iobroker.eos-admin 7.9.98 → 7.9.99

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iobroker.eos-admin",
-  "description": "NexoWatt EOS Admin – stable sales candidate with scrollable cockpit, clean login and verified account password writes.",
-  "version": "7.9.98",
+  "description": "NexoWatt EOS Admin – stable candidate with truthful EMS overview, verified user passwords and deterministic browser updates.",
+  "version": "7.9.99",
   "contributors": [
     "bluefox <dogafox@gmail.com>",
     "apollon77",
@@ -118,21 +118,22 @@
     "tools/nexowatt-version-sync-selftest.cjs",
     "tools/nexowatt-merge-update-selftest.cjs",
     "tools/nexowatt-ems-overview-selftest.cjs",
-    "README_STABILITY_V7.9.98.md",
-    "RELEASE_NOTES_V7.9.98.md",
-    "PUBLISH_STABLE_V7.9.98.md",
-    "INSTALL_TEST_V7.9.98.md",
-    "RELEASE_ACCEPTANCE_V7.9.98.md",
-    "MERGE_UPDATE_README_V7.9.98.md",
+    "README_STABILITY_V7.9.99.md",
+    "RELEASE_NOTES_V7.9.99.md",
+    "PUBLISH_STABLE_V7.9.99.md",
+    "INSTALL_TEST_V7.9.99.md",
+    "RELEASE_ACCEPTANCE_V7.9.99.md",
+    "MERGE_UPDATE_README_V7.9.99.md",
     "README_EMS_OVERVIEW_MERGE.md",
     "RC73_EOS_ADMIN_MERGE_VALIDATION.md",
     "VALIDATION_EMS_OVERVIEW_MERGE.md",
     "NexoWatt_EOS_Admin_EMS_OVERVIEW_MERGE_VALIDATION.md",
     "tools/nexowatt-apply-ems-overview.cjs",
     "tools/nexowatt-ui-overview-runtime-selftest.cjs",
-    "tools/nexowatt-stable-v98-selftest.cjs",
+    "tools/nexowatt-stable-v99-selftest.cjs",
     "tools/nexowatt-password-write-selftest.cjs",
-    "tools/nexowatt-account-password-flow-selftest.cjs"
+    "tools/nexowatt-request-security-selftest.cjs",
+    "tools/nexowatt-cache-update-selftest.cjs"
   ],
   "scripts": {
     "npm": "npm i -f && cd src-admin && npm i -f",
@@ -167,7 +168,7 @@
     "nexowatt:repo-entry": "node tools/nexowatt-generate-repo-entry.cjs",
     "nexowatt:patch-repo": "node tools/nexowatt-patch-repo.cjs",
     "nexowatt:repair-update": "node tools/nexowatt-repair-eos-admin-update.cjs",
-    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-account-password-flow-selftest.cjs && npm run check:eos-stable-v98 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
+    "check:eos-stability": "node tools/nexowatt-stability-check.cjs && node tools/nexowatt-esm-syntax-selftest.cjs && node tools/nexowatt-import-integrity-selftest.cjs && node tools/nexowatt-entrypoint-smoke-selftest.cjs && node tools/nexowatt-frontend-graph-check.cjs && node tools/nexowatt-policy-selftest.cjs && node tools/nexowatt-publish-channel-selftest.cjs && node tools/nexowatt-release-defaults-selftest.cjs && node tools/nexowatt-role-access-selftest.cjs && node tools/nexowatt-internal-reserve-selftest.cjs && node tools/nexowatt-first-login-selftest.cjs && node tools/nexowatt-account-management-selftest.cjs && node tools/nexowatt-cache-update-selftest.cjs && node tools/nexowatt-request-security-selftest.cjs && node tools/nexowatt-password-write-selftest.cjs && node tools/nexowatt-modern-ui-selftest.cjs && node tools/nexowatt-login-layout-selftest.cjs && node tools/nexowatt-branding-selftest.cjs && node tools/nexowatt-default-port-selftest.cjs && node tools/nexowatt-module-popup-selftest.cjs && node tools/nexowatt-datapoint-selftest.cjs && node tools/nexowatt-update-selftest.cjs && node tools/nexowatt-datapoint-interaction-selftest.cjs && node tools/nexowatt-manual-write-policy-selftest.cjs && node tools/nexowatt-value-column-selftest.cjs && node tools/nexowatt-native-shell-selftest.cjs && node tools/nexowatt-assistant-separation-selftest.cjs && node tools/nexowatt-runtime-cleanup-selftest.cjs && node tools/nexowatt-version-sync-selftest.cjs && node tools/nexowatt-merge-update-selftest.cjs && npm run check:eos-stable-v99 && node tools/nexowatt-ems-overview-selftest.cjs && node tools/nexowatt-ui-overview-runtime-selftest.cjs",
     "nexowatt:patch-built-frontend": "node tools/nexowatt-patch-built-frontend.cjs",
     "clean:eos-runtime": "node tools/nexowatt-clean-legacy-runtime.cjs",
     "precheck:eos-package": "npm run sync:eos-version && npm run prepare:eos-release-defaults && npm run clean:eos-runtime",
@@ -191,7 +192,10 @@
     "sync:eos-version": "node tools/nexowatt-sync-release-version.cjs",
     "test:eos-version-sync": "node tools/nexowatt-version-sync-selftest.cjs",
     "verify:eos-merge": "node tools/nexowatt-merge-update-selftest.cjs",
-    "check:eos-stable-v98": "node tools/nexowatt-stable-v98-selftest.cjs"
+    "check:eos-stable-v99": "node tools/nexowatt-stable-v99-selftest.cjs",
+    "test:eos-password-write": "node tools/nexowatt-password-write-selftest.cjs",
+    "test:eos-request-security": "node tools/nexowatt-request-security-selftest.cjs",
+    "test:eos-cache-update": "node tools/nexowatt-cache-update-selftest.cjs"
   },
   "author": "NexoWatt",
   "private": false,
@@ -202,7 +206,7 @@
   },
   "nexowattReleasePolicy": {
     "distTag": "latest",
-    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.98"
+    "purpose": "accepted stable NexoWatt EOS sales-product release 7.9.99"
   },
   "publisher": "NexoWatt"
 }

