iobroker.eos-admin 7.10.1 → 7.10.3

package/tools/nexowatt-prebuilt-release-selftest.cjs

@@ -0,0 +1,292 @@
+#!/usr/bin/env node
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const root = path.resolve(__dirname, '..');
+const manifestFile = path.join(root, 'NEXOWATT_EOS_PREBUILT_MANIFEST.json');
+const packageFile = path.join(root, 'package.json');
+const trackedRoots = [
+    'src',
+    'build',
+    'src-admin/src',
+    'src-admin/public',
+    'adminWww',
+    'admin',
+    'public',
+    'tools',
+];
+const trackedFiles = [
+    'tasks.mts',
+    'tsconfig.json',
+    'tsconfig.build.json',
+];
+const expectedPrepublishOnly =
+    'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability';
+const expectedPrepack =
+    'node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-ensure-release-defaults.cjs && node tools/nexowatt-clean-legacy-runtime.cjs --quiet && node tools/nexowatt-prebuilt-release-selftest.cjs';
+
+function normalize(relative) {
+    return relative.replace(/\\/g, '/');
+}
+
+function walk(relative, output) {
+    const absolute = path.join(root, relative);
+    if (!fs.existsSync(absolute)) return;
+    const stat = fs.lstatSync(absolute);
+    if (stat.isSymbolicLink()) {
+        throw new Error(`symbolic links are not allowed in the sealed release: ${normalize(relative)}`);
+    }
+    if (stat.isFile()) {
+        output.push(normalize(relative));
+        return;
+    }
+    if (!stat.isDirectory()) return;
+    for (const name of fs.readdirSync(absolute).sort()) {
+        walk(path.join(relative, name), output);
+    }
+}
+
+function collectTrackedFiles() {
+    const files = [];
+    for (const relative of trackedRoots) walk(relative, files);
+    for (const relative of trackedFiles) {
+        const absolute = path.join(root, relative);
+        if (!fs.existsSync(absolute) || !fs.statSync(absolute).isFile()) {
+            throw new Error(`tracked release input is missing: ${relative}`);
+        }
+        files.push(normalize(relative));
+    }
+    return [...new Set(files)].sort();
+}
+
+function sha256(relative) {
+    return crypto.createHash('sha256').update(fs.readFileSync(path.join(root, relative))).digest('hex');
+}
+
+function createManifest() {
+    const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+    const files = collectTrackedFiles();
+    const hashes = {};
+    for (const relative of files) hashes[relative] = sha256(relative);
+    return {
+        format: 1,
+        package: pkg.name,
+        version: pkg.version,
+        algorithm: 'sha256',
+        fileCount: files.length,
+        trackedRoots,
+        trackedFiles,
+        files: hashes,
+    };
+}
+
+function writeManifest() {
+    const manifest = createManifest();
+    fs.writeFileSync(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+    console.log(`[NexoWatt EOS prebuilt release] sealed ${manifest.fileCount} source/runtime file(s) for ${manifest.version}`);
+}
+
+function resolveLocal(fromFile, specifier) {
+    const base = path.resolve(path.dirname(fromFile), specifier);
+    const candidates = [base, `${base}.js`, `${base}.json`, path.join(base, 'index.js')];
+    if (fs.existsSync(base) && fs.statSync(base).isDirectory()) {
+        const nestedPackage = path.join(base, 'package.json');
+        if (fs.existsSync(nestedPackage)) {
+            try {
+                const value = JSON.parse(fs.readFileSync(nestedPackage, 'utf8'));
+                if (value.main) candidates.unshift(path.resolve(base, value.main));
+            } catch {
+                // The normal package validator reports malformed JSON in detail.
+            }
+        }
+    }
+    return candidates.find(candidate => fs.existsSync(candidate) && fs.statSync(candidate).isFile()) || null;
+}
+
+function inspectRuntimeClosure(failures) {
+    const entry = path.join(root, 'build', 'main.js');
+    const visited = new Set();
+    const runtimeFiles = new Set();
+
+    function inspect(file) {
+        const absolute = path.resolve(file);
+        if (visited.has(absolute)) return;
+        visited.add(absolute);
+        runtimeFiles.add(absolute);
+        if (!fs.existsSync(absolute)) {
+            failures.push(`missing runtime file ${normalize(path.relative(root, absolute))}`);
+            return;
+        }
+        if (!absolute.endsWith('.js')) return;
+
+        const parsed = spawnSync(process.execPath, ['--check', absolute], {
+            encoding: 'utf8',
+            windowsHide: true,
+        });
+        if (parsed.status !== 0) {
+            failures.push(
+                `${normalize(path.relative(root, absolute))} does not parse: ${(parsed.stderr || parsed.stdout || '').trim()}`,
+            );
+        }
+
+        const text = fs.readFileSync(absolute, 'utf8');
+        const patterns = [
+            /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g,
+            /\brequire\.resolve\(\s*['"]([^'"]+)['"]\s*\)/g,
+            /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g,
+        ];
+        for (const pattern of patterns) {
+            pattern.lastIndex = 0;
+            let match;
+            while ((match = pattern.exec(text))) {
+                const specifier = match[1];
+                if (!specifier.startsWith('.')) continue;
+                const target = resolveLocal(absolute, specifier);
+                if (!target) {
+                    failures.push(`${normalize(path.relative(root, absolute))} -> ${specifier} cannot be resolved`);
+                    continue;
+                }
+                inspect(target);
+            }
+        }
+    }
+
+    inspect(entry);
+    for (const required of [
+        'build/main.js',
+        'build/lib/web.js',
+        'build/lib/eosAutoUpdate.js',
