@snolla/data 0.0.0-stage → 1.0.7

package/dist/dbProvider.js

@@ -0,0 +1,1898 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+// Kysely db backend behind the data-provider seam (task:3821, requirements:65 п.2).
+//
+// dataProvider.js froze the seam: `get(slice, key)` / `enumerate(slice, opts)`
+// return the DB-loaded (template-shaped) row, so the engine does not care whether
+// a row came from fixtures or from the database. This module is the `db` backend of
+// that seam and the single Kysely runtime the product moves to (plan:49 Q2): one
+// query layer over Postgres/MariaDB/SQLite, with MSSQL kept as a migration source.
+// No Sequelize, no dialect branching above this file.
+//
+// Two properties are not optional:
+//   * every read is tenant-scoped — the cell's `siteId` feeds the R1 guard
+//     (deny-by-default), never the query payload, so the backend cannot serve
+//     another tenant's rows even by accident;
+//   * the module stays Sequelize-free and is imported by subpath
+//     (`@snolla/data/dbProvider.js`), like dataProvider.js — the engine can boot
+//     with no `config.data.sequelize` at all.
+//
+// Cell config (the per-slice/per-cell override, not a global canon):
+//   { dialect: 'postgres'|'mariadb'|'sqlite'|'mssql', dsn: string, siteId: uuid }
+//
+// Like the rest of the canon modules this file imports TypeScript sources (the R1
+// guard) — the consuming runtime strips types (Node ≥22.6) or bundles (Vite/Nitro),
+// which is how every canon consumer already runs.
+import { AliasNode, ColumnNode, IdentifierNode, Kysely, MssqlDialect, MssqlQueryCompiler, MysqlDialect, OffsetNode, OperationNodeTransformer, OrderByItemNode, OrderByNode, PostgresDialect, RawNode, ReferenceNode, SelectionNode, TopNode, ValueNode, sql, } from 'kysely';
+import { randomUUID } from 'node:crypto';
+import { canonicalSchema, isSiteScoped } from "./schema/index.js";
+import { tenantGuard } from "./guard.js";
+export const DIALECTS = ['postgres', 'mariadb', 'sqlite', 'mssql'];
+export const CELL_REQUIRED_KEYS = ['dialect', 'dsn', 'siteId'];
+const CANON_TABLES = new Map(canonicalSchema.tables.map((table) => [table.name, table]));
+const asBool = (value) => value === true || value === 1 || value === '1';
+/**
+ * A `datetime` column as an instant (task:4504). Drivers hand back what their type says:
+ * pg/mysql2/tedious return a `Date`. SQLite returns the stored text, and `sqliteDialect`
+ * writes it as UTC — so `Date.parse` on it reads LOCAL time and the blog post's day window
+ * resolves the wrong day (a dated URL then 404s a post it names). A naive timestamp is UTC
+ * by construction; a value that already carries a zone is trusted as it stands.
+ */
+const asInstant = (value) => {
+    if (value instanceof Date || value === null || value === undefined)
+        return value;
+    const text = String(value).trim();
+    if (/[zZ]$|[+-]\d{2}:?\d{2}$/.test(text))
+        return new Date(text);
+    return new Date(`${text.replace(' ', 'T')}Z`);
+};
+/**
+ * A slice is data, not code: which canon table it reads, which column is the key,
+ * the one optional join to the slice's template row, and how the flat row becomes
+ * the DB-loaded entity the view-model builders already consume. Adding a slice is
+ * a declaration here — no new query branch.
+ */
+/**
+ * A part-template table in the seam's terms (task:3888). Six canon tables carry the same shape
+ * — a `TemplateId` key, one owner column, `Name`/`Alias` and the stored field-definitions in
+ * `Content` — and the owner column is the only thing that differs, because each content
+ * container (site, blog, catalog, store) owns its own part templates. `owner` is the column the
+ * Sequelize model exposes as `ownerId`, which is what the engine passes in.
+ */
+const partTemplateSlice = (table, owner) => ({
+    table,
+    key: 'TemplateId',
+    columns: ['TemplateId', owner, 'Name', 'Alias', 'Content', 'CustomDefaultLayout', 'Layouts'],
+    shape: (row) => ({
+        id: row.TemplateId,
+        ownerId: row[owner],
+        name: row.Name,
+        alias: row.Alias,
+        content: row.Content,
+        customDefaultLayout: row.CustomDefaultLayout,
+        layouts: row.Layouts,
+        key: row.TemplateId,
+    }),
+});
+export const SLICES = {
+    // Boot surfaces (task:3873 step 1): the engine's first reads are the site row,
+    // its themes and its domains (`@snolla/web` initApp) — they must come from the
+    // same seam as content, or "the engine on another DSN" starts with a Sequelize read.
+    sites: {
+        table: 'Sites',
+        key: 'SiteId',
+        // Password is deliberately absent: the serving path never reads it, and a read
+        // contract that hands out credentials is a leak waiting for a caller.
+        columns: [
+            'SiteId', 'AccountId', 'Title', 'Alias', 'LoweredAlias', 'PrimaryDomain',
+            'TimeOffset', 'Culture', 'MultiCultural', 'Cultures', 'ActiveThemeId', 'RobotsTxt',
+            'Live', 'Production', 'PrefixAction', 'SettingsData', 'DefaultContentType',
+            'DefaultEncoding', 'DefaultPageName', 'DefaultExtension', 'CachingOptions',
+            'EnableCors', 'DefaultCorsPolicy', 'ContentCacheOptions', 'Writable',
+            // the search drainer's dirty flag (content-api/routes/search.js): null = rebuild
+            'SearchIndexCreationTimestamp',
+        ],
+        // the Sequelize-loaded asset shape (sequelize/snolla/site.js) — `app.locals.site` consumers
+        shape: (row) => ({
+            id: row.SiteId,
+            accountId: row.AccountId,
+            title: row.Title,
+            alias: row.Alias,
+            loweredAlias: row.LoweredAlias,
+            primaryDomain: row.PrimaryDomain,
+            timeOffset: row.TimeOffset,
+            culture: row.Culture,
+            multiCultural: asBool(row.MultiCultural),
+            cultures: row.Cultures,
+            activeThemeId: row.ActiveThemeId,
+            robotsTxt: row.RobotsTxt,
+            live: asBool(row.Live),
+            production: asBool(row.Production),
+            prefixAction: row.PrefixAction,
+            settingsData: row.SettingsData,
+            defaultContentType: row.DefaultContentType,
+            defaultEncoding: row.DefaultEncoding,
+            defaultPageName: row.DefaultPageName,
+            defaultExtension: row.DefaultExtension,
+            cachingOptions: row.CachingOptions,
+            enableCors: asBool(row.EnableCors),
+            defaultCorsPolicy: row.DefaultCorsPolicy,
+            contentCacheOptions: row.ContentCacheOptions,
+            writable: asBool(row.Writable),
+            searchIndexCreationTimestamp: row.SearchIndexCreationTimestamp,
+            key: row.SiteId,
+        }),
+    },
+    themes: {
+        table: 'Themes',
+        key: 'ThemeId',
+        columns: ['ThemeId', 'SiteId', 'Name', 'ViewEngineId', 'ImageSizes', 'ParentThemeId', 'SettingsData', 'SettingsMarkup'],
+        shape: (row) => ({
+            id: row.ThemeId,
+            siteId: row.SiteId,
+            name: row.Name,
+            viewEngineId: row.ViewEngineId,
+            imageSizes: row.ImageSizes,
+            parentThemeId: row.ParentThemeId,
+            settingsData: row.SettingsData,
+            settingsMarkup: row.SettingsMarkup,
+            key: row.ThemeId,
+        }),
+    },
+    domains: {
+        table: 'Domains',
+        key: 'DomainId',
+        columns: ['DomainId', 'SiteId', 'Name', 'ThemeId', 'PrefixAction', 'RobotsTxt', 'Public', 'SettingsData'],
+        shape: (row) => ({
+            id: row.DomainId,
+            siteId: row.SiteId,
+            name: row.Name,
+            themeId: row.ThemeId,
+            prefixAction: row.PrefixAction,
+            robotsTxt: row.RobotsTxt,
+            public: asBool(row.Public),
+            settingsData: row.SettingsData,
+            key: row.DomainId,
+        }),
+    },
+    redirections: {
+        // The redirect table is read on every GET (packages/web/middleware/redirections.js),
+        // so the service caches it — the slice only has to preserve the Seq order the matcher
+        // depends on (first match wins). Column notes come from the Sequelize model:
+        // `TargetUrl` is the URL to MATCH (`sourceUrl` in JS), `DestinationUrl` is the target.
+        table: 'Redirections',
+        key: 'RedirectionId',
+        columns: [
+            'RedirectionId', 'SiteId', 'Title', 'Seq', 'UrlDetection', 'TargetUrl', 'SourceType',
+            'Regex', 'IgnoreCase', 'Action', 'DestinationUrl', 'Permanent', 'ThemeId',
+            'BrowserDetection', 'MobileDeviceDetection', 'DeviceTypeDetection', 'IgnoreOptions',
+        ],
+        shape: (row) => ({
+            id: row.RedirectionId,
+            siteId: row.SiteId,
+            title: row.Title,
+            seq: row.Seq,
+            urlDetection: asBool(row.UrlDetection),
+            sourceUrl: row.TargetUrl,
+            sourceType: row.SourceType,
+            regex: asBool(row.Regex),
+            ignoreCase: asBool(row.IgnoreCase),
+            action: row.Action,
+            destinationUrl: row.DestinationUrl,
+            permanent: asBool(row.Permanent),
+            themeId: row.ThemeId,
+            browserDetection: asBool(row.BrowserDetection),
+            mobileDeviceDetection: asBool(row.MobileDeviceDetection),
+            deviceTypeDetection: asBool(row.DeviceTypeDetection),
+            ignoreOptions: asBool(row.IgnoreOptions),
+            key: row.RedirectionId,
+        }),
+    },
+    stores: {
+        // The store record (one per site) — the entry to every store route (task:3873).
