@cosmicdrift/kumiko-bundled-features 0.162.0 → 0.163.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.162.0",
+  "version": "0.163.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -117,11 +117,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.162.0",
-    "@cosmicdrift/kumiko-framework": "0.162.0",
-    "@cosmicdrift/kumiko-headless": "0.162.0",
-    "@cosmicdrift/kumiko-renderer": "0.162.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.162.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.163.0",
+    "@cosmicdrift/kumiko-framework": "0.163.0",
+    "@cosmicdrift/kumiko-headless": "0.163.0",
+    "@cosmicdrift/kumiko-renderer": "0.163.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.163.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -26,6 +26,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
@@ -44,11 +45,18 @@ import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+// kumiko-lint-ignore cross-feature-import regression-proof for #1463: seedTenant
+// must fire tier-engine's entity postSave hook on self-signup, not just on the
+// TenantHandlers.create HTTP path.
+import { tierAssignmentEntity } from "../../tier-engine/entity";
+import { createTierEngineFeature } from "../../tier-engine/feature";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 
+const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+
 const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
 
 // Activation mails now go through delivery (ctx.notify → channel-email). The
@@ -78,6 +86,12 @@ beforeAll(async () => {
       createAuthEmailPasswordFeature({
         signup: { tokenTtlMinutes: 60, appUrl: APP_ACTIVATION_URL },
       }),
+      // Regression-proof for #1463: seedTenant must fire the entity postSave
+      // hook on self-signup too, not just on the TenantHandlers.create path.
+      createTierEngineFeature({
+        defaultTier: "free",
+        tierMap: { free: { features: [], caps: {} } },
+      }),
     ],
     extraContext: (deps) => ({
       ...createDeliveryTestContext(deps),
@@ -102,6 +116,7 @@ beforeAll(async () => {
     configValuesTable,
     tenantMembershipsTable,
     notificationPreferencesTable,
+    tierAssignmentTable,
   });
 });
 
@@ -112,6 +127,7 @@ afterAll(async () => {
 beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tierAssignmentTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
   emailTransport.sent.length = 0;
   // Redis-cleanup damit Resend-Tests keine state-leaks haben.
@@ -220,6 +236,15 @@ describe("POST /api/auth/signup-confirm", () => {
       expect(JSON.parse(rolesRaw) as string[]).toContain("Admin");
     }
 
+    // #1463 regression: seedTenant fires the tenant entity's postSave
+    // hooks — tier-engine's auto-default-tier hook must run on self-signup
+    // exactly like it does on the regular TenantHandlers.create HTTP path.
+    const tierRows = await selectMany(stack.db, tierAssignmentTable, {
+      tenantId: body.user?.tenantId ?? "",
+    });
+    expect(tierRows).toHaveLength(1);
+    expect(tierRows[0]?.["tier"]).toBe("free");
+
     // Authority-Beweis: Login mit dem gesetzten Password funktioniert.
     const loginRes = await postLogin(email, password);
     expect(loginRes.status).toBe(200);

package/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -109,16 +109,23 @@ export function createSignupConfirmHandler() {
 
         let provisioned: { readonly userId: string; readonly tenantId: TenantId };
         try {
-          provisioned = await provisionSignupAccount(dbConn, {
-            email,
-            password: event.payload.password,
-            displayName,
-            tenantId,
-            tenantKey,
-            // Tenant-Display-Name als Default = Email. User wechselt das im
-            // Settings-Screen. Konzept "Tenant" leakt nicht in die Signup-UI.
-            tenantName: email,
-          });
+          provisioned = await provisionSignupAccount(
+            dbConn,
+            {
+              email,
+              password: event.payload.password,
+              displayName,
+              tenantId,
+              tenantKey,
+              // Tenant-Display-Name als Default = Email. User wechselt das im
+              // Settings-Screen. Konzept "Tenant" leakt nicht in die Signup-UI.
+              tenantName: email,
+            },
+            // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
+            // tier, an app's auto-default-compliance) must fire on self-signup
+            // exactly like they do on the regular TenantHandlers.create path.
+            { registry: ctx.registry, context: ctx },
+          );
         } catch (err) {
           // Email hat bereits ein Konto — provisionSignupAccount ist create-only
           // (#365): sauberer User-Fehler, KEINE Session für den fremden Account.