+        'build/lib/eosRequestSecurity.js',
+    ]) {
+        if (!runtimeFiles.has(path.join(root, required))) {
+            failures.push(`entrypoint closure does not include required module ${required}`);
+        }
+    }
+    return runtimeFiles.size;
+}
+
+function verifyManifest(failures) {
+    if (!fs.existsSync(manifestFile)) {
+        failures.push('NEXOWATT_EOS_PREBUILT_MANIFEST.json is missing');
+        return 0;
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
+    } catch (error) {
+        failures.push(`prebuilt manifest is invalid JSON: ${error.message}`);
+        return 0;
+    }
+    const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+    if (manifest.format !== 1) failures.push(`unsupported prebuilt manifest format ${manifest.format}`);
+    if (manifest.package !== pkg.name) failures.push(`prebuilt manifest package ${manifest.package} does not match ${pkg.name}`);
+    if (manifest.version !== pkg.version) failures.push(`prebuilt manifest version ${manifest.version} does not match ${pkg.version}`);
+    if (manifest.algorithm !== 'sha256') failures.push(`prebuilt manifest algorithm must be sha256, got ${manifest.algorithm}`);
+
+    let currentFiles = [];
+    try {
+        currentFiles = collectTrackedFiles();
+    } catch (error) {
+        failures.push(error.message);
+        return 0;
+    }
+    const sealedFiles = Object.keys(manifest.files || {}).sort();
+    const currentSet = new Set(currentFiles);
+    const sealedSet = new Set(sealedFiles);
+    for (const relative of currentFiles) {
+        if (!sealedSet.has(relative)) failures.push(`unsealed release file: ${relative}`);
+    }
+    for (const relative of sealedFiles) {
+        if (!currentSet.has(relative)) failures.push(`sealed release file is missing: ${relative}`);
+    }
+    for (const relative of sealedFiles) {
+        if (!currentSet.has(relative)) continue;
+        const actual = sha256(relative);
+        if (actual !== manifest.files[relative]) failures.push(`sealed release file changed after validation: ${relative}`);
+    }
+    if (manifest.fileCount !== sealedFiles.length) {
+        failures.push(`prebuilt manifest fileCount ${manifest.fileCount} does not match ${sealedFiles.length}`);
+    }
+    return sealedFiles.length;
+}
+
+function verifyLifecycle(failures) {
+    const pkg = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+    const scripts = pkg.scripts || {};
+    if (scripts.prepublishOnly !== expectedPrepublishOnly) {
+        failures.push('prepublishOnly is not the canonical dependency-free direct-publish workflow');
+    }
+    if (scripts.prepack !== expectedPrepack) {
+        failures.push('prepack is not the canonical dependency-free prebuilt-artifact verifier');
+    }
+    if (scripts['check:eos-prebuilt-release'] !== 'node tools/nexowatt-prebuilt-release-selftest.cjs') {
+        failures.push('check:eos-prebuilt-release script is missing or incorrect');
+    }
+    if (scripts['seal:eos-prebuilt-release'] !== 'node tools/nexowatt-prebuilt-release-selftest.cjs --write') {
+        failures.push('seal:eos-prebuilt-release script is missing or incorrect');
+    }
+    for (const [name, command] of [
+        ['prepublishOnly', scripts.prepublishOnly || ''],
+        ['prepack', scripts.prepack || ''],
+    ]) {
+        for (const forbidden of [
+            /(?:^|\s)tsc(?:\s|$)/i,
+            /(?:^|\s)tsx(?:\s|$)/i,
+            /build:backend/i,
+            /build:frontend/i,
+            /(?:^|\s)npx(?:\s|$)/i,
+            /npm\s+(?:i|install|ci)(?:\s|$)/i,
+        ]) {
+            if (forbidden.test(command)) failures.push(`${name} must not require local development dependencies: ${command}`);
+        }
+    }
+    const backendRuntimeSelftestFile = path.join(root, 'tools', 'nexowatt-backend-runtime-selftest.cjs');
+    if (!fs.existsSync(backendRuntimeSelftestFile)) {
+        failures.push('tools/nexowatt-backend-runtime-selftest.cjs is missing');
+    } else {
+        const backendRuntimeSelftest = fs.readFileSync(backendRuntimeSelftestFile, 'utf8');
+        if (!backendRuntimeSelftest.includes('dependency-free on Windows')) {
+            failures.push('backend runtime selftest is missing the cross-platform publish marker');
+        }
+        if (/const\s+npm\s*=\s*process\.platform|spawnSync\(\s*npm\s*,|['"]npm\.cmd['"]/.test(backendRuntimeSelftest)) {
+            failures.push('backend runtime selftest must not spawn a nested npm process');
+        }
+    }
+    const packageFiles = new Set((pkg.files || []).map(value => String(value).replace(/\\/g, '/')));
+    if (![...packageFiles].some(value => value.replace(/\/+$/, '') === 'build')) {
+        failures.push('package.json files must include the complete build directory');
+    }
+    for (const required of [
+        'tools/nexowatt-prebuilt-release-selftest.cjs',
+        'NEXOWATT_EOS_PREBUILT_MANIFEST.json',
+    ]) {
+        if (!packageFiles.has(required)) failures.push(`package.json files is missing ${required}`);
+    }
+}
+
+if (process.argv.includes('--write')) {
+    try {
+        writeManifest();
+    } catch (error) {
+        console.error(`[NexoWatt EOS prebuilt release] ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
+    }
+    process.exit(0);
+}
+
+const failures = [];
+verifyLifecycle(failures);
+const sealedCount = verifyManifest(failures);
+const runtimeCount = inspectRuntimeClosure(failures);
+
+if (failures.length) {
+    console.error(`[NexoWatt EOS prebuilt release] ${failures.length} failure(s):\n${failures.join('\n')}`);
+    process.exit(1);
+}
+console.log(
+    `[NexoWatt EOS prebuilt release] OK (${sealedCount} sealed source/runtime files; ${runtimeCount} backend runtime files; no tsc/tsx required for npm publish)`,
+);

