@open-mercato/cli 0.10.1-develop.7994.1.c9f31972aa → 0.10.1-develop.8022.1.b6753de892

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.7994.1.c9f31972aa",
+  "version": "0.10.1-develop.8022.1.b6753de892",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.7994.1.c9f31972aa",
-    "@open-mercato/queue": "0.10.1-develop.7994.1.c9f31972aa",
-    "@open-mercato/shared": "0.10.1-develop.7994.1.c9f31972aa",
-    "@open-mercato/telemetry": "0.10.1-develop.7994.1.c9f31972aa",
+    "@open-mercato/events": "0.10.1-develop.8022.1.b6753de892",
+    "@open-mercato/queue": "0.10.1-develop.8022.1.b6753de892",
+    "@open-mercato/shared": "0.10.1-develop.8022.1.b6753de892",
+    "@open-mercato/telemetry": "0.10.1-develop.8022.1.b6753de892",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7994.1.c9f31972aa"
+    "@open-mercato/shared": "0.10.1-develop.8022.1.b6753de892"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7994.1.c9f31972aa",
+    "@open-mercato/shared": "0.10.1-develop.8022.1.b6753de892",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"

package/src/__tests__/mercato.test.ts

@@ -1112,6 +1112,47 @@ describe('init command failure output', () => {
     )
   }
 
+  it.each(['--reinstall', '--no-demo-users'])('rejects unsafe production init before side effects with %s', async (flag) => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const authSetup = jest.fn().mockResolvedValue(undefined)
+    mockInitDependencies({ authSetup })
+    process.env.NODE_ENV = 'production'
+    process.env.OM_INIT_SUPERADMIN_PASSWORD = 'password'
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', flag, '--skip-password-policy'])).toBe(1)
+      const { Client } = await import('pg')
+      const { generateEntityIds } = await import('../lib/generators')
+      const { dbMigrate } = await import('../lib/db')
+      expect(Client).not.toHaveBeenCalled()
+      expect(generateEntityIds).not.toHaveBeenCalled()
+      expect(dbMigrate).not.toHaveBeenCalled()
+      expect(authSetup).not.toHaveBeenCalled()
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
+  it('passes valid production credentials to auth setup without bypassing policy', async () => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const authSetup = jest.fn().mockResolvedValue(undefined)
+    mockInitDependencies({ authSetup })
+    process.env.NODE_ENV = 'production'
+    process.env.OM_INIT_SUPERADMIN_PASSWORD = 'Unique-Owner-937!'
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', '--no-demo-users', '--skip-password-policy'])).toBe(0)
+      expect(authSetup).toHaveBeenCalledWith(expect.arrayContaining(['--password', 'Unique-Owner-937!']))
+      expect(authSetup.mock.calls[0][0]).not.toContain('--skip-password-policy')
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
   it('passes --include-demo-users to auth setup by default', async () => {
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
     const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
@@ -1336,6 +1377,22 @@ describe('init on an already initialized database', () => {
     consoleLogSpy.mockRestore()
   })
 
+  it('skips an initialized production database without bootstrap credentials', async () => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const { generateEntityIds } = mockSeededDatabase('3')
+    process.env.NODE_ENV = 'production'
+    delete process.env.OM_INIT_SUPERADMIN_PASSWORD
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', '--skip-if-initialized'])).toBe(0)
+      expect(generateEntityIds).not.toHaveBeenCalled()
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
   it('keeps the data, names the target database and exits 0 with --skip-if-initialized', async () => {
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
     const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()

package/src/i18n/de.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Das Superadmin-Passwort für die Produktion erfüllt die konfigurierte Passwortrichtlinie nicht. Flags zum Umgehen der Passwortrichtlinie gelten nur außerhalb der Produktion.",
+  "cli.init.errors.superadminPasswordRequired": "Die Produktionsinitialisierung erfordert ein eindeutiges Superadmin-Passwort über OM_INIT_SUPERADMIN_PASSWORD oder --password; integrierte Platzhalter sind nicht zulässig."
+}

