@cosmicdrift/kumiko-bundled-features 0.147.1 → 0.147.3

package/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -0,0 +1,106 @@
+// @runtime client
+// Login-Challenge-Step, gerendert wenn LoginScreen's onMfaChallenge feuert
+// (/auth/login antwortete mfaRequired). Stilistisch wie login-screen.tsx:
+// useState + direkter fetch-Call, kein Dispatcher — es existiert noch kein
+// JWT. Nach Erfolg ruft es session.refresh() statt eines Hard-Reloads, weil
+// der Aufrufer (typisch ein Wizard-State im App-Root) sofort neu rendern
+// will, sobald status:"authenticated" ankommt.
+
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type FormEvent, type ReactNode, useState } from "react";
+// kumiko-lint-ignore cross-feature-import client-only barrel, the feature's server barrel has no web/ re-export
+import { AuthCard, useSession } from "../../auth-email-password/web";
+import { verifyMfaChallenge } from "./mfa-client";
+
+export type MfaVerifyScreenProps = {
+  readonly challengeToken: string;
+  readonly title?: string;
+  readonly subtitle?: ReactNode;
+  readonly submitLabel?: string;
+  /** Called after the server confirms the code and the session state has
+   *  refreshed. Optional — apps that swap this screen back out purely on
+   *  session.status changing to "authenticated" don't need it. */
+  readonly onSuccess?: () => void;
+};
+
+function reasonToKey(reason: string): string {
+  switch (reason) {
+    case "invalid_totp_code":
+    case "invalid_recovery_code":
+    case "invalid_code":
+      return "auth.mfa.errors.invalidCode";
+    case "challenge_expired":
+    case "invalid_challenge_token":
+      return "auth.mfa.errors.challengeExpired";
+    case "too_many_attempts":
+      return "auth.mfa.errors.tooManyAttempts";
+    case "rate_limited":
+      return "auth.errors.rateLimited";
+    default:
+      return "auth.mfa.errors.verifyFailed";
+  }
+}
+
+export function MfaVerifyScreen({
+  challengeToken,
+  title,
+  subtitle,
+  submitLabel,
+  onSuccess,
+}: MfaVerifyScreenProps): ReactNode {
+  const t = useTranslation();
+  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const session = useSession();
+  const [code, setCode] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const doSubmit = async (): Promise<void> => {
+    setSubmitting(true);
+    setError(null);
+    const res = await verifyMfaChallenge(challengeToken, code);
+    if (res.kind === "success") {
+      await session.refresh();
+      setSubmitting(false);
+      onSuccess?.();
+      return;
+    }
+    setSubmitting(false);
+    setError(res.error.reason);
+  };
+
+  const onSubmit = (e?: FormEvent): void => {
+    e?.preventDefault();
+    void doSubmit();
+  };
+
+  return (
+    <AuthCard
+      title={title ?? t("auth.mfa.verify.title")}
+      subtitle={subtitle ?? t("auth.mfa.verify.subtitle")}
+    >
+      <div className="p-6 pt-0 flex flex-col gap-4">
+        <Form onSubmit={onSubmit}>
+          <Field id="mfa-verify-code" label={t("auth.mfa.verify.code")} required>
+            <Input
+              kind="text"
+              id="mfa-verify-code"
+              name="mfa-verify-code"
+              value={code}
+              onChange={setCode}
+              disabled={submitting}
+              required
+              autoComplete="one-time-code"
+            />
+          </Field>
+          {error !== null ? <Banner variant="error">{t(reasonToKey(error))}</Banner> : null}
+          <Button type="submit" loading={submitting} disabled={submitting}>
+            {submitting
+              ? t("auth.mfa.verify.submitting")
+              : (submitLabel ?? t("auth.mfa.verify.submit"))}
+          </Button>
+        </Form>
+      </div>
+    </AuthCard>
+  );
+}

