@cosmicdrift/kumiko-bundled-features 0.145.1 → 0.146.1

package/src/custom-fields/wire-user-data-rights.ts

@@ -1,18 +1,9 @@
 // T1.5c — user-data-rights wiring for custom-fields.
 
 import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  EXT_USER_DATA,
-  EXT_USER_DATA_ORDER,
-  type FeatureRegistrar,
-} from "@cosmicdrift/kumiko-framework/engine";
-import {
-  selectCustomFieldsHostRows,
-  selectFieldDefinitionsForEntity,
-  stripSensitiveCustomFieldKeys,
-} from "./db/queries/user-data-rights";
-import { isFieldDefinitionRow, parseSerializedField } from "./lib/parse-serialized-field";
+import type { UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { EXT_USER_DATA, type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import { selectCustomFieldsHostRows } from "./db/queries/user-data-rights";
 
 export interface WireCustomFieldsUserDataRightsOptions {
   readonly entityName: string;
@@ -36,14 +27,8 @@ function asCustomFieldsHostRow(value: unknown): CustomFieldsHostRow | null {
   return { id: value.id, customFields: Object.fromEntries(Object.entries(cf)) };
 }
 
-// The anonymize strip filters rows by `WHERE userIdColumn = userId`. A host
-// anonymize hook on the SAME entity that nulls that column (e.g. inserted_by_id
-// = NULL) would, if it ran first, leave the strip matching 0 rows → sensitive
-// jsonb PII silently retained (DSGVO Art. 17 violation). A negative order makes
-// runForgetCleanup run this strip before any default-order (0) owner-nulling
-// hook, independent of feature registration order.
-const ORDER_REDACT_BEFORE_OWNER_MUTATION = EXT_USER_DATA_ORDER.REDACT_BEFORE_OWNER;
-
+// Export-only wiring: custom fields hold supplemental business data, not PII
+// (#972) — there is nothing to redact on user-forget, only Art. 20 export.
 export function wireCustomFieldsUserDataRightsFor<TReg extends FeatureRegistrar<string>>(
   r: TReg,
   opts: WireCustomFieldsUserDataRightsOptions,
@@ -71,42 +56,8 @@ export function wireCustomFieldsUserDataRightsFor<TReg extends FeatureRegistrar<
     return { entity: `${opts.entityName}.customFields`, rows: snippetRows };
   };
 
-  const deleteHook: UserDataDeleteHook = async (ctx, strategy) => {
-    // skip: delete strategy removes rows wholesale — custom-field redaction N/A.
-    if (strategy === "delete") return;
-    const sensitiveKeys = await loadSensitiveFieldKeys(ctx.db, ctx.tenantId, opts.entityName);
-    // skip: no sensitive custom fields configured for this entity.
-    if (sensitiveKeys.length === 0) return;
-
-    await stripSensitiveCustomFieldKeys(
-      ctx.db,
-      tableName,
-      opts.userIdColumn,
-      sensitiveKeys,
-      ctx.userId,
-      ctx.tenantId,
-    );
-  };
-
   // biome-ignore lint/correctness/useHookAtTopLevel: r.useExtension is a registrar API, not a React hook.
   r.useExtension(EXT_USER_DATA, opts.entityName, {
     export: exportHook,
-    delete: deleteHook,
-    order: ORDER_REDACT_BEFORE_OWNER_MUTATION,
   });
 }
-
-async function loadSensitiveFieldKeys(
-  db: Parameters<UserDataExportHook>[0]["db"],
-  tenantId: string,
-  entityName: string,
-): Promise<string[]> {
-  const rows = await selectFieldDefinitionsForEntity(db, entityName, tenantId);
-  const keys: string[] = [];
-  for (const raw of rows) {
-    if (!isFieldDefinitionRow(raw)) continue;
-    const parsed = parseSerializedField(raw.serialized_field);
-    if (parsed?.sensitive === true) keys.push(raw.field_key);
-  }
-  return keys;
-}