package/src/i18n/en.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Production superadmin password does not meet the configured password policy. Password-policy bypass flags apply only outside production.",
+  "cli.init.errors.superadminPasswordRequired": "Production initialization requires a unique superadmin password via OM_INIT_SUPERADMIN_PASSWORD or --password; built-in placeholders are not allowed."
+}

package/src/i18n/es.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "La contraseña de superadministrador en producción no cumple la política de contraseñas configurada. Las opciones para omitir la política solo se aplican fuera de producción.",
+  "cli.init.errors.superadminPasswordRequired": "La inicialización en producción requiere una contraseña única de superadministrador mediante OM_INIT_SUPERADMIN_PASSWORD o --password; no se permiten los valores predeterminados de ejemplo."
+}

package/src/i18n/ko.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "프로덕션 슈퍼관리자 비밀번호가 설정된 비밀번호 정책을 충족하지 않습니다. 비밀번호 정책 우회 플래그는 프로덕션 외 환경에서만 적용됩니다.",
+  "cli.init.errors.superadminPasswordRequired": "프로덕션 초기화에는 OM_INIT_SUPERADMIN_PASSWORD 또는 --password로 지정한 고유한 슈퍼관리자 비밀번호가 필요합니다. 기본 예시 비밀번호는 사용할 수 없습니다."
+}

package/src/i18n/pl.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Hasło superadministratora w środowisku produkcyjnym nie spełnia skonfigurowanej polityki haseł. Flagi pomijające politykę haseł działają tylko poza środowiskiem produkcyjnym.",
+  "cli.init.errors.superadminPasswordRequired": "Inicjalizacja produkcyjna wymaga unikalnego hasła superadministratora podanego przez OM_INIT_SUPERADMIN_PASSWORD lub --password; wbudowane hasła przykładowe są niedozwolone."
+}

package/src/lib/__tests__/init-secrets.test.ts

@@ -1,4 +1,6 @@
-import { resolveInitDerivedSecrets } from '../init-secrets'
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { resolveInitDerivedSecrets, resolveInitSuperadminCredentials } from '../init-secrets'
 
 describe('resolveInitDerivedSecrets', () => {
   it("seeds the well-known 'secret' password in non-production when no env overrides are set", () => {
@@ -77,3 +79,85 @@ describe('resolveInitDerivedSecrets', () => {
   })
 })
 
