@open-mercato/core 0.6.6-develop.5612.1.d382eb2f33 → 0.6.6-develop.5617.1.62538c48ca

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.5612.1.d382eb2f33",
+  "version": "0.6.6-develop.5617.1.62538c48ca",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -245,16 +245,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.5612.1.d382eb2f33",
-    "@open-mercato/shared": "0.6.6-develop.5612.1.d382eb2f33",
-    "@open-mercato/ui": "0.6.6-develop.5612.1.d382eb2f33",
+    "@open-mercato/ai-assistant": "0.6.6-develop.5617.1.62538c48ca",
+    "@open-mercato/shared": "0.6.6-develop.5617.1.62538c48ca",
+    "@open-mercato/ui": "0.6.6-develop.5617.1.62538c48ca",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.5612.1.d382eb2f33",
-    "@open-mercato/shared": "0.6.6-develop.5612.1.d382eb2f33",
-    "@open-mercato/ui": "0.6.6-develop.5612.1.d382eb2f33",
+    "@open-mercato/ai-assistant": "0.6.6-develop.5617.1.62538c48ca",
+    "@open-mercato/shared": "0.6.6-develop.5617.1.62538c48ca",
+    "@open-mercato/ui": "0.6.6-develop.5617.1.62538c48ca",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/api_keys/data/entities.ts

@@ -1,7 +1,12 @@
-import { Entity, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'
+import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'
 
 @Entity({ tableName: 'api_keys' })
 @Unique({ properties: ['keyPrefix'] })
+@Index({
+  name: 'api_keys_opencode_session_id_uq',
+  expression:
+    'create unique index "api_keys_opencode_session_id_uq" on "api_keys" ("opencode_session_id") where "opencode_session_id" is not null and "deleted_at" is null',
+})
 export class ApiKey {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
@@ -42,6 +47,15 @@ export class ApiKey {
   @Property({ name: 'session_secret_encrypted', type: 'text', nullable: true })
   sessionSecretEncrypted?: string | null
 
+  /**
+   * OpenCode session id bound to this api_key row. Set the first time the
+   * chat dispatcher receives a `done` event after minting a session token,
+   * then asserted on every subsequent resume to prevent cross-user session
+   * continuation (see security fix 2026-05-23).
+   */
+  @Property({ name: 'opencode_session_id', type: 'text', nullable: true })
+  opencodeSessionId?: string | null
+
   @Property({ name: 'last_used_at', type: Date, nullable: true })
   lastUsedAt?: Date | null
 

package/src/modules/api_keys/migrations/.snapshot-open-mercato.json

@@ -115,6 +115,15 @@
           "nullable": true,
           "mappedType": "text"
         },
+        "opencode_session_id": {
+          "name": "opencode_session_id",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
         "last_used_at": {
           "name": "last_used_at",
           "type": "timestamptz",
@@ -188,6 +197,15 @@
           "constraint": true,
           "primary": true,
           "unique": true
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "api_keys_opencode_session_id_uq",
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null"
         }
       ],
       "checks": [],

package/src/modules/api_keys/migrations/Migration20260523234901.ts

@@ -0,0 +1,17 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260523234901 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "api_keys" add column "opencode_session_id" text null;`);
+    this.addSql(
+      `create unique index "api_keys_opencode_session_id_uq" on "api_keys" ("opencode_session_id") where "opencode_session_id" is not null and "deleted_at" is null;`
+    );
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index "api_keys_opencode_session_id_uq";`);
+    this.addSql(`alter table "api_keys" drop column "opencode_session_id";`);
+  }
+
+}

package/src/modules/api_keys/services/apiKeyService.ts

@@ -7,6 +7,7 @@ import { ApiKey } from '../data/entities'
 import { createKmsService } from '@open-mercato/shared/lib/encryption/kms'
 import { encryptWithAesGcm, decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
 import { getSharedApiKeyAuthCache } from '@open-mercato/shared/lib/auth/apiKeyAuthCache'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 const BCRYPT_COST = 10
 
@@ -230,6 +231,68 @@ export async function findApiKeyBySessionToken(
   return record
 }
 
