e.stack||e);process.exit(1)});
+
+const assert = require('node:assert/strict');
+const { NexoWattStableUpdateManager, isNexoWattRepositoryEntry } = require('../build/lib/eosAutoUpdate.js');
+
+const copy = value => JSON.parse(JSON.stringify(value));
+
+function createFixture() {
+    const objects = new Map();
+    const states = new Map();
+    const objectWrites = [];
+    const stateWrites = [];
+    const refresh = [];
+
+    objects.set('system.adapter.eos-admin.0', {
+        _id: 'system.adapter.eos-admin.0',
+        common: { name: 'eos-admin', version: '7.10.2' },
+        native: {
+            eosNexoWattAutoUpdate: true,
+            eosNexoWattAutoUpdateState: {
+                previousPolicies: {},
+                lastSync: 1,
+            },
+        },
+    });
+    objects.set('system.config', {
+        _id: 'system.config',
+        common: {
+            activeRepo: ['stable'],
+            adapterAutoUpgrade: { repositories: { stable: false }, defaultPolicy: 'none' },
+        },
+        native: {},
+    });
+    objects.set('system.repositories', {
+        _id: 'system.repositories',
+        native: {
+            repositories: {
+                stable: {
+                    json: {
+                        'eos-admin': { name: 'eos-admin', version: '7.10.2', meta: 'https://github.com/NexoWatt/ioBroker.eos-admin' },
+                        'nexowatt-ui': { name: 'nexowatt-ui', version: '0.8.202', publisher: 'NexoWatt' },
+                        'nexowatt-beta': { name: 'nexowatt-beta', version: '1.0.0-beta.1', publisher: 'NexoWatt' },
+                        admin: { name: 'admin', version: '7.7.0', publisher: 'ioBroker' },
+                    },
+                },
+            },
+        },
+    });
+    objects.set('system.adapter.eos-admin', {
+        _id: 'system.adapter.eos-admin',
+        common: { name: 'eos-admin', version: '7.10.2', automaticUpgrade: 'patch' },
+        native: {},
+    });
+    objects.set('system.adapter.nexowatt-ui', {
+        _id: 'system.adapter.nexowatt-ui',
+        common: { name: 'nexowatt-ui', version: '0.8.202' },
+        native: {},
+    });
+    objects.set('system.adapter.admin', {
+        _id: 'system.adapter.admin',
+        common: { name: 'admin', version: '7.7.0', automaticUpgrade: 'minor' },
+        native: {},
+    });
+
+    const adapter = {
+        namespace: 'eos-admin.0',
+        host: 'eos-host',
+        log: { debug() {}, info() {}, warn() {}, error() {} },
+        getForeignObjectAsync: async id => copy(objects.get(id) || null),
+        setForeignObjectAsync: async (id, object) => {
+            objectWrites.push(id);
+            objects.set(id, copy(object));
+        },
+        getObjectViewAsync: async () => ({
+            rows: [...objects.entries()]
+                .filter(([id]) => /^system\.adapter\.[^.]+$/.test(id))
+                .map(([id, value]) => ({ id, value: copy(value) })),
+        }),
+        getStateAsync: async id => copy(states.get(id) || null),
+        setStateAsync: async (id, value, ack) => {
+            const state = value && typeof value === 'object' && Object.prototype.hasOwnProperty.call(value, 'val')
+                ? { ...value }
+                : { val: value, ack: Boolean(ack) };
+            stateWrites.push(id);
+            states.set(id, copy(state));
+        },
+        sendToHostAsync: async (...args) => { refresh.push(args); },
+    };
+
+    return { adapter, objects, states, objectWrites, stateWrites, refresh };
+}
+
+(async () => {
+    assert.equal(isNexoWattRepositoryEntry('nexowatt-ui', { publisher: 'NexoWatt' }), true);
+    assert.equal(isNexoWattRepositoryEntry('admin', { publisher: 'ioBroker' }), false);
+
+    const fixture = createFixture();
+    const manager = new NexoWattStableUpdateManager(fixture.adapter);
+
+    const enabled = await manager.reconcile('test');
+    assert.equal(enabled.enabled, true);
+    assert.equal(enabled.repository, 'stable');
+    assert.deepEqual(enabled.managedAdapters, ['eos-admin', 'nexowatt-ui']);
+    assert.equal(fixture.objects.get('system.adapter.eos-admin').common.automaticUpgrade, 'major');
+    assert.equal(fixture.objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade, 'major');
+    assert.equal(fixture.objects.get('system.adapter.admin').common.automaticUpgrade, 'minor');
+    assert.equal(fixture.objects.get('system.config').common.adapterAutoUpgrade.repositories.stable, true);
+    assert.equal(fixture.states.get('info.nexowattStableUpdatesEnabled').val, true);
+    assert.ok(JSON.parse(fixture.states.get('info.nexowattStableUpdatesState').val).lastSync > 1);
+
+    // Regression guard for 7.10.1: runtime status must never be persisted into
+    // system.adapter.eos-admin.0.native, because that restarts the running adapter.