+        table: 'Stores',
+        key: 'StoreId',
+        columns: [
+            'StoreId', 'SiteId', 'Title', 'Path', 'Alias', 'Content', 'StoreFields',
+            'StoreLayout', 'StoreLayouts', 'ProductLayout', 'ProductsPath', 'ProductPath',
+            'ProductNumberFormat', 'CategoriesLayout', 'CategoryLayout', 'CategoryLayouts',
+            'CategoryFields', 'CategoriesPath', 'TagsLayout', 'TagLayout', 'TagLayouts',
+            'TagFields', 'TagsPath', 'VendorsLayout', 'VendorLayout', 'VendorLayouts',
+            'VendorFields', 'VendorsPath', 'IncludeInSitemap', 'SitemapLastUpdatedTime',
+            'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        shape: (row) => ({
+            id: row.StoreId,
+            siteId: row.SiteId,
+            title: row.Title,
+            path: row.Path,
+            alias: row.Alias,
+            content: row.Content,
+            storeFields: row.StoreFields,
+            storeLayout: row.StoreLayout,
+            storeLayouts: row.StoreLayouts,
+            productLayout: row.ProductLayout,
+            productsPath: row.ProductsPath,
+            productPath: row.ProductPath,
+            productNumberFormat: row.ProductNumberFormat,
+            categoriesLayout: row.CategoriesLayout,
+            categoryLayout: row.CategoryLayout,
+            categoryLayouts: row.CategoryLayouts,
+            categoryFields: row.CategoryFields,
+            categoriesPath: row.CategoriesPath,
+            tagsLayout: row.TagsLayout,
+            tagLayout: row.TagLayout,
+            tagLayouts: row.TagLayouts,
+            tagFields: row.TagFields,
+            tagsPath: row.TagsPath,
+            vendorsLayout: row.VendorsLayout,
+            vendorLayout: row.VendorLayout,
+            vendorLayouts: row.VendorLayouts,
+            vendorFields: row.VendorFields,
+            vendorsPath: row.VendorsPath,
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: row.SitemapLastUpdatedTime,
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            key: row.StoreId,
+        }),
+    },
+    storeProducts: {
+        // The store product (Sequelize model `storeProduct` → table Products, StoreId-keyed).
+        table: 'Products',
+        key: 'ProductId',
+        columns: [
+            'ProductId', 'StoreId', 'SiteId', 'Number', 'TypeId', 'Content', 'Slug', 'Title',
+            'Rating', 'VotesCount', 'CountryOfOrigin', 'VendorId', 'Published', 'DateCreated',
+            'IncludeInSitemap', 'SitemapLastUpdatedTime', 'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        shape: (row) => ({
+            id: row.ProductId,
+            storeId: row.StoreId,
+            number: row.Number,
+            templateId: row.TypeId,
+            content: row.Content,
+            slug: row.Slug,
+            title: row.Title,
+            rating: row.Rating,
+            votesCount: row.VotesCount,
+            countryOfOrigin: row.CountryOfOrigin,
+            vendorId: row.VendorId,
+            published: asBool(row.Published),
+            dateCreated: row.DateCreated,
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: row.SitemapLastUpdatedTime,
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            key: row.ProductId,
+        }),
+    },
+    storeProductTemplates: {
+        // `ProductTypes` is the product-template table (the Sequelize model keeps the legacy
+        // name `storeProductTemplate`, the canon names the table after its PK).
+        table: 'ProductTypes',
+        key: 'TypeId',
+        columns: ['TypeId', 'Name', 'Description', 'StoreId', 'Content', 'Alias', 'CustomDefaultLayout', 'Layouts', 'VariantTemplateId'],
+        shape: (row) => ({
+            id: row.TypeId,
+            name: row.Name,
+            description: row.Description,
+            storeId: row.StoreId,
+            content: row.Content,
+            alias: row.Alias,
+            customDefaultLayout: row.CustomDefaultLayout,
+            layouts: row.Layouts,
+            variantTemplateId: row.VariantTemplateId,
+            key: row.TypeId,
+        }),
+    },
+    storeProductVariantTemplates: {
+        table: 'ProductVariantTemplates',
+        key: 'TemplateId',
+        columns: ['TemplateId', 'StoreId', 'Name', 'Alias', 'Description', 'Content', 'CustomDefaultLayout', 'Layouts'],
+        shape: (row) => ({
+            id: row.TemplateId,
+            storeId: row.StoreId,
+            name: row.Name,
+            alias: row.Alias,
+            description: row.Description,
+            content: row.Content,
+            customDefaultLayout: row.CustomDefaultLayout,
+            layouts: row.Layouts,
+            key: row.TemplateId,
+        }),
+    },
+    storeProductVariants: {
+        table: 'ProductVariants',
+        key: 'VariantId',
+        columns: ['VariantId', 'ProductId', 'Position', 'Title', 'Sku', 'VendorCode', 'TemplateId', 'Content', 'Price', 'CompareAtPrice', 'InventoryQuantity', 'InventoryPolicyId'],
+        shape: (row) => ({
+            id: row.VariantId,
+            productId: row.ProductId,
+            position: row.Position,
+            title: row.Title,
+            sku: row.Sku,
+            vendorCode: row.VendorCode,
+            templateId: row.TemplateId,
+            content: row.Content,
+            price: row.Price,
+            compareAtPrice: row.CompareAtPrice,
+            inventoryQuantity: row.InventoryQuantity,
+            inventoryPolicyId: row.InventoryPolicyId,
+            key: row.VariantId,
+        }),
+    },
+    storeCategories: {
+        table: 'StoreCategories',
+        key: 'CategoryId',
+        columns: ['CategoryId', 'StoreId', 'Title', 'Description', 'Slug', 'Content'],
+        shape: (row) => ({
+            id: row.CategoryId,
+            storeId: row.StoreId,
+            title: row.Title,
+            description: row.Description,
+            slug: row.Slug,
+            content: row.Content,
+            key: row.CategoryId,
+        }),
+    },
+    storeTags: {
+        table: 'StoreTags',
+        key: 'TagId',
+        columns: ['TagId', 'StoreId', 'Title', 'Slug', 'Content'],
+        shape: (row) => ({
+            id: row.TagId,
+            storeId: row.StoreId,
+            title: row.Title,
+            slug: row.Slug,
+            content: row.Content,
+            key: row.TagId,
+        }),
+    },
+    storeVendors: {
+        table: 'StoreVendors',
+        key: 'VendorId',
+        columns: ['VendorId', 'StoreId', 'Title', 'Slug', 'Content'],
+        shape: (row) => ({
+            id: row.VendorId,
+            storeId: row.StoreId,
+            title: row.Title,
+            slug: row.Slug,
+            content: row.Content,
+            key: row.VendorId,
+        }),
+    },
+    productStoreCategories: {
+        // The product↔category edge. The join table is the association; a product's
+        // categories are composed in the service (one indexed read per edge), not joined —
+        // a to-many join would fan the product row out.
+        table: 'ProductStoreCategories',
+        key: 'Product_Id',
+        columns: ['Product_Id', 'ProductCategory_Id', 'SiteId'],
+        shape: (row) => ({ productId: row.Product_Id, categoryId: row.ProductCategory_Id, key: row.Product_Id }),
+    },
+    productStoreTags: {
+        table: 'ProductStoreTags',
+        key: 'Product_Id',
+        columns: ['Product_Id', 'ProductTag_Id', 'SiteId'],
+        shape: (row) => ({ productId: row.Product_Id, tagId: row.ProductTag_Id, key: row.Product_Id }),
+    },
+    blogs: {
+        // Blogs (one site has many) — the entry to every blog route (task:3873).
+        table: 'Blogs',
+        key: 'BlogId',
+        columns: [
+            'BlogId', 'SiteId', 'Title', 'Alias', 'Path', 'Content', 'Subtitle', 'About', 'AboutType',
+            'BlogLayout', 'BlogLayouts', 'PostLayout', 'CategoryLayout', 'TagLayout', 'AuthorLayout',
+            'ArchiveLayout', 'BlogFields', 'CategoryFields', 'TagFields', 'AuthorFields',
+            'PostPath', 'CategoriesPath', 'TagsPath', 'AuthorsPath', 'ArchivesPath',
+            'PostNumberFormat', 'YearFormat', 'MonthFormat', 'DayFormat', 'LastDateUpdated',
+            'IncludeInSitemap', 'SitemapLastUpdatedTime', 'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        shape: (row) => ({
+            id: row.BlogId,
+            siteId: row.SiteId,
+            title: row.Title,
+            // the legacy blog model swaps the two columns (sequelize/snolla/blog.js):
+            // `path` ← the Alias column, `alias` ← the Path column. The engine reads the
+            // ATTRIBUTE names, so the slice speaks the attribute mapping, not the column names.
+            path: row.Alias,
+            alias: row.Path,
+            content: row.Content,
+            subtitle: row.Subtitle,
+            about: row.About,
+            aboutType: row.AboutType,
+            blogLayout: row.BlogLayout,
+            blogLayouts: row.BlogLayouts,
+            postLayout: row.PostLayout,
+            categoryLayout: row.CategoryLayout,
+            tagLayout: row.TagLayout,
+            authorLayout: row.AuthorLayout,
+            archiveLayout: row.ArchiveLayout,
+            blogFields: row.BlogFields,
+            categoryFields: row.CategoryFields,
+            tagFields: row.TagFields,
+            authorFields: row.AuthorFields,
+            postPath: row.PostPath,
+            categoriesPath: row.CategoriesPath,
+            tagsPath: row.TagsPath,
+            authorsPath: row.AuthorsPath,
+            archivesPath: row.ArchivesPath,
+            postNumberFormat: row.PostNumberFormat,
+            yearFormat: row.YearFormat,
+            monthFormat: row.MonthFormat,
+            dayFormat: row.DayFormat,
+            lastDateUpdated: row.LastDateUpdated,
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: row.SitemapLastUpdatedTime,
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            key: row.BlogId,
+        }),
+    },
+    blogPosts: {
+        // The blog post (Sequelize `blogPost` → table Posts). `slug` is the `Alias` column.