package/tools/nexowatt-account-management-selftest.cjs

@@ -1,19 +1,23 @@
 #!/usr/bin/env node
 'use strict';
-const fs=require('fs');const path=require('path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const json=rel=>JSON.parse(read(rel));let bad=false;const fail=msg=>{console.error(`[NexoWatt EOS account management] ${msg}`);bad=true;};
-const mainSource=read('src/main.ts'),mainBuilt=read('build/main.js'),webSource=read('src/lib/web.ts'),webBuilt=read('build/lib/web.js'),sourceUi=read('src-admin/public/js/eos-account-management.js'),builtUi=read('adminWww/js/eos-account-management.js'),roleUi=read('adminWww/js/eos-role-ui.js'),css=read('adminWww/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),info=json('NEXOWATT_EOS_BUILD_INFO.json'),shellTag=String(info.shellCacheTag||info.shellCacheVersion);
-for(const code of [mainSource,mainBuilt])for(const marker of ['system.user.installer','system.user.guest','ensureEosDefaultRoleUsers','unknown random bootstrap secret','eosPasswordSetupRequired','personal password setup is required'])if(!code.includes(marker))fail(`main marker missing: ${marker}`);
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const json=rel=>JSON.parse(read(rel));
+const fail=m=>{console.error(`[NexoWatt EOS account management] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
+const mainSource=read('src/main.ts'),mainBuilt=read('build/main.js'),webSource=read('src/lib/web.ts'),webBuilt=read('build/lib/web.js'),passwordSource=read('src/lib/eosPassword.ts');
+const sourceUi=read('src-admin/public/js/eos-account-management.js'),builtUi=read('adminWww/js/eos-account-management.js'),roleUi=read('adminWww/js/eos-role-ui.js'),css=read('adminWww/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),info=json('NEXOWATT_EOS_BUILD_INFO.json'),shellTag=String(info.shellCacheTag||info.shellCacheVersion);
+for(const code of [mainSource,mainBuilt])for(const marker of ['system.user.installer','system.user.guest','ensureEosDefaultRoleUsers','unknown random bootstrap secret','personal password setup is required'])must(code.includes(marker),`main marker missing: ${marker}`);
 for(const code of [webSource,webBuilt]){
- for(const marker of ['getEosManagedAccounts','sendEosAccountManagement','resetEosAccountPassword','/nexowatt/account/manage','/nexowatt/account/reset','x-nexowatt-eos-account-reset','canResetInstaller','canResetEndUser',"targetUserId === 'system.user.admin'",'targetUserId === access.userId',"access.role === 'installer' && explicitlyManagedRole !== 'enduser'",'passwordResetAt','passwordResetBy',"passwordResetMode = 'initial-password'","setEosUserPassword(targetUserId, 'nexowatt')",'passwordlessFirstLoginAllowed = false','initialPasswordRequired: true','accountDisabled','getEosPasswordUserName','setPasswordAsync(userName, password','checkPasswordAsync(userName, password','updateEosAccountMetadata','extendForeignObjectAsync','invalidRequestOrigin'])if(!code.includes(marker))fail(`web marker missing: ${marker}`);
- if(!code.includes('const explicitInstaller = targetAccess.groups.some')||!code.includes('const explicitEndUser = targetAccess.groups.some'))fail('explicit managed-group guard missing');
- const reset=code.slice(code.indexOf('resetEosAccountPassword'),code.indexOf('getEosHistoryInstances'));
- if(reset.includes('setForeignObjectAsync(targetUserId'))fail('reset replaces the complete user object after password write');
+  for(const marker of ['getEosManagedAccounts','sendEosAccountManagement','resetEosAccountPassword','/nexowatt/account/manage','/nexowatt/account/reset','x-nexowatt-eos-account-reset','canResetInstaller','canResetEndUser',"targetUserId === 'system.user.admin'",'targetUserId === access.userId','const managedAccounts = await this.getEosManagedAccounts(access.role)','const managedTarget = managedAccounts.find(account => account.id === targetUserId)',"managedTarget?.role === 'installer'","managedTarget?.role === 'enduser'",'passwordResetAt','passwordResetBy',"passwordResetMode = 'initial-password'","setEosUserPassword(targetUserId, 'nexowatt')",'passwordlessFirstLoginAllowed = false','initialPasswordRequired: true','accountDisabled','passwordMetadataNotPersisted']) must(code.includes(marker),`web marker missing: ${marker}`);
+  must(!code.includes('const explicitInstaller = targetAccess.groups.some'),'obsolete explicit installer re-classifier remains');
+  must(!code.includes('const explicitEndUser = targetAccess.groups.some'),'obsolete explicit end-user re-classifier remains');
+  must(!code.includes('setForeignObjectAsync(targetUserId, user)'),'reset still writes stale full user object');
 }
-for(const marker of ['v98-account-management-real-password-write',"['admin', 'installer']",'nexowatt/account/manage','nexowatt/account/reset','X-NexoWatt-EOS-Account-Reset','data.canResetInstaller === true',"account.role === 'enduser'",'Startpasswort „nexowatt“','accountErrorText','invalidRequestOrigin','credentials: \'include\'','NEXOWATT_EOS_ACCOUNT_MANAGEMENT','ensureEntrySurface',"currentRoute() !== 'tab-users'",'eos-account-management-entry'])if(!sourceUi.includes(marker))fail(`account UI marker missing: ${marker}`);
-if(sourceUi.includes("launcher.className = 'eos-account-management-launcher'"))fail('standalone account launcher remains');
-if(sourceUi.includes('new MutationObserver'))fail('account management adds a second broad MutationObserver');
-if(sourceUi!==builtUi)fail('account UI source/build drift');
-if(!roleUi.includes("route === 'tab-users'"))fail('installer cannot reach access page');
-if(!index.includes(`eos-account-management.js?v=${shellTag}`))fail('account asset cache tag mismatch');
-for(const marker of ['.eos-account-management-entry','.eos-account-management-overlay','.eos-account-management-dialog','.eos-account-row','.eos-account-reset'])if(!css.includes(marker))fail(`account CSS missing: ${marker}`);
-if(bad)process.exit(1);console.log('[NexoWatt EOS account management] OK');
+for(const marker of ['setPasswordAsync(userName','checkPasswordAsync(userName','passwordNotPersisted','passwordVerificationFailed'])must(passwordSource.includes(marker),`password helper marker missing: ${marker}`);
+for(const marker of ["VERSION = 'v99-account-management-password-write'","['admin', 'installer']",'nexowatt/account/manage','nexowatt/account/reset','X-NexoWatt-EOS-Account-Reset','data.canResetInstaller === true',"account.role === 'enduser'",'Admin/Service','Installateure','NEXOWATT_EOS_ACCOUNT_MANAGEMENT','ensureEntrySurface',"currentRoute() !== 'tab-users'",'eos-account-management-entry','Startpasswort „nexowatt“','passwordVerificationFailed'])must(sourceUi.includes(marker),`UI marker missing: ${marker}`);
+must(sourceUi===builtUi,'account management source/build drift');
+must(!sourceUi.includes("launcher.className = 'eos-account-management-launcher'"),'standalone account launcher remains');
+must(!sourceUi.includes('new MutationObserver'),'account management adds a broad observer');
+must(roleUi.includes("route === 'tab-users'"),'installer cannot reach Zugänge & Rechte');
+must(!roleUi.includes('NEXOWATT_EOS_ACCOUNT_MANAGEMENT.open'),'overview opens account management outside Zugänge & Rechte');
+must(index.includes(`eos-account-management.js?v=${shellTag}`),'account management cache tag stale');
+for(const marker of ['.eos-account-management-entry','.eos-account-management-overlay','.eos-account-management-dialog','.eos-account-row','.eos-account-reset','html.eos-account-page-installer'])must(css.includes(marker),`CSS marker missing: ${marker}`);
+console.log('[NexoWatt EOS account management] OK (managed-list authorization and real password reset)');

