pgkiln 0.35.0 → 0.37.0

package/src/builder/ai-builder.ts

@@ -9,6 +9,7 @@ import type { Session } from '../session.ts';
 import { appOr404 } from './forms.ts';
 import { isAdmin } from './locks.ts';
 import { appHeader, back, BASE, csrf, developer, flash, region, select, send, shell, workshopTabs, type Req } from './ui.ts';
+import { workshopDb } from './workspaces.ts';
 import { WIZARD_KINDS, wizardTables } from './wizards.ts';
 
 // App Builder AI (migration 062), with the AI service an administrator
@@ -43,10 +44,20 @@ async function ask(s: Session, req: Parameters<typeof generate>[1]) {
   return generate(svc.name, req, { appId: null, user: s.username, source: 'builder' });
 }
 
-/** Schemas a developer may describe or ask about (not pgkiln's, not the system's). */
-async function schemas() {
-  return (await owner.query<{ n: string }>(
-    `select nspname as n from pg_namespace where nspname !~ '^pg_' and nspname not in ('information_schema', 'meta') order by 1`)).rows.map((r) => r.n);
+/** Schemas a developer may describe or ask about (not pgkiln's, not the system's; in an isolated workspace, its own). */
+async function schemas(s: Session) {
+  const db = await workshopDb(s);
+  return (await db.query<{ n: string }>(
+    `select nspname as n from pg_namespace where nspname !~ '^pg_' and nspname not in ('information_schema', 'meta')
+       ${db === owner ? '' : `and has_schema_privilege(oid, 'USAGE')`} order by 1`)).rows.map((r) => r.n);
+}
+
+/** A table's descriptions as database comments. */
+async function comment(c: { query: (sql: string) => Promise<unknown> }, t: TableInfo, notes: [string, string][]) {
+  const rel = `${pg.escapeIdentifier(t.schema)}.${pg.escapeIdentifier(t.table)}`;
+  const what = t.kind === 'view' ? 'view' : t.kind === 'materialized view' ? 'materialized view' : 'table';
+  for (const [col, note] of notes)
+    await c.query(col ? `comment on column ${rel}.${pg.escapeIdentifier(col)} is ${note ? pg.escapeLiteral(note) : 'null'}` : `comment on ${what} ${rel} is ${note ? pg.escapeLiteral(note) : 'null'}`);
 }
 
 interface TableInfo {
@@ -130,7 +141,7 @@ const SQL_SCHEMA = {
 };
 
 async function workshopPage(s: Session, reply: FastifyReply, out: { question?: string; schema?: string; sql?: string; error?: string; result?: Raw }) {
-  const list = await schemas();
+  const list = await schemas(s);
   const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ai')}
     ${await serviceBox(s)}
     <p><a href="${BASE}/sql/ai/describe">Describe tables for AI ▸</a> <span class="muted">(better answers: say what tables and columns mean)</span></p>
@@ -162,7 +173,7 @@ async function workshopPage(s: Session, reply: FastifyReply, out: { question?: s
 const isName = (v: unknown): v is string => typeof v === 'string' && v.length > 0 && v.length <= 63;
 