package/src/auth-email-password/seeding.ts

@@ -19,7 +19,7 @@ import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { hashPassword } from "../shared";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
-import { seedTenant, seedTenantMembership } from "../tenant/seeding";
+import { type SeedTenantHooks, seedTenant, seedTenantMembership } from "../tenant/seeding";
 // kumiko-lint-ignore cross-feature-import signup create-only guard reads the user projection by email
 import { userTable } from "../user/schema/user";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
@@ -115,6 +115,12 @@ export type ProvisionSignupAccountOptions = {
 export async function provisionSignupAccount(
   db: DbConnection,
   options: ProvisionSignupAccountOptions,
+  // Optional, append-only — existing callers (tests, seed scripts) that
+  // don't pass hooks keep today's behavior. The real signup-confirm
+  // handler DOES pass it (#1463) so seedTenant's postSave hooks
+  // (tier-engine's auto-default-tier, app auto-default-compliance) fire
+  // on self-signup, same as they do on the regular tenant-create path.
+  hooks?: SeedTenantHooks,
 ): Promise<{ readonly userId: string; readonly tenantId: TenantId }> {
   // Create-only-Guard VOR seedTenant: bei bereits registrierter Email hart
   // abbrechen, sonst entstünde ein verwaister Tenant und seedUser (idempotent
@@ -124,11 +130,15 @@ export async function provisionSignupAccount(
   if (existingUser) {
     throw new ConflictError({ message: "signup: email already registered" });
   }
-  await seedTenant(db, {
-    id: options.tenantId,
-    key: options.tenantKey,
-    name: options.tenantName,
-  });
+  await seedTenant(
+    db,
+    {
+      id: options.tenantId,
+      key: options.tenantKey,
+      name: options.tenantName,
+    },
+    hooks,
+  );
   const { id: userId } = await seedUserWithPassword(db, {
     email: options.email,
     password: options.password,

package/src/feature-toggles/__tests__/compose-tier-resolver.test.ts

@@ -1,16 +1,25 @@
 // Unit test (no DB) — the composition logic is pure given a tier resolver
 // function + a GlobalFeatureToggleRuntime whose in-memory snapshot is set
 // directly via .apply(). Pins the semantics documented in
-// compose-tier-resolver.ts: the global layer only NARROWS what the tier
-// grants (explicit `false` removes it), it never falls back to a
-// toggleable feature's own default and never widens beyond the tier.
+// compose-tier-resolver.ts:
+//   - tier-managed toggleables (in SOME tier's `features` list, per the
+//     tierResolver(SYSTEM_TENANT_ID) union convention): the global layer
+//     only NARROWS what the tier grants — an explicit `false` removes it,
+//     no row / `true` leaves the tier's grant untouched, it can never widen
+//     beyond what the tenant's own tier includes.
+//   - tier-unaware toggleables (in NO tier's `features` list at all, e.g. a
+//     pure operator kill-switch like auth-self-registration): membership
+//     comes entirely from computeEffectiveFeatures' normal cascade
+//     (override ?? toggleableDefault) since no tier ever votes on them.
 
 import { describe, expect, test } from "bun:test";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type {
-  EffectiveFeaturesResolver,
-  Registry,
-  TenantId,
+import {
+  createRegistry,
+  defineFeature,
+  type EffectiveFeaturesResolver,
+  SYSTEM_TENANT_ID,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { composeTierResolverWithGlobalToggles } from "../compose-tier-resolver";
 import { GlobalFeatureToggleRuntime } from "../toggle-runtime";
@@ -18,7 +27,18 @@ import { GlobalFeatureToggleRuntime } from "../toggle-runtime";
 // Never touched by .apply()/.readOverride() — the runtime only does I/O in
 // .initialize()/.refresh(), which this test never calls.
 const fakeDb = {} as unknown as DbConnection;
-const fakeRegistry = {} as unknown as Registry;
+
+// Mirrors publicstatus's real mix: "personal-access-tokens" is Team-tier-
+// gated (toggleable, default false), "auth-self-registration" is a global
+// kill-switch no tier ever lists (toggleable, default true).
+const testRegistry = createRegistry([
+  defineFeature("personal-access-tokens", (r) => {
+    r.toggleable({ default: false });
+  }),
+  defineFeature("auth-self-registration", (r) => {
+    r.toggleable({ default: true });
+  }),
+]);
 