package/src/inbound-mail-foundation/__tests__/retention.integration.test.ts

@@ -0,0 +1,199 @@
+// Integration-test für inbound-mail data-retention (#957). Treibt echte
+// ingests durch den Dispatcher + DB (setupTestStack), dann runInboundMailRetention
+// mit injiziertem `now`. Verifiziert die Plan-Pflicht-Szenarien:
+//   - Message älter als Frist → Row weg, Stream archiviert, jüngere bleibt
+//   - Rebuild resurrectet die gepurgte Row NICHT (archiveStream-Rationale)
+//   - Seen-Anchor-Cleanup: past-cutoff weg, in-window bleibt (Dedup intakt)
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import { inboundMessageAggregateId } from "../aggregate-id";
+import { InboundMailFoundationHandlers } from "../constants";
+import { seenMessageEntity, seenMessageTable, syncCursorEntity } from "../entities";
+import { inboundMailFoundationFeature } from "../feature";
+import { inboundMessagesProjectionTable } from "../projection";
+import { runInboundMailRetention } from "../retention-sweep";
+
+let stack: TestStack;
+let db: DbConnection;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      inboundMailFoundationFeature,
+      inboundProviderInMemoryFeature,
+    ],
+  });
+  db = stack.db;
+  await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await unsafeCreateEntityTable(db, syncCursorEntity);
+  await unsafeCreateEntityTable(db, seenMessageEntity);
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  resetPiiSubjectKmsForTests();
+});
+
+function adminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin", "SystemAdmin"],
+  });
+}
+
+async function connectSharedAccount(admin: ReturnType<typeof adminFor>): Promise<string> {
+  const result = (await stack.http.writeOk(
+    InboundMailFoundationHandlers.connectAccount,
+    {
+      provider: "inmemory",
+      authMethod: "password",
+      displayName: "Team-Inbox",
+      address: "inbox@tenant.example",
+      scope: "shared",
+    },
+    admin,
+  )) as { accountId: string };
+  return result.accountId;
+}
+
+async function ingest(
+  accountId: string,
+  admin: ReturnType<typeof adminFor>,
+  providerMessageId: string,
+  receivedAtIso: string,
+): Promise<void> {
+  await stack.http.writeOk(
+    InboundMailFoundationHandlers.ingestMessage,
+    {
+      accountId,
+      ownerUserId: null,
+      providerName: "inmemory",
+      providerMessageId,
+      messageIdHeader: `${providerMessageId}@example.com`,
+      providerThreadId: null,
+      references: [],
+      from: "sender@example.com",
+      to: ["inbox@tenant.example"],
+      cc: [],
+      subject: "Hello",
+      snippet: "Hello world …",
+      receivedAtIso,
+      bodyRef: "",
+      scope: "inbox",
+      providerCursor: '{"offset":1}',
+    },
+    admin,
+  );
+}
+
+describe("retention: inbound messages", () => {
+  test("expired message purged + stream archived; younger stays; rebuild does not resurrect", async () => {
+    const admin = adminFor(5001);
+    const accountId = await connectSharedAccount(admin);
+    await ingest(accountId, admin, "uid-old", "2024-01-01T10:00:00Z");
+    await ingest(accountId, admin, "uid-young", "2026-07-01T10:00:00Z");
+
+    const oldId = inboundMessageAggregateId(accountId, "uid-old");
+    const youngId = inboundMessageAggregateId(accountId, "uid-young");
+    expect(await selectMany(db, inboundMessagesProjectionTable, { accountId })).toHaveLength(2);
+
+    // now=2026-07-13, default 365d → cutoff 2025-07-13: old(2024) expired, young(2026-07) stays.
+    // seen weit hochgesetzt, damit dieser Fall nur die Messages misst.
+    const now = getTemporal().Instant.from("2026-07-13T00:00:00Z");
+    const report = await runInboundMailRetention({
+      db,
+      tenantId: admin.tenantId,
+      now,
+      seenRetentionDays: 100000,
+    });
+    expect(report.messagesPurged).toBe(1);
+    expect(report.seenPurged).toBe(0);
+
+    const rows = await selectMany(db, inboundMessagesProjectionTable, { accountId });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["id"]).toBe(youngId);
+
+    // Archivierter Stream → loadAggregate leer; junger Stream intakt.
+    expect(await loadAggregate(db, oldId, admin.tenantId)).toHaveLength(0);
+    expect((await loadAggregate(db, youngId, admin.tenantId)).length).toBeGreaterThanOrEqual(1);
+
+    // Rebuild replayt received NICHT für den archivierten Stream → keine Resurrection.
+    await rebuildProjection("inbound-mail-foundation:projection:inbound-message", {
+      db,
+      registry: stack.registry,
+    });
+    const afterRebuild = await selectMany(db, inboundMessagesProjectionTable, { accountId });
+    expect(afterRebuild).toHaveLength(1);
+    expect(afterRebuild[0]?.["id"]).toBe(youngId);
+  });
+});
+
+describe("retention: seen anchors", () => {
+  test("past-cutoff anchor purged, in-window anchor stays (dedup window intact)", async () => {
+    const admin = adminFor(5002);
+    const accountId = await connectSharedAccount(admin);
+    await ingest(accountId, admin, "uid-seen", "2026-07-01T10:00:00Z");
+
+    const seenRows = await selectMany(db, seenMessageTable, { tenantId: admin.tenantId });
+    expect(seenRows.length).toBeGreaterThanOrEqual(1);
+    const seenAt = getTemporal().Instant.from(String(seenRows[0]?.["seenAt"]));
+
+    // now = seenAt + 1 Tag → cutoff (now-90d) liegt vor seenAt → nichts fällig.
+    const nowInWindow = seenAt.add({ hours: 24 });
+    const inWindow = await runInboundMailRetention({
+      db,
+      tenantId: admin.tenantId,
+      now: nowInWindow,
+      seenRetentionDays: 90,
+      messageRetentionDays: 100000,
+    });
+    expect(inWindow.seenPurged).toBe(0);
+    expect(await selectMany(db, seenMessageTable, { tenantId: admin.tenantId })).toHaveLength(
+      seenRows.length,
+    );
+
+    // now = seenAt + 91 Tage → cutoff (now-90d) liegt nach seenAt → fällig.
+    const nowExpired = seenAt.add({ hours: 91 * 24 });
+    const expired = await runInboundMailRetention({
+      db,
+      tenantId: admin.tenantId,
+      now: nowExpired,
+      seenRetentionDays: 90,
+      messageRetentionDays: 100000,
+    });
+    expect(expired.seenPurged).toBeGreaterThanOrEqual(1);
+    expect(await selectMany(db, seenMessageTable, { tenantId: admin.tenantId })).toHaveLength(0);
+  });
+});