 async function describePage(s: Session, reply: FastifyReply, schema: string, table: string, draft: { table?: string; columns?: Record<string, string> } | null, message?: Raw) {
-  const list = await schemas();
+  const list = await schemas(s);
   const tables = schema && list.includes(schema) ? await tableInfo({ schema }) : [];
   const t = table ? tables.find((x) => x.table === table) : undefined;
   const noted = new Set((await owner.query<{ t: string }>(`select distinct table_name as t from meta.ai_table_note where schema_name = $1`, [schema])).rows.map((r) => r.t));
@@ -299,7 +310,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     let result: Raw;
     try {
       if (!question) throw new AiError('config', 'Type a question.');
-      if (!(await schemas()).includes(schema)) throw new AiError('config', 'Choose a schema.');
+      if (!(await schemas(s)).includes(schema)) throw new AiError('config', 'Choose a schema.');
       const res = await ask(s, {
         system: `You write PostgreSQL ${(await owner.one<{ v: number }>(`select current_setting('server_version_num')::int / 10000 as v`))!.v} SQL for a developer, for these tables and views:\n\n${describeTables(await tableInfo({ schema }))}\n\n` +
           'Use only those tables and columns, qualified with their schema. Write a SELECT unless the question clearly asks to change data. The developer reviews the SQL before anything runs.',
@@ -331,7 +342,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     let result: Raw;
     try {
       if (!sql.trim() && !error.trim()) throw new AiError('config', 'Paste a query, an error message or both.');
-      const tables = schema && (await schemas()).includes(schema) ? describeTables(await tableInfo({ schema })) : '';
+      const tables = schema && (await schemas(s)).includes(schema) ? describeTables(await tableInfo({ schema })) : '';
       const res = await ask(s, {
         system: 'You explain PostgreSQL to a developer: what a query does, why an error happens and how to fix it. Be concise; show corrected SQL when it helps.' +
           (tables ? `\n\nThe tables and views of the schema:\n\n${tables}` : ''),
@@ -352,10 +363,10 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
   });
 
   /** The posted table, checked against the catalog (null: unknown or reserved). */
-  const postedTable = async (b: Record<string, any>) => {
+  const postedTable = async (s: Session, b: Record<string, any>) => {
     const schema = String(b.schema ?? '');
     const table = String(b.table ?? '');
-    if (!isName(schema) || !isName(table) || RESERVED.test(schema)) return null;
+    if (!isName(schema) || !isName(table) || RESERVED.test(schema) || !(await schemas(s)).includes(schema)) return null;
     return (await tableInfo({ schema, table }))[0] ?? null;
   };
 
@@ -363,11 +374,14 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     const s = await developer(req, reply);
     if (!s) return;
     const b = (req.body ?? {}) as Record<string, any>;
-    const t = await postedTable(b);
+    const t = await postedTable(s, b);
     if (!t) return reply.code(404).send('Not found');
     const notes: [string, string][] = [['', String(b['note:'] ?? '')], ...t.columns.map((c): [string, string] => [c.name, String(b[`note:${c.name}`] ?? '')])]
       .map(([k, v]) => [k, v.replace(/\s+/g, ' ').trim().slice(0, 2000)]);
     try {
+      // database comments as the developer's SQL connection (an isolated workspace: its own login), then the notes
+      const db = await workshopDb(s);
+      if (b.comments === 'true' && db !== owner) await db.tx((c) => comment(c, t, notes));
       await owner.tx(async (c) => {
         for (const [col, note] of notes) {
           if (note) await c.query(
@@ -376,12 +390,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
             [t.schema, t.table, col, note, s.username]);
           else await c.query('delete from meta.ai_table_note where schema_name = $1 and table_name = $2 and column_name = $3', [t.schema, t.table, col]);
         }
-        if (b.comments === 'true') {
-          const rel = `${pg.escapeIdentifier(t.schema)}.${pg.escapeIdentifier(t.table)}`;
-          const what = t.kind === 'view' ? 'view' : t.kind === 'materialized view' ? 'materialized view' : 'table';
-          for (const [col, note] of notes)
-            await c.query(col ? `comment on column ${rel}.${pg.escapeIdentifier(col)} is ${note ? pg.escapeLiteral(note) : 'null'}` : `comment on ${what} ${rel} is ${note ? pg.escapeLiteral(note) : 'null'}`);
-        }
+        if (b.comments === 'true' && db === owner) await comment(c, t, notes);
       });
       flash(s, `Descriptions of ${t.schema}.${t.table} saved${b.comments === 'true' ? ', also as database comments' : ''}.`);
     } catch (e) {
@@ -394,7 +403,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     const s = await developer(req, reply);
     if (!s) return;
     const b = (req.body ?? {}) as Record<string, any>;
-    const t = await postedTable(b);
+    const t = await postedTable(s, b);
     if (!t) return reply.code(404).send('Not found');
     const names = t.columns.map((c) => c.name);
     try {

