@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/mail-foundation/__tests__/mail-foundation.integration.test.ts

@@ -10,7 +10,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -24,6 +24,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createMutableMasterKeyProvider,
+  createTestEnvelopeCipher,
   type MutableMasterKeyProvider,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { z } from "zod";
@@ -87,8 +88,8 @@ let providerRef: MutableMasterKeyProvider;
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  resolver = createConfigResolver({ cipher: encryption });
 
   // Master-key for the secrets-feature. Production env shape:
   //   KUMIKO_SECRETS_MASTER_KEY_V1=<base64 32 bytes>

package/src/mail-foundation/__tests__/mail-transport-contract.ts

@@ -0,0 +1,58 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+import type { EmailMessage } from "@cosmicdrift/kumiko-bundled-features/channel-email";
+import type { MailTransportContext, MailTransportPlugin } from "../feature";
+
+export type MailTransportContractFixture = {
+  readonly plugin: MailTransportPlugin;
+  readonly ctx: MailTransportContext;
+  readonly tenantId: string;
+  // Local providers (inmemory) expose readBack to assert real delivery;
+  // remote providers (smtp) omit it — send() needs a live server.
+  readonly readBack?: (tenantId: string) => readonly EmailMessage[];
+};
+
+export type MailTransportContractOptions = {
+  // Local providers (inmemory) can assert real delivery via readBack —
+  // remote providers (smtp) can't (send() needs a live server), so their
+  // delivery test must show as an explicit `skip` in test output, not a
+  // silently-passing green with zero assertions (#1334).
+  readonly verifiesDelivery: boolean;
+};
+
+export function describeMailTransportContract(
+  name: string,
+  factory: () => MailTransportContractFixture | Promise<MailTransportContractFixture>,
+  options: MailTransportContractOptions,
+): void {
+  describe(`${name} — MailTransportPlugin contract`, () => {
+    let fixture: MailTransportContractFixture;
+
+    beforeEach(async () => {
+      fixture = await factory();
+    });
+
+    test("build resolves to an EmailTransport with a send function", async () => {
+      const transport = await fixture.plugin.build(fixture.ctx, fixture.tenantId);
+      expect(typeof transport.send).toBe("function");
+    });
+
+    (options.verifiesDelivery ? test : test.skip)(
+      "send delivers the message — verified via readBack",
+      async () => {
+        if (!fixture.readBack) {
+          throw new Error(
+            "describeMailTransportContract: verifiesDelivery:true but the fixture has no readBack",
+          );
+        }
+        const message: EmailMessage = {
+          to: "contract-recipient@example.test",
+          subject: "contract-test-subject",
+          html: "<p>contract-test-body</p>",
+        };
+        const transport = await fixture.plugin.build(fixture.ctx, fixture.tenantId);
+        await transport.send(message);
+        expect(fixture.readBack(fixture.tenantId)).toContainEqual(message);
+      },
+    );
+  });
+}

package/src/mail-foundation/feature.ts

@@ -31,7 +31,10 @@
 // `channel-email` (App-wide-Mail-Sender via delivery) bleibt unangetastet
 // — additive Feature.
 
-import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
+import {
+  type EmailTransport,
+  withPiiCiphertextGuard,
+} from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { requireDefined } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import {
   access,
@@ -127,32 +130,31 @@ export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
     },
   });
 