package/src/inbound-mail-foundation/feature.ts

@@ -41,7 +41,12 @@
 // (crypto-shredding, Muster billing-foundation #800). Der Destroy-Hook
 // archiviert zusätzlich alle Streams + löscht die Rows.
 
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createFileProviderForTenant,
+  type FileStorageProvider,
+} from "@cosmicdrift/kumiko-framework/files";
 import { INBOUND_MAIL_FOUNDATION_FEATURE, INBOUND_MAIL_PROVIDER_EXTENSION } from "./constants";
 import {
   inboundMessageEntity,
@@ -84,6 +89,7 @@ import {
   mailAccountsProjectionTable,
   mailThreadsProjectionTable,
 } from "./projection";
+import { runInboundMailRetention } from "./retention-sweep";
 import {
   inboundMessageTenantDestroyHook,
   mailAccountTenantDestroyHook,
@@ -182,4 +188,56 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
   r.useExtension(EXT_TENANT_DATA, "mail-thread", {
     destroy: mailThreadTenantDestroyHook,
   });
+
+  // Data-Retention (#957) — perTenant-Fan-out (ein Run pro Tenant, wie
+  // data-retention:retention-cleanup): die job-DB ist NICHT tenant-scoped,
+  // der Sweep scoped jeden Delete explizit per tenantId. Ohne diesen Cron
+  // wachsen read_inbound_messages + die Bodies unbegrenzt (DSGVO Art. 5).
+  r.job(
+    "inbound-mail-retention",
+    { trigger: { cron: "0 3 * * *" }, perTenant: true, concurrency: "skip" },
+    async (_payload, ctx) => {
+      if (!ctx.db || !ctx.registry) {
+        throw new Error(
+          "inbound-mail-retention: ctx.db + ctx.registry required (JobContext incomplete)",
+        );
+      }
+      const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+      if (tenantId === undefined) {
+        // skip: cron fired without a perTenant fan-out tenant — nothing scoped
+        return;
+      }
+      const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
+      const retentionDb = ctx.db as DbConnection; // @cast-boundary db-operator
+
+      // Body-Objekte liegen in file-foundation. Provider lazy + memoized —
+      // heute schreibt der Ingest kein bodyRef (storeBody-Hook ungebunden),
+      // der Provider wird also nie gebaut. Sobald storeBody wired ist, raeumt
+      // die Retention die Bodies mit ab.
+      let providerPromise: Promise<FileStorageProvider> | null = null;
+      const deleteBodyObject = async (bodyRef: string): Promise<void> => {
+        if (!providerPromise) {
+          providerPromise = createFileProviderForTenant(
+            { config: ctx.config, registry: ctx.registry },
+            tenantId,
+          );
+        }
+        const provider = await providerPromise;
+        await provider.delete(bodyRef);
+      };
+
+      const report = await runInboundMailRetention({
+        db: retentionDb,
+        tenantId,
+        now: T.Now.instant(),
+        deleteBodyObject,
+      });
+      if (report.bodyObjectErrors > 0) {
+        // biome-ignore lint/suspicious/noConsole: operator-visibility for failed body deletes
+        console.warn(
+          `[inbound-mail-foundation:inbound-mail-retention] tenant=${tenantId} bodyObjectErrors=${report.bodyObjectErrors}`,
+        );
+      }
+    },
+  );
 });