package/tools/nexowatt-stable-v7103-selftest.cjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const root = path.resolve(__dirname, '..');
+const read = relative => fs.readFileSync(path.join(root, relative), 'utf8');
+const json = relative => JSON.parse(read(relative));
+const must = (value, message) => {
+    if (!value) {
+        console.error(`[NexoWatt EOS stable v7103] ${message}`);
+        process.exit(1);
+    }
+};
+
+const pkg = json('package.json');
+const io = json('io-package.json');
+const info = json('NEXOWATT_EOS_BUILD_INFO.json');
+const main = read('src/main.ts');
+const web = read('src/lib/web.ts');
+const boot = read('adminWww/js/eos-role-bootstrap.js');
+const role = read('adminWww/js/eos-role-ui.js');
+const css = read('adminWww/css/nexowatt-native-shell.css');
+const index = read('adminWww/index.html');
+const ems = read('adminWww/js/eos-ems-overview.js');
+const intro = read('src-admin/src/tabs/Intro.tsx');
+const bundle = read('adminWww/assets/Intro-DkwRiz1n-v84.js');
+const stable = read('adminWww/static/js/nexowatt-stable-v7101.js');
+const autoBackend = read('src/lib/eosAutoUpdate.ts');
+const autoUi = read('adminWww/js/eos-auto-update.js');
+const autoCss = read('adminWww/css/eos-auto-update.css');
+const autoTag = String(info.autoUpdateCacheTag || info.autoUpdateCacheVersion || info.shellCacheTag || info.shellCacheVersion);
+
+must(pkg.version === '7.10.3' && io.version === '7.10.3' && io.common.version === '7.10.3' && info.version === '7.10.3', 'version drift');
+must(io.native.eosRequireFirstLoginPassword === false && io.native.eosRequireFirstLoginPasswordChange === false, 'forced first password still enabled');
+must(!index.includes('eos-account-management.js'), 'custom reset UI still loaded');
+must(!boot.includes('installIntegratedFirstLogin(base);') && !boot.includes('showFirstLoginPassword(resolved, base);'), 'forced first-login UI still active');
+must(main.includes('standardPasswordMode: true') && main.includes('nexowattPasswordChangeRequired: false'), 'account migration missing');
+must(role.includes("route === 'tab-users'") && main.includes("command === 'changePassword'"), 'role-aware native password editing missing');
+must(css.includes('persistent native overview scrolling') && stable.includes("overflow-y','scroll"), 'persistent scroll missing');
+must(intro.includes('eos-overview-edit-controls') && bundle.includes('eos-overview-edit-controls'), 'edit control not in bottom grid');
+must(!ems.includes('Vollständige EMS-Diagnose öffnen'), 'unsupported EMS link remains');
+
+// 7.10.2 runtime and package hotfix baseline remains mandatory.
+must(autoBackend.includes("const ENABLED_STATE_ID = 'info.nexowattStableUpdatesEnabled'"), 'restart-safe enabled state missing');
+must(autoBackend.includes("const STATUS_STATE_ID = 'info.nexowattStableUpdatesState'"), 'restart-safe status state missing');
+must(autoBackend.includes('const STARTUP_RECONCILE_DELAY_MS = 30_000'), 'startup grace period missing');
+must(!autoBackend.includes('extendForeignObjectAsync(this.instanceId'), 'runtime still writes the running instance native configuration');
+must(web.includes('this.nexowattStableUpdateManager?.stop();'), 'auto-update manager is not stopped with the web server');
+must(fs.existsSync(path.join(root, 'build/lib/eosRequestSecurity.js')), 'eosRequestSecurity runtime module missing');
+
+// 7.10.3 placement acceptance: System Settings only.
+must(index.includes(`eos-auto-update.js?v=${autoTag}`), 'auto-update JavaScript cache key missing');
+must(index.includes(`eos-auto-update.css?v=${autoTag}`), 'auto-update CSS cache key missing');
+must(autoUi.includes('[role="dialog"][aria-labelledby="system-settings-dialog-title"]'), 'System Settings selector missing');
+must(autoUi.includes("root.dataset.context = 'system-settings'"), 'System Settings context missing');
+must(autoUi.includes('mount.content.insertBefore(root, mount.appBar.nextSibling)'), 'card is not placed below System Settings header');
+must(!autoUi.includes('introActive') && !autoUi.includes('eos-native-overview-hero') && !autoUi.includes('eos-ems-overview-runtime'), 'global overview/module placement remains');
+must(autoCss.includes('visible only inside the System Settings dialog'), 'System Settings CSS ownership missing');
+
+console.log('[NexoWatt EOS stable v7103] OK (v7102 crash/package baseline plus System Settings-only update control)');

