@open-mercato/cli 0.10.1-develop.7994.1.c9f31972aa → 0.10.1-develop.8004.1.a8a79ee43f

package/dist/lib/__fixtures__/official-module-package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@open-mercato/test-package",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": "./dist/index.js",
+    "./*": {
+      "types": "./src/*.ts",
+      "default": "./dist/*.js"
+    },
+    "./*/*": {
+      "types": "./src/*/*.ts",
+      "default": "./dist/*/*.js"
+    },
+    "./*/*/*": {
+      "types": "./src/*/*/*.ts",
+      "default": "./dist/*/*/*.js"
+    },
+    "./*/*/*/*": {
+      "types": "./src/*/*/*/*.ts",
+      "default": "./dist/*/*/*/*.js"
+    },
+    "./*/*/*/*/*": {
+      "types": "./src/*/*/*/*/*.ts",
+      "default": "./dist/*/*/*/*/*.js"
+    }
+  },
+  "peerDependencies": {
+    "@open-mercato/core": ">=0.4.7 <0.5.0"
+  }
+}

package/dist/lib/init-secrets.js

@@ -1,5 +1,15 @@
 import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
+import { getPasswordPolicy, validatePassword } from "@open-mercato/shared/lib/auth/passwordPolicy";
 import { randomBytes } from "node:crypto";
+import { createTranslator } from "@open-mercato/shared/lib/i18n/translate";
+import { createRequire } from "node:module";
+const requireLocale = createRequire(import.meta.url);
+function initTranslator(env) {
+  const locale = (env.LC_ALL || env.LC_MESSAGES || env.LANG || "en").split(/[_.-]/)[0].toLowerCase();
+  const supportedLocale = ["en", "pl", "es", "de", "ko"].includes(locale) ? locale : "en";
+  const dictionary = requireLocale(`../i18n/${supportedLocale}.json`);
+  return createTranslator(dictionary);
+}
 function readEnvValue(env, key) {
   const value = env[key];
   if (typeof value !== "string") return void 0;
@@ -40,7 +50,29 @@ function resolveInitDerivedSecrets(options) {
     employeePassword: resolvePassword("OM_INIT_EMPLOYEE_PASSWORD", employeeEmail)
   };
 }
+function resolveInitSuperadminCredentials(args, env = process.env) {
+  const argValue = (name) => args.find((arg) => arg.startsWith(`${name}=`))?.slice(name.length + 1) || void 0;
+  const email = argValue("--email") ?? readEnvValue(env, "OM_INIT_SUPERADMIN_EMAIL") ?? "superadmin@acme.com";
+  const suppliedPassword = argValue("--password") ?? readEnvValue(env, "OM_INIT_SUPERADMIN_PASSWORD");
+  const isProduction = (env.NODE_ENV ?? "").trim().toLowerCase() === "production";
+  const skipPolicyArg = args.find(
+    (arg) => arg === "--skip-password-policy" || arg.startsWith("--skip-password-policy=") || arg === "--allow-weak-password" || arg.startsWith("--allow-weak-password=")
+  );
+  const skipPasswordPolicy = !isProduction && (skipPolicyArg ? parseBooleanToken(skipPolicyArg.split("=")[1] ?? "true") ?? true : true);
+  if (isProduction) {
+    const t = initTranslator(env);
+    const placeholder = suppliedPassword?.trim().toLowerCase();
+    if (!suppliedPassword || !placeholder || ["secret", "password", "changeme", "change-me", "change_me", "replace-me", "replace_me"].includes(placeholder)) {
+      throw new Error(t("cli.init.errors.superadminPasswordRequired"));
+    }
+    if (!validatePassword(suppliedPassword, getPasswordPolicy(env)).ok) {