package/src/auth-mfa-user-data/__tests__/hooks.integration.test.ts

@@ -0,0 +1,132 @@
+// userMfaExportHook/userMfaDeleteHook — GDPR export must never surface the
+// TOTP secret or recovery codes, and forget must actually remove the row
+// (not just leave it dangling for a future projection rebuild to resurrect).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { base32Decode } from "../../auth-mfa/base32";
+import { AuthMfaHandlers } from "../../auth-mfa/constants";
+import { createAuthMfaFeature } from "../../auth-mfa/feature";
+import { userMfaEntity } from "../../auth-mfa/schema/user-mfa";
+import { currentTotpCode } from "../../auth-mfa/totp";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { userMfaDeleteHook, userMfaExportHook } from "../hooks";
+
+let stack: TestStack;
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function enrollUser(userId: string) {
+  const user = createTestUser({ id: userId, roles: ["User"] });
+  const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+    AuthMfaHandlers.enableStart,
+    { accountLabel: `${userId}@example.com` },
+    user,
+  );
+  const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+  const secret = base32Decode(secretParam);
+  await stack.http.writeOk(
+    AuthMfaHandlers.enableConfirm,
+    { setupToken: start.setupToken, code: currentTotpCode(secret) },
+    user,
+  );
+  return user;
+}
+
+describe("userMfaExportHook / userMfaDeleteHook", () => {
+  test("export confirms enrollment without leaking the TOTP secret or recovery codes", async () => {
+    const user = await enrollUser("export-1");
+
+    const snippet = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+
+    expect(snippet).not.toBeNull();
+    expect(snippet?.rows).toHaveLength(1);
+    const row = snippet?.rows[0] as Record<string, unknown>;
+    expect(row["enrolled"]).toBe(true);
+    expect(JSON.stringify(row)).not.toContain("totpSecret");
+    expect(JSON.stringify(row)).not.toContain("recoveryCodes");
+  });
+
+  test("export returns null for a user who never enrolled", async () => {
+    const user = createTestUser({ id: "never-enrolled", roles: ["User"] });
+    const snippet = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+    expect(snippet).toBeNull();
+  });
+
+  test("delete hard-removes the row via forget (rebuild-safe)", async () => {
+    const user = await enrollUser("delete-1");
+
+    const before = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+    expect(before).not.toBeNull();
+
+    await userMfaDeleteHook(
+      {
+        db: stack.db,
+        registry: stack.registry,
+        tenantId: user.tenantId,
+        userId: user.id,
+      },
+      "delete",
+    );
+
+    const after = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+    expect(after).toBeNull();
+  });
+});

package/src/auth-mfa-user-data/hooks.ts

@@ -0,0 +1,53 @@
+// EXT_USER_DATA hooks for userMfa (GDPR Art. 15/17/20). Both totpSecret and
+// recoveryCodes are marked userOwned in the schema for exactly this: on
+// forget, the row must actually disappear — a leftover TOTP secret or
+// recovery-code hash under an anonymized user is still a live credential
+// nobody can rotate. Mirrors folders-user-data/hooks.ts's executor-based
+// delete (rebuild-safe: forget replays via the event, a raw DELETE would be
+// resurrected by a projection rebuild).
+
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { userMfaEntity, userMfaTable } from "../auth-mfa";
+
+const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
+  entityName: "user-mfa",
+});
+
+// Never includes totpSecret/recoveryCodes — secret-derived credential
+// material, not portable personal data (same reasoning as api-token's
+// tokenHash exclusion in user-data-rights-defaults). Just confirms
+// enrollment + when, which is what a data subject actually needs to see.
+export const userMfaExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await selectMany<{ id: string; enabledAt: unknown }>(ctx.db, userMfaTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "user-mfa",
+    rows: rows.map((r) => ({ enrolled: true, enabledAt: String(r.enabledAt ?? "") })),
+  };
+};
+
+// Always a real hard-delete regardless of the incoming strategy — a 2FA
+// secret can't be anonymized, and userOwned already means this row belongs
+// to exactly one user (never shared tenant data).
+export const userMfaDeleteHook: UserDataDeleteHook = async (ctx) => {
+  const rows = await selectMany<{ id: string }>(ctx.db, userMfaTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  // skip: nothing enrolled for this user — no row to erase
+  if (rows.length === 0) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  for (const row of rows) {
+    await executor.forget({ id: row.id }, systemUser, tdb);
+  }
+};