+
+describe('production bootstrap superadmin credentials', () => {
+  const production = { NODE_ENV: 'production' }
+
+  it.each([undefined, '', '   ', 'secret', 'password', ' PASSWORD ', 'changeme', 'change-me', 'replace_me'])(
+    'rejects an absent or placeholder production password: %s', (password) => {
+      expect(() => resolveInitSuperadminCredentials([], {
+        ...production, OM_INIT_SUPERADMIN_PASSWORD: password,
+      })).toThrow('requires a unique superadmin password')
+    },
+  )
+
+  it.each(['--skip-password-policy', '--skip-password-policy=true', '--allow-weak-password', '--allow-weak-password=true'])(
+    'enforces production policy despite %s', (flag) => {
+      expect(() => resolveInitSuperadminCredentials([flag, '--password=weak'], production))
+        .toThrow('does not meet the configured password policy')
+      expect(resolveInitSuperadminCredentials([flag, '--password=Unique-Owner-937!'], production).skipPasswordPolicy).toBe(false)
+    },
+  )
+
+  it('uses the configured policy and never includes the password in errors', () => {
+    const password = 'Unique-Owner-937!'
+    expect(() => resolveInitSuperadminCredentials([`--password=${password}`], {
+      ...production, OM_PASSWORD_MIN_LENGTH: '40',
+    })).toThrow('does not meet the configured password policy')
+    try {
+      resolveInitSuperadminCredentials([`--password=${password}`], { ...production, OM_PASSWORD_MIN_LENGTH: '40' })
+    } catch (error) {
+      expect(String(error)).not.toContain(password)
+    }
+  })
+
+  it('rejects placeholders even with a relaxed policy', () => {
+    expect(() => resolveInitSuperadminCredentials([], {
+      ...production, OM_INIT_SUPERADMIN_PASSWORD: 'password', OM_PASSWORD_REQUIRE_DIGIT: 'false',
+      OM_PASSWORD_REQUIRE_UPPERCASE: 'false', OM_PASSWORD_REQUIRE_SPECIAL: 'false',
+    })).toThrow('requires a unique superadmin password')
+  })
+
+  it('prefers command arguments over environment overrides', () => {
+    expect(resolveInitSuperadminCredentials(['--email=owner@example.test', '--password=Unique-Owner-937!'], {
+      NODE_ENV: ' Production ', OM_INIT_SUPERADMIN_PASSWORD: 'password', OM_INIT_SUPERADMIN_EMAIL: 'other@example.test',
+    })).toEqual({ email: 'owner@example.test', password: 'Unique-Owner-937!', skipPasswordPolicy: false })
+  })
+
+  it('uses the CLI locale for operator-facing production diagnostics', () => {
+    expect(() => resolveInitSuperadminCredentials([], { ...production, LC_ALL: 'pl_PL.UTF-8' }))
+      .toThrow('Inicjalizacja produkcyjna wymaga')
+    expect(() => resolveInitSuperadminCredentials([], { ...production, LC_ALL: 'unknown' }))
+      .toThrow('Production initialization requires')
+  })
+
+  it('accepts a policy-compliant environment password', () => {
+    expect(resolveInitSuperadminCredentials([], {
+      ...production, OM_INIT_SUPERADMIN_PASSWORD: 'Unique-Owner-937!',
+    }).password).toBe('Unique-Owner-937!')
+  })
+
+  it.each([undefined, 'development', 'test', 'staging'])('preserves non-production defaults for %s', (nodeEnv) => {
+    expect(resolveInitSuperadminCredentials([], { NODE_ENV: nodeEnv })).toEqual({
+      email: 'superadmin@acme.com', password: 'secret', skipPasswordPolicy: true,
+    })
+    expect(resolveInitSuperadminCredentials([], { NODE_ENV: nodeEnv, OM_INIT_SUPERADMIN_PASSWORD: 'password' }).password).toBe('password')
+    expect(resolveInitSuperadminCredentials(['--skip-password-policy=false'], { NODE_ENV: nodeEnv }).skipPasswordPolicy).toBe(false)
+  })
+})
+
+describe('full-app Compose bootstrap defaults', () => {
+  it.each(['starters/docker/compose.fullapp.yml', 'packages/create-app/template/docker-compose.fullapp.yml'])(
+    '%s cannot bootstrap predictable production credentials', (composePath) => {
+      const compose = readFileSync(path.resolve(__dirname, '../../../../..', composePath), 'utf8')
+      const fallback = compose.match(/OM_INIT_SUPERADMIN_PASSWORD: \$\{OM_INIT_SUPERADMIN_PASSWORD:-(.*?)\}/)?.[1]
+      expect(fallback).toBeDefined()
+      expect(() => resolveInitSuperadminCredentials([], {
+        NODE_ENV: 'production', OM_INIT_SUPERADMIN_PASSWORD: fallback,
+      })).toThrow('requires a unique superadmin password')
+      expect(resolveInitSuperadminCredentials([], {
+        NODE_ENV: 'development', OM_INIT_SUPERADMIN_PASSWORD: fallback,
+      }).password).toBe(fallback)
+    },
+  )
+})

package/src/lib/__tests__/telemetry-init.test.ts

@@ -164,7 +164,7 @@ describe('mercato telemetry init', () => {
 
     const pkg = JSON.parse(read('package.json'))
     expect(pkg.dependencies['@open-mercato/telemetry']).toBe('1.2.3')
-    expect(pkg.optionalDependencies['bullmq-otel']).toBe('^1.3.1')
+    expect(pkg.optionalDependencies['bullmq-otel']).toBe('^2.0.1')
 
     expect(read('.env.example')).toContain('TELEMETRY_BACKEND')
     expect(read('.env.example')).toContain('OTEL_EXPORTER_OTLP_ENDPOINT')

package/src/lib/generators/__tests__/openapi.test.ts

@@ -160,6 +160,30 @@ export function buildOpenApiDocument(modules: any[], options: any) {
     expect(openApiDoc.paths['/api/demo/details']?.get?.summary).toBe('package details')
   })
 