 function tierResolverGranting(...features: readonly string[]): EffectiveFeaturesResolver {
   return ((_tenantId: TenantId) => new Set(features)) as EffectiveFeaturesResolver;
@@ -26,11 +46,14 @@ function tierResolverGranting(...features: readonly string[]): EffectiveFeatures
 
 describe("composeTierResolverWithGlobalToggles", () => {
   test("no override → tier's grant stands", () => {
-    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
     const composed = composeTierResolverWithGlobalToggles(
-      tierResolverGranting("auth-self-registration", "personal-access-tokens"),
+      tierResolverGranting("personal-access-tokens"),
       runtime,
+      testRegistry,
     );
+    // auth-self-registration joins via the tier-unaware cascade (default
+    // true, no override) — see the dedicated tier-unaware tests below.
     expect([...composed("t1" as TenantId)].sort()).toEqual([
       "auth-self-registration",
       "personal-access-tokens",
@@ -38,22 +61,30 @@ describe("composeTierResolverWithGlobalToggles", () => {
   });
 
   test("explicit override=false removes a tier-granted feature", () => {
-    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
-    runtime.apply("auth-self-registration", false);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    runtime.apply("personal-access-tokens", false);
     const composed = composeTierResolverWithGlobalToggles(
-      tierResolverGranting("auth-self-registration", "personal-access-tokens"),
+      tierResolverGranting("personal-access-tokens"),
       runtime,
+      testRegistry,
     );
-    expect([...composed("t1" as TenantId)]).toEqual(["personal-access-tokens"]);
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
   });
 
-  test("explicit override=true is a no-op — cannot widen beyond the tier's grant", () => {
-    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
-    runtime.apply("some-other-feature", true);
-    const composed = composeTierResolverWithGlobalToggles(
-      tierResolverGranting("auth-self-registration"),
-      runtime,
-    );
+  test("explicit override=true cannot widen a tier-managed feature beyond the tenant's own tier", () => {
+    // "personal-access-tokens" IS tier-managed (it's in SOME tier's list,
+    // per the SYSTEM_TENANT_ID union), but THIS tenant's own tier grants
+    // nothing (e.g. Free). An operator flipping the global row to true
+    // must not leak it in — that decision belongs to the tier, not the
+    // toggle.
+    const tierResolver = ((tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID
+        ? new Set(["personal-access-tokens"]) // union of all tiers' features
+        : new Set<string>()) as EffectiveFeaturesResolver; // this tenant's (Free) tier grants nothing
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    runtime.apply("personal-access-tokens", true);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, testRegistry);
+    // auth-self-registration still joins via the tier-unaware cascade.
     expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
   });
 
@@ -63,20 +94,46 @@ describe("composeTierResolverWithGlobalToggles", () => {
     // granted when the tier includes it and no operator has touched it —
     // computeEffectiveFeatures' cascade would otherwise fall back to
     // `false` the moment feature-toggles is composed in.
-    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
     const composed = composeTierResolverWithGlobalToggles(
       tierResolverGranting("personal-access-tokens"),
       runtime,
+      testRegistry,
     );
-    expect([...composed("t1" as TenantId)]).toEqual(["personal-access-tokens"]);
+    expect([...composed("t1" as TenantId)].sort()).toEqual([
+      "auth-self-registration",
+      "personal-access-tokens",
+    ]);
+  });
+
+  test("tier-unaware toggleable (in no tier's feature list) defaults on via the global cascade", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting(), // no tier grants anything
+      runtime,
+      testRegistry,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
+  });
+
+  test("tier-unaware toggleable — explicit override=false turns it off for every tenant", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    runtime.apply("auth-self-registration", false);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting(),
+      runtime,
+      testRegistry,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual([]);
   });
 
-  test("flip back on restores the tier's grant", () => {
-    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+  test("flip back on restores a tier-unaware feature's default", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
     runtime.apply("auth-self-registration", false);
     const composed = composeTierResolverWithGlobalToggles(
-      tierResolverGranting("auth-self-registration"),
+      tierResolverGranting(),
       runtime,
+      testRegistry,
     );
     expect([...composed("t1" as TenantId)]).toEqual([]);
 
@@ -85,12 +142,12 @@ describe("composeTierResolverWithGlobalToggles", () => {
   });
 
   test("preserves the tier resolver's trialGate", async () => {
-    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
     const tierResolver = tierResolverGranting();
     const trialGate = async (_tenantId: TenantId, _featureName: string) => true;
     Object.assign(tierResolver, { trialGate });
 