package/src/auth-mfa-user-data/index.ts

@@ -0,0 +1,21 @@
+// Provides the EXT_USER_DATA export/delete hooks for the `user-mfa` entity as
+// a standalone feature — mount it alongside `auth-mfa` + `user-data-rights`
+// when an app needs 2FA enrollment in its GDPR export/forget pipeline. Kept
+// separate from `auth-mfa` (which only requires "user"/"config") so auth-mfa
+// consumers without the user-data-rights stack don't pull a hard dependency.
+// Mirrors folders-user-data.
+
+import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import { userMfaDeleteHook, userMfaExportHook } from "./hooks";
+
+export const authMfaUserDataFeature = defineFeature("auth-mfa-user-data", (r) => {
+  r.describe(
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `auth-mfa` feature's `user-mfa` entity. Mounts the EXT_USER_DATA export + delete hooks so 2FA enrollment status is included in the user-data export bundle and a user's TOTP secret + recovery codes are hard-deleted (via executor.forget, rebuild-safe) on a data-subject erasure request. Kept separate from `auth-mfa` so consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `auth-mfa`.",
+  );
+  r.requires("user-data-rights");
+  r.optionalRequires("auth-mfa");
+  r.useExtension(EXT_USER_DATA, "user-mfa", {
+    export: userMfaExportHook,
+    delete: userMfaDeleteHook,
+  });
+});

package/src/legal-pages/__tests__/legal-pages.integration.test.ts

@@ -238,6 +238,10 @@ describe("legal-pages :: SYSTEM_TENANT-routing (production-bug-regression)", ()
         // Resolver gibt IMMER einen anderen Tenant zurück — wenn legal-
         // pages den respektieren würde, wäre der DB-Lookup leer.
         tenantResolver: () => otherTenantId,
+        // Mirrors publicstatus's real subdomain resolver: the tenant is
+        // derived from the host, which the client cannot forge — trusted
+        // over any client-supplied tenant.
+        resolverTrust: "authoritative",
         tenantExists: async (id) => id === otherTenantId || id === SYSTEM_TENANT_ID,
       },
       extraContext: ({ db }) => ({

package/src/legal-pages/feature.ts

@@ -21,10 +21,8 @@ import { renderMarkdownToHtml, wrapInLayout } from "./markdown";
 // wie bei jedem API-Endpunkt.
 const TEXT_CONTENT_BY_SLUG_QN = "text-content:query:by-slug";
 
-// Wire-Body-Shape von /api/query — das, was bySlugQuery returnt.
-type ByslugQueryBody = {
-  data: { title: string; body: string | null; updatedAt: string } | null;
-};
+// Return-Shape von bySlugQuery (text-content/handlers/by-slug.query.ts).
+type TextBlockQueryResult = { title: string; body: string | null; updatedAt: string } | null;
 