+/**
+ * Bind an OpenCode session id to the api_key row that owns this chat session.
+ *
+ * Called by the chat dispatcher the first time we see the `done` event for a
+ * freshly minted session token. From that point on,
+ * `findApiKeyByOpencodeSessionId(em, opencodeSessionId)` returns the same row,
+ * which the ai-assistant runtime uses to assert ownership on every resume.
+ *
+ * Throws when the session token has been deleted/expired, and when the api_key
+ * row is already bound to a DIFFERENT OpenCode session (defensive: this should
+ * never happen in practice because each chat mints a new session token, but we
+ * fail closed instead of silently overwriting).
+ *
+ * Idempotent when the row is already bound to the same OpenCode session id.
+ */
+export async function bindOpencodeSessionToApiKey(
+  em: EntityManager,
+  sessionToken: string,
+  opencodeSessionId: string
+): Promise<void> {
+  if (!sessionToken) throw new Error('Session token not found or expired')
+  if (!opencodeSessionId) throw new Error('OpenCode session id is required')
+
+  const row = await findApiKeyBySessionToken(em, sessionToken)
+  if (!row) throw new Error('Session token not found or expired')
+
+  if (row.opencodeSessionId === opencodeSessionId) return
+  if (row.opencodeSessionId && row.opencodeSessionId !== opencodeSessionId) {
+    throw new Error('Session token already bound to a different OpenCode session')
+  }
+
+  row.opencodeSessionId = opencodeSessionId
+  await em.persist(row).flush()
+}
+
+/**
+ * Find an api_key row by its bound OpenCode session id.
+ *
+ * Returns null if no active row matches, or if the matched row is expired
+ * (same contract as `findApiKeyBySessionToken`). Uses
+ * `findOneWithDecryption` so encrypted-at-rest fields on the row are decrypted
+ * before the ai-assistant runtime inspects `sessionUserId` / `tenantId` /
+ * `organizationId` for the ownership check.
+ */
+export async function findApiKeyByOpencodeSessionId(
+  em: EntityManager,
+  opencodeSessionId: string
+): Promise<ApiKey | null> {
+  if (!opencodeSessionId) return null
+
+  const record = await findOneWithDecryption(
+    em,
+    ApiKey,
+    { opencodeSessionId, deletedAt: null } as any,
+  )
+
+  if (!record) return null
+  if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null
+
+  return record
+}
+
 /**
  * Find a session API key with its decrypted secret.
  * Returns null if not found, expired, deleted, or decryption fails.

package/src/modules/attachments/api/partitions/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Attachment, AttachmentPartition } from '../../data/entities'
 import { ensureDefaultPartitions, DEFAULT_ATTACHMENT_PARTITIONS, sanitizePartitionCode, isPartitionSettingsLocked } from '../../lib/partitions'
 import { resolvePartitionEnvKey } from '../../lib/partitionEnv'
@@ -23,6 +24,24 @@ const deleteSchema = z.object({
 
 const DEFAULT_CODES = new Set(DEFAULT_ATTACHMENT_PARTITIONS.map((entry) => entry.code))
 
+type AuthLike = { sub?: string; tenantId?: string | null; orgId?: string | null; isSuperAdmin?: boolean } | null | undefined
+
+function isSuperAdmin(auth: AuthLike): boolean {
+  return auth?.isSuperAdmin === true
+}
+
+function canManagePartition(auth: AuthLike, entry: AttachmentPartition): boolean {
+  if (!auth?.tenantId) return false
+  if (entry.tenantId && entry.tenantId === auth.tenantId) return true
+  if (entry.tenantId == null && isSuperAdmin(auth)) return true
+  return false
+}
+
+function partitionVisibilityFilter(auth: AuthLike) {
+  if (isSuperAdmin(auth)) return {}
+  return { $or: [{ tenantId: null }, { tenantId: auth?.tenantId ?? null }] }
+}
+
 function serializePartition(entry: AttachmentPartition) {
   return {
     id: entry.id,
@@ -54,12 +73,18 @@ async function resolveEm() {
 
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   const em = await resolveEm()
   await ensureDefaultPartitions(em)
-  const rows = await em.find(AttachmentPartition, {}, { orderBy: { createdAt: 'asc' } })
+  const rows = await findWithDecryption(
+    em,
+    AttachmentPartition,
+    partitionVisibilityFilter(auth),
+    { orderBy: { createdAt: 'asc' } },
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
   return NextResponse.json({ items: rows.map((entry) => serializePartition(entry)) })
 }
 