package/tools/nexowatt-apply-ems-overview.cjs

@@ -52,7 +52,7 @@ if (!css.includes(cssMarker)) {
     overflow: hidden;
 }
 .eos-ems-overview-card * { box-sizing: border-box; }
-.eos-ems-overview-header { display:flex; align-items:flex-start; justify-content:space-between; gap:20px; }
+.eos-ems-overview-header { display:flex; align-items:flex-start; justify-content:flex-start; gap:20px; }
 .eos-ems-overview-header h2 { margin:5px 0 6px; font-size:clamp(1.2rem,2vw,1.65rem); color:#f5fbff; }
 .eos-ems-overview-header p { margin:0; max-width:760px; color:#9eb2c2; line-height:1.45; }
 .eos-ems-overview-eyebrow { color:#49e39e; font-size:.72rem; font-weight:900; letter-spacing:.13em; text-transform:uppercase; }
@@ -83,9 +83,7 @@ if (!css.includes(cssMarker)) {
 .eos-ems-overview-event time { color:#6f8799; font-size:.68rem; font-variant-numeric:tabular-nums; }
 .eos-ems-overview-event div { display:grid; gap:2px; min-width:0; }
 .eos-ems-overview-empty { color:#718797; font-size:.76rem; }
-.eos-ems-overview-footer { display:flex; justify-content:space-between; gap:12px; margin-top:12px; color:#60798a; font-size:.67rem; }
-.eos-ems-overview-footer a { color:#5ee0c2; font-weight:800; text-decoration:none; }
-.eos-ems-overview-footer a:hover,.eos-ems-overview-footer a:focus-visible { color:#9af2dd; text-decoration:underline; }
+.eos-ems-overview-footer { display:flex; justify-content:flex-start; gap:12px; margin-top:12px; color:#60798a; font-size:.67rem; }
 @media (max-width: 1100px) {
     .eos-ems-overview-card { flex-basis:100%; max-width:none; }
 }