+      throw new Error(t("cli.init.errors.superadminPasswordPolicy"));
+    }
+  }
+  return { email, password: suppliedPassword ?? "secret", skipPasswordPolicy };
+}
 export {
-  resolveInitDerivedSecrets
+  resolveInitDerivedSecrets,
+  resolveInitSuperadminCredentials
 };
 //# sourceMappingURL=init-secrets.js.map

package/dist/lib/init-secrets.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/init-secrets.ts"],
-  "sourcesContent": ["import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { randomBytes } from 'node:crypto'\n\ntype EnvReader = (key: string) => string | undefined\n\nfunction readEnvValue(env: NodeJS.ProcessEnv, key: string): string | undefined {\n  const value = env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction resolveEmailFromDomain(domain: string | undefined, prefix: string): string | null {\n  if (!domain) return null\n  return `${prefix}@${domain}`\n}\n\nexport type InitDerivedSecrets = {\n  adminEmail: string | null\n  employeeEmail: string | null\n  adminPassword: string | null\n  employeePassword: string | null\n}\n\n// Well-known dev/demo password baked into local bootstrap flows so developers\n// keep the documented \"log in as admin@<domain> with password 'secret'\" UX.\n// Only used when NODE_ENV !== 'production' and the OM_INIT_*_PASSWORD env vars\n// are unset \u2014 production paths always use a random 96-bit secret.\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\nlet warnedAboutDeprecatedRandomToggle = false\n\nexport function resolveInitDerivedSecrets(options: {\n  email: string\n  env?: NodeJS.ProcessEnv\n  randomSource?: (size: number) => Buffer\n}): InitDerivedSecrets {\n  const env = options.env ?? process.env\n  const envRead: EnvReader = (key) => readEnvValue(env, key)\n  const [, domain] = String(options.email ?? '').split('@')\n  const adminEmail = envRead('OM_INIT_ADMIN_EMAIL') ?? resolveEmailFromDomain(domain, 'admin')\n  const employeeEmail = envRead('OM_INIT_EMPLOYEE_EMAIL') ?? resolveEmailFromDomain(domain, 'employee')\n  // OM_INIT_GENERATE_RANDOM_PASSWORD used to be an opt-in toggle for random\n  // derived secrets; in production it is now the unconditional behaviour when\n  // no override is set. Surface a one-time deprecation warning so existing\n  // operators notice their config is no longer required.\n  if (parseBooleanToken(envRead('OM_INIT_GENERATE_RANDOM_PASSWORD') ?? '') === true && !warnedAboutDeprecatedRandomToggle) {\n    warnedAboutDeprecatedRandomToggle = true\n    console.warn(\n      '\u26A0\uFE0F  OM_INIT_GENERATE_RANDOM_PASSWORD is deprecated and no longer required: derived admin/employee passwords are always randomized in production when overrides are unset.',\n    )\n  }\n  const isProduction = (env.NODE_ENV ?? '').trim().toLowerCase() === 'production'\n  const randomize = options.randomSource ?? randomBytes\n  const randomSecret = () => randomize(12).toString('base64url')\n  const resolvePassword = (key: string, emailValue: string | null) => {\n    if (!emailValue) return null\n    const envValue = envRead(key)\n    if (envValue) return envValue\n    // Non-production (dev/test/staging defaults): seed the documented demo\n    // password so `yarn dev` / `mercato init` workflows stay predictable.