+        table: 'Posts',
+        key: 'PostId',
+        columns: [
+            'PostId', 'BlogId', 'SiteId', 'AuthorId', 'Number', 'Title', 'Excerpt', 'ExcerptType',
+            'Content', 'Alias', 'Published', 'DatePublished', 'DateCreated', 'TemplateId',
+            'IncludeInSitemap', 'SitemapLastUpdatedTime', 'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        shape: (row) => ({
+            id: row.PostId,
+            blogId: row.BlogId,
+            authorId: row.AuthorId,
+            number: row.Number,
+            title: row.Title,
+            excerpt: row.Excerpt,
+            excerptType: row.ExcerptType,
+            content: row.Content,
+            slug: row.Alias,
+            published: asBool(row.Published),
+            datePublished: asInstant(row.DatePublished),
+            dateCreated: asInstant(row.DateCreated),
+            templateId: row.TemplateId,
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: asInstant(row.SitemapLastUpdatedTime),
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            key: row.PostId,
+        }),
+    },
+    blogPostTemplates: {
+        table: 'BlogPostTemplates',
+        key: 'TemplateId',
+        columns: ['TemplateId', 'BlogId', 'Name', 'Alias', 'Description', 'Content', 'CustomDefaultLayout', 'Layouts'],
+        shape: (row) => ({
+            id: row.TemplateId,
+            blogId: row.BlogId,
+            name: row.Name,
+            alias: row.Alias,
+            description: row.Description,
+            content: row.Content,
+            customDefaultLayout: row.CustomDefaultLayout,
+            layouts: row.Layouts,
+            key: row.TemplateId,
+        }),
+    },
+    blogCategories: {
+        table: 'BlogCategories',
+        key: 'CategoryId',
+        columns: ['CategoryId', 'BlogId', 'Title', 'Description', 'Alias', 'Published', 'Content'],
+        shape: (row) => ({
+            id: row.CategoryId,
+            blogId: row.BlogId,
+            title: row.Title,
+            description: row.Description,
+            slug: row.Alias,
+            published: asBool(row.Published),
+            content: row.Content,
+            key: row.CategoryId,
+        }),
+    },
+    blogTags: {
+        table: 'BlogTags',
+        key: 'TagId',
+        columns: ['TagId', 'BlogId', 'Title', 'Description', 'Alias', 'Published', 'Content'],
+        shape: (row) => ({
+            id: row.TagId,
+            blogId: row.BlogId,
+            title: row.Title,
+            description: row.Description,
+            slug: row.Alias,
+            published: asBool(row.Published),
+            content: row.Content,
+            key: row.TagId,
+        }),
+    },
+    blogAuthors: {
+        table: 'BlogAuthors',
+        key: 'AuthorId',
+        columns: ['AuthorId', 'BlogId', 'Title', 'Slug', 'AdministratorId', 'Content'],
+        shape: (row) => ({
+            id: row.AuthorId,
+            blogId: row.BlogId,
+            title: row.Title,
+            slug: row.Slug,
+            administratorId: row.AdministratorId,
+            content: row.Content,
+            key: row.AuthorId,
+        }),
+    },
+    blogCategoryPosts: {
+        table: 'BlogCategoryPosts',
+        key: 'BlogCategory_Id',
+        columns: ['BlogCategory_Id', 'Post_Id', 'SiteId'],
+        shape: (row) => ({ categoryId: row.BlogCategory_Id, postId: row.Post_Id, key: row.BlogCategory_Id }),
+    },
+    blogTagPosts: {
+        table: 'BlogTagPosts',
+        key: 'BlogTag_Id',
+        columns: ['BlogTag_Id', 'Post_Id', 'SiteId'],
+        shape: (row) => ({ tagId: row.BlogTag_Id, postId: row.Post_Id, key: row.BlogTag_Id }),
+    },
+    pages: {
+        table: 'Pages',
+        key: 'Path',
+        // Legacy `getPageByPath` lowercases the path and relied on the MSSQL collation
+        // being case-insensitive. Postgres compares case-sensitively, so an exact match
+        // would silently 404 every mixed-case path — parity lives here, not in a caller.
+        keyFold: 'lower',
+        columns: [
+            'PageId', 'SiteId', 'Path', 'Title', 'Content', 'TemplateId', 'Published', 'IncludeInSitemap',
+            // the sitemap author controls (sitemap.service.js reads them off the row)
+            'SitemapLastUpdatedTime', 'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        join: {
+            table: 'PageTemplates',
+            on: ['TemplateId', 'TemplateId'],
+            columns: ['TemplateId', 'Alias', 'Name', 'Content', 'CustomDefaultLayout', 'Layouts'],
+        },
+        shape: (row) => ({
+            // the DB-loaded shape getPageViewModel expects (contentPages.js)
+            id: row.PageId,
+            siteId: row.SiteId,
+            path: row.Path,
+            title: row.Title,
+            content: row.Content,
+            templateId: row.TemplateId,
+            published: asBool(row.Published),
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: row.SitemapLastUpdatedTime,
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            template: row.tpl_TemplateId
+                ? {
+                    id: row.tpl_TemplateId,
+                    alias: row.tpl_Alias,
+                    name: row.tpl_Name,
+                    content: row.tpl_Content,
+                    customDefaultLayout: row.tpl_CustomDefaultLayout,
+                    layouts: row.tpl_Layouts,
+                }
+                : null,
+            // the fixture backend carries the key on every row; a provider swap must not lose it
+            key: row.Path,
+        }),
+    },
+    staticPages: {
+        // Static pages are a separate canon table (StaticPages) with their own sitemap
+        // flags — the sitemap enumerates them as their own source (`static-pages`), and the
+        // staticPages middleware serves their body/content-type by path.
+        table: 'StaticPages',
+        key: 'PageId',
+        columns: [
+            'PageId', 'SiteId', 'Path', 'Content', 'ContentType', 'Encoding', 'Published', 'IncludeInSitemap',
+            'SitemapLastUpdatedTime', 'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        shape: (row) => ({
+            id: row.PageId,
+            siteId: row.SiteId,
+            path: row.Path,
+            content: row.Content,
+            contentType: row.ContentType,
+            encoding: row.Encoding,
+            published: asBool(row.Published),
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: row.SitemapLastUpdatedTime,
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            key: row.PageId,
+        }),
+    },
+    pageTemplates: {
+        // The template row on its own (task:3933): a listing narrows pages by template, and
+        // the pages slice cannot filter on its joined columns — so the alias resolves to an id
+        // first, and the paginated read/count carry the id filter.
+        table: 'PageTemplates',
+        key: 'TemplateId',
+        columns: ['TemplateId', 'SiteId', 'Alias', 'Name', 'Content', 'CustomDefaultLayout', 'Layouts'],
+        shape: (row) => ({
+            id: row.TemplateId,
+            siteId: row.SiteId,
+            alias: row.Alias,
+            name: row.Name,
+            content: row.Content,
+            customDefaultLayout: row.CustomDefaultLayout,
+            layouts: row.Layouts,
+            key: row.TemplateId,
+        }),
+    },
+    reviewTemplates: {
+        // A review template is its own row (task:3933): the reviews listing narrows by alias, and
+        // a joined column is out of the filter's reach — so the alias resolves to an id first.
+        table: 'ReviewTemplates',
+        key: 'TemplateId',
+        columns: ['TemplateId', 'SiteId', 'Name', 'Alias', 'Description', 'Content', 'CustomDefaultLayout', 'Layouts'],
+        shape: (row) => ({
+            id: row.TemplateId,
+            siteId: row.SiteId,
+            name: row.Name,
+            alias: row.Alias,
+            description: row.Description,
+            content: row.Content,
+            customDefaultLayout: row.CustomDefaultLayout,
+            layouts: row.Layouts,
+            key: row.TemplateId,
+        }),
+    },
+    reviews: {
+        // The reviewed item is joined as `item` (task:3933): the legacy include narrowed the
+        // listing by the PAGE's `Published` (and its path), so that column is filterable through
+        // its qualifier (`where: { 'Pages.Published': true }`) — a bare `Published` is the review's.
+        table: 'Reviews',
+        key: 'ReviewId',
+        columns: [
+            'ReviewId', 'SiteId', 'ItemType', 'ItemId', 'TemplateId', 'ReviewerName', 'ReviewerEmail',
+            'Public', 'Rating', 'Summary', 'Details', 'Pros', 'Cons', 'Fields',
+            'HelpfulVotesCount', 'NotHelpfulVotesCount', 'Published', 'DatePublished', 'IsSpam', 'IsDublicate',
+        ],
+        join: {
+            table: 'Pages',
+            on: ['ItemId', 'PageId'],
+            // the legacy `item` was loaded with `attributes: ['id', 'path', 'title']`
+            columns: ['PageId', 'Path', 'Title', 'Published'],
+        },
+        shape: (row) => ({
+            id: row.ReviewId,
+            siteId: row.SiteId,
+            itemType: row.ItemType,
+            itemId: row.ItemId,
+            templateId: row.TemplateId,
+            reviewerName: row.ReviewerName,
+            reviewerEmail: row.ReviewerEmail,
+            public: asBool(row.Public),
+            rating: row.Rating,
+            summary: row.Summary,
+            details: row.Details,
+            pros: row.Pros,
+            cons: row.Cons,
+            fields: row.Fields,
+            helpfulVotesCount: row.HelpfulVotesCount,
+            notHelpfulVotesCount: row.NotHelpfulVotesCount,
+            published: asBool(row.Published),
+            datePublished: row.DatePublished,
+            isSpam: asBool(row.IsSpam),
+            isDublicate: asBool(row.IsDublicate),
+            item: row.tpl_PageId ? { id: row.tpl_PageId, path: row.tpl_Path, title: row.tpl_Title } : null,
+            key: row.ReviewId,
+        }),
+    },
+    // Feeds (task:3933): a feed is resolved by its pre-lowered alias and configured by child
+    // rows, so the service reads two slices and nests (`core/lib/services/feeds.js`).
+    feeds: {
+        table: 'Feeds',
+        key: 'FeedId',
+        columns: ['FeedId', 'SiteId', 'Title', 'Alias', 'LoweredAlias', 'Discriminator', 'Content', 'FetchInterval'],
+        shape: (row) => ({
+            id: row.FeedId,
+            siteId: row.SiteId,
+            title: row.Title,
+            alias: row.Alias,
+            loweredAlias: row.LoweredAlias,
+            discriminator: row.Discriminator,
+            content: row.Content,
+            fetchInterval: row.FetchInterval,
+            key: row.FeedId,
+        }),
+    },
+    feedParams: {
+        table: 'FeedParams',
+        key: 'ParamId',
+        columns: ['ParamId', 'FeedId', 'Key', 'Value', 'Liquidizable', 'SiteId'],
+        // `key` here is the param NAME the feed renders (`path`, `template`, `orderby`), not the
+        // seam identity — the Sequelize shape the view models read spells it the same way.
+        shape: (row) => ({
+            id: row.ParamId,
+            feedId: row.FeedId,
+            key: row.Key,
+            value: row.Value,
+            liquidizable: asBool(row.Liquidizable),
+        }),
+    },
+    feedPages: {
+        // One table carries all three subtypes (EF table-per-hierarchy); `discriminator`
+        // separates root FeedPage from SegmentFeedPage/SlugFeedPage leaves.
+        table: 'FeedPages',
+        key: 'PageId',
+        columns: [
+            'PageId', 'SiteId', 'ParentPageId', 'Discriminator', 'Path', 'Slug', 'Title', 'FeedId',
+            'TemplateName', 'PageContent', 'PageNumberParamName', 'PageSizeParamName', 'PageSize', 'Level', 'Params',
+        ],
+        shape: (row) => ({
+            id: row.PageId,
+            siteId: row.SiteId,
+            parentPageId: row.ParentPageId,
+            discriminator: row.Discriminator,
+            path: row.Path,
+            slug: row.Slug,
+            title: row.Title,
+            feedId: row.FeedId,
+            templateName: row.TemplateName,
+            pageContent: row.PageContent,
+            pageNumberParamName: row.PageNumberParamName,
+            pageSizeParamName: row.PageSizeParamName,
+            pageSize: row.PageSize,
+            level: row.Level,
+            params: row.Params,
+            key: row.PageId,
+        }),
+    },
+    catalogs: {
+        // A catalog is its own content container (many per site) — section pages, product
+        // listings and taxonomy hanging off it all read this row first (task:3873 sitemap).