package/tools/nexowatt-cache-update-selftest.cjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');
+const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const fail=m=>{console.error(`[NexoWatt EOS cache update] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
+const source=read('src/lib/web.ts'),built=read('build/lib/web.js'),index=read('adminWww/index.html'),dev=read('src-admin/index.html'),watch=read('adminWww/js/eos-release-watch.js');
+for(const code of [source,built])for(const marker of ['isEosCurrentAsset','applyNoStoreHeaders','Surrogate-Control','this.indexHTML = await this.prepareIndex'])must(code.includes(marker),`server marker missing: ${marker}`);
+for(const marker of ["const RELEASE = '7.9.99'",'nexowatt.eos.loadedRelease','cache: \'no-store\'','window.location.replace','navigator.serviceWorker?.getRegistrations'])must(watch.includes(marker),`watcher marker missing: ${marker}`);
+for(const html of [index,dev])for(const marker of ['eos-release-watch.js?v=99','nexowatt-stable-v99.js?v=99','nexowatt-native-shell.css?v=99'])must(html.includes(marker),`index marker missing: ${marker}`);
+must(index.includes('hostInit-v84.js?v=99')&&index.includes('index-CQZugZ1z-v84.js?v=99'),'productive module entry cache tags missing');
+must(!/\?v=(?:97|98)(?:["'])/.test(index),'stale product cache tag remains');
+console.log('[NexoWatt EOS cache update] OK (no-store entrypoints and release watcher)');

package/tools/nexowatt-clean-legacy-runtime.cjs

@@ -74,7 +74,7 @@ function isLegacyVersionedRuntime(file, activeRuntime, activeShell) {
   // Stable product overlays use the product release number in their filename,
   // while the compiled React runtime can intentionally remain on v84. Keep
   // only the active stable overlay and remove stale release assets left behind
-  // by a flat ZIP update (for example v96 when installing v97).
+  // by a flat ZIP update (for example v98 when installing v99).
   const stableMatch = name.match(/^nexowatt-stable-v(\d+)\.js$/i);
   if (stableMatch) return Number(stableMatch[1]) !== activeShell;
   const versionMatch = name.match(/-v(\d+)\.(?:js|js\.map|css|css\.map)$/i);

package/tools/nexowatt-ems-overview-selftest.cjs

@@ -19,11 +19,11 @@ for (const marker of [
     'document.visibilityState',
     'window.setInterval(() => void load(), 5_000)',
     'Diagnose ist rein lesend',
-    'Vollständige EMS-Diagnose öffnen',
     'system.adapter.nexowatt-ui.*.alive',
 ]) if (!component.includes(marker)) fail(`Komponenten-Vertrag fehlt: ${marker}`);
 if ((component.match(/NexoWatt EMS · Live-Diagnose/g) || []).length !== 1) fail('EMS-Überschrift ist doppelt oder fehlt.');
 if (!css.includes('/* nexowatt-ems-overview-v1 */')) fail('Responsive EMS-CSS fehlt.');
+if (component.includes('Vollständige EMS-Diagnose öffnen')) fail('Nicht vorhandener Diagnose-Link darf nicht angeboten werden.');
 if (/setState\(|setForeignState\(|sendToHost\(/.test(component)) fail('EMS-Overview darf keine ioBroker-Schreiboperation enthalten.');
 const assetDir = path.join(root, 'admin', 'assets');
 if (fs.existsSync(assetDir)) {