-    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, testRegistry);
     expect(composed.trialGate).toBe(trialGate);
   });
 });

package/src/feature-toggles/compose-tier-resolver.ts

@@ -1,4 +1,9 @@
-import type { EffectiveFeaturesResolver } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  computeEffectiveFeatures,
+  type EffectiveFeaturesResolver,
+  type Registry,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import type { GlobalFeatureToggleRuntime } from "./toggle-runtime";
 
 // Composes a tenantTierResolver (tier-engine) with a GlobalFeatureToggleRuntime
@@ -12,25 +17,44 @@ import type { GlobalFeatureToggleRuntime } from "./toggle-runtime";
 // combine them itself. This is that combination, factored out here instead
 // of duplicated per app.
 //
-// Semantics: the global toggle layer can only NARROW what the tier grants,
-// never widen it — an explicit `enabled: false` row removes a feature the
-// tier would otherwise include; no row, or an explicit `true` row, leaves
-// the tier's grant untouched. Deliberately NOT computeEffectiveFeatures'
-// cascade (which falls back to a toggleable feature's declared default):
-// under tier-engine, a toggleable feature with no override row is governed
-// by the TIER, not by its own default — falling back to the default would
-// silently kill every tier-gated toggleable feature (e.g. a Team-tier
-// feature defaulting `false`) the moment feature-toggles gets composed in.
+// Two disjoint classes of toggleable feature exist once both are mounted:
+//   - tier-managed (e.g. a Team-tier perk like personal-access-tokens): the
+//     TIER decides membership, not the feature's own default — a toggleable
+//     feature with no override row must stay governed by its tier, or every
+//     tier-gated toggleable would silently leak/vanish the moment
+//     feature-toggles is composed in. The global layer may only NARROW this
+//     (`enabled: false` removes it; no row / `true` leaves the tier's grant
+//     untouched).
+//   - tier-unaware (e.g. a pure operator kill-switch with no tier
+//     differentiation at all, such as auth-self-registration): no tier's
+//     `features` list ever mentions it, so it would never appear in ANY
+//     tenant's tier-set — narrowing alone can only remove features, never
+//     grant this one. Its membership must come from computeEffectiveFeatures'
+//     normal cascade (override ?? toggleableDefault) instead.
+//
+// `tierResolver(SYSTEM_TENANT_ID)` is tier-engine's documented convention for
+// "union of every tier's features" (operator-tooling/async-dispatch
+// convention) — used here purely to classify which toggleable names are
+// tier-managed, without needing the app's TierMap as a separate parameter.
 export function composeTierResolverWithGlobalToggles(
   tierResolver: EffectiveFeaturesResolver,
   toggleRuntime: GlobalFeatureToggleRuntime,
+  registry: Registry,
 ): EffectiveFeaturesResolver {
+  const tierManaged = tierResolver(SYSTEM_TENANT_ID);
+
   const composed = ((tenantId) => {
     const tierSet = tierResolver(tenantId);
     const result = new Set<string>();
     for (const name of tierSet) {
       if (toggleRuntime.readOverride(name) !== false) result.add(name);
     }
+    const globalCascade = computeEffectiveFeatures(registry, (name) =>
+      toggleRuntime.readOverride(name),
+    );
+    for (const name of globalCascade) {
+      if (!tierManaged.has(name)) result.add(name);
+    }
     return result;
   }) as EffectiveFeaturesResolver;
 

package/src/feature-toggles/feature.ts

@@ -1,6 +1,7 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { FEATURE_TOGGLE_SET_EVENT_NAME, TOGGLE_ADMIN_SCREEN_ID } from "./constants";
 import { featureToggleSetSchema } from "./events";
+import { globalFeatureStateTableMeta } from "./global-feature-state-table";
 import { listQuery } from "./handlers/list.query";
 import { registeredQuery } from "./handlers/registered.query";
 import { createSetWriteHandler } from "./handlers/set.write";
@@ -47,6 +48,9 @@ export function createFeatureTogglesFeature(
       recommended: false,
     });
     r.systemScope();
+    r.storeTable(globalFeatureStateTableMeta, {
+      reason: "feature_toggles.global_override_snapshot",
+    });
 