 // 60s-shared-cache saves the origin-revalidate roundtrip; legal-content edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
@@ -81,35 +79,28 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
         method: "GET",
         path: route.path,
         anonymous: true,
-        handler: async (c, { app }) => {
-          const url = new URL(c.req.url);
+        handler: async (c, { systemQuery }) => {
           // Architektur: 1 App = X Tenants = 1 Impressum. Egal welche
           // Subdomain der Visitor besucht (apex, admin.*, tenant-x.*) —
-          // legal-pages serven IMMER die SYSTEM_TENANT-Texte. Deshalb
-          // explizit X-Tenant-Header setzen statt host weiterreichen
-          // (sonst würde ein host-basierter anonymousAccess-Resolver
-          // die tenant-Subdomain auf tenant-tenantId resolven und
-          // tenant-x's leere imprint-Tabelle abfragen → 404).
-          const queryRes = await app.fetch(
-            new Request(`${url.origin}/api/query`, {
-              method: "POST",
-              headers: {
-                "content-type": "application/json",
-                "X-Tenant": SYSTEM_TENANT_ID,
-              },
-              body: JSON.stringify({
-                type: TEXT_CONTENT_BY_SLUG_QN,
-                payload: { slug: route.slug, lang: route.lang },
-              }),
-            }),
-          );
-
-          if (!queryRes.ok) {
+          // legal-pages serven IMMER die SYSTEM_TENANT-Texte. systemQuery
+          // erzwingt SYSTEM_TENANT_ID in-process (kein X-Tenant-Header-
+          // Trick über app.fetch — der sähe für einen host-basierten
+          // anonymousAccess-Resolver wie ein Client-Override aus und würde
+          // von resolverTrust: "authoritative" zurecht abgelehnt).
+          let data: TextBlockQueryResult;
+          try {
+            // @cast-boundary engine-payload — dispatcher.query returnt
+            // unknown; Shape ist durch bySlugQuery's Handler-Return-Type
+            // (siehe text-content/handlers/by-slug.query.ts) vertraut.
+            data = (await systemQuery(
+              TEXT_CONTENT_BY_SLUG_QN,
+              { slug: route.slug, lang: route.lang },
+              SYSTEM_TENANT_ID,
+            )) as TextBlockQueryResult;
+          } catch {
             return c.text("legal page unavailable", 503);
           }
 
-          const body: ByslugQueryBody = await queryRes.json();
-          const data = body.data;
           if (!data?.body) {
             return c.text(
               `${route.titleFallback} not configured. Tenant-Admin must set this text-block.`,