package/tools/nexowatt-login-layout-selftest.cjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 'use strict';
 const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');
-const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');let bad=false;const fail=msg=>{console.error(`[NexoWatt EOS login layout] ${msg}`);bad=true;};
-const css=read('adminWww/css/nexowatt-native-shell.css');const sourceCss=read('src-admin/public/css/nexowatt-native-shell.css');const login=read('src-admin/src/login/Login.tsx');const stableLogin=read('adminWww/static/js/nexowatt-stable-login.js');const stable=read('adminWww/static/js/nexowatt-stable-v98.js');const index=read('adminWww/index.html');const info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));const bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js');
-if(css!==sourceCss)fail('login CSS source/build drift');
-for(const marker of ['NexoWatt EOS 7.9.98 – stable scrolling','html.eos-app body','overflow: hidden !important','overflow-y: auto !important','width: min(456px','width: min(400px','min-height: 0 !important','overflow: visible !important','.MuiInputLabel-root { display: none !important; }','.MuiOutlinedInput-input::placeholder','margin-top: 28px !important'])if(!css.includes(marker))fail(`login marker missing: ${marker}`);
-if(!login.includes("minHeight: 0")||!login.includes("maxWidth: 400")||!login.includes('placeholder={`${I18n.t(\'enterLogin\')} *`}')||!login.includes('placeholder={`${I18n.t(\'enterPassword\')} *`}'))fail('native Login source does not use clean v98 placeholders');
-if(!bootstrap.includes('placeholder:')||!bootstrap.includes('I18n.t("enterLogin")+" *"')||!bootstrap.includes('I18n.t("enterPassword")+" *"'))fail('productive login bundle does not use placeholders');
-if(/label:.*I18n\.t\("enterLogin"\)|label:.*I18n\.t\("enterPassword"\)/.test(bootstrap.slice(1335000,1340500)))fail('productive login bundle still uses floating labels');
-if(/data-nw-login-card|data-nw-login-shell|min-height:590px|width:min\(460px|createElement\(['"]style/.test(stableLogin))fail('stable-login runtime mutates geometry');
-if(/width:min\(460px|min-height:540px|createElement\(['"]style/.test(stable))fail('stable v98 runtime injects geometry');
-if(!index.includes(`nexowatt-native-shell.css?v=${info.shellCacheTag}`)||!index.includes('nexowatt-stable-v98.js?v=98'))fail('v98 login assets not active');
-if(bad)process.exit(1);console.log('[NexoWatt EOS login layout] OK');
+const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const fail=m=>{console.error(`[NexoWatt EOS login layout] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
+const css=read('adminWww/css/nexowatt-native-shell.css'),sourceCss=read('src-admin/public/css/nexowatt-native-shell.css');
+const login=read('src-admin/src/login/Login.tsx'),stableLogin=read('adminWww/static/js/nexowatt-stable-login.js'),stable=read('adminWww/static/js/nexowatt-stable-v99.js'),index=read('adminWww/index.html'),info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));
+must(css===sourceCss,'login CSS source/build drift');
+for(const marker of ['outer frame is decorative only','orderly login, moderately enlarged','width: min(440px, calc(100vw - 20px)) !important','height: min(580px, calc(100dvh - 20px)) !important','width: min(380px, calc(100vw - 52px)) !important','min-height: 510px !important','height: auto !important','overflow: visible !important'])must(css.includes(marker),`login marker missing: ${marker}`);
+must(!css.includes('width: min(520px, calc(100vw - 24px))')&&!css.includes('width: min(460px, calc(100vw - 56px))'),'oversized v96 geometry remains');
+must(!/data-nw-login-card|data-nw-login-shell|min-height:590px|width:min\(460px|createElement\(['"]style/.test(stableLogin),'stable-login runtime mutates geometry');
+must(!/width:min\(460px|min-height:540px|createElement\(['"]style/.test(stable),'stable v99 runtime injects login geometry');
+must(login.includes('minHeight: 510')&&login.includes("overflowY: 'visible'")&&login.includes("maxHeight: 'none'"),'native Login source does not match product contract');
+must(index.includes(`nexowatt-native-shell.css?v=${info.shellCacheTag}`)&&index.includes('nexowatt-stable-v99.js?v=99'),'v99 login assets not active');
+console.log('[NexoWatt EOS login layout] OK');

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.9.98.md',
+    'MERGE_UPDATE_README_V7.9.99.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',

package/tools/nexowatt-modern-ui-selftest.cjs

@@ -19,7 +19,7 @@ for (const marker of [
   '--nx-shadow-soft', '--nx-shadow-float', 'backdrop-filter: blur', '#app-paper', '.MuiDialog-paper',
   '.MuiButton-root', '.MuiTableRow-root', ':focus-visible', 'border-radius: 24px', 'linear-gradient',
   '@media (max-width: 720px)', '.eos-activation-steps', '.eos-account-row:hover',
-  'main.MuiPaper-root::before', 'width: min(400px, calc(100vw - 48px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
+  'main.MuiPaper-root::before', 'width: min(380px, calc(100vw - 52px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
   '.eos-account-management-entry', 'pointer-events: auto !important', 'touch-action: manipulation', 'overflow: visible',
 ]) if (!css.includes(marker)) fail(`modern styling marker missing: ${marker}`);
 if (sourceCss !== css) fail('modern CSS source/build drift');
@@ -29,7 +29,7 @@ for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','e
 for (const marker of ['NexoWatt EOS', 'Zugänge & Rollen', 'Endkunden-Zugänge', 'ensureEntrySurface']) {
   if (!accountUi.includes(marker)) fail(`modern account surface missing label: ${marker}`);
 }
-for (const marker of ['installIntegratedFirstLogin','v98 compact normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
+for (const marker of ['installIntegratedFirstLogin','v99 normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
   if (!bootstrap.includes(marker)) fail(`integrated first-activation surface missing: ${marker}`);
 }
 if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('compact login still injects role buttons or a second panel');