-  const configKeys = r.config({
-    keys: {
-      // Provider-selector. Default empty so the boot-validator throws
-      // if a tenant tries to send mail without first picking + setting
-      // up a provider — better than a silent fallback.
-      // The actual list of valid values lives in the registered plugins,
-      // not here — Designer-UI can render `getExtensionUsages
-      // ("mailTransport").map(u => u.entityName)` as the option-list.
-      provider: createTenantConfig("text", {
-        default: "",
-        // required: ohne gewählten Provider wirft createTransportForTenant —
-        // readiness meldete vorher ready:true und der erste Mail-Send
-        // lieferte den UnconfiguredError (280/1).
-        required: true,
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-      }),
-    },
-  });
+  // Provider-selector. Default empty so the boot-validator throws if a
+  // tenant tries to send mail without first picking + setting up a
+  // provider — better than a silent fallback. The actual list of valid
+  // values lives in the registered plugins, not here — Designer-UI can
+  // render `getExtensionUsages("mailTransport").map(u => u.entityName)`
+  // as the option-list.
+  const providerConfigKey = r.config(
+    "provider",
+    createTenantConfig("text", {
+      default: "",
+      // required: ohne gewählten Provider wirft createTransportForTenant —
+      // readiness meldete vorher ready:true und der erste Mail-Send
+      // lieferte den UnconfiguredError (280/1).
+      required: true,
+      write: access.roles("TenantAdmin", "SystemAdmin"),
+      read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+    }),
+  );
   // Readiness gating: transport-plugins' required keys/secrets count only
   // while their plugin is the one this key selects.
-  r.extensionSelector("mailTransport", configKeys.provider);
+  r.extensionSelector("mailTransport", providerConfigKey);
 
   return {
     /** Config-key-handle for the provider-selector. */
-    configKeys,
+    providerConfigKey,
   };
 });
 
@@ -187,7 +189,7 @@ export async function createTransportForTenant(
   }
 
   const provider = requireDefined(
-    await ctxConfig(mailFoundationFeature.exports.configKeys.provider),
+    await ctxConfig(mailFoundationFeature.exports.providerConfigKey),
     FEATURE_NAME,
     "provider",
   ) as string; // @cast-boundary engine-payload
@@ -216,5 +218,5 @@ export async function createTransportForTenant(
         `extension options must be a MailTransportPlugin.`,
     );
   }
-  return usage.options.build(ctx, tenantId);
+  return withPiiCiphertextGuard(await usage.options.build(ctx, tenantId));
 }

package/src/mail-transport-inmemory/__tests__/feature.test.ts

@@ -1,8 +1,31 @@
 // feature.ts contract tests for mail-transport-inmemory.
 
 import { describe, expect, test } from "bun:test";
+import { isMailTransportPlugin, type MailTransportPlugin } from "../../mail-foundation";
+import { describeMailTransportContract } from "../../mail-foundation/__tests__/mail-transport-contract";
 import { clearInbox, getInbox, mailTransportInMemoryFeature } from "../feature";
 
+function registeredPlugin(): MailTransportPlugin {
+  const usage = mailTransportInMemoryFeature.extensionUsages.find(
+    (u) => u.extensionName === "mailTransport" && u.entityName === "inmemory",
+  );
+  if (!usage || !isMailTransportPlugin(usage.options)) {
+    throw new Error("mail-transport-inmemory: plugin not registered under 'inmemory'");
+  }
+  return usage.options;
+}
+
+describeMailTransportContract(
+  "mail-transport-inmemory",
+  () => ({
+    plugin: registeredPlugin(),
+    ctx: {},
+    tenantId: "contract-test-tenant",
+    readBack: getInbox,
+  }),
+  { verifiesDelivery: true },
+);
+
 describe("mailTransportInMemoryFeature — shape", () => {
   test("has the expected name", () => {
     expect(mailTransportInMemoryFeature.name).toBe("mail-transport-inmemory");

package/src/mail-transport-smtp/__tests__/feature.test.ts

@@ -4,8 +4,73 @@
 // build-fn presence).
 
 import { describe, expect, test } from "bun:test";
+import type { ConfigAccessor } from "@cosmicdrift/kumiko-framework/engine";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { createSecret } from "@cosmicdrift/kumiko-framework/secrets";
+import { isMailTransportPlugin, type MailTransportPlugin } from "../../mail-foundation";
+import { describeMailTransportContract } from "../../mail-foundation/__tests__/mail-transport-contract";
 import { mailTransportSmtpFeature, SMTP_PASSWORD } from "../feature";
 