\n    // Production: generate a fresh random secret so credentials are never\n    // hardcoded and the operator-facing CLI prints the value once.\n    return isProduction ? randomSecret() : DEMO_DERIVED_PASSWORD\n  }\n\n  return {\n    adminEmail,\n    employeeEmail,\n    adminPassword: resolvePassword('OM_INIT_ADMIN_PASSWORD', adminEmail),\n    employeePassword: resolvePassword('OM_INIT_EMPLOYEE_PASSWORD', employeeEmail),\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,yBAAyB;AAClC,SAAS,mBAAmB;AAI5B,SAAS,aAAa,KAAwB,KAAiC;AAC7E,QAAM,QAAQ,IAAI,GAAG;AACrB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,uBAAuB,QAA4B,QAA+B;AACzF,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,GAAG,MAAM,IAAI,MAAM;AAC5B;AAaA,MAAM,wBAAwB;AAE9B,IAAI,oCAAoC;AAEjC,SAAS,0BAA0B,SAInB;AACrB,QAAM,MAAM,QAAQ,OAAO,QAAQ;AACnC,QAAM,UAAqB,CAAC,QAAQ,aAAa,KAAK,GAAG;AACzD,QAAM,CAAC,EAAE,MAAM,IAAI,OAAO,QAAQ,SAAS,EAAE,EAAE,MAAM,GAAG;AACxD,QAAM,aAAa,QAAQ,qBAAqB,KAAK,uBAAuB,QAAQ,OAAO;AAC3F,QAAM,gBAAgB,QAAQ,wBAAwB,KAAK,uBAAuB,QAAQ,UAAU;AAKpG,MAAI,kBAAkB,QAAQ,kCAAkC,KAAK,EAAE,MAAM,QAAQ,CAAC,mCAAmC;AACvH,wCAAoC;AACpC,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACA,QAAM,gBAAgB,IAAI,YAAY,IAAI,KAAK,EAAE,YAAY,MAAM;AACnE,QAAM,YAAY,QAAQ,gBAAgB;AAC1C,QAAM,eAAe,MAAM,UAAU,EAAE,EAAE,SAAS,WAAW;AAC7D,QAAM,kBAAkB,CAAC,KAAa,eAA8B;AAClE,QAAI,CAAC,WAAY,QAAO;AACxB,UAAM,WAAW,QAAQ,GAAG;AAC5B,QAAI,SAAU,QAAO;AAKrB,WAAO,eAAe,aAAa,IAAI;AAAA,EACzC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,eAAe,gBAAgB,0BAA0B,UAAU;AAAA,IACnE,kBAAkB,gBAAgB,6BAA6B,aAAa;AAAA,EAC9E;AACF;",
+  "sourcesContent": ["import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { randomBytes } from 'node:crypto'\nimport { createTranslator } from '@open-mercato/shared/lib/i18n/translate'\nimport { createRequire } from 'node:module'\n\nconst requireLocale = createRequire(import.meta.url)\n\nfunction initTranslator(env: NodeJS.ProcessEnv) {\n  const locale = (env.LC_ALL || env.LC_MESSAGES || env.LANG || 'en').split(/[_.-]/)[0].toLowerCase()\n  const supportedLocale = ['en', 'pl', 'es', 'de', 'ko'].includes(locale) ? locale : 'en'\n  const dictionary: Record<string, string> = requireLocale(`../i18n/${supportedLocale}.json`)\n  return createTranslator(dictionary)\n}\n\ntype EnvReader = (key: string) => string | undefined\n\nfunction readEnvValue(env: NodeJS.ProcessEnv, key: string): string | undefined {\n  const value = env[key]\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction resolveEmailFromDomain(domain: string | undefined, prefix: string): string | null {\n  if (!domain) return null\n  return `${prefix}@${domain}`\n}\n\nexport type InitDerivedSecrets = {\n  adminEmail: string | null\n  employeeEmail: string | null\n  adminPassword: string | null\n  employeePassword: string | null\n}\n\n// Well-known dev/demo password baked into local bootstrap flows so developers\n// keep the documented \"log in as admin@<domain> with password 'secret'\" UX.\n// Only used when NODE_ENV !== 'production' and the OM_INIT_*_PASSWORD env vars\n// are unset \u2014 production paths always use a random 96-bit secret.