+        table: 'Catalogs',
+        key: 'CatalogId',
+        columns: [
+            'CatalogId', 'SiteId', 'Title', 'Path', 'Alias', 'Content',
+            'CatalogLayout', 'CatalogLayouts', 'CatalogFields',
+            'CategoriesLayout', 'CategoryLayout', 'CategoryLayouts', 'CategoryFields',
+            'TagsLayout', 'TagLayout', 'TagLayouts', 'TagFields',
+            'ProductLayout', 'ProductPath', 'ProductsPath', 'ProductNumberFormat',
+            'CategoriesPath', 'TagsPath',
+            'IncludeInSitemap', 'SitemapLastUpdatedTime', 'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        shape: (row) => ({
+            id: row.CatalogId,
+            siteId: row.SiteId,
+            title: row.Title,
+            path: row.Path,
+            alias: row.Alias,
+            content: row.Content,
+            catalogLayout: row.CatalogLayout,
+            catalogLayouts: row.CatalogLayouts,
+            catalogFields: row.CatalogFields,
+            categoriesLayout: row.CategoriesLayout,
+            categoryLayout: row.CategoryLayout,
+            categoryLayouts: row.CategoryLayouts,
+            categoryFields: row.CategoryFields,
+            tagsLayout: row.TagsLayout,
+            tagLayout: row.TagLayout,
+            tagLayouts: row.TagLayouts,
+            tagFields: row.TagFields,
+            productLayout: row.ProductLayout,
+            productPath: row.ProductPath,
+            productsPath: row.ProductsPath,
+            productNumberFormat: row.ProductNumberFormat,
+            categoriesPath: row.CategoriesPath,
+            tagsPath: row.TagsPath,
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: row.SitemapLastUpdatedTime,
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            key: row.CatalogId,
+        }),
+    },
+    catalogProducts: {
+        // Catalog products are their own canon table (CatalogProducts, ProductId-keyed),
+        // one product row per catalog — a different table from the store's Products.
+        table: 'CatalogProducts',
+        key: 'ProductId',
+        columns: [
+            'ProductId', 'CatalogId', 'SiteId', 'TemplateId', 'Number', 'Slug', 'Title', 'Content',
+            'Published', 'IncludeInSitemap',
+            'SitemapLastUpdatedTime', 'SitemapChangeFrequency', 'SitemapPriority',
+        ],
+        shape: (row) => ({
+            id: row.ProductId,
+            catalogId: row.CatalogId,
+            templateId: row.TemplateId,
+            number: row.Number,
+            slug: row.Slug,
+            title: row.Title,
+            content: row.Content,
+            published: asBool(row.Published),
+            includeInSitemap: asBool(row.IncludeInSitemap),
+            sitemapLastUpdatedTime: row.SitemapLastUpdatedTime,
+            sitemapChangeFrequency: row.SitemapChangeFrequency,
+            sitemapPriority: row.SitemapPriority,
+            key: row.ProductId,
+        }),
+    },
+    catalogCategories: {
+        table: 'CatalogCategories',
+        key: 'CategoryId',
+        columns: ['CategoryId', 'CatalogId', 'SiteId', 'Title', 'Slug', 'Content'],
+        shape: (row) => ({
+            id: row.CategoryId,
+            catalogId: row.CatalogId,
+            title: row.Title,
+            slug: row.Slug,
+            content: row.Content,
+            key: row.CategoryId,
+        }),
+    },
+    catalogTags: {
+        table: 'CatalogTags',
+        key: 'TagId',
+        columns: ['TagId', 'CatalogId', 'SiteId', 'Title', 'Slug', 'Content'],
+        shape: (row) => ({
+            id: row.TagId,
+            catalogId: row.CatalogId,
+            title: row.Title,
+            slug: row.Slug,
+            content: row.Content,
+            key: row.TagId,
+        }),
+    },
+    catalogProductTemplates: {
+        // The catalog product's own template (the legacy `include { as: 'template' }`).
+        table: 'CatalogProductTemplates',
+        key: 'TemplateId',
+        columns: ['TemplateId', 'CatalogId', 'Name', 'Alias', 'Content'],
+        shape: (row) => ({
+            id: row.TemplateId,
+            catalogId: row.CatalogId,
+            name: row.Name,
+            alias: row.Alias,
+            content: row.Content,
+            key: row.TemplateId,
+        }),
+    },
+    catalogProductsCategories: {
+        // The catalog product↔category edge; a product's categories are composed in the
+        // service (one indexed read per edge), not joined — a to-many join fans the row out.
+        table: 'CatalogProductsCategories',
+        key: 'ProductId',
+        columns: ['ProductId', 'CategoryId', 'SiteId'],
+        shape: (row) => ({ productId: row.ProductId, categoryId: row.CategoryId, key: row.ProductId }),
+    },
+    catalogProductsTags: {
+        table: 'CatalogProductsTags',
+        key: 'ProductId',
+        columns: ['ProductId', 'TagId', 'SiteId'],
+        shape: (row) => ({ productId: row.ProductId, tagId: row.TagId, key: row.ProductId }),
+    },
+    // Media (task:3888): the view-model builder reads the item's galleries, and images hang off
+    // a gallery 1:N — the declaration carries one table per slice (no `join`), so the caller
+    // enumerates both and nests (`core/lib/services/galleries.js`).
+    galleries: {
+        table: 'Gallery',
+        key: 'IdGallery',
+        columns: ['IdGallery', 'IdOwner', 'Name', 'Title', 'Description', 'TemplateId'],
+        shape: (row) => ({
+            id: row.IdGallery,
+            ownerId: row.IdOwner,
+            name: row.Name,
+            title: row.Title,
+            description: row.Description,
+            templateId: row.TemplateId,
+            key: row.IdGallery,
+        }),
+    },
+    galleryImages: {
+        table: 'GalleryImage',
+        key: 'IdImage',
+        columns: [
+            'IdImage', 'IdGallery', 'Seq', 'Title', 'Alt', 'Description', 'Visible',
+            'Author', 'Copyright', 'Hash', 'OriginalFilename',
+            // the image URL is signed over this pair (and the theme prints the rest): leaving them
+            // out of the read contract degraded every gallery image to s3://undefined/… (task:3944)
+            'StorageClient', 'StorageFilename', 'MimeType', 'Width', 'Height', 'FileSize',
+        ],
+        shape: (row) => ({
+            id: row.IdImage,
+            galleryId: row.IdGallery,
+            seq: row.Seq,
+            title: row.Title,
+            alt: row.Alt,
+            description: row.Description,
+            // Surfaced as a bool instead of filtered here: `Visible` is a bool column, and a
+            // bound bool is dialect-dependent (sqlite/mariadb keep 0/1, postgres a real
+            // boolean), so the caller keeps the filter (services/galleries.js).
+            visible: asBool(row.Visible),
+            author: row.Author,
+            copyright: row.Copyright,
+            hash: row.Hash,
+            originalFilename: row.OriginalFilename,
+            storageClient: row.StorageClient,
+            storageFilename: row.StorageFilename,
+            mimeType: row.MimeType,
+            width: row.Width,
+            height: row.Height,
+            fileSize: row.FileSize,
+            key: row.IdImage,
+        }),
+    },
+    // Theme layouts (task:3944): the render path loads a theme's liquid layouts from the DB at
+    // boot, one row per layout name.
+    layouts: {
+        table: 'Layouts',
+        key: 'LayoutId',
+        columns: ['LayoutId', 'SiteId', 'ThemeId', 'Name', 'LoweredName', 'Content', 'ViewEngineId'],
+        shape: (row) => ({
+            id: row.LayoutId,
+            siteId: row.SiteId,
+            themeId: row.ThemeId,
+            name: row.Name,
+            loweredName: row.LoweredName,
+            content: row.Content,
+            viewEngineId: row.ViewEngineId,
+            key: row.LayoutId,
+        }),
+    },
+    // Media folders and files (task:3933): the media middleware resolves a folder by its owner +
+    // lowered path and then an asset by its folder + lowered filename — one read each.
+    folders: {
+        table: 'Folders',
+        key: 'FolderId',
+        columns: ['FolderId', 'SiteId', 'OwnerId', 'Path', 'LoweredPath'],
+        shape: (row) => ({
+            id: row.FolderId,
+            siteId: row.SiteId,
+            ownerId: row.OwnerId,
+            path: row.Path,
+            loweredPath: row.LoweredPath,
+            key: row.FolderId,
+        }),
+    },
+    files: {
+        table: 'Files',
+        key: 'FileId',
+        columns: ['FileId', 'SiteId', 'FolderId', 'Filename', 'LoweredFilename', 'ContentType', 'Size', 'StorageClient', 'StorageFilename', 'Hash'],
+        shape: (row) => ({
+            id: row.FileId,
+            siteId: row.SiteId,
+            folderId: row.FolderId,
+            filename: row.Filename,
+            loweredFilename: row.LoweredFilename,
+            contentType: row.ContentType,
+            size: Number(row.Size),
+            storageClient: row.StorageClient,
+            storageFilename: row.StorageFilename,
+            hash: row.Hash,
+            key: row.FileId,
+        }),
+    },
+    // Email templates (task:3933): the composer resolves one by its pre-lowered name.
+    emailTemplates: {
+        table: 'EmailTemplates',
+        key: 'TemplateId',
+        columns: [
+            'TemplateId', 'SiteId', 'Name', 'LoweredName', 'Description',
+            'From', 'FromDisplayName', 'To', 'Cc', 'Bcc', 'Subject', 'HtmlEnabled', 'PlainText', 'Html',
+        ],
+        shape: (row) => ({
+            id: row.TemplateId,
+            siteId: row.SiteId,
+            name: row.Name,
+            loweredName: row.LoweredName,
+            description: row.Description,
+            from: row.From,
+            fromDisplayName: row.FromDisplayName,
+            to: row.To,
+            cc: row.Cc,
+            bcc: row.Bcc,
+            subject: row.Subject,
+            htmlEnabled: asBool(row.HtmlEnabled),
+            plainText: row.PlainText,
+            html: row.Html,
+            key: row.TemplateId,
+        }),
+    },
+    // Forms (task:3944): the submission flow reads one form by path with its template, writes the
+    // submission, and resolves the recipients' admin emails. `Administrators` is a control-scope
+    // table, read here through the site channel because the mode is one schema (requirements:67
+    // R2): the guard scopes site tables and leaves a control table alone.