package/src/managed-pages/__tests__/managed-pages.integration.test.ts

@@ -697,3 +697,114 @@ describe("managed-pages :: Custom CSS (gated, sanitized render)", () => {
     expect(JSON.stringify(screen)).toContain("branding-custom-css");
   });
 });
+
+// resolverTrust: "authoritative" (kumiko-platform#278/1, show-pony#51):
+// diese Suite verdrahtet einen ECHTEN host-basierten anonymousAccess.
+// tenantResolver (nicht nur tenantExists wie die Suite oben) — genau die
+// Konfiguration, unter der publicstatus/show-pony laufen.
+//
+// Mechanismus: ein interner Self-Fetch (der alte app.fetch-Pfad) trägt
+// KEINEN Host-Header — Host steckt nur implizit in der Request-URL, nicht
+// in Headers. Ein Resolver, der (wie publicstatus' echter Resolver) nur
+// c.req.header("host") liest, löst für den inneren Request also null auf;
+// unter resolverTrust: "authoritative" gibt es dafür keinen Client-Tenant-
+// Fallback → tenant_required → "page unavailable" 503, obwohl der äußere
+// Request (Host da) den Tenant längst korrekt aufgelöst hätte. systemQuery
+// (siehe feature.ts) entfernt den internen HTTP-Roundtrip komplett und
+// erzwingt den bereits aufgelösten tenantId in-process — kein Header mehr,
+// der fehlen könnte. Rot/Grün verifiziert: mit dem alten app.fetch-Pfad UND
+// einem fallback-freien Resolver (wie hier) schlagen 4 der Tests in dieser
+// Datei/seo.integration.test.ts fehl (503/leere sitemap-Einträge); mit
+// systemQuery sind alle grün.
+describe("managed-pages :: resolverTrust authoritative (host-based, wie publicstatus/show-pony)", () => {
+  let authStack: TestStack;
+  const authManaged = createManagedPagesFeature({
+    resolveApexTenant: (host) => {
+      if (host.startsWith("a.")) return TENANT_A;
+      if (host.startsWith("b.")) return TENANT_B;
+      return null;
+    },
+  });
+  const authConfigFeature = createConfigFeature();
+  const hostTenant = (host: string): string | null => {
+    if (host.startsWith("a.")) return TENANT_A;
+    if (host.startsWith("b.")) return TENANT_B;
+    return null;
+  };
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    authStack = await setupTestStack({
+      features: [authConfigFeature, authManaged],
+      anonymousAccess: {
+        // KEIN URL-Fallback — spiegelt publicstatus' echten Resolver
+        // (resolveSubdomain(c.req.header("Host") ?? "")). Ein interner
+        // Self-Fetch trägt keinen Host-Header (Host steckt nur in der URL,
+        // nicht in Headers) — ein Resolver, der nur den Header liest, löst
+        // für den inneren Request also null auf. Mit URL-Fallback würde
+        // dieser Test den Bug maskieren.
+        tenantResolver: (c) => hostTenant(c.req.header("host") ?? ""),
+        resolverTrust: "authoritative",
+        tenantExists: async (id) => id === TENANT_A || id === TENANT_B,
+      },
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafeCreateEntityTable(authStack.db, pageEntity);
+    await unsafePushTables(authStack.db, { configValuesTable });
+    await createEventsTable(authStack.db);
+    await seedPage(authStack.db, {
+      tenantId: TENANT_A,
+      slug: "about",
+      lang: "en",
+      title: "About A",
+      body: "# Hello from **A**",
+      published: true,
+    });
+    await seedPage(authStack.db, {
+      tenantId: TENANT_B,
+      slug: "about",
+      lang: "en",
+      title: "About B",
+      body: "# Hello from **B**",
+      published: true,
+    });
+  });
+
+  afterAll(async () => {
+    await authStack.cleanup();
+  });
+
+  test("published Page → 200 (systemQuery-Render-Pfad übersteht authoritative resolver)", async () => {
+    const res = await authStack.app.request("http://a.example.com/p/about");
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("About A");
+    expect(html).toContain("<strong>A</strong>");
+  });
+
+  test("Cross-Tenant-Isolation: Host löst den jeweils eigenen Tenant auf", async () => {
+    const a = await (await authStack.app.request("http://a.example.com/p/about")).text();
+    const b = await (await authStack.app.request("http://b.example.com/p/about")).text();
+    expect(a).toContain("About A");
+    expect(a).not.toContain("About B");
+    expect(b).toContain("About B");
+    expect(b).not.toContain("About A");
+  });
+
+  test("X-Tenant-Header auf der Render-Route ist wirkungslos — Host bleibt allein maßgeblich", async () => {
+    // Die Render-Route liest den Tenant NUR über resolveApexTenant(host),
+    // nie über den Client-Header — anders als bei Query/Write-Dispatch gibt
+    // es hier also gar keinen X-Tenant-Override-Vektor. Ein gesetzter,
+    // abweichender Header wird schlicht ignoriert: 200, weiterhin A's Page.
+    const res = await authStack.app.request("http://a.example.com/p/about", {
+      headers: { "X-Tenant": TENANT_B },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.text();
+    expect(body).toContain("About A");
+    expect(body).not.toContain("About B");
+  });
+});

package/src/managed-pages/feature.ts

@@ -34,22 +34,27 @@ const ADMIN_ACCESS = { roles: ["TenantAdmin", "SystemAdmin"] } as const;
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 
 // QN-Konstante als dokumentierter Public-Contract — der Render-Pfad ruft
-// die by-slug-Query via internem app.fetch (kein Code-Import des Handlers,
-// symmetrisch zum legal-pages-Muster).
+// die by-slug-Query via systemQuery in-process (kein Code-Import des
+// Handlers, symmetrisch zum legal-pages-Muster).
 const BY_SLUG_QN = "managed-pages:query:by-slug";
 
-// Wire-Body-Shape von /api/query — das was bySlugQuery returnt (published-only).
-type ByslugQueryBody = {
-  data: {
-    title: string;
-    body: string;
-    lang: string;
-    description: string | null;
-    ogImage: string | null;
-    version: number;
-    updatedAt: string;
-  } | null;
-};
+// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — mirrors
+// http-route.ts's signature. Not importing HttpRouteHandlerDeps itself: it
+// isn't part of the engine's public surface (only the httpRoute-
+// registration types are; same convention as seo/feature.ts's FetchApp).
+type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;
+
+// Raw Handler-Return von bySlugQuery (published-only) — systemQuery dispatcht
+// direkt gegen den Handler, keine `{data}`-Envelope wie am /api/query-Wire.
+type BySlugQueryResult = {
+  title: string;
+  body: string;
+  lang: string;
+  description: string | null;
+  ogImage: string | null;
+  version: number;
+  updatedAt: string;
+} | null;
 
 function brandingRevisionSeed(branding: BrandingTokens): string {
   return JSON.stringify([
@@ -63,14 +68,15 @@ function brandingRevisionSeed(branding: BrandingTokens): string {
   ]);
 }
 