\nconst DEMO_DERIVED_PASSWORD = 'secret'\n\nlet warnedAboutDeprecatedRandomToggle = false\n\nexport function resolveInitDerivedSecrets(options: {\n  email: string\n  env?: NodeJS.ProcessEnv\n  randomSource?: (size: number) => Buffer\n}): InitDerivedSecrets {\n  const env = options.env ?? process.env\n  const envRead: EnvReader = (key) => readEnvValue(env, key)\n  const [, domain] = String(options.email ?? '').split('@')\n  const adminEmail = envRead('OM_INIT_ADMIN_EMAIL') ?? resolveEmailFromDomain(domain, 'admin')\n  const employeeEmail = envRead('OM_INIT_EMPLOYEE_EMAIL') ?? resolveEmailFromDomain(domain, 'employee')\n  // OM_INIT_GENERATE_RANDOM_PASSWORD used to be an opt-in toggle for random\n  // derived secrets; in production it is now the unconditional behaviour when\n  // no override is set. Surface a one-time deprecation warning so existing\n  // operators notice their config is no longer required.\n  if (parseBooleanToken(envRead('OM_INIT_GENERATE_RANDOM_PASSWORD') ?? '') === true && !warnedAboutDeprecatedRandomToggle) {\n    warnedAboutDeprecatedRandomToggle = true\n    console.warn(\n      '\u26A0\uFE0F  OM_INIT_GENERATE_RANDOM_PASSWORD is deprecated and no longer required: derived admin/employee passwords are always randomized in production when overrides are unset.',\n    )\n  }\n  const isProduction = (env.NODE_ENV ?? '').trim().toLowerCase() === 'production'\n  const randomize = options.randomSource ?? randomBytes\n  const randomSecret = () => randomize(12).toString('base64url')\n  const resolvePassword = (key: string, emailValue: string | null) => {\n    if (!emailValue) return null\n    const envValue = envRead(key)\n    if (envValue) return envValue\n    // Non-production (dev/test/staging defaults): seed the documented demo\n    // password so `yarn dev` / `mercato init` workflows stay predictable.\n    // Production: generate a fresh random secret so credentials are never\n    // hardcoded and the operator-facing CLI prints the value once.\n    return isProduction ? randomSecret() : DEMO_DERIVED_PASSWORD\n  }\n\n  return {\n    adminEmail,\n    employeeEmail,\n    adminPassword: resolvePassword('OM_INIT_ADMIN_PASSWORD', adminEmail),\n    employeePassword: resolvePassword('OM_INIT_EMPLOYEE_PASSWORD', employeeEmail),\n  }\n}\n\nexport function resolveInitSuperadminCredentials(args: string[], env: NodeJS.ProcessEnv = process.env) {\n  const argValue = (name: string) => args.find((arg) => arg.startsWith(`${name}=`))?.slice(name.length + 1) || undefined\n  const email = argValue('--email') ?? readEnvValue(env, 'OM_INIT_SUPERADMIN_EMAIL') ?? 'superadmin@acme.com'\n  const suppliedPassword = argValue('--password') ?? readEnvValue(env, 'OM_INIT_SUPERADMIN_PASSWORD')\n  const isProduction = (env.NODE_ENV ?? '').trim().toLowerCase() === 'production'\n  const skipPolicyArg = args.find((arg) =>\n    arg === '--skip-password-policy' || arg.startsWith('--skip-password-policy=') ||\n    arg === '--allow-weak-password' || arg.startsWith('--allow-weak-password='),\n  )\n  const skipPasswordPolicy = !isProduction && (skipPolicyArg\n    ? parseBooleanToken(skipPolicyArg.split('=')[1] ?? 