@cosmicdrift/kumiko-bundled-features 0.147.2 → 0.148.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.147.2",
+  "version": "0.148.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -114,11 +114,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.147.2",
-    "@cosmicdrift/kumiko-framework": "0.147.2",
-    "@cosmicdrift/kumiko-headless": "0.147.2",
-    "@cosmicdrift/kumiko-renderer": "0.147.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.147.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.148.0",
+    "@cosmicdrift/kumiko-framework": "0.148.0",
+    "@cosmicdrift/kumiko-headless": "0.148.0",
+    "@cosmicdrift/kumiko-renderer": "0.148.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.148.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/audit/__tests__/audit-screens.boot.test.ts

@@ -15,7 +15,7 @@ describe("audit log screen + handler access alignment", () => {
   test("audit-log screen is custom, access.admin-gated", () => {
     const audit = createAuditFeature();
     const screen = audit.screens[AUDIT_LOG_SCREEN_ID];
-    if (!screen || screen.type !== "custom") {
+    if (screen?.type !== "custom") {
       throw new Error(`expected a custom screen for ${AUDIT_LOG_SCREEN_ID}, got ${screen?.type}`);
     }
     if (!("access" in screen) || !screen.access || !("roles" in screen.access)) {
@@ -27,7 +27,7 @@ describe("audit log screen + handler access alignment", () => {
   test("audit-log-detail screen is custom, admin-gated, breadcrumb-linked to list", () => {
     const audit = createAuditFeature();
     const screen = audit.screens[AUDIT_LOG_DETAIL_SCREEN_ID];
-    if (!screen || screen.type !== "custom") {
+    if (screen?.type !== "custom") {
       throw new Error(
         `expected a custom screen for ${AUDIT_LOG_DETAIL_SCREEN_ID}, got ${screen?.type}`,
       );

package/src/auth-mfa/web/i18n.ts

@@ -7,6 +7,7 @@ import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
 export const defaultTranslations: TranslationsByLocale = {
   de: {
+    "screen:auth-mfa-enable.title": "Zwei-Faktor-Authentifizierung",
     "auth.mfa.verify.title": "Zwei-Faktor-Bestätigung",
     "auth.mfa.verify.subtitle": "Gib den 6-stelligen Code aus deiner Authenticator-App ein.",
     "auth.mfa.verify.code": "Code",
@@ -36,6 +37,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.enable.success": "Zwei-Faktor-Authentifizierung ist jetzt aktiv.",
   },
   en: {
+    "screen:auth-mfa-enable.title": "Two-factor authentication",
     "auth.mfa.verify.title": "Two-factor verification",
     "auth.mfa.verify.subtitle": "Enter the 6-digit code from your authenticator app.",
     "auth.mfa.verify.code": "Code",

package/src/auth-mfa/web/mfa-enable-screen.tsx

@@ -39,7 +39,7 @@ export type MfaEnableScreenProps = { readonly embedded?: boolean };
 
 export function MfaEnableScreen({ embedded = false }: MfaEnableScreenProps = {}): ReactNode {
   const t = useTranslation();
-  const { Button, Banner, Field, Input, Card, Heading } = usePrimitives();
+  const { Button, Banner, Field, Input, Section, Heading } = usePrimitives();
   const dispatcher = useDispatcher();
   const session = useSession();
 
@@ -98,22 +98,43 @@ export function MfaEnableScreen({ embedded = false }: MfaEnableScreenProps = {})
       {error !== null && <Banner variant="error">{t(`auth.mfa.errors.${error}`)}</Banner>}
 
       {!setup && !enabled && (
-        <Card options={{ padded: true }} className="flex flex-col gap-3">
+        <Section
+          testId="mfa-enable-intro"
+          actions={
+            <Button
+              variant="primary"
+              onClick={() => void startSetup()}
+              loading={busy}
+              disabled={busy}
+            >
+              {t("auth.mfa.enable.start")}
+            </Button>
+          }
+        >
           <span className="text-sm text-muted-foreground">{t("auth.mfa.enable.intro")}</span>
-          <Button
-            variant="primary"
-            onClick={() => void startSetup()}
-            loading={busy}
-            disabled={busy}
-          >
-            {t("auth.mfa.enable.start")}
-          </Button>
-        </Card>
+        </Section>
       )}
 