package/tools/nexowatt-validate-package.cjs

@@ -11,6 +11,8 @@ const fail = msg => {
 const read = file => fs.readFileSync(path.join(root, file), 'utf8');
 const readJson = file => JSON.parse(read(file));
 const exists = file => fs.existsSync(path.join(root, file));
+const canonicalPrepublishOnly = 'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime && npm run check:eos-publish-channel && npm run check:eos-package && npm run check:eos-stability';
+const canonicalPrepack = 'node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-ensure-release-defaults.cjs && node tools/nexowatt-clean-legacy-runtime.cjs --quiet && node tools/nexowatt-prebuilt-release-selftest.cjs';
 
 const pkg = readJson('package.json');
 const pkgLock = readJson('package-lock.json');
@@ -41,8 +43,18 @@ if (pkg.scripts['test:eos-version-sync'] !== 'node tools/nexowatt-version-sync-s
 if (pkg.scripts['verify:eos-merge'] !== 'node tools/nexowatt-merge-update-selftest.cjs') fail('merge update selftest script is missing or incorrect');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-version-sync-selftest.cjs')) fail('version sync selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-merge-update-selftest.cjs')) fail('merge update selftest is not part of check:eos-stability');
-if (pkg.scripts['check:eos-stable-v7101'] !== 'node tools/nexowatt-stable-v7101-selftest.cjs') fail('stable v7101 selftest script is missing or incorrect');
-if (!pkg.scripts.prepublishOnly?.startsWith('npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run check:eos-publish-channel')) fail('prepublishOnly must synchronize versions and normalize release defaults before the publish channel guard');
+if (pkg.scripts['check:eos-stable-v7103'] !== 'node tools/nexowatt-stable-v7103-selftest.cjs') fail('stable v7103 selftest script is missing or incorrect');
+if (pkg.scripts['test:eos-auto-update-placement'] !== 'node tools/nexowatt-auto-update-placement-selftest.cjs') fail('auto-update placement selftest script is missing or incorrect');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-auto-update-placement-selftest.cjs')) fail('auto-update placement selftest is not part of check:eos-stability');
+if (pkg.scripts.prepublishOnly !== canonicalPrepublishOnly) fail('prepublishOnly must use the dependency-free direct-publish workflow');
+if (/\b(?:tsc|tsx)\b|build:(?:backend|frontend)|\bnpx\b|npm\s+(?:i|install|ci)\b/i.test(pkg.scripts.prepublishOnly || '')) fail('prepublishOnly must not require local development dependencies');
+if (pkg.scripts['check:eos-prebuilt-release'] !== 'node tools/nexowatt-prebuilt-release-selftest.cjs') fail('prebuilt release selftest script is missing or incorrect');
+if (pkg.scripts['seal:eos-prebuilt-release'] !== 'node tools/nexowatt-prebuilt-release-selftest.cjs --write') fail('prebuilt release sealing script is missing or incorrect');
+const backendRuntimeSelftest = read('tools/nexowatt-backend-runtime-selftest.cjs');
+if (!backendRuntimeSelftest.includes('dependency-free on Windows')) fail('backend runtime selftest is missing the cross-platform publish marker');
+if (/const\s+npm\s*=\s*process\.platform|spawnSync\(\s*npm\s*,|['"]npm\.cmd['"]/.test(backendRuntimeSelftest)) fail('backend runtime selftest must not spawn a nested npm process');
+if (!(pkg.files || []).some(value => String(value).replace(/\\/g, '/').replace(/\/+$/, '') === 'build')) fail('package.json files must include the complete build directory');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-prebuilt-release-selftest.cjs')) fail('prebuilt release selftest is not part of check:eos-stability');
 if (pkg.scripts['precheck:eos-package'] !== 'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-package must synchronize versions, normalize release defaults and clean stale runtime files');
 if (pkg.scripts['precheck:eos-stability'] !== 'npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime') fail('precheck:eos-stability must synchronize versions, normalize release defaults and clean stale runtime files');
 if (pkg.scripts['test:eos-publish-channel'] !== 'node tools/nexowatt-publish-channel-selftest.cjs') fail('publish channel selftest script is missing');
@@ -53,6 +65,9 @@ if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-password-flo
 if (io.native?.auth !== true) fail('fresh sales installations must default to authenticated access');
 if (io.native?.eosHideLegacyBackupFromNonAdmins !== true) fail('internal BackItUp reserve must default to Admin/Service visibility');
 if (io.native?.nexowattHideLegacyBackupFromNonAdmins !== true) fail('NexoWatt backup visibility compatibility flag must default to true');
+const instanceObjectIds = new Set((io.instanceObjects || []).map(object => object?._id));
+if (!instanceObjectIds.has('info.nexowattStableUpdatesEnabled')) fail('restart-safe auto-update enabled state is missing');