+    forms: {
+        table: 'Forms',
+        key: 'FormId',
+        columns: ['FormId', 'SiteId', 'Name', 'Content', 'SubmissionAction', 'RedirectUrl', 'SuccessMessage', 'Path', 'TemplateId'],
+        join: {
+            table: 'FormTemplates',
+            on: ['TemplateId', 'TemplateId'],
+            columns: ['TemplateId', 'Alias', 'Name', 'Content', 'ConfirmationEmailTemplate', 'SubmissionEmailTemplate', 'CustomDefaultLayout', 'Layouts'],
+        },
+        shape: (row) => ({
+            id: row.FormId,
+            siteId: row.SiteId,
+            name: row.Name,
+            content: row.Content,
+            submissionAction: row.SubmissionAction,
+            redirectUrl: row.RedirectUrl,
+            successMessage: row.SuccessMessage,
+            path: row.Path,
+            templateId: row.TemplateId,
+            template: row.tpl_TemplateId
+                ? {
+                    id: row.tpl_TemplateId,
+                    alias: row.tpl_Alias,
+                    name: row.tpl_Name,
+                    content: row.tpl_Content,
+                    confirmationEmailTemplate: row.tpl_ConfirmationEmailTemplate,
+                    submissionEmailTemplate: row.tpl_SubmissionEmailTemplate,
+                    customDefaultLayout: row.tpl_CustomDefaultLayout,
+                    layouts: row.tpl_Layouts,
+                }
+                : null,
+            key: row.FormId,
+        }),
+    },
+    formSubmissions: {
+        table: 'FormSubmissions',
+        key: 'SubmissionId',
+        columns: ['SubmissionId', 'SiteId', 'FormId', 'Date', 'UtcDate', 'Number', 'IpAddress', 'UserAgent', 'IsSpam', 'Content'],
+        shape: (row) => ({
+            id: row.SubmissionId,
+            siteId: row.SiteId,
+            formId: row.FormId,
+            date: row.Date,
+            utcDate: row.UtcDate,
+            number: row.Number,
+            ipAddress: row.IpAddress,
+            userAgent: row.UserAgent,
+            isSpam: asBool(row.IsSpam),
+            content: row.Content,
+            key: row.SubmissionId,
+        }),
+    },
+    formRecipients: {
+        table: 'FormRecipients',
+        key: 'RecipientId',
+        columns: ['RecipientId', 'SiteId', 'FormId', 'AdministratorId', 'DateCreated', 'UtcDateCreated'],
+        shape: (row) => ({
+            id: row.RecipientId,
+            siteId: row.SiteId,
+            formId: row.FormId,
+            administratorId: row.AdministratorId,
+            dateCreated: row.DateCreated,
+            key: row.RecipientId,
+        }),
+    },
+    administrators: {
+        table: 'Administrators',
+        key: 'AdministratorId',
+        // no Password column: the serving path reads identity for the recipient emails, and a
+        // read contract that hands out credentials is a leak waiting for a caller
+        columns: ['AdministratorId', 'Username', 'FirstName', 'LastName', 'Email', 'DateCreated'],
+        shape: (row) => ({
+            id: row.AdministratorId,
+            username: row.Username,
+            firstName: row.FirstName,
+            lastName: row.LastName,
+            email: row.Email,
+            dateCreated: row.DateCreated,
+            key: row.AdministratorId,
+        }),
+    },
+    // Numbering (task:3933): the task is a DICTIONARY (no SiteId — one set of rows for the whole
+    // database), so it is read through the control channel; the counters are the tenant's own and
+    // are read AND written through the site channel (`packages/numbering/numberingProvider.js`).
+    numberingTasks: {
+        table: 'NumberingTasks',
+        key: 'TaskId',
+        columns: ['TaskId', 'Label', 'Name', 'Commentary', 'PeriodTypeId', 'MinNumber', 'MaxNumber'],
+        shape: (row) => ({
+            id: row.TaskId,
+            label: row.Label,
+            name: row.Name,
+            description: row.Commentary,
+            periodTypeId: row.PeriodTypeId,
+            minNumber: row.MinNumber,
+            maxNumber: row.MaxNumber,
+            key: row.TaskId,
+        }),
+    },
+    numberingCounters: {
+        table: 'NumberingCounters',
+        key: 'CounterId',
+        columns: ['CounterId', 'SiteId', 'TaskId', 'OwnerId', 'Date', 'LastNumber'],
+        shape: (row) => ({
+            id: row.CounterId,
+            siteId: row.SiteId,
+            taskId: row.TaskId,
+            ownerId: row.OwnerId,
+            date: row.Date,
+            lastNumber: row.LastNumber,
+            key: row.CounterId,
+        }),
+    },
+    // Part templates (task:3888): one slice per canon table, named after the LEGACY model the
+    // engine passes to fillViewModel (see core/lib/services/partTemplates.js for the mapping).
+    pagePartTemplates: partTemplateSlice('PagePartTemplates', 'SiteId'),
+    blogPostPartTemplates: partTemplateSlice('BlogPostPartTemplates', 'BlogId'),
+    catalogProductPartTemplates: partTemplateSlice('CatalogProductPartTemplates', 'CatalogId'),
+    storeProductPartTemplates: partTemplateSlice('ProductPartTemplates', 'StoreId'),
+    storePartTemplates: partTemplateSlice('StorePartTemplates', 'StoreId'),
+    tableRecordPartTemplates: partTemplateSlice('TableRecordPartTemplates', 'SiteId'),
+    // Data tables (task:3933): a table row carries its template, and its records hang off
+    // TableId — one read per call, composed in `core/lib/services/tables.js`.
+    tables: {
+        table: 'Tables',
+        key: 'TableId',
+        columns: ['TableId', 'SiteId', 'Title', 'Slug', 'TemplateId'],
+        join: {
+            table: 'TableTemplates',
+            on: ['TemplateId', 'TemplateId'],
+            columns: ['TemplateId', 'Alias', 'Name', 'Description', 'Content', 'CustomDefaultLayout', 'Layouts'],
+        },
+        shape: (row) => ({
+            id: row.TableId,
+            siteId: row.SiteId,
+            title: row.Title,
+            slug: row.Slug,
+            templateId: row.TemplateId,
+            template: row.tpl_TemplateId
+                ? {
+                    id: row.tpl_TemplateId,
+                    alias: row.tpl_Alias,
+                    name: row.tpl_Name,
+                    description: row.tpl_Description,
+                    content: row.tpl_Content,
+                    customDefaultLayout: row.tpl_CustomDefaultLayout,
+                    layouts: row.tpl_Layouts,
+                }
+                : null,
+            key: row.TableId,
+        }),
+    },
+    tableRecords: {
+        table: 'TableRecords',
+        key: 'RecordId',
+        columns: ['RecordId', 'SiteId', 'TableId', 'Title', 'Slug', 'Content', 'Published', 'DatePublished'],
+        shape: (row) => ({
+            id: row.RecordId,
+            siteId: row.SiteId,
+            tableId: row.TableId,
+            title: row.Title,
+            slug: row.Slug,
+            content: row.Content,
+            published: asBool(row.Published),
+            datePublished: row.DatePublished,
+            key: row.RecordId,
+        }),
+    },
+};
+/** `Server=host;Database=db;User Id=u;Password=p;Port=1433;Encrypt=true;…` → tedious config. */
+const parseMssqlDsn = (dsn) => {
+    const parts = {};
+    for (const pair of dsn.split(';')) {
+        const at = pair.indexOf('=');
+        if (at > 0)
+            parts[pair.slice(0, at).trim().toLowerCase()] = pair.slice(at + 1).trim();
+    }
+    const pick = (...names) => names.map((name) => parts[name]).find((value) => value !== undefined);
+    // classic MSSQL syntax puts the port after the host: `Server=host,1433`
+    const rawServer = String(pick('server', 'data source', 'host') ?? '').replace(/^tcp:/i, '');
+    const [host, inlinePort] = rawServer.split(',');
+    const server = host.trim();
+    const database = pick('database', 'initial catalog');
+    const rawPort = pick('port') ?? inlinePort ?? 1433;
+    const port = Number(rawPort);
+    // this is the migration SOURCE (plan:49 Q4): a typo here means a transfer silently
+    // reads nothing, and tedious reports it later in its own words
+    if (!server)
+        throw new Error('db-provider: the MSSQL DSN names no server (Server=/Data Source=)');
+    if (!database)
+        throw new Error('db-provider: the MSSQL DSN names no database (Database=/Initial Catalog=)');
+    if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+        throw new Error(`db-provider: the MSSQL DSN has an unusable port (${JSON.stringify(rawPort)})`);
+    }
+    return {
+        server,
+        options: {
+            database,
+            port,
+            encrypt: pick('encrypt') !== 'false',
+            trustServerCertificate: pick('trustservercertificate', 'trust server certificate') !== 'false',
+            // tedious defaults to 15 s; a cutover DELETE on a 166k-row table (Folders) legitimately
+            // runs longer and dies as a bare ETIMEOUT. `RequestTimeout=0` = no client-side limit.
+            requestTimeout: pick('requesttimeout') === undefined ? 15000 : Number(pick('requesttimeout')),
+        },
+        authentication: {
+            type: 'default',
+            options: {
+                userName: pick('user id', 'uid', 'user', 'username'),
+                password: pick('password', 'pwd'),
+            },
+        },
+    };
+};
+/**
+ * T-SQL spells `limit`/`offset` as `OFFSET n ROWS FETCH NEXT m ROWS ONLY`, and the fetch
+ * requires an `ORDER BY`. Kysely compiles the generic `limit`, which SQL Server rejects —
+ * so paging on the migration source is fixed here, once, instead of in every caller
+ * (found by task:3955: the admin API lists pages on MSSQL).
+ */
+class MssqlFetchCompiler extends MssqlQueryCompiler {
+    #limit = null;
+    compileQuery(node) {
+        this.#limit = null;
+        return super.compileQuery(new MssqlPagingTransformer().transformNode(node));
+    }
+    // `limit` is visited first, `offset` last: hold the fetch and emit it after the offset,
+    // which is the only order T-SQL accepts (`OFFSET n ROWS FETCH NEXT m ROWS ONLY`).
+    visitLimit(node) {
+        this.#limit = node.limit;
+    }
+    visitOffset(node) {
+        this.append('offset ');
+        this.visitNode(node.offset);
+        this.append(' rows');
+        if (this.#limit) {
+            this.append(' fetch next ');
+            this.visitNode(this.#limit);
+            this.append(' rows only');
+        }
+    }
+}
+class MssqlPagingTransformer extends OperationNodeTransformer {
+    transformSelectQuery(node) {
+        const transformed = super.transformSelectQuery(node);
+        if (!transformed.limit)
+            return transformed;
+        // `limit` alone is `TOP(n)`: a fetch needs an ORDER BY, and ordering a whole table
+        // just to take n rows is the difference between milliseconds and a full sort.