+    assert.equal(fixture.objectWrites.includes('system.adapter.eos-admin.0'), false);
+
+    // A second reconciliation may refresh state timestamps, but must not rewrite
+    // unchanged adapter policies or system.config.
+    const objectWriteCount = fixture.objectWrites.length;
+    await manager.reconcile('repeat');
+    assert.equal(fixture.objectWrites.length, objectWriteCount);
+
+    // A manual user change while EOS management is active must not be overwritten on disable.
+    fixture.objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade = 'minor';
+    const disabled = await manager.setEnabled(false);
+    assert.equal(disabled.enabled, false);
+    assert.equal(fixture.objects.get('system.adapter.eos-admin').common.automaticUpgrade, 'patch');
+    assert.equal(fixture.objects.get('system.adapter.nexowatt-ui').common.automaticUpgrade, 'minor');
+    assert.equal(fixture.objects.get('system.adapter.admin').common.automaticUpgrade, 'minor');
+    assert.equal(fixture.objects.get('system.config').common.adapterAutoUpgrade.repositories.stable, false);
+    assert.equal(fixture.states.get('info.nexowattStableUpdatesEnabled').val, false);
+    assert.equal(fixture.objectWrites.includes('system.adapter.eos-admin.0'), false);
+    manager.stop();
+
+    // Startup must only schedule reconciliation. It must not modify repository or
+    // adapter objects while the HTTP server is serving the first browser assets.
+    const startupFixture = createFixture();
+    const startupManager = new NexoWattStableUpdateManager(startupFixture.adapter);
+    await startupManager.start();
+    assert.deepEqual(startupFixture.objectWrites, []);
+    startupManager.stop();
+
+    console.log('[NexoWatt EOS auto update] OK (restart-safe state persistence, delayed startup, stable-only scope, third-party isolation and restore)');
+})().catch(error => {
+    console.error(error.stack || error);
+    process.exit(1);
+});

package/tools/nexowatt-backend-runtime-selftest.cjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const root = path.resolve(__dirname, '..');
+const entry = path.join(root, 'build', 'main.js');
+const packageFile = path.join(root, 'package.json');
+const failures = [];
+const visited = new Set();
+const runtimeFiles = new Set();
+
+function fail(message) {
+    failures.push(message);
+}
+
+function normalize(relative) {
+    return String(relative).replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+function resolveLocal(fromFile, specifier) {
+    const base = path.resolve(path.dirname(fromFile), specifier);
+    const candidates = [base, `${base}.js`, `${base}.json`, path.join(base, 'index.js')];
+    if (fs.existsSync(base) && fs.statSync(base).isDirectory()) {
+        const packageJsonFile = path.join(base, 'package.json');
+        if (fs.existsSync(packageJsonFile)) {
+            try {
+                const packageJson = JSON.parse(fs.readFileSync(packageJsonFile, 'utf8'));
+                if (packageJson.main) candidates.unshift(path.resolve(base, packageJson.main));
+            } catch (error) {
+                fail(`${normalize(path.relative(root, packageJsonFile))} is invalid JSON: ${error.message}`);
+            }
+        }
+    }
+    return candidates.find(candidate => fs.existsSync(candidate) && fs.statSync(candidate).isFile()) || null;
+}
+
+function inspect(file) {
+    const absolute = path.resolve(file);
+    if (visited.has(absolute)) return;
+    visited.add(absolute);
+    runtimeFiles.add(absolute);
+
+    if (!fs.existsSync(absolute)) {
+        fail(`missing runtime file ${normalize(path.relative(root, absolute))}`);
+        return;
+    }
+    if (!absolute.endsWith('.js')) return;
+
+    const text = fs.readFileSync(absolute, 'utf8');
+    const patterns = [
+        /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g,
+        /\brequire\.resolve\(\s*['"]([^'"]+)['"]\s*\)/g,
+        /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g,
+    ];
+    for (const pattern of patterns) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(text))) {