       {setup && (
-        <Card options={{ padded: true }} className="flex flex-col gap-4">
-          <div className="flex flex-col gap-2">
+        <Section
+          testId="mfa-enable-setup"
+          actions={
+            <>
+              <Button variant="secondary" onClick={() => setSetup(null)} disabled={busy}>
+                {t("auth.mfa.enable.cancel")}
+              </Button>
+              <Button
+                variant="primary"
+                onClick={() => void confirmSetup()}
+                loading={busy}
+                disabled={busy || !acknowledged || code.length < 6}
+              >
+                {t("auth.mfa.enable.confirm")}
+              </Button>
+            </>
+          }
+        >
+          <div className="flex flex-col items-center gap-2 text-center">
             <span className="text-sm font-semibold">{t("auth.mfa.enable.scanTitle")}</span>
             {/* qrcode's own SVG string output, not user input — safe to inline */}
             <div
@@ -124,7 +145,7 @@ export function MfaEnableScreen({ embedded = false }: MfaEnableScreenProps = {})
             <span className="text-xs text-muted-foreground">
               {t("auth.mfa.enable.manualEntry")}
             </span>
-            <code className="block break-all rounded bg-muted px-3 py-2 font-mono text-sm">
+            <code className="inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm">
               {setup.secretParam}
             </code>
           </div>
@@ -159,21 +180,7 @@ export function MfaEnableScreen({ embedded = false }: MfaEnableScreenProps = {})
               autoComplete="one-time-code"
             />
           </Field>
-
-          <div className="flex justify-end gap-2">
-            <Button variant="secondary" onClick={() => setSetup(null)} disabled={busy}>
-              {t("auth.mfa.enable.cancel")}
-            </Button>
-            <Button
-              variant="primary"
-              onClick={() => void confirmSetup()}
-              loading={busy}
-              disabled={busy || !acknowledged || code.length < 6}
-            >
-              {t("auth.mfa.enable.confirm")}
-            </Button>
-          </div>
-        </Card>
+        </Section>
       )}
     </div>
   );