+        if (!transformed.offset && !transformed.orderBy) {
+            // `top()` takes the literal count; the limit node wraps it in a value node.
+            return { ...transformed, top: TopNode.create(transformed.limit.limit.value), limit: undefined };
+        }
+        // Paged reads keep an ORDER BY (offset/fetch demands one); an unordered page gets
+        // the dialect-neutral `(select null)`.
+        return {
+            ...transformed,
+            orderBy: transformed.orderBy ??
+                OrderByNode.create([
+                    OrderByItemNode.create(RawNode.createWithSql('(select null)'), RawNode.createWithSql('asc')),
+                ]),
+            offset: transformed.offset ?? OffsetNode.create(ValueNode.createImmediate(0)),
+        };
+    }
+}
+/**
+ * SQL Server's driver hands every `decimal`/`numeric` back as a JS float — in every
+ * version of tedious, by construction (`value * sign / 10**scale`). The canon says a
+ * decimal is a string precisely because floats lose money, and `decimal(18,2)` reaches
+ * past a double's exact range, so a read that skipped this would quietly round prices.
+ *
+ * The rewrite is per query: a plain `select *` of one canon table becomes the explicit
+ * column list, with decimal columns cast to text. It stays inside the dialect seam
+ * (task:3994) and only touches the shape it must — a joined `select *` is left alone,
+ * and callers that name their columns are untouched.
+ */
+class MssqlDecimalTexts extends OperationNodeTransformer {
+    transformSelectQuery(node) {
+        const transformed = super.transformSelectQuery(node);
+        if (transformed.joins?.length)
+            return transformed;
+        const source = transformed.from?.froms?.[0];
+        if (!source)
+            return transformed;
+        const tableNode = source.kind === 'AliasNode' ? source.node : source;
+        // a table reference is `SchemableIdentifierNode` (schema + identifier) in Kysely 0.28+
+        const tableName = tableNode?.table?.identifier?.name ?? tableNode?.table?.name;
+        const qualifier = source.kind === 'AliasNode' ? source.alias?.name ?? source.alias?.identifier?.name : tableName;
+        const spec = tableNode?.kind === 'TableNode' ? CANON_TABLES.get(tableName) : null;
+        if (!spec || !qualifier)
+            return transformed;
+        const decimals = Object.entries(spec.columns)
+            .filter(([, column]) => column.type === 'decimal')
+            .map(([name]) => name);
+        if (!decimals.length)
+            return transformed;
+        const isStar = (selection) => selection.selection?.kind === 'SelectAllNode' || selection.selection?.column?.kind === 'SelectAllNode';
+        if (!transformed.selections.some(isStar))
+            return transformed;
+        // The cast rides NEXT TO `*` under the SAME name: the driver keeps the last value for
+        // a duplicated column, and the SQL Server evaluates the cast, so the caller sees the
+        // exact text. Expanding `*` into an explicit canon list would instead break every
+        // read of a database that predates the migration (no `SiteId` column yet) — which is
+        // exactly the migration source (task:3994).
+        const casts = decimals.map((name) => SelectionNode.create(AliasNode.create(sql `cast(${sql.id(qualifier, name)} as ${sql.raw('nvarchar(50)')})`.toOperationNode(), IdentifierNode.create(name))));
+        return { ...transformed, selections: [...transformed.selections, ...casts] };
+    }
+}
+class PagingMssqlDialect extends MssqlDialect {
+    createQueryCompiler() {
+        return new MssqlFetchCompiler();
+    }
+}
+/** The table name a `TableNode`/aliased table points at — nullable. */
+const tableNameOf = (node) => {
+    const table = node?.kind === 'AliasNode' ? node.node : node;
+    return table?.table?.identifier?.name ?? table?.table?.name ?? null;
+};
+/** True when the canon declares `table.column` a decimal (money). */
+const isDecimal = (table, column) => {
+    const spec = table ? CANON_TABLES.get(table) : null;
+    return spec?.columns?.[column]?.type === 'decimal';
+};
+/**
+ * A SQLite decimal reaches the caller as a number, like on every other cell (task:4094, 4140).
+ *
+ * The canon renders a decimal column as `text` on SQLite (`mapType` — money must not become a
+ * float in the DDL), so the driver hands back `"1170"`. The other dialects coerce at their own
+ * seam (pg's NUMERIC parser, mysql2's `decimalNumbers`); SQLite had no seam, so a price read on
+ * a SQLite cell dropped out of the site's `typeof price === 'number'` filter and the product card
+ * lost its per-piece price (measured 2026-10-28: 166 routes of the SQLite stand).
+ *
+ * Same decision as task:4094, taken on the selection: `node:sqlite` reports no declared column
+ * type, and the result hook of a Kysely plugin gets no query shape, so the cast rides the SQL —
+ * the shape MssqlDecimalTexts already uses for the same disagreement (there: to text). Only the
+ * reads the cell itself compiles are rewritten: a column list whose columns are canon-decimal.
+ */
+class SqliteDecimalNumbers {
+    transformQuery({ node }) {
+        if (node?.kind !== 'SelectQueryNode' || !node.selections?.length)
+            return node;
+        let rewritten = false;
+        const selections = node.selections.map((selection) => {
+            const reference = selection?.selection;
+            if (reference?.kind !== 'ReferenceNode')
+                return selection;
+            const table = tableNameOf(reference.table);
+            const column = reference.column?.column?.name;
+            if (!isDecimal(table, column))
+                return selection;
+            rewritten = true;
+            return SelectionNode.create(AliasNode.create(sql `cast(${sql.id(table, column)} as real)`.toOperationNode(), IdentifierNode.create(column)));
+        });
+        return rewritten ? { ...node, selections } : node;
+    }
+    transformResult({ result }) {
+        return result;
+    }
+}
+/**
+ * The dialect a DSN names — the one place the product reads a scheme.
+ * Postgres/MariaDB keep their URI, MSSQL accepts the Prisma-era `sqlserver://` spelling
+ * and the driver's own ADO form, SQLite the `file:` convention (`:memory:` included).
+ */
+export const dialectOf = (dsn) => {
+    const text = String(dsn ?? '');
+    if (text.startsWith(':memory:'))
+        return 'sqlite';
+    const scheme = text.split(':')[0]?.toLowerCase() ?? '';
+    switch (scheme) {
+        case 'postgres':
+        case 'postgresql':
+            return 'postgres';
+        case 'mysql':
+        case 'mariadb':
+            return 'mariadb';
+        case 'sqlserver':
+        case 'mssql':
+            return 'mssql';
+        case 'sqlite':
+        case 'file':
+            return 'sqlite';
+        default:
+            throw new Error(`db-provider: unsupported dialect in DSN "${scheme}:" (expected postgres://, mysql://, sqlserver:// or file:)`);
+    }
+};
+/**
+ * `sqlserver://host:1433;database=db;user=u;password=p` (the Prisma-era URL a deployment
+ * still carries) → the driver's ADO spelling. Only the first segment differs: host and port
+ * live in the URL authority.
+ */
+const mssqlUrlToAdo = (dsn) => {
+    const [authority, ...settings] = String(dsn).replace(/^(sqlserver|mssql):\/\//i, '').split(';');
+    // The Prisma-era URL carries credentials in the authority (`user:password@host:port`);
+    // what follows the last `@` is the address, and the password may itself hold colons.
+    const at = authority.lastIndexOf('@');
+    const credentials = at === -1 ? '' : authority.slice(0, at);
+    const [host, port] = (at === -1 ? authority : authority.slice(at + 1)).split(':');
+    const colon = credentials.indexOf(':');
+    const user = colon === -1 ? credentials : credentials.slice(0, colon);
+    const password = colon === -1 ? '' : credentials.slice(colon + 1);
+    return [
+        `Server=${host}`,
+        port ? `Port=${port}` : '',
+        user ? `User Id=${decodeURIComponent(user)}` : '',
+        user ? `Password=${decodeURIComponent(password)}` : '',
+        ...settings,
+    ]
+        .filter(Boolean)
+        .join(';');
+};
+/**
+ * The string the driver of `dialect` expects, from any spelling the deployment may hand
+ * over. Applications pass the DSN through and never reshape it (requirements:67 R1.3).
+ */
+export const normalizeDsn = (dialect, dsn) => {
+    switch (dialect) {
+        case 'mssql':
+            return /^(sqlserver|mssql):\/\//i.test(String(dsn)) ? mssqlUrlToAdo(dsn) : dsn;
+        case 'sqlite':
+            // `file:`/`sqlite:` are our DSN conventions; node:sqlite wants the path itself.
+            return String(dsn).replace(/^(file|sqlite):(\/\/)?/i, '');
+        default:
+            return dsn;
+    }
+};
+/**
+ * Load an optional dialect driver.
+ *
+ * The drivers live in `optionalDependencies`: a cell installs the one dialect it uses, and the
+ * other three are dead weight (~8 MB plus the @azure tree behind `tedious`). An optional
+ * dependency may be absent, so the absence has to be tellable apart from a broken install:
+ * ERR_MODULE_NOT_FOUND from a lazy import deep inside the provider is not (task:4042).
+ */
+const RESOLUTION_CODES = new Set(['ERR_MODULE_NOT_FOUND', 'MODULE_NOT_FOUND']);
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+// LIKE pattern for a prefix filter: the escape CHARACTER is `!`, escaping itself and the two
+// wildcards. A backslash is the obvious choice and the wrong one: MariaDB reads `escape '\'`
+// as an unterminated literal (ER_PARSE_ERROR 1064) — `!` is unambiguous on every dialect.
+const LIKE_ESCAPE = '!';
+const likePrefix = (text) => String(text).toLowerCase().replace(/[!%_]/g, (ch) => `${LIKE_ESCAPE}${ch}`);
+// "the driver itself is absent" — not "the driver is installed but something inside it is
+// broken". Both arrive as a resolution error, and only the first one is ours to explain.
+const namesMissingTopLevel = (error, specifier) => {
+    if (!RESOLUTION_CODES.has(error?.code))
+        return false;
+    const message = String(error?.message ?? '');
+    return new RegExp(`Cannot find (?:package|module) ['"]${escapeRegExp(specifier)}(?:[/'"])`).test(message);
+};
+export const loadDriver = async (specifier, dialect) => {
+    try {
+        return await import(__rewriteRelativeImportExtension(specifier));
+    }
+    catch (error) {
+        if (!namesMissingTopLevel(error, specifier))
+            throw error;
+        const missing = new Error(`db-provider: the ${dialect} driver is not installed � '${specifier}' is an optional dependency. ` +
+            `Install it in the package that declares this deployment profile (yarn add ${specifier}), ` +
+            'or install without omitting optional dependencies.', { cause: error });
+        missing.code = 'ERR_DIALECT_DRIVER_MISSING';
+        throw missing;
+    }
+};
+/**
+ * A UUID reaches the caller in the canon's one form — lowercase (task:4000, 4129).