-// Parse the branding query's `{ data }` envelope into BrandingTokens, never
-// throwing: a non-ok status or malformed body degrades to the unbranded
-// default (branding is decoration, not a hard dependency of the page render).
-async function readBrandingResponse(res: Response): Promise<BrandingTokens> {
-  if (!res.ok) return EMPTY_BRANDING;
+// Never throws: a query failure or malformed result degrades to the
+// unbranded default (branding is decoration, not a hard dependency of the
+// page render).
+async function readBrandingViaSystemQuery(
+  systemQuery: SystemQueryFn,
+  tenantId: string,
+): Promise<BrandingTokens> {
   try {
-    const body: { data?: unknown } = await res.json();
-    return coerceBranding(body.data);
+    return coerceBranding(await systemQuery(BRANDING_QUERY_QN, {}, tenantId));
   } catch {
     return EMPTY_BRANDING;
   }
@@ -162,7 +168,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
 
   return defineFeature("managed-pages", (r) => {
     r.describe(
-      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
+      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
     );
     r.uiHints({
       displayLabel: "Managed Pages · Public CMS",
@@ -205,7 +211,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
       method: "GET",
       path: `${basePath}/:slug`,
       anonymous: true,
-      handler: async (c, { app }) => {
+      handler: async (c, { systemQuery }) => {
         // `param("slug")` ist string|undefined, weil `path` ein computed
         // Template ist (Hono inferiert `:slug` nur aus String-Literalen).
         const slug = c.req.param("slug");
@@ -218,31 +224,25 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
         const tenantId = await opts.resolveApexTenant(host);
         if (!tenantId) return c.text("not found", 404);
 
-        const queryHeaders = { "content-type": "application/json", "X-Tenant": tenantId };
-        const queryUrl = `${url.origin}/api/query`;
-        const queryReq = (type: string, payload: unknown) =>
-          app.fetch(
-            new Request(queryUrl, {
-              method: "POST",
-              headers: queryHeaders,
-              body: JSON.stringify({ type, payload }),
-            }),
-          );
-
-        // Page + branding read in parallel (same in-process app, same
-        // X-Tenant). Branding is decoration → a failed/empty branding read
-        // degrades to the unbranded default, it never blocks the page.
-        const [pageRes, brandingRes] = await Promise.all([
-          queryReq(BY_SLUG_QN, { slug, lang }),
-          queryReq(BRANDING_QUERY_QN, {}),
+        // Page + branding read in parallel, beide über systemQuery in-
+        // process gegen den host-resolved tenantId erzwungen (kein X-Tenant-
+        // Header-Trick über app.fetch — der sähe für einen host-basierten
+        // anonymousAccess-Resolver wie ein Client-Override aus und würde
+        // von resolverTrust: "authoritative" zurecht abgelehnt; siehe
+        // systemQuery's Doc in http-route.ts). Branding ist Deko → ein
+        // Fehlschlag degradiert zum unbranded Default, blockt nie die Page.
+        const [pageSettled, brandingResult] = await Promise.all([
+          systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
+            .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
+            .catch(() => ({ ok: false as const, data: null as BySlugQueryResult })),
+          readBrandingViaSystemQuery(systemQuery, tenantId),
         ]);
-        if (!pageRes.ok) return c.text("page unavailable", 503);
+        if (!pageSettled.ok) return c.text("page unavailable", 503);
 
-        const body: ByslugQueryBody = await pageRes.json();
-        const data = body.data;
+        const data = pageSettled.data;
         if (!data) return c.text("not found", 404);
 
-        const branding = await readBrandingResponse(brandingRes);
+        const branding = brandingResult;
 
         const etag = computeRevisionEtag([
           tenantId,