+if (!instanceObjectIds.has('info.nexowattStableUpdatesState')) fail('restart-safe auto-update runtime state is missing');
 for (const key of ['description', 'files', 'scripts', 'nexowattReleasePolicy']) {
   if (JSON.stringify(pkgLock.packages?.['']?.[key]) !== JSON.stringify(pkg[key])) {
     fail(`package-lock root ${key} must match package.json`);
@@ -114,23 +129,27 @@ for (const file of [
   'src-admin/src/components/Drawer.tsx',
   'src-admin/src/components/DrawerItem.tsx',
   'admin/admin.svg',
+  'build/lib/eosRequestSecurity.js',
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.10.1.md',
-  'RELEASE_NOTES_V7.10.1.md',
-  'PUBLISH_STABLE_V7.10.1.md',
-  'INSTALL_TEST_V7.10.1.md',
-  'RELEASE_ACCEPTANCE_V7.10.1.md',
+  'README_STABILITY_V7.10.3.md',
+  'RELEASE_NOTES_V7.10.3.md',
+  'PUBLISH_STABLE_V7.10.3.md',
+  'INSTALL_TEST_V7.10.3.md',
+  'RELEASE_ACCEPTANCE_V7.10.3.md',
   'MERGE_UPDATE.ps1',
   'MERGE_UPDATE.cmd',
-  'MERGE_UPDATE_README_V7.10.1.md',
+  'MERGE_UPDATE_README_V7.10.3.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
   'tools/nexowatt-runtime-cleanup-selftest.cjs',
   'tools/nexowatt-esm-syntax-selftest.cjs',
   'tools/nexowatt-import-integrity-selftest.cjs',
+  'tools/nexowatt-backend-runtime-selftest.cjs',
+  'tools/nexowatt-prebuilt-release-selftest.cjs',
+  'NEXOWATT_EOS_PREBUILT_MANIFEST.json',
   'tools/nexowatt-entrypoint-smoke-selftest.cjs',
   'tools/nexowatt-role-access-selftest.cjs',
   'tools/nexowatt-first-login-selftest.cjs',
@@ -142,9 +161,14 @@ for (const file of [
   'tools/nexowatt-sync-release-version.cjs',
   'tools/nexowatt-version-sync-selftest.cjs',
   'tools/nexowatt-merge-update-selftest.cjs',
-  'tools/nexowatt-stable-v7101-selftest.cjs',
+  'tools/nexowatt-stable-v7103-selftest.cjs',
   'tools/nexowatt-password-write-selftest.cjs',
   'tools/nexowatt-account-password-flow-selftest.cjs',
+  'tools/nexowatt-auto-update-placement-selftest.cjs',
+  'adminWww/js/eos-auto-update.js',
+  'adminWww/css/eos-auto-update.css',
+  'src-admin/public/js/eos-auto-update.js',
+  'src-admin/public/css/eos-auto-update.css',
   'tools/nexowatt-ems-overview-selftest.cjs',
   'tools/nexowatt-ui-overview-runtime-selftest.cjs',
   'adminWww/js/eos-ems-overview.js',
@@ -174,6 +198,7 @@ const runtime = buildInfo.runtimeEntry;
 const runtimeNumber = Number(String(runtime).replace(/^v/, ''));
 const shellCache = Number(buildInfo.shellCacheVersion ?? buildInfo.nativeShellVersion ?? runtimeNumber);
 const shellTag = String(buildInfo.shellCacheTag || shellCache);
+const autoUpdateTag = String(buildInfo.autoUpdateCacheTag || buildInfo.autoUpdateCacheVersion || shellTag);
 if (!runtime || !Number.isFinite(runtimeNumber)) fail(`invalid runtimeEntry ${runtime}`);
 if (!Number.isFinite(shellCache)) fail(`invalid shellCacheVersion ${buildInfo.shellCacheVersion}`);
 for (const marker of [
@@ -189,7 +214,8 @@ if (!index.includes(`eos-role-bootstrap.js?v=${shellTag}`)) fail('role bootstrap
 if (!index.includes(`eos-branding-sanitizer.js?v=${shellTag}`)) fail('branding sanitizer cache key mismatch');
 if (!index.includes(`eos-role-ui.js?v=${shellTag}`)) fail('role UI cache key mismatch');
 if (index.includes('eos-account-management.js')) fail('custom account-management runtime must not be loaded in standard password mode');
-if (!index.includes(`eos-auto-update.js?v=${shellTag}`)) fail('auto-update cache key mismatch');
+if (!index.includes(`eos-auto-update.js?v=${autoUpdateTag}`)) fail('auto-update JavaScript cache key mismatch');
+if (!index.includes(`eos-auto-update.css?v=${autoUpdateTag}`)) fail('auto-update CSS cache key mismatch');
 if (!index.includes(`eos-assistant.js?v=${shellTag}`)) fail('EOS Assist cache key mismatch');
 if (!index.includes(`eos-ems-overview.js?v=${shellTag}`)) fail('EMS overview cache key mismatch');
 if (!index.includes(`eos-ems-overview.css?v=${shellTag}`)) fail('EMS overview CSS cache key mismatch');
@@ -255,19 +281,26 @@ if (!mf.includes(`remoteEntry-${runtime}.js`) || !mf.includes(`index-D2ymscJA-${
 const webBuild = read('build/lib/web.js');
 if (!webBuild.includes('refreshLifetime: 60 * 60 * 24 * 7')) fail('build/lib/web.js must keep upstream-compatible refresh lifetime');
 if (!webBuild.includes('Follow upstream admin semantics again')) fail('build/lib/web.js lacks session compatibility fix');
+if (!exists('build/lib/eosRequestSecurity.js')) fail('build/lib/eosRequestSecurity.js is missing');
+const autoUpdateSource = read('src/lib/eosAutoUpdate.ts');
+if (autoUpdateSource.includes('extendForeignObjectAsync(this.instanceId')) fail('auto-update runtime must not write the running instance native configuration');
+if (!autoUpdateSource.includes("const ENABLED_STATE_ID = 'info.nexowattStableUpdatesEnabled'")) fail('restart-safe auto-update state storage is missing');
 const mainBuild = read('build/main.js');
 if (!mainBuild.includes('v37 BackItUp/runtime-adapter compatibility')) fail('build/main.js lacks BackItUp compatibility guard');
 