+ *
+ * `tedious` hands a `uniqueidentifier` back UPPERCASE while every canon identifier (generated
+ * types, `PAGE_TEMPLATE_IDS`, sitemap keys) is lowercase, so a consumer that compares ids takes
+ * its fallback branch: the site lost the CMS title/description on 13 routes of the MSSQL stand
+ * while MariaDB/Postgres/SQLite rendered them (measured 2026-10-29). The other two dialects hand
+ * back lowercase by themselves, so this lives on the MSSQL seam only.
+ *
+ * The result hook of a Kysely plugin carries no query shape here, so the test is the value's
+ * own shape: a driver UUID matches exactly, and text that merely contains one is left alone.
+ */
+const UUID_TEXT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const lowerUuidValues = (rows) => {
+    for (const row of rows ?? []) {
+        for (const [key, value] of Object.entries(row)) {
+            if (typeof value === 'string' && value !== value.toLowerCase() && UUID_TEXT.test(value)) {
+                row[key] = value.toLowerCase();
+            }
+        }
+    }
+    return rows;
+};
+const mssqlDialect = async (dsn) => {
+    const [tarnModule, tediousModule] = await Promise.all([loadDriver('tarn', 'mssql'), loadDriver('tedious', 'mssql')]);
+    const Tarn = tarnModule.default ?? tarnModule;
+    const Tedious = tediousModule.default ?? tediousModule;
+    const config = parseMssqlDsn(dsn);
+    return new PagingMssqlDialect({
+        tarn: { ...Tarn, options: { min: 0, max: 5 } },
+        tedious: { ...Tedious, connectionFactory: () => new Tedious.Connection(config) },
+    });
+};
+/**
+ * A decimal column is money, and money has one JS type on every cell (task:4094).
+ *
+ * The drivers disagree by default: `tedious` (MSSQL) and `node:sqlite` return a number,
+ * `pg` and `mysql2` return the DECIMAL as text. The production engine ran on MSSQL, so every
+ * consumer in the ecosystem (`typeof price === 'number'` in the site's cards, sums in the
+ * loader) was written against numbers — on a MariaDB/Postgres cell those values fall out of
+ * the filter and the price silently disappears from the page.
+ *
+ * Only NUMERIC/DECIMAL (oid 1700) is coerced. BIGINT (20) stays text on purpose: a 64-bit
+ * integer does not survive `Number`, and no canon column of that shape is a price.
+ *
+ * The result is a JS double, the same representation the MSSQL source handed out — at
+ * `decimal(18,2)` it holds every value the column can store for display and for the
+ * arithmetic the site does (a price times a volume).
+ */
+const NUMERIC_OID = 1700;
+const numericTypes = (pg) => ({
+    getTypeParser: (oid, format) => oid === NUMERIC_OID
+        ? (value) => (value === null ? null : Number(value))
+        : pg.types.getTypeParser(oid, format),
+});
+/**
+ * The parts of a mysql DSN as a connection config.
+ *
+ * `mysql2` reads a URL only when the whole config *is* that string, which leaves no room for
+ * an option next to it (`decimalNumbers`). The query string of the DSN is forwarded as
+ * options, so an unusual `?charset=`/`?timezone=` keeps working.
+ */
+const mysqlDsnParts = (dsn) => {
+    const url = new URL(dsn);
+    if (!/^(mysql|mariadb):$/.test(url.protocol)) {
+        throw new Error(`db-provider: a mariadb DSN must be mysql:// or mariadb://, got ${url.protocol}//`);
+    }
+    const parts = {
+        host: url.hostname,
+        port: url.port ? Number(url.port) : 3306,
+        user: decodeURIComponent(url.username),
+        password: decodeURIComponent(url.password),
+    };
+    const database = url.pathname.replace(/^\//, '');
+    if (database)
+        parts.database = decodeURIComponent(database);
+    for (const [key, value] of url.searchParams)
+        parts[key] = value;
+    return parts;
+};
+const buildDialect = async (name, dsn) => {
+    switch (name) {
+        case 'postgres': {
+            const pg = await loadDriver('pg', 'postgres');
+            return new PostgresDialect({ pool: new pg.Pool({ connectionString: dsn, types: numericTypes(pg) }) });
+        }
+        case 'mariadb': {
+            // Kysely's MySQL driver speaks the callback API of mysql2, not the promise one.
+            // `decimalNumbers` is the same decision as Postgres' NUMERIC parser above: a decimal
+            // column is money (task:4094), and `mysql2` hands it over as text unless asked.
+            const mysql = (await loadDriver('mysql2', 'mariadb')).default;
+            return new MysqlDialect({ pool: mysql.createPool({ ...mysqlDsnParts(dsn), decimalNumbers: true }) });
+        }
+        // sqlite has no dialect-only path: `openSqlite` opens the file eagerly, so the
+        // handle it locks must be owned by something that can close it on destroy —
+        // `openDb` routes sqlite to `sqliteKysely` before reaching here.
+        case 'sqlite':
+            throw new Error('db-provider: sqlite must go through openDb (the handle needs an owner that closes it)');
+        case 'mssql':
+            return mssqlDialect(dsn);
+        default:
+            throw new Error(`db-provider: unsupported dialect "${name}" (${DIALECTS.join(', ')})`);
+    }
+};
+/**
+ * A raw Kysely handle from a DSN — the tooling seam (site transfer, task:3826).
+ *
+ * The provider below owns a tenant (`siteId` is mandatory: deny-by-default); the
+ * transfer core takes an open handle and applies the guard itself, so opening a
+ * dialect must be reachable without one. Same dialect list, same DSN syntax — the
+ * cell config stays one contract whether the caller is a cell or a migration tool.
+ */
+export const openDb = async ({ dialect, dsn } = {}) => {
+    if (!dialect || !dsn)
+        throw new Error('db-provider: openDb requires a dialect and a dsn');
+    const normalized = normalizeDsn(dialect, dsn);
+    // Loaded on demand: `node:sqlite` is a builtin the bundlers' externalizer lists do not
+    // know, and a Postgres/MSSQL cell must not depend on it being resolvable.
+    if (dialect === 'sqlite') {
+        const { sqliteKysely } = await import('./sqliteDialect.js');
+        // decimals are text in this dialect's DDL and numbers for every caller (task:4140)
+        return sqliteKysely(normalized, [new SqliteDecimalNumbers()]);
+    }
+    const db = new Kysely({ dialect: await buildDialect(dialect, normalized) });
+    // decimals are text in the canon and floats in the driver: the seam restores the canon
+    return dialect === 'mssql'
+        ? db.withPlugin({
+            transformQuery: ({ node }) => new MssqlDecimalTexts().transformNode(node),
+            // canon forms on the way out: a decimal is text here, a uuid is lowercase
+            transformResult: ({ result }) => {
+                lowerUuidValues(result.rows);
+                return result;
+            },
+        })
+        : db;
+};
+export class DbDataProvider {
+    #db;
+    #raw;
+    #siteId;
+    #slices;
+    #ownsDb;
+    #channel;
+    /**
+     * @param {object} options
+     * @param {import('kysely').Kysely<any>} options.db  an open Kysely instance (the cell's runtime)
+     * @param {string} [options.siteId]  the tenant every read is scoped to (site channel only)
+     * @param {'site'|'control'} [options.channel]  `site` (default) or the control-plane channel
+     *   that reads dictionaries and the site registry — and may not touch site-scoped tables
+     * @param {object} [options.slices]  slice declarations (tests may add their own)
+     * @param {boolean} [options.ownsDb]  true when the provider built the connection itself
+     */
+    constructor({ db, siteId, channel = 'site', slices = SLICES, ownsDb = false } = {}) {
+        if (!db)
+            throw new Error('db-provider: an open Kysely instance ("db") is required');
+        if (channel !== 'site' && channel !== 'control') {
+            throw new Error(`db-provider: unknown channel "${channel}" (site, control)`);
+        }
+        if (channel === 'site' && !siteId) {
+            throw new Error('db-provider: "siteId" is required — without it read queries are deny-by-default');
+        }
+        this.#raw = db;
+        this.#channel = channel;
+        // the provider is the writer path: it grants writes explicitly (task:3865 — a
+        // site handle is read-only without the grant), while a report/export reader
+        // builds its own handle and leaves the grant out
+        this.#db = channel === 'site'
+            ? db.withPlugin(tenantGuard({ kind: 'site', siteId, frozen: false, writable: true }))
+            : db.withPlugin(tenantGuard({ kind: 'control' }));
+        this.#siteId = siteId;
+        this.#slices = slices;
+        this.#ownsDb = ownsDb;
+    }
+    /** Build a provider from a cell config; connections stay lazy until the first query. */
+    static async fromCell(cell, { slices } = {}) {
+        const required = cell?.channel === 'control' ? ['dialect', 'dsn'] : CELL_REQUIRED_KEYS;
+        const missing = required.filter((key) => !cell?.[key]);
+        if (missing.length)
+            throw new Error(`db-provider: cell config is missing ${missing.join(', ')}`);
+        // MSSQL is a cell target since task:3994: the canon renders its DDL like any other
+        // dialect, so a cell on it reads a schema the canon describes. `openDb` already
+        // serves the dialect (it used to be reached only through the migration tool).
+        return new DbDataProvider({
+            db: await openDb({ dialect: cell.dialect, dsn: cell.dsn }),
+            siteId: cell.siteId,
+            channel: cell.channel,
+            slices,
+            ownsDb: true,
+        });
+    }
+    get siteId() {
+        return this.#siteId;
+    }
+    get channel() {
+        return this.#channel;
+    }
+    #spec(slice) {
+        const spec = this.#slices[slice];
+        if (!spec) {
+            throw new Error(`db-provider: unknown slice "${slice}" (known: ${Object.keys(this.#slices).join(', ')})`);
+        }
+        return spec;
+    }
+    #scope(spec, query) {
+        const canon = CANON_TABLES.get(spec.table);
+        if (this.#channel === 'control') {
+            // the control channel reads what has no tenant: dictionaries and the registry.
+            // A site-scoped table is refused here rather than silently unscoped (the guard
+            // would refuse it too — this just says which table and why).
+            if (canon && isSiteScoped(canon)) {
+                throw new Error(`db-provider: slice "${spec.table}" is site-scoped — a control provider cannot read it (build a site provider)`);
+            }
+            return query;
+        }
+        // The R1 guard scopes every SITE-scoped table on its own (it injects the
+        // predicate at compile time). A control-plane table (the Sites registry) is
+        // deliberately out of the guard's reach — so a site handle must pin its own
+        // row here, or the registry would be read unscoped. Deny-by-default: a control
+        // table with no SiteId column cannot be served by a site handle at all.