@@ -71,7 +96,7 @@ export async function POST(req: Request) {
     )
   }
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   let json: unknown = null
@@ -90,7 +115,13 @@ export async function POST(req: Request) {
   }
   const em = await resolveEm()
   await ensureDefaultPartitions(em)
-  const exists = await em.findOne(AttachmentPartition, { code })
+  const exists = await findOneWithDecryption(
+    em,
+    AttachmentPartition,
+    { code },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
   if (exists) {
     return NextResponse.json({ error: 'Partition code already exists.' }, { status: 409 })
   }
@@ -106,6 +137,8 @@ export async function POST(req: Request) {
         ? parsed.data.requiresOcr
         : resolveDefaultAttachmentOcrEnabled(),
     ocrModel: parsed.data.ocrModel?.trim() || null,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
   })
   await em.persist(entry).flush()
   return NextResponse.json({ item: serializePartition(entry) }, { status: 201 })
@@ -119,7 +152,7 @@ export async function PUT(req: Request) {
     )
   }
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   let json: unknown = null
@@ -133,8 +166,14 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
   }
   const em = await resolveEm()
-  const entry = await em.findOne(AttachmentPartition, { id: parsed.data.id })
-  if (!entry) {
+  const entry = await findOneWithDecryption(
+    em,
+    AttachmentPartition,
+    { id: parsed.data.id },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
+  if (!entry || !canManagePartition(auth, entry)) {
     return NextResponse.json({ error: 'Partition not found' }, { status: 404 })
   }
   if (sanitizePartitionCode(parsed.data.code) !== entry.code) {
@@ -167,7 +206,7 @@ export async function DELETE(req: Request) {
     )
   }
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   const url = new URL(req.url)
@@ -177,14 +216,22 @@ export async function DELETE(req: Request) {
     return NextResponse.json({ error: 'Partition id is required' }, { status: 400 })
   }
   const em = await resolveEm()
-  const entry = await em.findOne(AttachmentPartition, { id: parsed.data.id })
-  if (!entry) {
+  const entry = await findOneWithDecryption(
+    em,
+    AttachmentPartition,
+    { id: parsed.data.id },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
+  if (!entry || !canManagePartition(auth, entry)) {
     return NextResponse.json({ error: 'Partition not found' }, { status: 404 })
   }
   if (DEFAULT_CODES.has(entry.code)) {
     return NextResponse.json({ error: 'Default partitions cannot be removed.' }, { status: 400 })
   }
-  const usage = await em.count(Attachment, { partitionCode: entry.code })
+  const usageFilter: Record<string, unknown> = { partitionCode: entry.code }
+  if (entry.tenantId) usageFilter.tenantId = entry.tenantId
+  const usage = await em.count(Attachment, usageFilter)
   if (usage > 0) {
     return NextResponse.json({ error: 'Partition is in use and cannot be removed.' }, { status: 409 })
   }

package/src/modules/attachments/data/entities.ts

@@ -34,6 +34,13 @@ export class AttachmentPartition {
   @Property({ name: 'ocr_model', type: 'text', nullable: true })
   ocrModel?: string | null
 
+  @Property({ name: 'organization_id', type: 'uuid', nullable: true })
+  organizationId?: string | null
+
+  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })
+  @Index({ name: 'attachment_partitions_tenant_idx' })
+  tenantId?: string | null
+
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 

package/src/modules/attachments/migrations/.snapshot-open-mercato.json

@@ -270,6 +270,24 @@
           "nullable": true,
           "mappedType": "text"
         },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "uuid"
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "uuid"
+        },
         "created_at": {
           "name": "created_at",
           "type": "timestamptz",
@@ -294,6 +312,16 @@
       "name": "attachment_partitions",
       "schema": "public",
       "indexes": [
+        {
+          "keyName": "attachment_partitions_tenant_idx",
+          "columnNames": [
+            "tenant_id"
+          ],
+          "composite": false,
+          "constraint": false,
+          "primary": false,
+          "unique": false
+        },
         {
           "keyName": "attachment_partitions_code_unique",
           "columnNames": [