+  it('bundles into a per-run file and leaves no bundle behind', async () => {
+    touchFile(
+      path.join(tmpDir, 'packages', 'core', 'src', 'modules', 'demo', 'api', 'health', 'route.ts'),
+      [
+        'export async function GET() { return new Response("pkg-health") }',
+        'export const openApi = {',
+        "  GET: { summary: 'package health' }",
+        '}',
+        '',
+      ].join('\n'),
+    )
+    const cacheDir = path.join(tmpDir, 'node_modules', '.cache')
+    touchFile(path.join(cacheDir, '_openapi-bundle.mjs'), 'export {}\n')
+
+    const result = await generateOpenApi({ resolver: createMockResolver([{ id: 'demo', from: '@open-mercato/core' }]), quiet: true })
+
+    expect(result.errors).toEqual([])
+    const openApiDoc = JSON.parse(
+      fs.readFileSync(path.join(tmpDir, 'output', 'generated', 'openapi.generated.json'), 'utf8'),
+    ) as { paths: Record<string, { get?: { summary?: string } }> }
+    expect(openApiDoc.paths['/api/demo/health']?.get?.summary).toBe('package health')
+    expect(fs.readdirSync(cacheDir).filter((name) => name.startsWith('_openapi-bundle'))).toEqual([])
+  })
+
   it('skips route discovery and bundling when all tracked inputs are unchanged', async () => {
     touchFile(
       path.join(tmpDir, 'packages', 'core', 'src', 'modules', 'demo', 'api', 'health', 'route.ts'),

package/src/lib/generators/openapi.ts

@@ -7,6 +7,7 @@
  */
 
 import * as fs from 'node:fs'
+import { randomBytes } from 'node:crypto'
 import * as path from 'node:path'
 import type { ModuleEntry, PackageResolver } from '../resolver'
 import { getEnabledModuleIdentities } from '../module-identity'
@@ -340,7 +341,10 @@ async function generateOpenApiViaBundle(
   const cacheDir = path.join(rootDir, 'node_modules', '.cache')
   if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true })
 
-  const bundlePath = path.join(cacheDir, '_openapi-bundle.mjs')
+  // Per-run file: `yarn dev`'s watcher and a CLI `generate` (e.g. after
+  // create-mercato-module init) can bundle concurrently, and a shared path let
+  // one process execute the other's half-written bundle ("Unexpected end of input").
+  const bundlePath = path.join(cacheDir, `_openapi-bundle-${process.pid}-${randomBytes(6).toString('hex')}.mjs`)
   let inputPaths: string[] = []
 
   // Build the entry script that imports all routes and calls buildOpenApiDocument
@@ -607,7 +611,8 @@ process.stdout.write(JSON.stringify(deepClone(doc), (_, v) =>
     // process exit when a plugin request is still in flight.
     try { await esbuild.stop() } catch {}
     // Clean up old files from previous tsx-based approach
-    for (const file of ['_openapi-register.mjs', '_openapi-loader.mjs', '_next-stub.cjs']) {
+    try { fs.unlinkSync(bundlePath) } catch {}
+    for (const file of ['_openapi-bundle.mjs', '_openapi-register.mjs', '_openapi-loader.mjs', '_next-stub.cjs']) {
       try { fs.unlinkSync(path.join(cacheDir, file)) } catch {}
     }
   }

package/src/lib/init-secrets.ts

@@ -1,5 +1,17 @@
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { randomBytes } from 'node:crypto'
+import { createTranslator } from '@open-mercato/shared/lib/i18n/translate'
+import { createRequire } from 'node:module'
+
+const requireLocale = createRequire(import.meta.url)
+
+function initTranslator(env: NodeJS.ProcessEnv) {
+  const locale = (env.LC_ALL || env.LC_MESSAGES || env.LANG || 'en').split(/[_.-]/)[0].toLowerCase()
+  const supportedLocale = ['en', 'pl', 'es', 'de', 'ko'].includes(locale) ? locale : 'en'
+  const dictionary: Record<string, string> = requireLocale(`../i18n/${supportedLocale}.json`)
+  return createTranslator(dictionary)
+}
 