'true') ?? true\n    : true)\n  if (isProduction) {\n    const t = initTranslator(env)\n    const placeholder = suppliedPassword?.trim().toLowerCase()\n    if (!suppliedPassword || !placeholder || ['secret', 'password', 'changeme', 'change-me', 'change_me', 'replace-me', 'replace_me'].includes(placeholder)) {\n      throw new Error(t('cli.init.errors.superadminPasswordRequired'))\n    }\n    if (!validatePassword(suppliedPassword, getPasswordPolicy(env)).ok) {\n      throw new Error(t('cli.init.errors.superadminPasswordPolicy'))\n    }\n  }\n  return { email, password: suppliedPassword ?? 'secret', skipPasswordPolicy }\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAyB;AAClC,SAAS,mBAAmB,wBAAwB;AACpD,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AACjC,SAAS,qBAAqB;AAE9B,MAAM,gBAAgB,cAAc,YAAY,GAAG;AAEnD,SAAS,eAAe,KAAwB;AAC9C,QAAM,UAAU,IAAI,UAAU,IAAI,eAAe,IAAI,QAAQ,MAAM,MAAM,OAAO,EAAE,CAAC,EAAE,YAAY;AACjG,QAAM,kBAAkB,CAAC,MAAM,MAAM,MAAM,MAAM,IAAI,EAAE,SAAS,MAAM,IAAI,SAAS;AACnF,QAAM,aAAqC,cAAc,WAAW,eAAe,OAAO;AAC1F,SAAO,iBAAiB,UAAU;AACpC;AAIA,SAAS,aAAa,KAAwB,KAAiC;AAC7E,QAAM,QAAQ,IAAI,GAAG;AACrB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,uBAAuB,QAA4B,QAA+B;AACzF,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,GAAG,MAAM,IAAI,MAAM;AAC5B;AAaA,MAAM,wBAAwB;AAE9B,IAAI,oCAAoC;AAEjC,SAAS,0BAA0B,SAInB;AACrB,QAAM,MAAM,QAAQ,OAAO,QAAQ;AACnC,QAAM,UAAqB,CAAC,QAAQ,aAAa,KAAK,GAAG;AACzD,QAAM,CAAC,EAAE,MAAM,IAAI,OAAO,QAAQ,SAAS,EAAE,EAAE,MAAM,GAAG;AACxD,QAAM,aAAa,QAAQ,qBAAqB,KAAK,uBAAuB,QAAQ,OAAO;AAC3F,QAAM,gBAAgB,QAAQ,wBAAwB,KAAK,uBAAuB,QAAQ,UAAU;AAKpG,MAAI,kBAAkB,QAAQ,kCAAkC,KAAK,EAAE,MAAM,QAAQ,CAAC,mCAAmC;AACvH,wCAAoC;AACpC,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACA,QAAM,gBAAgB,IAAI,YAAY,IAAI,KAAK,EAAE,YAAY,MAAM;AACnE,QAAM,YAAY,QAAQ,gBAAgB;AAC1C,QAAM,eAAe,MAAM,UAAU,EAAE,EAAE,SAAS,WAAW;AAC7D,QAAM,kBAAkB,CAAC,KAAa,eAA8B;AAClE,QAAI,CAAC,WAAY,QAAO;AACxB,UAAM,WAAW,QAAQ,GAAG;AAC5B,QAAI,SAAU,QAAO;AAKrB,WAAO,eAAe,aAAa,IAAI;AAAA,EACzC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,eAAe,gBAAgB,0BAA0B,UAAU;AAAA,IACnE,kBAAkB,gBAAgB,6BAA6B,aAAa;AAAA,EAC9E;AACF;AAEO,SAAS,iCAAiC,MAAgB,MAAyB,QAAQ,KAAK;AACrG,QAAM,WAAW,CAAC,SAAiB,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,KAAK,SAAS,CAAC,KAAK;AAC7G,QAAM,QAAQ,SAAS,SAAS,KAAK,aAAa,KAAK,0BAA0B,KAAK;AACtF,QAAM,mBAAmB,SAAS,YAAY,KAAK,aAAa,KAAK,6BAA6B;AAClG,QAAM,gBAAgB,IAAI,YAAY,IAAI,KAAK,EAAE,YAAY,MAAM;AACnE,QAAM,gBAAgB,KAAK;AAAA,IAAK,CAAC,QAC/B,QAAQ,4BAA4B,IAAI,WAAW,yBAAyB,KAC5E,QAAQ,2BAA2B,IAAI,WAAW,wBAAwB;AAAA,EAC5E;AACA,QAAM,qBAAqB,CAAC,iBAAiB,gBACzC,kBAAkB,cAAc,MAAM,GAAG,EAAE,CAAC,KAAK,MAAM,KAAK,OAC5D;AACJ,MAAI,cAAc;AAChB,UAAM,IAAI,eAAe,GAAG;AAC5B,UAAM,cAAc,kBAAkB,KAAK,EAAE,YAAY;AACzD,QAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,UAAU,YAAY,YAAY,aAAa,aAAa,cAAc,YAAY,EAAE,SAAS,WAAW,GAAG;AACvJ,YAAM,IAAI,MAAM,EAAE,4CAA4C,CAAC;AAAA,IACjE;AACA,QAAI,CAAC,iBAAiB,kBAAkB,kBAAkB,GAAG,CAAC,EAAE,IAAI;AAClE,YAAM,IAAI,MAAM,EAAE,0CAA0C,CAAC;AAAA,IAC/D;AAAA,EACF;AACA,SAAO,EAAE,OAAO,UAAU,oBAAoB,UAAU,mBAAmB;AAC7E;",
   "names": []
 }

package/dist/mercato.js

@@ -5,7 +5,7 @@ import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 import { getSslConfig } from "@open-mercato/shared/lib/db/ssl";
 import { getRedisUrl, getRedisUrlOrThrow, parseRedisUrl } from "@open-mercato/shared/lib/redis/connection";