 if (!pkg.scripts['nexowatt:patch-built-frontend']) fail('missing nexowatt:patch-built-frontend script');
 if (pkg.scripts['check:eos-esm'] !== 'node tools/nexowatt-esm-syntax-selftest.cjs') fail('check:eos-esm script is missing or incorrect');
 if (pkg.scripts['check:eos-imports'] !== 'node tools/nexowatt-import-integrity-selftest.cjs') fail('check:eos-imports script is missing or incorrect');
+if (pkg.scripts['check:eos-backend-runtime'] !== 'node tools/nexowatt-backend-runtime-selftest.cjs') fail('check:eos-backend-runtime script is missing or incorrect');
 if (pkg.scripts['check:eos-entry'] !== 'node tools/nexowatt-entrypoint-smoke-selftest.cjs') fail('check:eos-entry script is missing or incorrect');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-esm-syntax-selftest.cjs')) fail('ESM syntax selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-import-integrity-selftest.cjs')) fail('import integrity selftest is not part of check:eos-stability');
+if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-backend-runtime-selftest.cjs')) fail('backend runtime selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-entrypoint-smoke-selftest.cjs')) fail('entrypoint smoke selftest is not part of check:eos-stability');
 if (pkg.scripts['clean:eos-runtime'] !== 'node tools/nexowatt-clean-legacy-runtime.cjs') fail('clean:eos-runtime script is missing or incorrect');
-if (pkg.scripts.prepack !== 'node tools/nexowatt-sync-release-version.cjs --quiet && node tools/nexowatt-clean-legacy-runtime.cjs --quiet') fail('prepack must silently synchronize versions and clean stale runtime files');
-if (!pkg.scripts.build?.includes('npm run clean:eos-runtime')) fail('build must finish with runtime cleanup');
+if (pkg.scripts.prepack !== canonicalPrepack) fail('prepack must verify the sealed prebuilt artifact without tsc/tsx');
+if (/\b(?:tsc|tsx)\b|build:(?:backend|frontend)|\bnpx\b|npm\s+(?:i|install|ci)\b/i.test(pkg.scripts.prepack || '')) fail('prepack must not require local development dependencies');
+if (pkg.scripts.build !== 'npm run build:frontend && npm run build:backend && npm run clean:eos-runtime && npm run seal:eos-prebuilt-release') fail('build must clean and seal the prebuilt release after compilation');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-role-access-selftest.cjs')) fail('role access selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-password-flow-selftest.cjs')) fail('standard account-password flow selftest is not part of check:eos-stability');
 if (!pkg.scripts['check:eos-stability']?.includes('nexowatt-account-password-flow-selftest.cjs')) fail('standard account-password management selftest is not part of check:eos-stability');