package/src/managed-pages/__tests__/managed-pages.integration.test.ts

@@ -697,3 +697,114 @@ describe("managed-pages :: Custom CSS (gated, sanitized render)", () => {
     expect(JSON.stringify(screen)).toContain("branding-custom-css");
   });
 });
+
+// resolverTrust: "authoritative" (kumiko-platform#278/1, show-pony#51):
+// diese Suite verdrahtet einen ECHTEN host-basierten anonymousAccess.
+// tenantResolver (nicht nur tenantExists wie die Suite oben) — genau die
+// Konfiguration, unter der publicstatus/show-pony laufen.
+//
+// Mechanismus: ein interner Self-Fetch (der alte app.fetch-Pfad) trägt
+// KEINEN Host-Header — Host steckt nur implizit in der Request-URL, nicht
+// in Headers. Ein Resolver, der (wie publicstatus' echter Resolver) nur
+// c.req.header("host") liest, löst für den inneren Request also null auf;
+// unter resolverTrust: "authoritative" gibt es dafür keinen Client-Tenant-
+// Fallback → tenant_required → "page unavailable" 503, obwohl der äußere
+// Request (Host da) den Tenant längst korrekt aufgelöst hätte. systemQuery
+// (siehe feature.ts) entfernt den internen HTTP-Roundtrip komplett und
+// erzwingt den bereits aufgelösten tenantId in-process — kein Header mehr,
+// der fehlen könnte. Rot/Grün verifiziert: mit dem alten app.fetch-Pfad UND
+// einem fallback-freien Resolver (wie hier) schlagen 4 der Tests in dieser
+// Datei/seo.integration.test.ts fehl (503/leere sitemap-Einträge); mit
+// systemQuery sind alle grün.
+describe("managed-pages :: resolverTrust authoritative (host-based, wie publicstatus/show-pony)", () => {
+  let authStack: TestStack;
+  const authManaged = createManagedPagesFeature({
+    resolveApexTenant: (host) => {
+      if (host.startsWith("a.")) return TENANT_A;
+      if (host.startsWith("b.")) return TENANT_B;
+      return null;
+    },
+  });
+  const authConfigFeature = createConfigFeature();
+  const hostTenant = (host: string): string | null => {
+    if (host.startsWith("a.")) return TENANT_A;
+    if (host.startsWith("b.")) return TENANT_B;
+    return null;
+  };
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    authStack = await setupTestStack({
+      features: [authConfigFeature, authManaged],
+      anonymousAccess: {
+        // KEIN URL-Fallback — spiegelt publicstatus' echten Resolver
+        // (resolveSubdomain(c.req.header("Host") ?? "")). Ein interner
+        // Self-Fetch trägt keinen Host-Header (Host steckt nur in der URL,
+        // nicht in Headers) — ein Resolver, der nur den Header liest, löst
+        // für den inneren Request also null auf. Mit URL-Fallback würde
+        // dieser Test den Bug maskieren.
+        tenantResolver: (c) => hostTenant(c.req.header("host") ?? ""),
+        resolverTrust: "authoritative",
+        tenantExists: async (id) => id === TENANT_A || id === TENANT_B,
+      },
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafeCreateEntityTable(authStack.db, pageEntity);
+    await unsafePushTables(authStack.db, { configValuesTable });
+    await createEventsTable(authStack.db);
+    await seedPage(authStack.db, {
+      tenantId: TENANT_A,
+      slug: "about",
+      lang: "en",
+      title: "About A",
+      body: "# Hello from **A**",
+      published: true,
+    });
+    await seedPage(authStack.db, {
+      tenantId: TENANT_B,
+      slug: "about",
+      lang: "en",
+      title: "About B",
+      body: "# Hello from **B**",
+      published: true,
+    });
+  });
+
+  afterAll(async () => {
+    await authStack.cleanup();
+  });
+
+  test("published Page → 200 (systemQuery-Render-Pfad übersteht authoritative resolver)", async () => {
+    const res = await authStack.app.request("http://a.example.com/p/about");
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("About A");
+    expect(html).toContain("<strong>A</strong>");
+  });
+
+  test("Cross-Tenant-Isolation: Host löst den jeweils eigenen Tenant auf", async () => {
+    const a = await (await authStack.app.request("http://a.example.com/p/about")).text();
+    const b = await (await authStack.app.request("http://b.example.com/p/about")).text();
+    expect(a).toContain("About A");
+    expect(a).not.toContain("About B");
+    expect(b).toContain("About B");
+    expect(b).not.toContain("About A");
+  });
+
+  test("X-Tenant-Header auf der Render-Route ist wirkungslos — Host bleibt allein maßgeblich", async () => {
+    // Die Render-Route liest den Tenant NUR über resolveApexTenant(host),
+    // nie über den Client-Header — anders als bei Query/Write-Dispatch gibt
+    // es hier also gar keinen X-Tenant-Override-Vektor. Ein gesetzter,
+    // abweichender Header wird schlicht ignoriert: 200, weiterhin A's Page.
+    const res = await authStack.app.request("http://a.example.com/p/about", {
+      headers: { "X-Tenant": TENANT_B },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.text();
+    expect(body).toContain("About A");
+    expect(body).not.toContain("About B");
+  });
+});

package/src/managed-pages/feature.ts

@@ -34,22 +34,27 @@ const ADMIN_ACCESS = { roles: ["TenantAdmin", "SystemAdmin"] } as const;
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 
 // QN-Konstante als dokumentierter Public-Contract — der Render-Pfad ruft
-// die by-slug-Query via internem app.fetch (kein Code-Import des Handlers,
-// symmetrisch zum legal-pages-Muster).
+// die by-slug-Query via systemQuery in-process (kein Code-Import des
+// Handlers, symmetrisch zum legal-pages-Muster).
 const BY_SLUG_QN = "managed-pages:query:by-slug";
 
-// Wire-Body-Shape von /api/query — das was bySlugQuery returnt (published-only).
-type ByslugQueryBody = {
-  data: {
-    title: string;
-    body: string;
-    lang: string;
-    description: string | null;
-    ogImage: string | null;
-    version: number;
-    updatedAt: string;
-  } | null;
-};
+// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — mirrors
+// http-route.ts's signature. Not importing HttpRouteHandlerDeps itself: it
+// isn't part of the engine's public surface (only the httpRoute-
+// registration types are; same convention as seo/feature.ts's FetchApp).
+type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;
+
+// Raw Handler-Return von bySlugQuery (published-only) — systemQuery dispatcht
+// direkt gegen den Handler, keine `{data}`-Envelope wie am /api/query-Wire.
+type BySlugQueryResult = {
+  title: string;
+  body: string;
+  lang: string;
+  description: string | null;
+  ogImage: string | null;
+  version: number;
+  updatedAt: string;
+} | null;
 
 function brandingRevisionSeed(branding: BrandingTokens): string {
   return JSON.stringify([
@@ -63,14 +68,15 @@ function brandingRevisionSeed(branding: BrandingTokens): string {
   ]);
 }
 