 import { formatInitSummary } from "./lib/init-summary.js";
-import { resolveInitDerivedSecrets } from "./lib/init-secrets.js";
+import { resolveInitDerivedSecrets, resolveInitSuperadminCredentials } from "./lib/init-secrets.js";
 import { decideExistingDatabase, formatSkipIfInitializedMessage } from "./lib/init-existing-database.js";
 import {
   resolveAutoSpawnWorkersMode,
@@ -766,6 +766,7 @@ async function run(argv = process.argv) {
         delete process.env.OM_INIT_REINSTALL;
       }
       const skipIfInitialized = initArgs.includes("--skip-if-initialized");
+      const credentials = skipIfInitialized && !reinstall ? void 0 : resolveInitSuperadminCredentials(initArgs);
       const skipExamples = initArgs.includes("--no-examples");
       const skipDemoUsers = initArgs.includes("--no-demo-users");
       const stressTestEnabled = initArgs.includes("--stresstest") || initArgs.includes("--stress-test");
@@ -934,6 +935,7 @@ async function run(argv = process.argv) {
           }
         }
       }
+      const { email, password, skipPasswordPolicy } = credentials ?? resolveInitSuperadminCredentials(initArgs);
       console.log("\u{1F527} Preparing modules (registry, entities, DI)...");
       const { createResolver } = await import("./lib/resolver.js");
       const { generateEntityIds, generateModuleRegistries, generateModuleEntities, generateModuleDi, generateModulePackageSources, generateOpenApi, generateWebResearchAdapters } = await import("./lib/generators/index.js");
@@ -969,16 +971,7 @@ async function run(argv = process.argv) {
         }
         return fallback;
       };
-      const readEnvDefault = (key) => {
-        const value = process.env[key];
-        if (typeof value === "string" && value.trim().length > 0) return value.trim();
-        return void 0;
-      };
-      const defaultEmail = readEnvDefault("OM_INIT_SUPERADMIN_EMAIL") ?? "superadmin@acme.com";
-      const defaultPassword = readEnvDefault("OM_INIT_SUPERADMIN_PASSWORD") ?? "secret";
       const orgName = findArgValue(["--org=", "--orgName="], "Acme Corp");
-      const email = findArgValue(["--email="], defaultEmail);
-      const password = findArgValue(["--password="], defaultPassword);
       const derivedSecrets = resolveInitDerivedSecrets({ email, env: process.env });
       const adminEmailDerived = derivedSecrets.adminEmail;
       const employeeEmailDerived = derivedSecrets.employeeEmail;
@@ -996,10 +989,6 @@ async function run(argv = process.argv) {
         process.env.OM_INIT_EMPLOYEE_EMAIL = employeeEmailDerived;
       }
       const roles = findArgValue(["--roles="], "superadmin,admin,employee");
-      const skipPasswordPolicyRaw = initArgs.find(
-        (arg) => arg === "--skip-password-policy" || arg.startsWith("--skip-password-policy=") || arg === "--allow-weak-password" || arg.startsWith("--allow-weak-password=")
-      );
-      const skipPasswordPolicy = skipPasswordPolicyRaw ? parseBooleanToken(skipPasswordPolicyRaw.split("=")[1] ?? "true") ?? true : true;
       console.log("\u{1F510} Setting up RBAC and users...");
       const setupArgs = [
         "--orgName",