package/src/builder/blueprints.ts

@@ -133,7 +133,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.get(`${BASE}/blueprints`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const list = (await owner.query(`select b.id, b.name, b.created_by, b.updated_at::text as updated, a.id as app_id, a.alias from meta.blueprint b left join meta.app a on a.id = b.app_id order by lower(b.name), b.id`)).rows;
+    const list = (await owner.query(`select b.id, b.name, b.created_by, b.updated_at::text as updated, a.id as app_id, a.alias from meta.blueprint b left join meta.app a on a.id = b.app_id where b.workspace_id = $1 order by lower(b.name), b.id`, [currentWorkspace(s)])).rows;
     return page(s, reply, '', html`<h1>Blueprints</h1>
       <p class="muted">Describe an application as a blueprint (tables, pages, menu, sample rows), review it and create it. <a class="btn btn-hot" href="${BASE}/blueprints/new">${icon('plus')} New blueprint</a></p>
       ${list.length
@@ -154,7 +154,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.get(`${BASE}/blueprints/:id(^\\d+$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const b = await owner.one('select id, name, spec from meta.blueprint where id = $1', [req.params.id]);
+    const b = await owner.one('select id, name, spec from meta.blueprint where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]);
     if (!b) return reply.code(404).send('Not found');
     return editor(s, reply, { id: b.id, name: b.name, spec: JSON.stringify(b.spec, null, 2) });
   });
@@ -178,8 +178,8 @@ export async function blueprintRoutes(app: FastifyInstance) {
     if (error || !json || typeof json !== 'object' || Array.isArray(json))
       return editor(s, reply, { ...o, message: html`<div class="alert alert-error" role="alert">${error ?? 'A blueprint is a JSON object.'}</div>` });
     const id = o.id
-      ? (await owner.one('update meta.blueprint set name = $2, spec = $3, updated_at = now() where id = $1 returning id', [o.id, o.name, JSON.stringify(json)]))?.id
-      : (await owner.one('insert into meta.blueprint (name, spec, created_by) values ($1, $2, $3) returning id', [o.name, JSON.stringify(json), s.username])).id;
+      ? (await owner.one('update meta.blueprint set name = $2, spec = $3, updated_at = now() where id = $1 and workspace_id = $4 returning id', [o.id, o.name, JSON.stringify(json), currentWorkspace(s)]))?.id
+      : (await owner.one('insert into meta.blueprint (name, spec, created_by, workspace_id) values ($1, $2, $3, $4) returning id', [o.name, JSON.stringify(json), s.username, currentWorkspace(s)])).id;
     if (!id) return reply.code(404).send('Not found');
     flash(s, `Blueprint ${o.name} saved.`);
     return back(reply, s, `${BASE}/blueprints/${id}`);
@@ -240,8 +240,8 @@ export async function blueprintRoutes(app: FastifyInstance) {
           throw new Error(createAppError(e, checked.alias));
         });
         const r = await buildBlueprint(c, blueprint, checked.role, { dashboard: (tables, no) => addDashboard(c, checked.alias, tables, no) });
-        if (o.id) await c.query('update meta.blueprint set app_id = $2, spec = $3, updated_at = now() where id = $1', [o.id, a.id, JSON.stringify(json)]);
-        else await c.query('insert into meta.blueprint (name, spec, created_by, app_id) values ($1, $2, $3, $4)', [o.name, JSON.stringify(json), s.username, a.id]);
+        if (o.id) await c.query('update meta.blueprint set app_id = $2, spec = $3, updated_at = now() where id = $1 and workspace_id = $4', [o.id, a.id, JSON.stringify(json), currentWorkspace(s)]);
+        else await c.query('insert into meta.blueprint (name, spec, created_by, app_id, workspace_id) values ($1, $2, $3, $4, $5)', [o.name, JSON.stringify(json), s.username, a.id, currentWorkspace(s)]);
         return { ...r, existing: a.existingAccount };
       });
       await logActivity({ username: s.username, event: 'blueprint', ip: clientIp(req), detail: `created ${blueprint.alias} from blueprint ${o.name}` });
@@ -255,7 +255,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.post(`${BASE}/blueprints/:id(^\\d+$)/delete`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const r = await owner.query('delete from meta.blueprint where id = $1', [req.params.id]);
+    const r = await owner.query('delete from meta.blueprint where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]);
     flash(s, r.rowCount ? 'Blueprint deleted (applications created from it stay).' : 'There is no such blueprint.');
     return back(reply, s, `${BASE}/blueprints`);
   });