     // Toggle-change domain event. The event ends up in the events-table
     // alongside every other write — audit.list picks it up automatically,
@@ -127,7 +131,7 @@ export function createFeatureTogglesFeature(
 }
 
 export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./constants";
-export { globalFeatureStateTable } from "./global-feature-state-table";
+export { globalFeatureStateTable, globalFeatureStateTableMeta } from "./global-feature-state-table";
 // Re-export the runtime factory + class so app-boot code has a single
 // import path: "@cosmicdrift/kumiko-bundled-features/feature-toggles".
 export {

package/src/feature-toggles/global-feature-state-table.ts

@@ -1,5 +1,7 @@
 import {
   boolean,
+  defineUnmanagedTable,
+  type EntityTableMeta,
   instant,
   integer,
   table as pgTable,
@@ -26,3 +28,17 @@ export const globalFeatureStateTable = pgTable("store_global_feature_state", {
   // UserId (text — SessionUser.id is a uuid string post-ES).
   updatedBy: text("updated_by"),
 });
+
+// r.storeTable meta — without this, collectTableMetas(FEATURES) never
+// sees the table, so `kumiko schema generate` reports no changes and no
+// app ever gets a migration for it (framework gap, not app-local).
+export const globalFeatureStateTableMeta: EntityTableMeta = defineUnmanagedTable({
+  tableName: "store_global_feature_state",
+  columns: [
+    { name: "feature_name", pgType: "text", notNull: true, primaryKey: true },
+    { name: "enabled", pgType: "boolean", notNull: true },
+    { name: "version", pgType: "integer", notNull: true, defaultSql: "1" },
+    { name: "updated_at", pgType: "timestamptz", notNull: true, defaultSql: "now()" },
+    { name: "updated_by", pgType: "text", notNull: false },
+  ],
+});

package/src/feature-toggles/index.ts

@@ -13,4 +13,5 @@ export {
   type FeatureTogglesOptions,
   GlobalFeatureToggleRuntime,
   globalFeatureStateTable,
+  globalFeatureStateTableMeta,
 } from "./feature";

package/src/tenant/seeding.ts

@@ -34,8 +34,15 @@ import {
   createTenantDb,
   type DbRunner,
 } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  type AppContext,
+  HookPhases,
+  type Registry,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { createLifecycleHooks } from "@cosmicdrift/kumiko-framework/pipeline";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { assertAssignableMembershipRoles } from "./membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
@@ -74,6 +81,19 @@ export type SeedTenantOptions = {
   readonly by?: SessionUser;
 };
 
+// seedTenant runs through the raw event-store executor, which fires no
+// postSave hooks (#1463) — feature-registered entity hooks on "tenant"
+// (e.g. tier-engine's auto-default-tier, an app's auto-default-compliance)
+// silently never run for tenants created this way. Pass `hooks` to fire
+// them explicitly, same lookup as the dispatcher (registry.getEntityPostSaveHooks
+// by result.entityName), just without the full dispatch roundtrip. Omit it
+// to keep today's hook-less behavior (existing fixture call-sites that don't
+// care about hooks need no changes).
+export type SeedTenantHooks = {
+  readonly registry: Registry;
+  readonly context: AppContext;
+};
+
 /**
  * Seed a tenant through the event-store executor. Idempotent add-only:
  * a second call for the same `id` is a no-op (no update path). Same
@@ -83,6 +103,7 @@ export type SeedTenantOptions = {
 export async function seedTenant(
   db: DbRunner,
   options: SeedTenantOptions,
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: TenantId }> {
   const by = options.by ?? TestUsers.systemAdmin;
   // executor.create erwartet eine TenantDb (mit .insert()-API), nicht
@@ -112,6 +133,24 @@ export async function seedTenant(
       `seedTenant failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
+
+  if (hooks) {
+    // Fresh instance per call, no systemHooks — only feature-registered
+    // entity/handler hooks fire (search-index/SSE system hooks are wired
+    // at server-boot and out of reach here, same as before this fix).
+    // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
+    // (keyed by result.entityName === "tenant") — that's exactly what
+    // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
+    const lifecycle = createLifecycleHooks(hooks.registry);
+    await lifecycle.runPostSave(
+      "tenant:seed",
+      result.data,
+      hooks.context,
+      HookPhases.inTransaction,
+    );
+    await lifecycle.runPostSave("tenant:seed", result.data, hooks.context, HookPhases.afterCommit);
+  }
+
   return { id: options.id };
 }