+function registeredPlugin(): MailTransportPlugin {
+  const usage = mailTransportSmtpFeature.extensionUsages.find(
+    (u) => u.extensionName === "mailTransport" && u.entityName === "smtp",
+  );
+  if (!usage || !isMailTransportPlugin(usage.options)) {
+    throw new Error("mail-transport-smtp: plugin not registered under 'smtp'");
+  }
+  return usage.options;
+}
+
+function fakeConfig(
+  overrides: Partial<
+    Record<"host" | "port" | "secure" | "from" | "authUser", string | number | boolean>
+  > = {},
+): ConfigAccessor {
+  const keys = mailTransportSmtpFeature.exports.configKeys;
+  const values = new Map<string, string | number | boolean>([
+    [keys.host.name, overrides.host ?? "smtp.contract-test.invalid"],
+    [keys.port.name, overrides.port ?? 587],
+    [keys.secure.name, overrides.secure ?? false],
+    [keys.from.name, overrides.from ?? "noreply@contract-test.invalid"],
+    [keys.authUser.name, overrides.authUser ?? "contract-test-user"],
+  ]);
+  return (async (handle: string | { readonly name: string }) => {
+    const key = typeof handle === "string" ? handle : handle.name;
+    return values.get(key);
+  }) as ConfigAccessor;
+}
+
+function fakeSecrets(): SecretsContext {
+  return {
+    get: async () => createSecret("contract-test-password"),
+    has: async () => true,
+    set: async () => {},
+    delete: async () => true,
+  };
+}
+
+describeMailTransportContract(
+  "mail-transport-smtp",
+  () => ({
+    plugin: registeredPlugin(),
+    ctx: { config: fakeConfig(), secrets: fakeSecrets(), _userId: "contract-test-user" },
+    tenantId: "contract-test-tenant",
+  }),
+  // send() needs a live SMTP server — can't assert real delivery here.
+  { verifiesDelivery: false },
+);
+
+describe("mailTransportSmtpFeature — build error path", () => {
+  test("build rejects when a required config-key (host) is unset", async () => {
+    const ctx = {
+      config: fakeConfig({ host: "" }),
+      secrets: fakeSecrets(),
+      _userId: "contract-test-user",
+    };
+    await expect(registeredPlugin().build(ctx, "contract-test-tenant")).rejects.toThrow(/host/);
+  });
+});
+
 describe("mailTransportSmtpFeature — shape", () => {
   test("has the expected name", () => {
     expect(mailTransportSmtpFeature.name).toBe("mail-transport-smtp");

package/src/managed-pages/__tests__/branding-coerce.test.ts

@@ -2,12 +2,8 @@ import { describe, expect, test } from "bun:test";
 import { type BrandingTokens, EMPTY_BRANDING } from "../../page-render";
 import { coerceBranding } from "../branding";
 
-// coerceBranding is the IO boundary for the branding query's wire response:
-// untrusted `unknown` → BrandingTokens with no `as` cast. Every missing or
-// non-string field must collapse to "" so a malformed/empty response renders
-// the unbranded default rather than throwing — and an attacker-controlled
-// non-string (e.g. a logoUrl object) can never leak through as a live render
-// token. Exercised only indirectly by the integration path before this.
+// IO-boundary coercion: untrusted `unknown` → BrandingTokens, no `as` cast —
+// every missing/non-string field collapses to "" instead of throwing.
 