 type EnvReader = (key: string) => string | undefined
 
@@ -71,3 +83,28 @@ export function resolveInitDerivedSecrets(options: {
     employeePassword: resolvePassword('OM_INIT_EMPLOYEE_PASSWORD', employeeEmail),
   }
 }
+
+export function resolveInitSuperadminCredentials(args: string[], env: NodeJS.ProcessEnv = process.env) {
+  const argValue = (name: string) => args.find((arg) => arg.startsWith(`${name}=`))?.slice(name.length + 1) || undefined
+  const email = argValue('--email') ?? readEnvValue(env, 'OM_INIT_SUPERADMIN_EMAIL') ?? 'superadmin@acme.com'
+  const suppliedPassword = argValue('--password') ?? readEnvValue(env, 'OM_INIT_SUPERADMIN_PASSWORD')
+  const isProduction = (env.NODE_ENV ?? '').trim().toLowerCase() === 'production'
+  const skipPolicyArg = args.find((arg) =>
+    arg === '--skip-password-policy' || arg.startsWith('--skip-password-policy=') ||
+    arg === '--allow-weak-password' || arg.startsWith('--allow-weak-password='),
+  )
+  const skipPasswordPolicy = !isProduction && (skipPolicyArg
+    ? parseBooleanToken(skipPolicyArg.split('=')[1] ?? 'true') ?? true
+    : true)
+  if (isProduction) {
+    const t = initTranslator(env)
+    const placeholder = suppliedPassword?.trim().toLowerCase()
+    if (!suppliedPassword || !placeholder || ['secret', 'password', 'changeme', 'change-me', 'change_me', 'replace-me', 'replace_me'].includes(placeholder)) {
+      throw new Error(t('cli.init.errors.superadminPasswordRequired'))
+    }
+    if (!validatePassword(suppliedPassword, getPasswordPolicy(env)).ok) {
+      throw new Error(t('cli.init.errors.superadminPasswordPolicy'))
+    }
+  }
+  return { email, password: suppliedPassword ?? 'secret', skipPasswordPolicy }
+}

package/src/lib/telemetry-init.ts

@@ -23,7 +23,7 @@ import { dirname, join, resolve } from 'node:path'
  * `@open-mercato/cli`'s telemetry dependency once the app updates its packages.
  */
 
-const BULLMQ_OTEL_VERSION = '^1.3.1'
+const BULLMQ_OTEL_VERSION = '^2.0.1'
 
 type StepStatus = 'created' | 'patched' | 'skipped' | 'manual'
 

package/src/lib/testing/__tests__/integration.test.ts

@@ -17,6 +17,7 @@ import {
   resolveAppReadyTimeoutMs,
   resolveEphemeralPostgresImage,
   resolveEphemeralJwtSecret,
+  resolveEphemeralSuperadminPassword,
   ephemeralPostgresInitSql,
   shouldReuseBuildArtifacts,
   acquireEphemeralRuntimeLock,
@@ -30,6 +31,7 @@ import {
 } from '../integration'
 import type { CapturedOutputProcess, ShutdownProcessRef } from '../integration'
 import { resolveSpawnCommand } from '../../spawn'
+import { resolveInitSuperadminCredentials } from '../../init-secrets'
 import { EventEmitter } from 'node:events'
 import { spawn } from 'node:child_process'
 import type { ChildProcess } from 'node:child_process'
@@ -510,6 +512,28 @@ describe('integration cache and options', () => {
     )
   })
 