-// Parse the branding query's `{ data }` envelope into BrandingTokens, never
-// throwing: a non-ok status or malformed body degrades to the unbranded
-// default (branding is decoration, not a hard dependency of the page render).
-async function readBrandingResponse(res: Response): Promise<BrandingTokens> {
-  if (!res.ok) return EMPTY_BRANDING;
+// Never throws: a query failure or malformed result degrades to the
+// unbranded default (branding is decoration, not a hard dependency of the
+// page render).
+async function readBrandingViaSystemQuery(
+  systemQuery: SystemQueryFn,
+  tenantId: string,
+): Promise<BrandingTokens> {
   try {
-    const body: { data?: unknown } = await res.json();
-    return coerceBranding(body.data);
+    return coerceBranding(await systemQuery(BRANDING_QUERY_QN, {}, tenantId));
   } catch {
     return EMPTY_BRANDING;
   }
@@ -205,7 +211,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
       method: "GET",
       path: `${basePath}/:slug`,
       anonymous: true,
-      handler: async (c, { app }) => {
+      handler: async (c, { systemQuery }) => {
         // `param("slug")` ist string|undefined, weil `path` ein computed
         // Template ist (Hono inferiert `:slug` nur aus String-Literalen).
         const slug = c.req.param("slug");
@@ -218,31 +224,25 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
         const tenantId = await opts.resolveApexTenant(host);
         if (!tenantId) return c.text("not found", 404);
 
-        const queryHeaders = { "content-type": "application/json", "X-Tenant": tenantId };
-        const queryUrl = `${url.origin}/api/query`;
-        const queryReq = (type: string, payload: unknown) =>
-          app.fetch(
-            new Request(queryUrl, {
-              method: "POST",
-              headers: queryHeaders,
-              body: JSON.stringify({ type, payload }),
-            }),
-          );
-
-        // Page + branding read in parallel (same in-process app, same
-        // X-Tenant). Branding is decoration → a failed/empty branding read
-        // degrades to the unbranded default, it never blocks the page.
-        const [pageRes, brandingRes] = await Promise.all([
-          queryReq(BY_SLUG_QN, { slug, lang }),
-          queryReq(BRANDING_QUERY_QN, {}),
+        // Page + branding read in parallel, beide über systemQuery in-
+        // process gegen den host-resolved tenantId erzwungen (kein X-Tenant-
+        // Header-Trick über app.fetch — der sähe für einen host-basierten
+        // anonymousAccess-Resolver wie ein Client-Override aus und würde
+        // von resolverTrust: "authoritative" zurecht abgelehnt; siehe
+        // systemQuery's Doc in http-route.ts). Branding ist Deko → ein
+        // Fehlschlag degradiert zum unbranded Default, blockt nie die Page.
+        const [pageSettled, brandingResult] = await Promise.all([
+          systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
+            .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
+            .catch(() => ({ ok: false as const, data: null as BySlugQueryResult })),
+          readBrandingViaSystemQuery(systemQuery, tenantId),
         ]);
-        if (!pageRes.ok) return c.text("page unavailable", 503);
+        if (!pageSettled.ok) return c.text("page unavailable", 503);
 
-        const body: ByslugQueryBody = await pageRes.json();
-        const data = body.data;
+        const data = pageSettled.data;
         if (!data) return c.text("not found", 404);
 
-        const branding = await readBrandingResponse(brandingRes);
+        const branding = brandingResult;
 