 describe("coerceBranding", () => {
   const FULL: BrandingTokens = {

package/src/managed-pages/__tests__/i18n-surface.boot.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createConfigFeature } from "../../config/feature";
+import { createManagedPagesFeature } from "../feature";
+
+// Completeness-Gate: managed-pages ruft jetzt r.translations → der Boot-Validator
+// erzwingt den KOMPLETTEN Required-Surface-Key-Satz (screen:*.title,
+// entity:*:field:*, Section-Header, rowAction-Labels/Confirms) in de+en. Fehlt
+// EIN Key, wirft validateBoot. Beide allowCustomCss-Varianten müssen booten —
+// bei true kommen die zwei customCss-Keys als required dazu.
+
+const resolveApexTenant = () => null;
+
+describe("managed-pages i18n surface completeness", () => {
+  test("boot-validates with allowCustomCss: false", () => {
+    const features = [
+      createConfigFeature(),
+      createManagedPagesFeature({ resolveApexTenant, allowCustomCss: false }),
+    ];
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("boot-validates with allowCustomCss: true (customCss keys required)", () => {
+    const features = [
+      createConfigFeature(),
+      createManagedPagesFeature({ resolveApexTenant, allowCustomCss: true }),
+    ];
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+});

package/src/managed-pages/__tests__/managed-pages.integration.test.ts

@@ -398,6 +398,32 @@ describe("managed-pages :: set with tenantIdOverride (cross-tenant, SystemAdmin)
   });
 });
 