+        if (canon && !isSiteScoped(canon)) {
+            if (!canon.columns.SiteId) {
+                throw new Error(`db-provider: slice "${spec.table}" is control-plane without a SiteId column — a site handle cannot be scoped to it (build a control provider)`);
+            }
+            return query.where(`${spec.table}.SiteId`, '=', this.#siteId);
+        }
+        return query;
+    }
+    /** A qualified canon column — `Column` of the slice's own table, or `Table.Column` when the
+     *  slice declares that join. A typo is refused, not compiled. */
+    #column(spec, column) {
+        const dot = column.indexOf('.');
+        const table = dot > 0 ? column.slice(0, dot) : spec.table;
+        const name = dot > 0 ? column.slice(dot + 1) : column;
+        if (table !== spec.table && table !== spec.join?.table) {
+            throw new Error(`db-provider: filter on "${column}" — the slice "${spec.table}" declares no join to "${table}"`);
+        }
+        const canon = CANON_TABLES.get(table);
+        if (canon && !canon.columns[name]) {
+            throw new Error(`db-provider: slice "${spec.table}" has no column "${column}" — options must name canon columns`);
+        }
+        return `${table}.${name}`;
+    }
+    /** Equality filters (`null` → IS NULL, an array → IN) plus three case-folded string
+     *  operators (`{ startsWith }`, `{ equals }`, `{ notLike }`). Join columns are out of reach
+     *  by design: a filter that needs the joined row is a slice that needs its own declaration. */
+    #filter(spec, query, where) {
+        if (!where)
+            return query;
+        let filtered = query;
+        for (const [column, value] of Object.entries(where)) {
+            const ref = this.#column(spec, column);
+            if (Array.isArray(value)) {
+                // an empty IN is a valid question with the answer "nothing" — spelled out, since
+                // not every dialect accepts `in ()`
+                filtered = value.length === 0
+                    ? filtered.where(sql `1`, '=', 0)
+                    : filtered.where(ref, 'in', value);
+                continue;
+            }
+            if (value !== null && typeof value === 'object') {
+                // one filter may carry several operators (a path is a prefix AND not a grandchild)
+                for (const [operator, operand] of Object.entries(value)) {
+                    // A prefix filter is a LIKE, and LIKE reserves two characters: a path holding
+                    // `_` would otherwise match any character, so the pattern is escaped. The compare
+                    // folds case because legacy relied on the MSSQL collation being case-insensitive
+                    // and the callers pass lowercased prefixes; postgres LIKE would not.
+                    // The escape CHARACTER is `!`, never a backslash: MariaDB parses `escape '\'`
+                    // as an unterminated literal and answers ER_PARSE_ERROR 1064 (`content-api`'s
+                    // page listing died on a MariaDB cell, measured 2026-10-26).
+                    // shortcut: a folded compare skips the plain Path index, add a functional index
+                    // if a prefix scan ever shows up in a slow query.
+                    if (operator === 'startsWith') {
+                        const prefix = likePrefix(operand);
+                        filtered = filtered.where(sql `lower(${sql.ref(ref)}) like ${`${prefix}%`} escape '!'`);
+                        continue;
+                    }
+                    // `notLike` takes the legacy SQL pattern as-is (the grandchild test composes
+                    // `%/%` wildcards on purpose): the value is bound, never concatenated, so the
+                    // only thing the caller decides is the pattern.
+                    if (operator === 'notLike') {
+                        filtered = filtered.where(sql `lower(${sql.ref(ref)}) not like ${String(operand)} escape '!'`);
+                        continue;
+                    }
+                    // Folded equality: the same case-insensitivity an exact lookup needs, for
+                    // columns whose slice has no `keyFold` (a non-key column compared by path).
+                    if (operator === 'equals') {
+                        filtered = filtered.where(sql `lower(${sql.ref(ref)})`, '=', String(operand).toLowerCase());
+                        continue;
+                    }
+                    throw new Error(`db-provider: filter on "${column}" names no supported operator ("${operator}"; startsWith, notLike, equals)`);
+                }
+                continue;
+            }
+            filtered = value === null ? filtered.where(ref, 'is', null) : filtered.where(ref, '=', value);
+        }
+        return filtered;
+    }
+    /** Deterministic ordering: the requested columns, then the key as the tiebreaker. */
+    #ordered(spec, query, order) {
+        const entries = order ? [...order] : [];
+        const named = new Set(entries.map((entry) => (Array.isArray(entry) ? entry[0] : entry)));
+        if (!named.has(spec.key))
+            entries.push(spec.key);
+        let ordered = query;
+        for (const entry of entries) {
+            const [column, direction] = Array.isArray(entry) ? entry : [entry, 'asc'];
+            ordered = ordered.orderBy(this.#column(spec, column), direction === 'desc' ? 'desc' : 'asc');
+        }
+        return ordered;
+    }
+    /** The slice's FROM, its optional single join, and the tenant scope — the shape every read
+     *  and the count share, so a filter on a joined column narrows the same rows in both. */
+    #from(spec) {
+        let query = this.#db.selectFrom(spec.table);
+        if (spec.join) {
+            const [local, foreign] = spec.join.on;
+            query = query.leftJoin(spec.join.table, `${spec.join.table}.${foreign}`, `${spec.table}.${local}`);
+        }
+        return this.#scope(spec, query);
+    }
+    #select(spec) {
+        let query = this.#from(spec).select(spec.columns.map((column) => `${spec.table}.${column}`));
+        if (spec.join) {
+            query = query.select(spec.join.columns.map((column) => `${spec.join.table}.${column} as tpl_${column}`));
+        }
+        return query;
+    }
+    /** The key expression for a lookup: the raw column, or a folded one (`keyFold`). */
+    #keyExpression(spec) {
+        return spec.keyFold === 'lower'
+            ? sql `lower(${sql.ref(`${spec.table}.${spec.key}`)})`
+            : sql.ref(`${spec.table}.${spec.key}`);
+    }
+    /** One entity by key (path/slug/id) — the seam contract of dataProvider.js. */
+    async get(slice, key) {
+        const spec = this.#spec(slice);
+        const value = spec.keyFold === 'lower' ? String(key).toLowerCase() : key;
+        const row = await this.#select(spec).where(this.#keyExpression(spec), '=', value).executeTakeFirst();
+        return row ? spec.shape(row) : null;
+    }
+    /** All entities of a slice, ordered by the slice key so listing is deterministic. */
+    async enumerate(slice, opts = {}) {
+        const spec = this.#spec(slice);
+        let query = this.#ordered(spec, this.#filter(spec, this.#select(spec), opts.where), opts.order);
+        if (opts.offset)
+            query = query.offset(opts.offset);
+        if (opts.limit)
+            query = query.limit(opts.limit);
+        const rows = await query.execute();
+        return rows.map((row) => spec.shape(row));
+    }
+    /** The count behind a listing — same tenant scope and filters as `enumerate`, no page window. */
+    async count(slice, opts = {}) {
+        const spec = this.#spec(slice);
+        const filtered = this.#filter(spec, this.#from(spec), opts.where);
+        const row = await filtered.select(sql `count(*)`.as('count')).executeTakeFirstOrThrow();
+        return Number(row.count);
+    }
+    /**
+     * The write half of the seam (task:3933): a slice may be written, not only read.
+     *
+     * `values` names CANON columns, exactly like `where` does, and only columns the slice
+     * declares: the declaration is the contract on both sides, so a write cannot reach a
+     * column the reads never see. The tenant key is NOT the caller's to set — the guard
+     * injects `SiteId` from the provider it belongs to and refuses a payload that carries one.
+     */
+    async insert(slice, values = {}) {
+        const spec = this.#spec(slice);
+        const row = { ...values };
+        // the legacy models generated the key client-side; the seam keeps that, so an insert
+        // never depends on a dialect's RETURNING support
+        if (row[spec.key] === undefined)
+            row[spec.key] = randomUUID();
+        for (const column of Object.keys(row))
+            this.#writable(spec, column);
+        await this.#db.insertInto(spec.table).values(row).execute();
+        return this.get(slice, row[spec.key]);
+    }
+    /**
+     * Change one row by key, within the tenant: the guard adds the site predicate to the UPDATE.
+     *
+     * `opts.where` makes the write conditional (a compare-and-set): the row is updated only while
+     * the named columns still hold the named values. The read-back cannot tell a conditional miss
+     * from a match, so a CAS caller compares the field it stamped — the search drainer does
+     * exactly that (`SearchIndexCreationTimestamp` still null means a save re-dirtied the site).
+     */
+    async update(slice, key, values = {}, opts = {}) {
+        const spec = this.#spec(slice);
+        const row = { ...values };
+        delete row[spec.key];
+        for (const column of Object.keys(row))
+            this.#writable(spec, column);
+        const query = this.#db
+            .updateTable(spec.table)
+            .set(row)
+            .where(this.#keyExpression(spec), '=', spec.keyFold === 'lower' ? String(key).toLowerCase() : key);
+        await this.#filter(spec, query, opts.where).execute();
+        // No row-count check: the drivers disagree on how (and whether) they report one, and the
+        // guard's predicate already makes another tenant's key a no-op. Reading the row back says
+        // the truth in the one vocabulary the seam has — null when this tenant does not own it.
+        return this.get(slice, key);
+    }
+    /** A column a write may set: a bare canon column the slice selects (no join, no key games). */
+    #writable(spec, column) {
+        if (column === 'SiteId') {
+            throw new Error('db-provider: SiteId is the access layer\'s, not the payload\'s');
+        }
+        if (!spec.columns.includes(column)) {
+            throw new Error(`db-provider: slice "${spec.table}" does not declare "${column}" — a write may only set what the read contract carries`);
+        }
+        const canon = CANON_TABLES.get(spec.table);
+        if (canon && !canon.columns[column]) {
+            throw new Error(`db-provider: slice "${spec.table}" has no column "${column}"`);
+        }
+    }
+    /**
+     * Raw connectivity probe (the MSSQL source role). Deliberately runs on the
+     * UNGUARDED handle: a raw statement cannot be scoped by the guard, so pretending
+     * otherwise would be worse than saying it out loud. It is an operator/diagnostic
+     * entry point — never feed it a query parameter (canon: raw SQL is an escape hatch).
+     */
+    async probe(statement) {
+        const { rows } = await sql `${sql.raw(statement)}`.execute(this.#raw);
+        return rows;
+    }
+    /** Closes the connection only when the provider owns it; an injected db is the caller's. */
+    async close() {
+        if (this.#ownsDb)
+            await this.#raw.destroy();
+    }
+}
+export const createDbProvider = (cell, options) => DbDataProvider.fromCell(cell, options);