package/src/modules/attachments/migrations/Migration20260524000000.ts

@@ -0,0 +1,25 @@
+import { Migration } from '@mikro-orm/migrations'
+
+export class Migration20260524000000 extends Migration {
+  override async up(): Promise<void> {
+    this.addSql(
+      `alter table "attachment_partitions" add column "organization_id" uuid null;`,
+    )
+    this.addSql(
+      `alter table "attachment_partitions" add column "tenant_id" uuid null;`,
+    )
+    this.addSql(
+      `create index "attachment_partitions_tenant_idx" on "attachment_partitions" ("tenant_id");`,
+    )
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "attachment_partitions_tenant_idx";`)
+    this.addSql(
+      `alter table "attachment_partitions" drop column "tenant_id";`,
+    )
+    this.addSql(
+      `alter table "attachment_partitions" drop column "organization_id";`,
+    )
+  }
+}

package/src/modules/auth/api/roles/route.ts

@@ -14,11 +14,8 @@ import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { roleCrudEvents, roleCrudIndexer } from '@open-mercato/core/modules/auth/commands/roles'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
-import {
-  assertActorCanAccessRoleTarget,
-  assertActorCanModifySuperAdminRoleTarget,
-} from '@open-mercato/core/modules/auth/lib/grantChecks'
-import { enforceTenantSelection } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import { assertActorCanModifySuperAdminRoleTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import { enforceRoleTenantAccess } from '@open-mercato/core/modules/auth/lib/roleTenantGuard'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 const querySchema = z.object({
@@ -88,18 +85,8 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
     create: {
       commandId: 'auth.roles.create',
       schema: rawBodySchema,
-      mapInput: async ({ parsed, ctx }) => {
-        // Preserve an explicit null so the create command rejects it (400 — global
-        // roles are unsupported); only resolve string/omitted tenantId against the actor.
-        if (parsed.tenantId === null) return parsed
-        const requestedTenantId = typeof parsed.tenantId === 'string' ? parsed.tenantId : undefined
-        const resolvedTenantId = await enforceTenantSelection(
-          { auth: ctx.auth, container: ctx.container },
-          requestedTenantId,
-        )
-        if (resolvedTenantId) parsed.tenantId = resolvedTenantId
-        return parsed
-      },
+      mapInput: async ({ parsed, ctx }) =>
+        enforceRoleTenantAccess('create', parsed, { auth: ctx.auth, container: ctx.container }),
       response: ({ result }) => ({ id: String(result.id) }),
       status: 201,
     },
@@ -109,9 +96,8 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
       mapInput: async ({ parsed, ctx }) => {
         if (ctx.request && typeof parsed.id === 'string' && parsed.id.length) {
           await assertCanModifySuperAdminRole(ctx.request, parsed.id)
-          await assertCanAccessRoleTarget(ctx.request, parsed.id)
         }
-        return parsed
+        return enforceRoleTenantAccess('update', parsed, { auth: ctx.auth, container: ctx.container })
       },
       response: () => ({ ok: true }),
     },
@@ -121,9 +107,8 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
         const targetId = resolveDeleteTargetId(parsed, raw)
         if (ctx.request && targetId) {
           await assertCanModifySuperAdminRole(ctx.request, targetId)
-          await assertCanAccessRoleTarget(ctx.request, targetId)
         }
-        return parsed
+        return enforceRoleTenantAccess('delete', parsed, { auth: ctx.auth, container: ctx.container })
       },
       response: () => ({ ok: true }),
     },
@@ -275,7 +260,6 @@ export const DELETE = async (req: Request) => {
   if (targetId) {
     try {
       await assertCanModifySuperAdminRole(req, targetId)
-      await assertCanAccessRoleTarget(req, targetId)
     } catch (err) {
       if (err instanceof CrudHttpError) {
         return NextResponse.json(err.body, { status: err.status })
@@ -301,21 +285,6 @@ async function assertCanModifySuperAdminRole(req: Request, targetRoleId: string)
   })
 }
 