+  it('supplies a production-valid superadmin password when the inherited one is missing or a placeholder', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const fallback = resolveEphemeralSuperadminPassword({})
+      expect(fallback).toBe('Om-Ephemeral-Superadmin-2026!')
+      expect(() =>
+        resolveInitSuperadminCredentials([], { NODE_ENV: 'production', OM_INIT_SUPERADMIN_PASSWORD: fallback }),
+      ).not.toThrow()
+      expect(warnSpy).not.toHaveBeenCalled()
+      expect(resolveEphemeralSuperadminPassword({ OM_INIT_SUPERADMIN_PASSWORD: 'secret' })).toBe(fallback)
+      expect(warnSpy).toHaveBeenCalledTimes(1)
+    } finally {
+      warnSpy.mockRestore()
+    }
+  })
+
+  it('keeps a production-valid operator-provided superadmin password', () => {
+    expect(resolveEphemeralSuperadminPassword({ OM_INIT_SUPERADMIN_PASSWORD: 'Operator-Chosen-Pass-42!' })).toBe(
+      'Operator-Chosen-Pass-42!',
+    )
+  })
+
   it('creates the vector and pgcrypto extensions in the ephemeral init SQL', () => {
     const sql = ephemeralPostgresInitSql()
     expect(sql).toContain('CREATE EXTENSION IF NOT EXISTS vector')

package/src/lib/testing/integration.ts

@@ -11,6 +11,7 @@ import spawn from 'cross-spawn'
 import { fetchWithTimeout, type FetchWithTimeoutInit } from '@open-mercato/shared/lib/http/fetchWithTimeout'
 import { isUnsafeJwtSecret } from '@open-mercato/shared/lib/auth/jwt'
 import { resolveEnvironment } from '../resolver'
+import { resolveInitSuperadminCredentials } from '../init-secrets'
 import { resolveSpawnCommand } from '../spawn'
 import { discoverIntegrationSpecFiles as discoverIntegrationSpecFilesShared } from './integration-discovery'
 import { resolveDockerHostFromContext, runCommandAndCapture } from './runtime-utils'
@@ -202,6 +203,23 @@ export function resolveEphemeralJwtSecret(env: NodeJS.ProcessEnv = process.env):
   }
   return DEFAULT_EPHEMERAL_JWT_SECRET
 }
+const DEFAULT_EPHEMERAL_SUPERADMIN_PASSWORD = 'Om-Ephemeral-Superadmin-2026!'
+
+export function resolveEphemeralSuperadminPassword(env: NodeJS.ProcessEnv = process.env): string {
+  const inherited = env.OM_INIT_SUPERADMIN_PASSWORD
+  if (inherited !== undefined && inherited.trim().length > 0) {
+    try {
+      resolveInitSuperadminCredentials([], { ...env, NODE_ENV: 'production', OM_INIT_SUPERADMIN_PASSWORD: inherited })
+      return inherited
+    } catch {
+      console.warn(
+        '[integration] Ignoring the inherited OM_INIT_SUPERADMIN_PASSWORD: it is a placeholder or fails the password policy and the ephemeral app initializes with NODE_ENV=production. Using the ephemeral default instead.',
+      )
+    }
+  }
+  return DEFAULT_EPHEMERAL_SUPERADMIN_PASSWORD
+}
+
 const PLAYWRIGHT_ENV_UNAVAILABLE_PATTERNS: RegExp[] = [
   /net::ERR_CONNECTION_REFUSED/i,
   /Failed to connect to .* (localhost|127\.0\.0\.1)/i,
@@ -2197,6 +2215,7 @@ function buildReusableEnvironment(
     // OM_INIT_*_PASSWORD to fix the seeded credential.
     OM_INIT_ADMIN_PASSWORD: process.env.OM_INIT_ADMIN_PASSWORD ?? 'secret',
     OM_INIT_EMPLOYEE_PASSWORD: process.env.OM_INIT_EMPLOYEE_PASSWORD ?? 'secret',
+    OM_INIT_SUPERADMIN_PASSWORD: resolveEphemeralSuperadminPassword(),
     OM_INTEGRATION_TEST: 'true',
     OM_ENABLE_ENTERPRISE_MODULES: enterpriseModulesFlag,
     OM_ENABLE_ENTERPRISE_MODULES_SSO: process.env.OM_ENABLE_ENTERPRISE_MODULES_SSO ?? enterpriseModulesFlag,
@@ -3585,6 +3604,10 @@ export async function startEphemeralEnvironment(options: EphemeralRuntimeOptions
       // NODE_ENV=production.
       OM_INIT_ADMIN_PASSWORD: process.env.OM_INIT_ADMIN_PASSWORD ?? 'secret',
       OM_INIT_EMPLOYEE_PASSWORD: process.env.OM_INIT_EMPLOYEE_PASSWORD ?? 'secret',
+      // Production init refuses a missing or placeholder superadmin password
+      // (#8896). Integration auth helpers read OM_INIT_SUPERADMIN_PASSWORD, so
+      // the Playwright runner logs in with the same value.
+      OM_INIT_SUPERADMIN_PASSWORD: resolveEphemeralSuperadminPassword(),
       // Pool sizing for the ephemeral integration runtime. Defaults were once
       // very aggressive (max=5, idle=1000) which exposed flaky 'timeout exceeded
       // when trying to connect' errors on `progressService.createJob`-backed