package/tools/nexowatt-password-write-selftest.cjs

@@ -1,48 +1,46 @@
 #!/usr/bin/env node
 'use strict';
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const path = require('node:path');
-const vm = require('node:vm');
-const root = path.resolve(__dirname, '..');
-const built = fs.readFileSync(path.join(root, 'build/lib/web.js'), 'utf8');
-const source = fs.readFileSync(path.join(root, 'src/lib/web.ts'), 'utf8');
-const begin = built.indexOf('    getEosPasswordUserName(userId) {');
-const end = built.indexOf('    async destroyEosRequestSessions', begin);
-assert(begin >= 0 && end > begin, 'password methods not found in built backend');
-const methods = built.slice(begin, end);
-const sandbox = { module: { exports: null }, EOS_PASSWORD_SERVICE_USER: 'system.user.admin' };
-vm.runInNewContext(`module.exports = class Harness {\nconstructor(adapter){this.adapter=adapter;}\n${methods}\n}`, sandbox);
-const Harness = sandbox.module.exports;
-(async () => {
-  const calls = [];
-  const userObject = { _id: 'system.user.user', common: { password: '$2b$hash' }, native: { keep: true } };
-  const adapter = {
-    setPasswordAsync: async (user, password, options) => calls.push(['set', user, password, options]),
-    checkPasswordAsync: async (user, password, options) => { calls.push(['check', user, password, options]); return [true, `system.user.${user}`]; },
-    getForeignObjectAsync: async id => { calls.push(['get', id]); return JSON.parse(JSON.stringify(userObject)); },
-    extendForeignObjectAsync: async (id, patch, options) => calls.push(['extend', id, patch, options]),
-    setForeignObjectAsync: async () => { throw new Error('full user object replacement must not be used'); },
+const assert=require('node:assert/strict');
+const fs=require('node:fs');
+const path=require('node:path');
+const {normalizeEosPasswordTarget,setEosUserPasswordWithVerification}=require('../build/lib/eosPassword.js');
+const root=path.resolve(__dirname,'..');
+const source=fs.readFileSync(path.join(root,'src/lib/eosPassword.ts'),'utf8');
+const web=fs.readFileSync(path.join(root,'src/lib/web.ts'),'utf8');
+
+function adapterFixture({verify=true,persist=true,callback=false}={}){
+  let password='old';
+  let hash=persist?'$old':'';
+  const calls=[];
+  const adapter={
+    calls,
+    getForeignObjectAsync:async id=>id==='system.user.user'?{_id:id,common:{password:hash},native:{}}:null,
+    checkPasswordAsync:async (user,value,options)=>{calls.push({kind:'check',user,value,options});return [verify&&user==='user'&&value===password,'system.user.user'];},
   };
-  const harness = new Harness(adapter);
-  await harness.setEosUserPassword('system.user.user', 'NexoWatt2025!');
-  assert.deepEqual(calls[0].slice(0, 3), ['set', 'user', 'NexoWatt2025!']);
-  assert.deepEqual(calls[1].slice(0, 3), ['check', 'user', 'NexoWatt2025!']);
-  await harness.updateEosAccountMetadata('system.user.user', (native, account) => {
-    account.passwordInitialized = true;
-    native.nexowattPasswordChangeRequired = false;
-  });
-  const extend = calls.find(row => row[0] === 'extend');
-  assert(extend, 'native metadata was not extended');
-  assert.equal(extend[1], 'system.user.user');
-  assert.equal(extend[2].native.keep, true);
-  assert.equal(extend[2].native.nexowattEosAccount.passwordInitialized, true);
-  assert(!Object.prototype.hasOwnProperty.call(extend[2], 'common'), 'password/common must not be overwritten by metadata update');
-  for (const code of [source, built]) {
-    assert.match(code, /setPasswordAsync\(userName, password/);
-    assert.match(code, /checkPasswordAsync\(userName, password/);
-    assert.match(code, /extendForeignObjectAsync/);
-    assert.match(code, /passwordVerificationFailed/);
+  const set=async(user,value,options)=>{calls.push({kind:'set',user,value,options});if(user!=='user')throw new Error('shortUserNameRequired');if(persist){password=value;hash=`$hash:${value}`;}};
+  if(callback) adapter.setPassword=(user,value,options,cb)=>set(user,value,options).then(()=>cb(),cb);
+  else adapter.setPasswordAsync=set;
+  return adapter;
+}
+
+(async()=>{
+  assert.deepEqual(normalizeEosPasswordTarget('user'),{userId:'system.user.user',userName:'user'});
+  assert.deepEqual(normalizeEosPasswordTarget('system.user.user'),{userId:'system.user.user',userName:'user'});
+  assert.throws(()=>normalizeEosPasswordTarget('system.user.bad.name'),/invalidPasswordTarget/);
+  for(const fixture of [adapterFixture(),adapterFixture({callback:true})]){
+    const result=await setEosUserPasswordWithVerification(fixture,'system.user.user','Strong!2026');
+    assert.equal(result.userName,'user');
+    assert.equal(fixture.calls.find(c=>c.kind==='set').user,'user','password API must receive short user name');
+    assert.deepEqual(fixture.calls.find(c=>c.kind==='set').options,{user:'system.user.admin'});
+    assert.equal(fixture.calls.find(c=>c.kind==='check').user,'user','password check must receive short user name');
   }
-  console.log('[NexoWatt EOS password write] OK: real account name, verified password API and metadata-only update');
-})().catch(error => { console.error(error.stack || error); process.exit(1); });
+  const noCheck=adapterFixture();delete noCheck.checkPasswordAsync;
+  await setEosUserPasswordWithVerification(noCheck,'user','NoCheck!2026');
+  await assert.rejects(()=>setEosUserPasswordWithVerification(adapterFixture({persist:false}),'user','Missing!2026'),/passwordNotPersisted/);
+  await assert.rejects(()=>setEosUserPasswordWithVerification(adapterFixture({verify:false}),'user','Verify!2026'),/passwordVerificationFailed/);
+  for(const marker of ['setPasswordAsync(userName','checkPasswordAsync(userName','common?.password','userId.replace(/^system\\.user\\./']) assert(source.includes(marker),`source marker missing: ${marker}`);
+  assert(!/setForeignObject|common\.password\s*=/.test(source),'helper must never hash/write common.password itself');
+  assert(web.includes('extendForeignObjectAsync')&&web.includes('passwordMetadataNotPersisted'),'first-login metadata persistence guard missing');
+  assert(!web.includes('setForeignObjectAsync(access.userId, userObject)'),'stale full-user first-login write remains');
+  console.log('[NexoWatt EOS password write] OK (short name, persistence, credential and native-only metadata)');
+})().catch(error=>{console.error(error?.stack||error);process.exit(1);});