-async function assertCanAccessRoleTarget(req: Request, targetRoleId: string) {
-  const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  await assertActorCanAccessRoleTarget({
-    em,
-    rbacService: container.resolve('rbacService') as RbacService,
-    actorUserId: auth.sub,
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
-    targetRoleId,
-  })
-}
-
 function resolveDeleteTargetId(parsed: unknown, raw: unknown): string | null {
   const fromParsed = readId(parsed as Record<string, unknown> | null | undefined)
   if (fromParsed) return fromParsed
@@ -343,7 +312,7 @@ export const openApi: OpenApiRouteDoc = {
     },
     POST: {
       summary: 'Create role',
-      description: 'Creates a new role for the current tenant or globally when `tenantId` is omitted.',
+      description: 'Creates a new role anchored to the caller\'s tenant. Non-superadmins cannot target another tenant; supplying a foreign `tenantId` is rejected.',
       requestBody: {
         contentType: 'application/json',
         schema: roleCreateSchema,

package/src/modules/auth/cli.ts

@@ -5,7 +5,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
-import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError } from './lib/setup-app'
+import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
 import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -401,7 +401,7 @@ const addOrganization: ModuleCli = {
   },
 }
 
-const SETUP_USAGE = 'Usage: mercato auth setup --orgName <name> --email <email> --password <password> [--orgSlug <slug>] [--roles superadmin,admin,employee] [--skip-password-policy] [--with-examples] [--json]'
+const SETUP_USAGE = 'Usage: mercato auth setup --orgName <name> --email <email> --password <password> [--orgSlug <slug>] [--roles superadmin,admin,employee] [--skip-password-policy] [--include-demo-users] [--with-examples] [--json]'
 
 const setupApp: ModuleCli = {
   command: 'setup',
@@ -440,6 +440,10 @@ const setupApp: ModuleCli = {
     const withExamples = typeof withExamplesRaw === 'boolean'
       ? withExamplesRaw
       : parseBooleanToken(typeof withExamplesRaw === 'string' ? withExamplesRaw : null) ?? false
+    const includeDemoUsersRaw = args['include-demo-users'] ?? args.includeDemoUsers
+    const includeDemoUsers = typeof includeDemoUsersRaw === 'boolean'
+      ? includeDemoUsersRaw
+      : parseBooleanToken(typeof includeDemoUsersRaw === 'string' ? includeDemoUsersRaw : null) ?? false
     const jsonModeRaw = args.json
     const jsonMode = typeof jsonModeRaw === 'boolean'
       ? jsonModeRaw
@@ -489,7 +493,14 @@ const setupApp: ModuleCli = {
         orgSlug,
         roleNames,
         primaryUser: { email, password, confirm: true },
-        includeDerivedUsers: true,
+        // Derived admin/employee demo accounts only land when the operator
+        // explicitly opts in via --include-demo-users. Default-deny prevents
+        // production deployments from silently seeding well-known emails.
+        includeDerivedUsers: includeDemoUsers,
+        // When demo users are explicitly requested, the operator has consented
+        // to having admin@/employee@ accounts created with autogenerated
+        // passwords (surfaced in stdout) when no env override is provided.
+        allowDemoDerivedPasswords: includeDemoUsers,
         // When the caller passes an explicit slug, treat it as a "fresh tenant"
         // signal — silent reuse of an existing user's tenant defeats the point
         // of slugging the new tenant for downstream tooling.
@@ -537,7 +548,12 @@ const setupApp: ModuleCli = {
       if (env.NODE_ENV !== 'test') {
         for (const snapshot of result.users) {
           if (snapshot.created) {
-            console.log('🎉 Created user', snapshot.user.email)
+            if (snapshot.generatedPassword) {
+              console.log('⚠️  GENERATED password — copy now; it is not stored in plain text')
+              console.log('🎉 Created user', snapshot.user.email, 'password:', snapshot.generatedPassword)
+            } else {
+              console.log('🎉 Created user', snapshot.user.email)
+            }
           } else {
             console.log(`Updated user ${snapshot.user.email}`)
           }
@@ -552,6 +568,13 @@ const setupApp: ModuleCli = {
         process.exitCode = 1
         return
       }
+      if (err instanceof DerivedUserPasswordRequiredError) {
+        process.stderr.write(
+          `Setup aborted: ${err.message}. In production, set OM_INIT_ADMIN_PASSWORD and OM_INIT_EMPLOYEE_PASSWORD before passing --include-demo-users, or omit --include-demo-users to skip derived demo accounts entirely.\n`,
+        )
+        process.exitCode = 2
+        return
+      }
       if (err instanceof Error && err.message === 'USER_EXISTS') {
         process.stderr.write('Setup aborted: user already exists with the provided email.\n')
         process.exitCode = 1