         const etag = computeRevisionEtag([
           tenantId,

package/src/seo/__tests__/seo.integration.test.ts

@@ -280,3 +280,71 @@ describe("seo :: runSeoBootCheck (direct unit-tests)", () => {
     }
   });
 });
+
+// resolverTrust: "authoritative" (kumiko-platform#278/1, show-pony#51) —
+// dieselbe Regression wie managed-pages' Suite, für sitemap.xml/llms.txt.
+// gatherEntries' interner Self-Fetch für die by-tenant-published-Query trug
+// keinen Host-Header; ein fallback-freier Resolver (wie hier, wie
+// publicstatus' echter Resolver) löste dafür null auf → tenant_required
+// statt der Managed-Pages-Einträge. systemQuery behebt das (siehe
+// managed-pages' Suite für die volle Mechanismus-Erklärung + Rot/Grün-Beweis).
+describe("seo :: resolverTrust authoritative (host-based, wie publicstatus/show-pony)", () => {
+  let authStack: TestStack;
+  const authManaged = createManagedPagesFeature({
+    resolveApexTenant: (host) => (host.startsWith("a.") ? TENANT_A : null),
+  });
+  const authSeo = createSeoFeature({
+    sitemapEntries: (host) => [{ loc: `https://${host}/`, changefreq: "daily" }],
+    managedPages: {
+      resolveApexTenant: (host) => (host.startsWith("a.") ? TENANT_A : null),
+    },
+  });
+  const authConfigFeature = createConfigFeature();
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    authStack = await setupTestStack({
+      features: [authConfigFeature, authManaged, authSeo],
+      anonymousAccess: {
+        // KEIN URL-Fallback — spiegelt publicstatus' echten Resolver. Ein
+        // interner Self-Fetch trägt keinen Host-Header; mit Fallback würde
+        // dieser Test den Bug maskieren (siehe managed-pages' Suite).
+        tenantResolver: (c) => ((c.req.header("host") ?? "").startsWith("a.") ? TENANT_A : null),
+        resolverTrust: "authoritative",
+        tenantExists: async (id) => id === TENANT_A,
+      },
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafeCreateEntityTable(authStack.db, pageEntity);
+    await unsafePushTables(authStack.db, { configValuesTable });
+    await createEventsTable(authStack.db);
+    await seedPage(authStack.db, {
+      tenantId: TENANT_A,
+      slug: "about",
+      lang: "en",
+      title: "About",
+      body: "# About",
+      published: true,
+    });
+  });
+
+  afterAll(async () => {
+    await authStack.cleanup();
+  });
+
+  test("sitemap.xml → 200, merges managed-pages' published slugs via systemQuery", async () => {
+    const res = await authStack.app.request("http://a.example.com/sitemap.xml");
+    expect(res.status).toBe(200);
+    const xml = await res.text();
+    expect(xml).toContain("<loc>https://a.example.com/</loc>");
+    expect(xml).toContain("<loc>http://a.example.com/p/about</loc>");
+  });
+
+  test("llms.txt → 200", async () => {
+    const res = await authStack.app.request("http://a.example.com/llms.txt");
+    expect(res.status).toBe(200);
+  });
+});

package/src/seo/feature.ts

@@ -19,11 +19,11 @@ const SEO_CACHE = { kind: "revalidate", maxAgeSeconds: 300 } as const;
 const MANAGED_PAGES_BY_TENANT_PUBLISHED_QN = "managed-pages:query:by-tenant-published";
 const SEO_CONFIG_QUERY_QN = "seo:query:config";
 
-// Minimal shape of the httpRoute handler's `{ app }` dep — just enough to
-// make an internal /api/query call. Not importing HttpRouteHandlerDeps
-// itself: it isn't part of the engine's public surface (only the
-// httpRoute-registration types are).
-type FetchApp = { readonly fetch: (req: Request) => Promise<Response> | Response };
+// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — just
+// enough to force a specific tenant in-process. Not importing
+// HttpRouteHandlerDeps itself: it isn't part of the engine's public surface
+// (only the httpRoute-registration types are).
+type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;
 
 export type ManagedPagesDiscoveryOptions = {
   /** Same per-host tenant resolver the app already passes to
@@ -76,26 +76,18 @@ const EMPTY_SEO_CONFIG: SeoConfigValues = {
   defaultOgImage: "",
 };
 