package/tools/nexowatt-request-security-selftest.cjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+'use strict';
+const assert=require('node:assert/strict');
+const {isEosSameOriginRequest}=require('../build/lib/eosRequestSecurity.js');
+assert.equal(isEosSameOriginRequest({host:'192.168.10.124:8081'}),true);
+assert.equal(isEosSameOriginRequest({origin:'http://192.168.10.124:8081',host:'192.168.10.124:8081','sec-fetch-site':'same-origin'}),true);
+assert.equal(isEosSameOriginRequest({origin:'https://eos.example.test',host:'proxy:443','x-forwarded-host':'eos.example.test','sec-fetch-site':'same-site'}),true);
+assert.equal(isEosSameOriginRequest({origin:'http://192.168.10.125:8081',host:'192.168.10.124:8081','sec-fetch-site':'same-origin'}),false);
+assert.equal(isEosSameOriginRequest({origin:'http://192.168.10.124:8081',host:'192.168.10.124:8081','sec-fetch-site':'cross-site'}),false);
+assert.equal(isEosSameOriginRequest({origin:'file:///tmp/eos',host:'192.168.10.124:8081'}),false);
+console.log('[NexoWatt EOS request security] OK (LAN, proxy and cross-site guard)');

package/tools/nexowatt-runtime-cleanup-selftest.cjs

@@ -15,15 +15,15 @@ try {
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'static', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'adminWww', 'static', 'js'), { recursive: true });
-  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 98 }));
+  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 99 }));
 
   const keep = [
     'adminWww/assets/bootstrap-current-v82.js',
     'adminWww/assets/Objects-current-v82.js',
     'adminWww/remoteEntry-v82.js',
     'adminWww/remoteEntry.js',
-    'adminWww/static/js/nexowatt-stable-v98.js',
-    'src-admin/public/static/js/nexowatt-stable-v98.js',
+    'adminWww/static/js/nexowatt-stable-v99.js',
+    'src-admin/public/static/js/nexowatt-stable-v99.js',
     'adminWww/static/js/nexowatt-stable-login.js',
   ];
   const remove = [
@@ -34,8 +34,8 @@ try {
     'adminWww/js/eos-branding.js',
     'adminWww/css/eos-branding.css',
     'src-admin/public/js/eos-security-ui.js',
-    'adminWww/static/js/nexowatt-stable-v97.js',
-    'src-admin/public/static/js/nexowatt-stable-v95.js',
+    'adminWww/static/js/nexowatt-stable-v98.js',
+    'src-admin/public/static/js/nexowatt-stable-v97.js',
   ];
   for (const rel of [...keep, ...remove]) {
     const file = path.join(temp, rel);
@@ -45,7 +45,7 @@ try {
 
   const result = cleanLegacyRuntime({ root: temp, quiet: true, silent: true });
   assert.strictEqual(result.activeRuntime, 82);
-  assert.strictEqual(result.activeShell, 98);
+  assert.strictEqual(result.activeShell, 99);
   assert.strictEqual(result.removed.length, remove.length);
   for (const rel of keep) assert.ok(fs.existsSync(path.join(temp, rel)), `current runtime removed: ${rel}`);
   for (const rel of remove) assert.ok(!fs.existsSync(path.join(temp, rel)), `legacy file remained: ${rel}`);

package/tools/nexowatt-stable-v99-selftest.cjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');
+const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const exists=rel=>fs.existsSync(path.join(root,rel));
+const fail=m=>{console.error(`[NexoWatt EOS stable v99] ${m}`);process.exit(1)};const must=(c,m)=>{if(!c)fail(m)};
+const pkg=JSON.parse(read('package.json')),io=JSON.parse(read('io-package.json')),info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));
+const index=read('adminWww/index.html'),css=read('adminWww/css/nexowatt-native-shell.css'),stable=read('adminWww/static/js/nexowatt-stable-v99.js');
+const ems=read('adminWww/js/eos-ems-overview.js'),emsSource=read('src-admin/src/components/Intro/NexoWattEmsOverview.tsx');
+const intro=read('src-admin/src/tabs/Intro.tsx'),bundle=read('adminWww/assets/Intro-DkwRiz1n-v84.js');
+const web=read('src/lib/web.ts'),built=read('build/lib/web.js'),password=read('src/lib/eosPassword.ts'),bootstrap=read('adminWww/js/eos-role-bootstrap.js');
+must(pkg.version==='7.9.99'&&io.version==='7.9.99'&&io.common.version==='7.9.99'&&info.version==='7.9.99','version drift');
+must(info.shellCacheVersion===99&&info.nativeShellVersion===99&&String(info.shellCacheTag)==='99','shell cache is not v99');
+must(index.includes('nexowatt-stable-v99.js?v=99')&&index.includes('eos-release-watch.js?v=99'),'v99 runtime/watcher not loaded');
+must(!exists('adminWww/static/js/nexowatt-stable-v97.js')&&!exists('src-admin/public/static/js/nexowatt-stable-v97.js'),'legacy v97 runtime remains');
+must(!ems.includes('Vollständige EMS-Diagnose öffnen')&&!emsSource.includes('Vollständige EMS-Diagnose öffnen'),'unsupported EMS link remains');
+must(intro.includes('className="eos-overview-edit-controls"')&&intro.includes('eos-native-intro-grid'),'source pencil is not in the card grid');
+must(bundle.includes('className:"eos-overview-edit-controls"')&&bundle.includes('className:"eos-native-intro-grid"'),'productive pencil is not in the card grid');
+must(css.includes('edit controls belong to the lowest Intro card grid')&&css.includes('.eos-overview-edit-controls .MuiFab-root'),'pencil placement CSS missing');
+must(password.includes('setPasswordAsync(userName')&&password.includes('checkPasswordAsync(userName'),'password API does not use short name');
+must(web.includes('passwordMetadataNotPersisted')&&built.includes('passwordMetadataNotPersisted'),'password metadata verification missing');
+must(!web.includes('setForeignObjectAsync(access.userId, userObject)')&&!built.includes('setForeignObjectAsync(access.userId, userObject)'),'stale full-user password write remains');
+must(bootstrap.includes("VERSION = 'v99-first-login-password-persisted'")&&bootstrap.includes('passwordVerificationFailed'),'v99 first-login UI missing');
+must(stable.includes('NEXOWATT_EOS_STABLE_V99'),'stable v99 global marker missing');
+for(const rel of ['tools/nexowatt-password-write-selftest.cjs','tools/nexowatt-request-security-selftest.cjs','tools/nexowatt-cache-update-selftest.cjs'])must(exists(rel),`${rel} missing`);
+console.log('[NexoWatt EOS stable v99] OK');