package/INSTALL_TEST_V7.10.1.md

@@ -1,10 +0,0 @@
-# NexoWatt EOS Admin 7.10.1
-
-- Basis: veröffentlichte 7.9.98-Stable-Repository-ZIP.
-- Keine erzwungene EOS-Erstpasswortseite und kein eigener EOS-Passwortreset.
-- Standardpasswort `nexowatt` nur bei neu angelegten oder wirklich passwortlosen Konten.
-- Passwortänderung unter Zugänge & Rechte über die native ioBroker-Passwortfunktion.
-- Dauerhafter vertikaler Cockpit-Scrollbereich.
-- Bearbeiten-Stift innerhalb des untersten Kartenrasters.
-- Nicht vorhandener Link zur vollständigen EMS-Diagnose entfernt.
-- Automatische Stable-Updates nur für installierte NexoWatt-Adapter, standardmäßig aktiv und durch Admin/Service abschaltbar.

package/MERGE_UPDATE_README_V7.10.1.md

@@ -1,10 +0,0 @@
-# NexoWatt EOS Admin 7.10.1
-
-- Basis: veröffentlichte 7.9.98-Stable-Repository-ZIP.
-- Keine erzwungene EOS-Erstpasswortseite und kein eigener EOS-Passwortreset.
-- Standardpasswort `nexowatt` nur bei neu angelegten oder wirklich passwortlosen Konten.
-- Passwortänderung unter Zugänge & Rechte über die native ioBroker-Passwortfunktion.
-- Dauerhafter vertikaler Cockpit-Scrollbereich.
-- Bearbeiten-Stift innerhalb des untersten Kartenrasters.
-- Nicht vorhandener Link zur vollständigen EMS-Diagnose entfernt.
-- Automatische Stable-Updates nur für installierte NexoWatt-Adapter, standardmäßig aktiv und durch Admin/Service abschaltbar.

package/PUBLISH_STABLE_V7.10.1.md

@@ -1,10 +0,0 @@
-# NexoWatt EOS Admin 7.10.1
-
-- Basis: veröffentlichte 7.9.98-Stable-Repository-ZIP.
-- Keine erzwungene EOS-Erstpasswortseite und kein eigener EOS-Passwortreset.
-- Standardpasswort `nexowatt` nur bei neu angelegten oder wirklich passwortlosen Konten.
-- Passwortänderung unter Zugänge & Rechte über die native ioBroker-Passwortfunktion.
-- Dauerhafter vertikaler Cockpit-Scrollbereich.
-- Bearbeiten-Stift innerhalb des untersten Kartenrasters.
-- Nicht vorhandener Link zur vollständigen EMS-Diagnose entfernt.
-- Automatische Stable-Updates nur für installierte NexoWatt-Adapter, standardmäßig aktiv und durch Admin/Service abschaltbar.

package/README_STABILITY_V7.10.1.md

@@ -1,10 +0,0 @@
-# NexoWatt EOS Admin 7.10.1
-
-- Basis: veröffentlichte 7.9.98-Stable-Repository-ZIP.
-- Keine erzwungene EOS-Erstpasswortseite und kein eigener EOS-Passwortreset.
-- Standardpasswort `nexowatt` nur bei neu angelegten oder wirklich passwortlosen Konten.
-- Passwortänderung unter Zugänge & Rechte über die native ioBroker-Passwortfunktion.
-- Dauerhafter vertikaler Cockpit-Scrollbereich.
-- Bearbeiten-Stift innerhalb des untersten Kartenrasters.
-- Nicht vorhandener Link zur vollständigen EMS-Diagnose entfernt.
-- Automatische Stable-Updates nur für installierte NexoWatt-Adapter, standardmäßig aktiv und durch Admin/Service abschaltbar.