package/src/mercato.ts

@@ -10,7 +10,7 @@ import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { getSslConfig } from '@open-mercato/shared/lib/db/ssl'
 import { getRedisUrl, getRedisUrlOrThrow, parseRedisUrl } from '@open-mercato/shared/lib/redis/connection'
 import { formatInitSummary } from './lib/init-summary'
-import { resolveInitDerivedSecrets } from './lib/init-secrets'
+import { resolveInitDerivedSecrets, resolveInitSuperadminCredentials } from './lib/init-secrets'
 import { decideExistingDatabase, formatSkipIfInitializedMessage } from './lib/init-existing-database'
 import {
   resolveAutoSpawnWorkersMode,
@@ -1032,6 +1032,7 @@ export async function run(argv = process.argv) {
         delete process.env.OM_INIT_REINSTALL
       }
       const skipIfInitialized = initArgs.includes('--skip-if-initialized')
+      const credentials = skipIfInitialized && !reinstall ? undefined : resolveInitSuperadminCredentials(initArgs)
       const skipExamples = initArgs.includes('--no-examples')
       const skipDemoUsers = initArgs.includes('--no-demo-users')
       const stressTestEnabled =
@@ -1209,6 +1210,8 @@ export async function run(argv = process.argv) {
         }
       }
 
+      const { email, password, skipPasswordPolicy } = credentials ?? resolveInitSuperadminCredentials(initArgs)
+
       // Step 1: Run generators directly (no process spawn)
       console.log('🔧 Preparing modules (registry, entities, DI)...')
       const { createResolver } = await import('./lib/resolver')
@@ -1257,16 +1260,7 @@ export async function run(argv = process.argv) {
         }
         return fallback
       }
-      const readEnvDefault = (key: string) => {
-        const value = process.env[key]
-        if (typeof value === 'string' && value.trim().length > 0) return value.trim()
-        return undefined
-      }
-      const defaultEmail = readEnvDefault('OM_INIT_SUPERADMIN_EMAIL') ?? 'superadmin@acme.com'
-      const defaultPassword = readEnvDefault('OM_INIT_SUPERADMIN_PASSWORD') ?? 'secret'
       const orgName = findArgValue(['--org=', '--orgName='], 'Acme Corp')
-      const email = findArgValue(['--email='], defaultEmail)
-      const password = findArgValue(['--password='], defaultPassword)
       const derivedSecrets = resolveInitDerivedSecrets({ email, env: process.env })
       const adminEmailDerived = derivedSecrets.adminEmail
       const employeeEmailDerived = derivedSecrets.employeeEmail
@@ -1300,16 +1294,6 @@ export async function run(argv = process.argv) {
         process.env.OM_INIT_EMPLOYEE_EMAIL = employeeEmailDerived
       }
       const roles = findArgValue(['--roles='], 'superadmin,admin,employee')
-      const skipPasswordPolicyRaw = initArgs.find((arg) =>
-        arg === '--skip-password-policy' ||
-        arg.startsWith('--skip-password-policy=') ||
-        arg === '--allow-weak-password' ||
-        arg.startsWith('--allow-weak-password=')
-      )
-      const skipPasswordPolicy = skipPasswordPolicyRaw
-        ? parseBooleanToken(skipPasswordPolicyRaw.split('=')[1] ?? 'true') ?? true
-        : true
-
       console.log('🔐 Setting up RBAC and users...')
       // Run auth setup command via CLI
       const setupArgs = [