package/src/inbound-mail-foundation/retention-sweep.ts

@@ -0,0 +1,155 @@
+// Inbound-mail data-retention (#957). DSGVO Art. 5 (Datenminimierung):
+// ohne Retention wachsen read_inbound_messages + die File-Storage-Bodies
+// unbegrenzt. Zwei Targets, zwei Mechanismen — der Unterschied ist
+// event-sourced vs. unmanaged:
+//
+//   read_inbound_messages (event-sourced, EXPLIZITE r.projection):
+//     pro Row aelter als messageRetentionDays → archiveStream + Row-Delete
+//     (+ bodyRef-Objekt loeschen). archiveStream statt executor.forget, weil
+//     die Projection nur das received-Domain-Event mappt, nicht den
+//     forgotten-Auto-Verb (den registriert nur ImplicitProjection). Ein
+//     forget-Event wuerde beim Rebuild ignoriert und die Row aus dem
+//     received-Event resurrecten (#648-Klasse). Der archivierte Stream macht
+//     loadAggregate leer → received wird gar nicht erst repliziert. Gleiches
+//     Muster wie tenant-destroy-hook, nur per-Row-cutoff statt ganzer Tenant.
+//
+//   read_mail_seen_messages (unmanaged, direct-write, nicht event-sourced):
+//     Dedup-Anker braucht nur das Backfill-/Replay-Fenster → seenAt-cutoff
+//     via plain deleteMany, kein Stream/Archiv. Gescoped auf die accountIds
+//     dieses Tenants (die Tabelle traegt keine tenantId-Spalte).
+//
+// GRENZE (#957 Teil 2, Plan §3.4): die PII in den Message-Events bleibt
+// unter dem TENANT-Subject-Key entschluesselbar — per-Row-Retention
+// shreddet keinen Key. Echte Art.-17-Erasure der Event-Payloads passiert
+// erst bei tenant-destroy (Key-Erase). Read-Row + Body-File sind nach dem
+// Sweep weg; das Event-Log ist append-only by design.
+
+import {
+  type DbRunner,
+  deleteMany,
+  type EntityTableMeta,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
+import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { seenMessageTable } from "./entities";
+import { INBOUND_MESSAGE_AGGREGATE_TYPE } from "./events";
+import { inboundMessagesProjectionTable } from "./projection";
+
+// Temporal.Instant ohne den Caller zwingen es aus globalThis zu ziehen
+// (Muster data-retention/keep-for.ts).
+type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
+
+export const MESSAGE_RETENTION_DAYS = 365;
+export const SEEN_RETENTION_DAYS = 90;
+const BATCH_LIMIT = 1000;
+const ARCHIVED_BY = "inbound-mail:retention";
+const REASON = "retention_expired";
+
+export interface InboundRetentionArgs {
+  readonly db: DbRunner;
+  readonly tenantId: TenantId;
+  /** Now-Injection — Tests pinnen den Wert ohne Date-Mock (Pattern keep-for.ts). */
+  readonly now: Instant;
+  readonly messageRetentionDays?: number;
+  readonly seenRetentionDays?: number;
+  /** Loescht ein file-storage-Body-Objekt per bodyRef-key. Vom Job lazy
+   *  verdrahtet (createFileProviderForTenant). Fehlt = kein Body-Delete. */
+  readonly deleteBodyObject?: (bodyRef: string) => Promise<void>;
+}
+
+export interface InboundRetentionReport {
+  readonly messagesPurged: number;
+  readonly bodyObjectsDeleted: number;
+  readonly bodyObjectErrors: number;
+  readonly seenPurged: number;
+}
+
+export async function runInboundMailRetention(
+  args: InboundRetentionArgs,