+describe("managed-pages :: by-tenant-published (Discovery-Query)", () => {
+  // tenantAdmin/otherAdmin operate under the default test tenant + a third
+  // tenant (see file header) — neither is TENANT_A/TENANT_B, so this needs
+  // its own explicit-tenantId users (same pattern as adminA/adminB below).
+  const pageAdminA = createTestUser({ id: 14, roles: ["TenantAdmin"], tenantId: TENANT_A });
+  const pageAdminB = createTestUser({ id: 15, roles: ["TenantAdmin"], tenantId: TENANT_B });
+
+  test("listet nur published Pages des Tenants, SQL-gefiltert (Drafts fehlen)", async () => {
+    const res = await stack.http.queryOk<{
+      pages: Array<{ slug: string; lang: string; title: string }>;
+    }>("managed-pages:query:by-tenant-published", {}, pageAdminA);
+    const slugs = res.pages.map((p) => p.slug);
+    expect(slugs).toContain("about");
+    expect(slugs).not.toContain("secret");
+  });
+
+  test("Cross-Tenant-Isolation: TENANT_B sieht nur eigene Slugs, keine von TENANT_A", async () => {
+    const res = await stack.http.queryOk<{ pages: Array<{ slug: string; title: string }> }>(
+      "managed-pages:query:by-tenant-published",
+      {},
+      pageAdminB,
+    );
+    expect(res.pages).toEqual([expect.objectContaining({ slug: "about", title: "About B" })]);
+  });
+});
+
 describe("managed-pages :: Branding (Config + Render)", () => {
   // config:write:set leitet tenantId aus user.tenantId ab → tenant-spezifische
   // Admins, damit das Branding auf TENANT_A bzw. TENANT_B landet (Host a.*/b.*).
@@ -671,3 +697,114 @@ describe("managed-pages :: Custom CSS (gated, sanitized render)", () => {
     expect(JSON.stringify(screen)).toContain("branding-custom-css");
   });
 });
+
+// resolverTrust: "authoritative" (kumiko-platform#278/1, show-pony#51):
+// diese Suite verdrahtet einen ECHTEN host-basierten anonymousAccess.
+// tenantResolver (nicht nur tenantExists wie die Suite oben) — genau die
+// Konfiguration, unter der publicstatus/show-pony laufen.
+//
+// Mechanismus: ein interner Self-Fetch (der alte app.fetch-Pfad) trägt
+// KEINEN Host-Header — Host steckt nur implizit in der Request-URL, nicht
+// in Headers. Ein Resolver, der (wie publicstatus' echter Resolver) nur
+// c.req.header("host") liest, löst für den inneren Request also null auf;
+// unter resolverTrust: "authoritative" gibt es dafür keinen Client-Tenant-
+// Fallback → tenant_required → "page unavailable" 503, obwohl der äußere
+// Request (Host da) den Tenant längst korrekt aufgelöst hätte. systemQuery
+// (siehe feature.ts) entfernt den internen HTTP-Roundtrip komplett und
+// erzwingt den bereits aufgelösten tenantId in-process — kein Header mehr,
+// der fehlen könnte. Rot/Grün verifiziert: mit dem alten app.fetch-Pfad UND
+// einem fallback-freien Resolver (wie hier) schlagen 4 der Tests in dieser
+// Datei/seo.integration.test.ts fehl (503/leere sitemap-Einträge); mit
+// systemQuery sind alle grün.
+describe("managed-pages :: resolverTrust authoritative (host-based, wie publicstatus/show-pony)", () => {
+  let authStack: TestStack;
+  const authManaged = createManagedPagesFeature({
+    resolveApexTenant: (host) => {
+      if (host.startsWith("a.")) return TENANT_A;
+      if (host.startsWith("b.")) return TENANT_B;
+      return null;
+    },
+  });
+  const authConfigFeature = createConfigFeature();
+  const hostTenant = (host: string): string | null => {
+    if (host.startsWith("a.")) return TENANT_A;
+    if (host.startsWith("b.")) return TENANT_B;
+    return null;
+  };
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    authStack = await setupTestStack({
+      features: [authConfigFeature, authManaged],
+      anonymousAccess: {
+        // KEIN URL-Fallback — spiegelt publicstatus' echten Resolver
+        // (resolveSubdomain(c.req.header("Host") ?? "")). Ein interner
+        // Self-Fetch trägt keinen Host-Header (Host steckt nur in der URL,
+        // nicht in Headers) — ein Resolver, der nur den Header liest, löst
+        // für den inneren Request also null auf. Mit URL-Fallback würde
+        // dieser Test den Bug maskieren.
+        tenantResolver: (c) => hostTenant(c.req.header("host") ?? ""),
+        resolverTrust: "authoritative",
+        tenantExists: async (id) => id === TENANT_A || id === TENANT_B,
+      },
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafeCreateEntityTable(authStack.db, pageEntity);
+    await unsafePushTables(authStack.db, { configValuesTable });
+    await createEventsTable(authStack.db);
+    await seedPage(authStack.db, {
+      tenantId: TENANT_A,
+      slug: "about",
+      lang: "en",
+      title: "About A",
+      body: "# Hello from **A**",
+      published: true,
+    });
+    await seedPage(authStack.db, {
+      tenantId: TENANT_B,
+      slug: "about",
+      lang: "en",
+      title: "About B",
+      body: "# Hello from **B**",
+      published: true,
+    });
+  });
+
+  afterAll(async () => {
+    await authStack.cleanup();
+  });
+
+  test("published Page → 200 (systemQuery-Render-Pfad übersteht authoritative resolver)", async () => {
+    const res = await authStack.app.request("http://a.example.com/p/about");
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("About A");
+    expect(html).toContain("<strong>A</strong>");
+  });
+
+  test("Cross-Tenant-Isolation: Host löst den jeweils eigenen Tenant auf", async () => {
+    const a = await (await authStack.app.request("http://a.example.com/p/about")).text();
+    const b = await (await authStack.app.request("http://b.example.com/p/about")).text();
+    expect(a).toContain("About A");
+    expect(a).not.toContain("About B");
+    expect(b).toContain("About B");
+    expect(b).not.toContain("About A");
+  });
+
+  test("X-Tenant-Header auf der Render-Route ist wirkungslos — Host bleibt allein maßgeblich", async () => {
+    // Die Render-Route liest den Tenant NUR über resolveApexTenant(host),
+    // nie über den Client-Header — anders als bei Query/Write-Dispatch gibt
+    // es hier also gar keinen X-Tenant-Override-Vektor. Ein gesetzter,
+    // abweichender Header wird schlicht ignoriert: 200, weiterhin A's Page.
+    const res = await authStack.app.request("http://a.example.com/p/about", {
+      headers: { "X-Tenant": TENANT_B },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.text();
+    expect(body).toContain("About A");
+    expect(body).not.toContain("About B");
+  });
+});