package/RELEASE_ACCEPTANCE_V7.10.1.md

@@ -1,10 +0,0 @@
-# NexoWatt EOS Admin 7.10.1
-
-- Basis: veröffentlichte 7.9.98-Stable-Repository-ZIP.
-- Keine erzwungene EOS-Erstpasswortseite und kein eigener EOS-Passwortreset.
-- Standardpasswort `nexowatt` nur bei neu angelegten oder wirklich passwortlosen Konten.
-- Passwortänderung unter Zugänge & Rechte über die native ioBroker-Passwortfunktion.
-- Dauerhafter vertikaler Cockpit-Scrollbereich.
-- Bearbeiten-Stift innerhalb des untersten Kartenrasters.
-- Nicht vorhandener Link zur vollständigen EMS-Diagnose entfernt.
-- Automatische Stable-Updates nur für installierte NexoWatt-Adapter, standardmäßig aktiv und durch Admin/Service abschaltbar.

package/RELEASE_NOTES_V7.10.1.md

@@ -1,10 +0,0 @@
-# NexoWatt EOS Admin 7.10.1
-
-- Basis: veröffentlichte 7.9.98-Stable-Repository-ZIP.
-- Keine erzwungene EOS-Erstpasswortseite und kein eigener EOS-Passwortreset.
-- Standardpasswort `nexowatt` nur bei neu angelegten oder wirklich passwortlosen Konten.
-- Passwortänderung unter Zugänge & Rechte über die native ioBroker-Passwortfunktion.
-- Dauerhafter vertikaler Cockpit-Scrollbereich.
-- Bearbeiten-Stift innerhalb des untersten Kartenrasters.
-- Nicht vorhandener Link zur vollständigen EMS-Diagnose entfernt.
-- Automatische Stable-Updates nur für installierte NexoWatt-Adapter, standardmäßig aktiv und durch Admin/Service abschaltbar.

package/adminWww/js/eos-release-watch.js

@@ -1,77 +0,0 @@
-(() => {
-    'use strict';
-    const RELEASE = '7.10.0';
-    const RELEASE_KEY = 'nexowatt.eos.loadedRelease';
-    const RELOAD_KEY = 'nexowatt.eos.reloadTarget';
-    const CHECK_MS = 15000;
-    let refreshing = false;
-
-    const normalize = value => String(value || '').trim().replace(/^v/i, '');
-    const validRelease = value => /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(normalize(value));
-    const reloadUrl = version => {
-        const url = new URL(window.location.href);
-        url.searchParams.set('_eosRelease', normalize(version) || RELEASE);
-        url.searchParams.set('_eosReload', String(Date.now()));
-        return url.toString();
-    };
-    const purgeBrowserCaches = async () => {
-        const jobs = [];
-        try {
-            if ('caches' in window) {
-                jobs.push(caches.keys().then(keys => Promise.all(keys.map(key => caches.delete(key)))));
-            }
-        } catch (_) { /* Cache API is optional */ }
-        try {
-            if (navigator.serviceWorker?.getRegistrations) {
-                jobs.push(navigator.serviceWorker.getRegistrations().then(rows => Promise.all(rows.map(row => row.unregister()))));
-            }
-        } catch (_) { /* service workers may be unavailable */ }
-        await Promise.allSettled(jobs);
-    };
-    const reloadFor = async version => {
-        const target = normalize(version) || RELEASE;
-        if (refreshing || sessionStorage.getItem(RELOAD_KEY) === target) return;
-        refreshing = true;
-        sessionStorage.setItem(RELOAD_KEY, target);
-        document.documentElement.classList.add('eos-release-refreshing');
-        await purgeBrowserCaches();
-        window.location.replace(reloadUrl(target));
-    };
-    const checkServerVersion = async () => {
-        try {
-            const endpoint = new URL('./version', window.location.href);
-            endpoint.searchParams.set('_eosTs', String(Date.now()));
-            const response = await fetch(endpoint, {
-                cache: 'no-store',
-                credentials: 'same-origin',
-                headers: { 'Cache-Control': 'no-cache' },
-            });
-            if (!response.ok) return;
-            const serverVersion = normalize(await response.text());
-            if (validRelease(serverVersion) && serverVersion !== RELEASE) {
-                await reloadFor(serverVersion);
-            }
-        } catch (_) { /* adapter restart or temporary network interruption */ }
-    };
-
-    window.NEXOWATT_EOS_RELEASE = RELEASE;
-    const previous = normalize(localStorage.getItem(RELEASE_KEY));
-    localStorage.setItem(RELEASE_KEY, RELEASE);
-    const loadedFor = normalize(new URL(window.location.href).searchParams.get('_eosRelease'));
-    if (previous && previous !== RELEASE && loadedFor !== RELEASE) {
-        void reloadFor(RELEASE);
-    } else {
-        sessionStorage.removeItem(RELOAD_KEY);
-    }
-
-    window.addEventListener('focus', () => void checkServerVersion());
-    document.addEventListener('visibilitychange', () => {
-        if (document.visibilityState === 'visible') void checkServerVersion();
-    });
-    window.setInterval(() => void checkServerVersion(), CHECK_MS);
-    window.NEXOWATT_EOS_RELEASE_WATCH = Object.freeze({
-        release: RELEASE,
-        check: checkServerVersion,
-        purge: purgeBrowserCaches,
-    });
-})();