+): Promise<InboundRetentionReport> {
+  const messageDays = args.messageRetentionDays ?? MESSAGE_RETENTION_DAYS;
+  const seenDays = args.seenRetentionDays ?? SEEN_RETENTION_DAYS;
+  const messageCutoff = args.now.subtract({ hours: messageDays * 24 });
+  const seenCutoff = args.now.subtract({ hours: seenDays * 24 });
+
+  const messages = await purgeExpiredMessages(args, messageCutoff);
+  const seenPurged = await purgeExpiredSeenAnchors(args.db, args.tenantId, seenCutoff);
+
+  return { ...messages, seenPurged };
+}
+
+type ExpiredMessageRow = { readonly id: string; readonly bodyRef: string | null };
+
+async function purgeExpiredMessages(
+  args: InboundRetentionArgs,
+  cutoff: Instant,
+): Promise<Omit<InboundRetentionReport, "seenPurged">> {
+  let messagesPurged = 0;
+  let bodyObjectsDeleted = 0;
+  let bodyObjectErrors = 0;
+
+  // Drain-Loop: jede Page loescht die Rows die sie liest, die naechste ist
+  // damit frisch. archiveStream VOR dem Delete (crash dazwischen → naechster
+  // Lauf re-archiviert idempotent + loescht). Delete strikt nach den
+  // archivierten ids, nie per cutoff-WHERE — sonst koennte eine zwischen
+  // select und delete eingegangene Alt-Mail unarchiviert geloescht werden
+  // und beim Rebuild resurrecten.
+  for (;;) {
+    const rows = await selectMany<ExpiredMessageRow>(
+      args.db,
+      inboundMessagesProjectionTable,
+      { receivedAt: { lt: cutoff }, tenantId: args.tenantId },
+      { limit: BATCH_LIMIT },
+    );
+    if (rows.length === 0) break;
+
+    const ids: string[] = [];
+    for (const row of rows) {
+      await archiveStream(args.db, {
+        tenantId: args.tenantId,
+        aggregateId: row.id,
+        aggregateType: INBOUND_MESSAGE_AGGREGATE_TYPE,
+        archivedBy: ARCHIVED_BY,
+        reason: REASON,
+      });
+      if (row.bodyRef && args.deleteBodyObject) {
+        try {
+          await args.deleteBodyObject(row.bodyRef);
+          bodyObjectsDeleted++;
+        } catch {
+          bodyObjectErrors++;
+        }
+      }
+      ids.push(row.id);
+    }
+    await deleteMany(args.db, inboundMessagesProjectionTable as EntityTableMeta, {
+      id: { in: ids },
+    });
+    messagesPurged += ids.length;
+
+    if (rows.length < BATCH_LIMIT) break;
+  }
+
+  return { messagesPurged, bodyObjectsDeleted, bodyObjectErrors };
+}
+
+async function purgeExpiredSeenAnchors(
+  db: DbRunner,
+  tenantId: TenantId,
+  cutoff: Instant,
+): Promise<number> {
+  // Seen-Anker erben tenantId (table-builder: jede Entity hat tenant_id) →
+  // direkt tenant-scoped, kein Account-Join. Trifft auch Anker, deren Account
+  // schon disconnected/geloescht ist.
+  const where = { tenantId, seenAt: { lt: cutoff } };
+  const expired = await selectMany<{ accountId: string }>(
+    db,
+    seenMessageTable as EntityTableMeta,
+    where,
+  );
+  if (expired.length === 0) return 0;
+  await deleteMany(db, seenMessageTable as EntityTableMeta, where);
+  return expired.length;
+}

package/src/managed-pages/__tests__/managed-pages.integration.test.ts

@@ -398,6 +398,32 @@ describe("managed-pages :: set with tenantIdOverride (cross-tenant, SystemAdmin)
   });
 });
 