package/src/managed-pages/feature.ts

@@ -15,10 +15,13 @@ import {
   renderSafeMarkdown,
   wrapInLayout,
 } from "../page-render";
+import type { SystemQueryFn } from "../shared";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding";
 import { createBrandingQuery } from "./handlers/branding.query";
 import { bySlugQuery } from "./handlers/by-slug.query";
+import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query";
 import { setWrite } from "./handlers/set.write";
+import { MANAGED_PAGES_I18N } from "./i18n";
 import { createBrandingSettingsScreen } from "./screens/branding-screen";
 import { pageEditScreen, pageListScreen } from "./screens/page-screens";
 import { pageEntity } from "./table";
@@ -28,28 +31,25 @@ import { pageEntity } from "./table";
 // Alias (publicstatus = "Admin") müssen TenantAdmin granten/mappen.
 const ADMIN_ACCESS = { roles: ["TenantAdmin", "SystemAdmin"] } as const;
 
-// Published CMS-Content ändert sich selten — ein 60s-Shared-Cache-Fenster
-// spart den Origin-Revalidate-Roundtrip (jeder 304 re-runt sonst Page- +
-// Branding-Query), Edits sind nach spätestens 60s live.
+// 60s-shared-cache saves the origin-revalidate roundtrip; CMS edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 
 // QN-Konstante als dokumentierter Public-Contract — der Render-Pfad ruft
-// die by-slug-Query via internem app.fetch (kein Code-Import des Handlers,
-// symmetrisch zum legal-pages-Muster).
+// die by-slug-Query via systemQuery in-process (kein Code-Import des
+// Handlers, symmetrisch zum legal-pages-Muster).
 const BY_SLUG_QN = "managed-pages:query:by-slug";
 
-// Wire-Body-Shape von /api/query — das was bySlugQuery returnt (published-only).
-type ByslugQueryBody = {
-  data: {
-    title: string;
-    body: string;
-    lang: string;
-    description: string | null;
-    ogImage: string | null;
-    version: number;
-    updatedAt: string;
-  } | null;
-};
+// Raw Handler-Return von bySlugQuery (published-only) — systemQuery dispatcht
+// direkt gegen den Handler, keine `{data}`-Envelope wie am /api/query-Wire.
+type BySlugQueryResult = {
+  title: string;
+  body: string;
+  lang: string;
+  description: string | null;
+  ogImage: string | null;
+  version: number;
+  updatedAt: string;
+} | null;
 
 function brandingRevisionSeed(branding: BrandingTokens): string {
   return JSON.stringify([
@@ -63,14 +63,15 @@ function brandingRevisionSeed(branding: BrandingTokens): string {
   ]);
 }
 
-// Parse the branding query's `{ data }` envelope into BrandingTokens, never
-// throwing: a non-ok status or malformed body degrades to the unbranded
-// default (branding is decoration, not a hard dependency of the page render).
-async function readBrandingResponse(res: Response): Promise<BrandingTokens> {
-  if (!res.ok) return EMPTY_BRANDING;
+// Never throws: a query failure or malformed result degrades to the
+// unbranded default (branding is decoration, not a hard dependency of the
+// page render).
+async function readBrandingViaSystemQuery(
+  systemQuery: SystemQueryFn,
+  tenantId: string,
+): Promise<BrandingTokens> {
   try {
-    const body: { data?: unknown } = await res.json();
-    return coerceBranding(body.data);
+    return coerceBranding(await systemQuery(BRANDING_QUERY_QN, {}, tenantId));
   } catch {
     return EMPTY_BRANDING;
   }
@@ -162,7 +163,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
 
   return defineFeature("managed-pages", (r) => {
     r.describe(
-      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
+      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
     );
     r.uiHints({
       displayLabel: "Managed Pages · Public CMS",
@@ -181,6 +182,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
     const handlers = { set: r.writeHandler(setWrite) };
     const queries = {
       bySlug: r.queryHandler(bySlugQuery),
+      byTenantPublished: r.queryHandler(byTenantPublishedQuery),
       branding: r.queryHandler(createBrandingQuery({ allowCustomCss })),
     };
 