-function queryRequest(origin: string, tenantId: string, type: string, payload: unknown): Request {
-  return new Request(`${origin}/api/query`, {
-    method: "POST",
-    headers: { "content-type": "application/json", "X-Tenant": tenantId },
-    body: JSON.stringify({ type, payload }),
-  });
-}
-
 // Config is decoration, not a hard dependency — a failed/unreachable read
 // degrades to empty strings (same posture as managed-pages' readBrandingResponse).
+// systemQuery forces tenantId in-process — no internal X-Tenant self-fetch,
+// which a host-based anonymousAccess resolver in "authoritative" mode would
+// reject as a forged client override.
 async function readSeoConfig(
-  app: FetchApp,
-  origin: string,
+  systemQuery: SystemQueryFn,
   tenantId: string,
 ): Promise<SeoConfigValues> {
   try {
-    const res = await app.fetch(queryRequest(origin, tenantId, SEO_CONFIG_QUERY_QN, {}));
-    if (!res.ok) return EMPTY_SEO_CONFIG;
-    const body: { data?: Partial<SeoConfigValues> } = await res.json();
-    return { ...EMPTY_SEO_CONFIG, ...body.data };
+    const data = (await systemQuery(SEO_CONFIG_QUERY_QN, {}, tenantId)) as Partial<SeoConfigValues>;
+    return { ...EMPTY_SEO_CONFIG, ...data };
   } catch {
     return EMPTY_SEO_CONFIG;
   }
@@ -104,13 +96,13 @@ async function readSeoConfig(
 // Merges the app callback with the optional legal-pages/managed-pages
 // sources. legal-pages routes are static (no per-tenant data) — merged
 // directly from the public LEGAL_ROUTES constant. managed-pages entries need
-// a live query (per-tenant published slugs) — merged via app.fetch, same
+// a live query (per-tenant published slugs) — merged via systemQuery, same
 // cross-feature decoupling as legal-pages' own text-content calls; a
 // failed/unreachable read degrades to "no managed-pages entries" rather than
 // failing the whole route.
 async function gatherEntries(
   opts: SeoOptions,
-  app: FetchApp,
+  systemQuery: SystemQueryFn,
   origin: string,
   host: string,
 ): Promise<SitemapEntry[]> {
@@ -126,21 +118,16 @@ async function gatherEntries(
     const tenantId = await opts.managedPages.resolveApexTenant(host);
     if (tenantId) {
       try {
-        const res = await app.fetch(
-          queryRequest(origin, tenantId, MANAGED_PAGES_BY_TENANT_PUBLISHED_QN, {}),
-        );
-        if (res.ok) {
-          const body: {
-            data?: { pages?: readonly { slug: string; title: string; updatedAt: string }[] };
-          } = await res.json();
-          const basePath = opts.managedPages.basePath ?? "/p";
-          for (const page of body.data?.pages ?? []) {
-            entries.push({
-              loc: `${origin}${basePath}/${page.slug}`,
-              title: page.title,
-              lastmod: page.updatedAt,
-            });
-          }
+        const data = (await systemQuery(MANAGED_PAGES_BY_TENANT_PUBLISHED_QN, {}, tenantId)) as {
+          pages?: readonly { slug: string; title: string; updatedAt: string }[];
+        };
+        const basePath = opts.managedPages.basePath ?? "/p";
+        for (const page of data.pages ?? []) {
+          entries.push({
+            loc: `${origin}${basePath}/${page.slug}`,
+            title: page.title,
+            lastmod: page.updatedAt,
+          });
         }
       } catch {
         // managed-pages unreachable/not mounted — degrade to callback-only entries.
@@ -203,9 +190,9 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       method: "GET",
       path: paths.sitemap,
       anonymous: true,
-      handler: async (c, { app }) => {
+      handler: async (c, { systemQuery }) => {
         const { origin, host } = requestHost(c);
-        const entries = await gatherEntries(opts, app, origin, host);
+        const entries = await gatherEntries(opts, systemQuery, origin, host);
         const xml = buildSitemapXml(entries);
         const etag = computeRevisionEtag([host, xml]);
         return cachedSecurePageResponse(c.req.raw, {
@@ -221,14 +208,14 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       method: "GET",
       path: paths.llmsTxt,
       anonymous: true,
-      handler: async (c, { app }) => {
+      handler: async (c, { systemQuery }) => {
         const { origin, host } = requestHost(c);
         const tenantId = opts.managedPages
           ? ((await opts.managedPages.resolveApexTenant(host)) ?? SYSTEM_TENANT_ID)
           : SYSTEM_TENANT_ID;
         const [entries, seoConfig] = await Promise.all([
-          gatherEntries(opts, app, origin, host),
-          readSeoConfig(app, origin, tenantId),
+          gatherEntries(opts, systemQuery, origin, host),
+          readSeoConfig(systemQuery, tenantId),
         ]);
         const sections =
           entries.length > 0