+describe("managed-pages :: by-tenant-published (Discovery-Query)", () => {
+  // tenantAdmin/otherAdmin operate under the default test tenant + a third
+  // tenant (see file header) — neither is TENANT_A/TENANT_B, so this needs
+  // its own explicit-tenantId users (same pattern as adminA/adminB below).
+  const pageAdminA = createTestUser({ id: 14, roles: ["TenantAdmin"], tenantId: TENANT_A });
+  const pageAdminB = createTestUser({ id: 15, roles: ["TenantAdmin"], tenantId: TENANT_B });
+
+  test("listet nur published Pages des Tenants, SQL-gefiltert (Drafts fehlen)", async () => {
+    const res = await stack.http.queryOk<{
+      pages: Array<{ slug: string; lang: string; title: string }>;
+    }>("managed-pages:query:by-tenant-published", {}, pageAdminA);
+    const slugs = res.pages.map((p) => p.slug);
+    expect(slugs).toContain("about");
+    expect(slugs).not.toContain("secret");
+  });
+
+  test("Cross-Tenant-Isolation: TENANT_B sieht nur eigene Slugs, keine von TENANT_A", async () => {
+    const res = await stack.http.queryOk<{ pages: Array<{ slug: string; title: string }> }>(
+      "managed-pages:query:by-tenant-published",
+      {},
+      pageAdminB,
+    );
+    expect(res.pages).toEqual([expect.objectContaining({ slug: "about", title: "About B" })]);
+  });
+});
+
 describe("managed-pages :: Branding (Config + Render)", () => {
   // config:write:set leitet tenantId aus user.tenantId ab → tenant-spezifische
   // Admins, damit das Branding auf TENANT_A bzw. TENANT_B landet (Host a.*/b.*).

package/src/managed-pages/feature.ts

@@ -18,6 +18,7 @@ import {
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding";
 import { createBrandingQuery } from "./handlers/branding.query";
 import { bySlugQuery } from "./handlers/by-slug.query";
+import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query";
 import { setWrite } from "./handlers/set.write";
 import { MANAGED_PAGES_I18N } from "./i18n";
 import { createBrandingSettingsScreen } from "./screens/branding-screen";
@@ -161,7 +162,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
 
   return defineFeature("managed-pages", (r) => {
     r.describe(
-      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
+      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
     );
     r.uiHints({
       displayLabel: "Managed Pages · Public CMS",
@@ -180,6 +181,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
     const handlers = { set: r.writeHandler(setWrite) };
     const queries = {
       bySlug: r.queryHandler(bySlugQuery),
+      byTenantPublished: r.queryHandler(byTenantPublishedQuery),
       branding: r.queryHandler(createBrandingQuery({ allowCustomCss })),
     };
 

package/src/managed-pages/handlers/by-tenant-published.query.ts

@@ -0,0 +1,52 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import {
+  crossTenantOverrideDenied,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { type PageRow, pagesTable } from "../table";
+
+// Public-Read aller published Pages eines Tenants — Discovery-Quelle für
+// sitemap.xml/llms.txt (siehe seo-Feature). Anders als by-slug (single-row,
+// nur der angefragte Slug) listet dies alle published Slugs auf einmal, SQL-
+// seitig auf `published = true` gefiltert (Drafts nie im Ergebnis, kein
+// Body-Content — Discovery-Zweck braucht nur Slug/Title/updatedAt).
+// Anonymous: explizit in roles, symmetrisch zu text-content's by-tenant.
+export type PublishedPageSummary = {
+  readonly slug: string;
+  readonly lang: string;
+  readonly title: string;
+  readonly updatedAt: Date;
+};
+
+export const byTenantPublishedQuery = defineQueryHandler({
+  name: "by-tenant-published",
+  schema: z.object({
+    /** Optional cross-tenant read — nur für SystemAdmin. Symmetrisch zur
+     *  by-slug.query Override-Logik. */
+    tenantIdOverride: z.string().min(1).optional(),
+  }),
+  access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  handler: async (query, ctx) => {
+    const override = query.payload.tenantIdOverride;
+    const overrideDenied = crossTenantOverrideDenied(
+      query.user,
+      override,
+      "managedPages.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) throw overrideDenied;
+    const tenantId = override ?? query.user.tenantId;
+    const rows = castTenantRows<PageRow>(
+      await selectMany(ctx.db, pagesTable, { tenantId: tenantId, published: true }),
+    );
+    return {
+      pages: rows.map((row) => ({
+        slug: row.slug,
+        lang: row.lang,
+        title: row.title,
+        updatedAt: row.updatedAt,
+      })),
+    };
+  },
+});