@@ -198,11 +200,13 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
     r.screen(pageEditScreen);
     r.screen(createBrandingSettingsScreen({ allowCustomCss }));
 
+    r.translations({ keys: MANAGED_PAGES_I18N });
+
     r.httpRoute({
       method: "GET",
       path: `${basePath}/:slug`,
       anonymous: true,
-      handler: async (c, { app }) => {
+      handler: async (c, { systemQuery }) => {
         // `param("slug")` ist string|undefined, weil `path` ein computed
         // Template ist (Hono inferiert `:slug` nur aus String-Literalen).
         const slug = c.req.param("slug");
@@ -215,31 +219,25 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
         const tenantId = await opts.resolveApexTenant(host);
         if (!tenantId) return c.text("not found", 404);
 
-        const queryHeaders = { "content-type": "application/json", "X-Tenant": tenantId };
-        const queryUrl = `${url.origin}/api/query`;
-        const queryReq = (type: string, payload: unknown) =>
-          app.fetch(
-            new Request(queryUrl, {
-              method: "POST",
-              headers: queryHeaders,
-              body: JSON.stringify({ type, payload }),
-            }),
-          );
-
-        // Page + branding read in parallel (same in-process app, same
-        // X-Tenant). Branding is decoration → a failed/empty branding read
-        // degrades to the unbranded default, it never blocks the page.
-        const [pageRes, brandingRes] = await Promise.all([
-          queryReq(BY_SLUG_QN, { slug, lang }),
-          queryReq(BRANDING_QUERY_QN, {}),
+        // Page + branding read in parallel, beide über systemQuery in-
+        // process gegen den host-resolved tenantId erzwungen (kein X-Tenant-
+        // Header-Trick über app.fetch — der sähe für einen host-basierten
+        // anonymousAccess-Resolver wie ein Client-Override aus und würde
+        // von resolverTrust: "authoritative" zurecht abgelehnt; siehe
+        // systemQuery's Doc in http-route.ts). Branding ist Deko → ein
+        // Fehlschlag degradiert zum unbranded Default, blockt nie die Page.
+        const [pageSettled, brandingResult] = await Promise.all([
+          systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
+            .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
+            .catch(() => ({ ok: false as const, data: null as BySlugQueryResult })),
+          readBrandingViaSystemQuery(systemQuery, tenantId),
         ]);
-        if (!pageRes.ok) return c.text("page unavailable", 503);
+        if (!pageSettled.ok) return c.text("page unavailable", 503);
 
-        const body: ByslugQueryBody = await pageRes.json();
-        const data = body.data;
+        const data = pageSettled.data;
         if (!data) return c.text("not found", 404);
 
-        const branding = await readBrandingResponse(brandingRes);
+        const branding = brandingResult;
 
         const etag = computeRevisionEtag([
           tenantId,

package/src/managed-pages/handlers/branding.query.ts

@@ -21,7 +21,11 @@ export function createBrandingQuery(opts: { readonly allowCustomCss: boolean })
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
     handler: async (_query, ctx) => {
       const base = await readBranding(ctx.config);
-      if (!opts.allowCustomCss || !ctx.config || !ctx.hasFeature(MANAGED_PAGES_CSS_FEATURE)) {
+      if (
+        !opts.allowCustomCss ||
+        !ctx.config ||
+        !(await ctx.hasFeature(MANAGED_PAGES_CSS_FEATURE))
+      ) {
         return base;
       }
       return { ...base, customCss: await readCustomCss(ctx.config) };