package/tools/nexowatt-sync-release-version.cjs

@@ -19,14 +19,6 @@ function setValue(changes, label, object, key, value) {
     }
 }
 
-function setJsonValue(changes, label, object, key, value) {
-    const previous = object[key];
-    if (JSON.stringify(previous) !== JSON.stringify(value)) {
-        changes.push({ label, previous, value });
-        object[key] = value === undefined ? undefined : JSON.parse(JSON.stringify(value));
-    }
-}
-
 function syncReleaseVersion(rootDir) {
     const root = path.resolve(rootDir);
     const packageFile = path.join(root, 'package.json');
@@ -70,40 +62,7 @@ function syncReleaseVersion(rootDir) {
             update(json) {
                 setValue(changes, 'package-lock.json version', json, 'version', version);
                 if (json.packages?.['']) {
-                    const rootPackage = json.packages[''];
-                    setValue(changes, 'package-lock.json packages[""] version', rootPackage, 'version', version);
-                    // A merge archive can update package.json while leaving stale release scripts,
-                    // files and policy metadata in package-lock.json. npm reads the lock root during
-                    // packaging, so keep every release-critical root field canonical as well.
-                    for (const key of [
-                        'name',
-                        'description',
-                        'license',
-                        'author',
-                        'private',
-                        'engines',
-                        'main',
-                        'files',
-                        'scripts',
-                        'dependencies',
-                        'devDependencies',
-                        'overrides',
-                        'keywords',
-                        'publishConfig',
-                        'nexowattReleasePolicy',
-                        'publisher',
-                        'copyright',
-                    ]) {
-                        if (Object.prototype.hasOwnProperty.call(pkg, key)) {
-                            setJsonValue(
-                                changes,
-                                `package-lock.json packages[""] ${key}`,
-                                rootPackage,
-                                key,
-                                pkg[key],
-                            );
-                        }
-                    }
+                    setValue(changes, 'package-lock.json packages[""] version', json.packages[''], 'version', version);
                 }
             },
         },

package/tools/nexowatt-ui-overview-runtime-selftest.cjs

@@ -5,7 +5,9 @@ const runtime=read('adminWww/js/eos-ems-overview.js');const source=read('src-adm
 if(runtime!==source)fail('runtime source/build drift');
 for(const marker of ['nexowatt-ems-overview-v1','nexowatt-ui.*.info.adminOverview.*','system.adapter.nexowatt-ui.*.alive','POLL_MS = 5000','STALE_MS = 20000',"REQUIRED_UI_VERSION = '0.8.198'",'getForeignStates','Keine Kachel besitzt Schreibhoheit','currentDecisions','§14a-Fallback','nexowatt-eos-admin-socket-ready','readUiAdapterInfo','socketFromReact'])if(!runtime.includes(marker))fail(`runtime marker missing: ${marker}`);
 for(const forbidden of ['setForeignState','setState(','sendToHost','writeFile','extendObject'])if(runtime.includes(forbidden))fail(`read-only runtime contains ${forbidden}`);
-for(const marker of ['eos-ems-overview.css?v=98','eos-ems-overview.js?v=98','nexowatt-stable-v98.js?v=98'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
+for(const marker of ['eos-ems-overview.css?v=99','eos-ems-overview.js?v=99','nexowatt-stable-v99.js?v=99','eos-release-watch.js?v=99'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
+if(runtime.includes('Vollständige EMS-Diagnose öffnen'))fail('unsupported EMS destination remains visible');
+if(!intro.includes('eos-overview-edit-controls')||!introBundle.includes('eos-overview-edit-controls'))fail('edit control is not inside bottom card grid');
 if(!css.includes('#eos-ems-overview-runtime')||!css.includes('.eos-ems-overview-metrics')||!css.includes('startup and compatibility messages stay compact'))fail('EMS card CSS incomplete');
 if(role.includes('overview.innerHTML = `')||!role.includes('never cover the real Admin Intro'))fail('obsolete role overview still active');
 if(!shell.includes("label: 'Installateur'")||!shell.includes("label: 'Endkunde'")||!shell.includes('eosNativeReactOverview'))fail('native overview role bridge incomplete');