+            const specifier = match[1];
+            if (!specifier.startsWith('.')) continue;
+            const target = resolveLocal(absolute, specifier);
+            if (!target) {
+                fail(`${normalize(path.relative(root, absolute))} -> ${specifier} cannot be resolved`);
+                continue;
+            }
+            inspect(target);
+        }
+    }
+}
+
+function packageRules() {
+    if (!fs.existsSync(packageFile)) {
+        fail('package.json is missing');
+        return [];
+    }
+    try {
+        const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+        if (!Array.isArray(pkg.files) || pkg.files.length === 0) {
+            fail('package.json files whitelist is missing');
+            return [];
+        }
+        return pkg.files
+            .map(rule => normalize(rule).replace(/\/+$/, ''))
+            .filter(Boolean);
+    } catch (error) {
+        fail(`package.json is invalid JSON: ${error.message}`);
+        return [];
+    }
+}
+
+function isDeclaredForPackage(relative, rules) {
+    const value = normalize(relative);
+    return rules.some(rule => value === rule || value.startsWith(`${rule}/`));
+}
+
+if (!fs.existsSync(entry)) fail('build/main.js is missing');
+else inspect(entry);
+
+for (const file of runtimeFiles) {
+    if (!file.endsWith('.js')) continue;
+    const result = spawnSync(process.execPath, ['--check', file], {
+        encoding: 'utf8',
+        windowsHide: true,
+    });
+    if (result.error) {
+        fail(`${normalize(path.relative(root, file))} syntax check could not start: ${result.error.message}`);
+    } else if (result.status !== 0) {
+        fail(`${normalize(path.relative(root, file))} does not parse: ${(result.stderr || result.stdout || '').trim()}`);
+    }
+}
+
+// Do not start a nested `npm pack` process here. This self-test runs from
+// prepublishOnly, and spawning npm.cmd from a Node child process is unreliable
+// on Windows and can also re-enter npm lifecycle hooks. The final npm artifact
+// is still verified externally by `npm publish --dry-run`; this check proves
+// that every reachable local backend dependency is covered by package.json's
+// explicit files whitelist without requiring npm, tsc, tsx or node_modules.
+const rules = packageRules();
+for (const file of runtimeFiles) {
+    const relative = normalize(path.relative(root, file));
+    if (!isDeclaredForPackage(relative, rules)) {
+        fail(`runtime dependency is not declared for the npm package: ${relative}`);
+    }
+}
+
+for (const required of [
+    'build/main.js',
+    'build/lib/web.js',
+    'build/lib/eosAutoUpdate.js',
+    'build/lib/eosRequestSecurity.js',
+]) {
+    if (!runtimeFiles.has(path.join(root, required))) {
+        fail(`entrypoint closure does not include required module ${required}`);
+    }
+}
+
+if (failures.length) {
+    console.error(`[NexoWatt EOS backend runtime] ${failures.length} failure(s):\n${failures.join('\n')}`);
+    process.exit(1);
+}
+
+console.log(
+    `[NexoWatt EOS backend runtime] OK (${runtimeFiles.size} local runtime files resolve, parse and are declared by the npm files whitelist; dependency-free on Windows)`,
+);

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.10.1.md',
+    'MERGE_UPDATE_README_V7.10.3.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',
@@ -67,5 +67,11 @@ if (!pkg.scripts['precheck:eos-package']?.startsWith('npm run sync:eos-version')
 if (!pkg.scripts.prepublishOnly?.startsWith('npm run sync:eos-version')) {
     fail('npm publishing does not self-heal stale merged version files');
 }
+if (/\b(?:tsc|tsx)\b|build:(?:backend|frontend)|\bnpx\b|npm\s+(?:i|install|ci)\b/i.test(pkg.scripts.prepublishOnly || '')) {
+    fail('npm publishing must not require local development dependencies');
+}
+if (!pkg.scripts.prepack?.includes('nexowatt-prebuilt-release-selftest.cjs')) {
+    fail('npm packaging does not verify the sealed prebuilt release');
+}
 
 console.log('[NexoWatt EOS merge update selftest] OK (flat overwrite + EMS merge + version repair + guarded verification)');