package/src/builder/code-editor.ts

@@ -1,10 +1,11 @@
 import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { owner, runtime } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html, raw, type Raw } from '../html.ts';
 import { checkSql, type SqlShape } from './advisor.ts';
 import { BASE, developer, type Req } from './ui.ts';
-import { appAllowed } from './workspaces.ts';
+import { appAllowed, workshopDb } from './workspaces.ts';
 
 // The builder's code editor (public/code-editor.js) and its SQL completions.
 //
@@ -215,7 +216,7 @@ export async function codeEditorRoutes(app: FastifyInstance) {
     if (!sql.trim()) return reply.send({ ok: true, message: 'Nothing to check.' });
     if (/^\s*(STATIC|LOV):/i.test(sql)) return reply.send({ ok: true, message: 'Not SQL: a static or shared list of values.' });
     const role = target ? (await owner.one('select db_role from meta.app where id = $1', [target.id]))?.db_role : null;
-    const c = await owner.pool.connect();
+    const c = await (target ? await devDbForApp(target.id) : await workshopDb(s)).pool.connect();
     try {
       await c.query('begin');
       await c.query(`set local statement_timeout = '5s'`);

package/src/builder/components.ts

@@ -104,7 +104,7 @@ export const COMPONENTS: Record<string, ComponentSpec> = {
       { name: 'title', label: 'Title', kind: 'text', group: 'Identification' },
       { name: 'static_id', label: 'Static ID', kind: 'text', group: 'Identification',
         help: 'Optional, unique on the page: lower case letters, digits, _ and -, starting with a letter. Names the region in exported files (so renaming it keeps them) and is data-static-id on the page, for CSS and JavaScript.' },
-      { name: 'type', label: 'Type', kind: 'select', options: ['report', 'grid', 'form', 'chart', 'cards', 'calendar', 'facets', 'smart_filters', 'display_selector', 'tasks', 'workflows', 'map', 'tree', 'template_component', 'list', 'static', 'dynamic', 'data_reporter', 'ai_assistant', 'plugin', 'url', 'search'], group: 'Identification' },
+      { name: 'type', label: 'Type', kind: 'select', options: ['report', 'grid', 'form', 'login', 'chart', 'cards', 'calendar', 'facets', 'smart_filters', 'display_selector', 'tasks', 'workflows', 'map', 'tree', 'template_component', 'list', 'static', 'dynamic', 'data_reporter', 'ai_assistant', 'plugin', 'url', 'search'], group: 'Identification' },
       { name: 'source', label: 'Source', kind: 'code', wide: true, group: 'Source',
         help: 'report/grid: a SELECT (use :ITEM binds) · chart: label column + one numeric column per series · cards: title, subtitle, body, badge, icon · calendar: start_date, end_date, title · map: lat and lng (or location "lat,lng"), title, body, geojson · tree: id, parent_id, label, icon · template_component: any SELECT (its columns are #COLUMN# in the template), or empty for one instance · dynamic: a SELECT returning HTML (escape with meta.html_escape) · static: HTML with &ITEM. substitutions · url: the page to show, https://host/path?q=&P1_ITEM. (the host is written out; items are URL-encoded) or a path on this server (/a/other/1).' },
       { name: 'rest_source', label: 'REST data source', kind: 'rest_source', group: 'Source',
@@ -114,7 +114,7 @@ export const COMPONENTS: Record<string, ComponentSpec> = {
       { name: 'pk_item', label: 'Primary key item (form)', kind: 'upper', group: 'Source' },
       { name: 'seq', label: 'Sequence', kind: 'int', group: 'Layout' },
       { name: 'columns', label: 'Column span (1-12)', kind: 'int', group: 'Layout' },
-      { name: 'template', label: 'Template', kind: 'select', options: ['standard', 'plain', 'collapsible'], group: 'Layout' },
+      { name: 'template', label: 'Template', kind: 'select', options: ['standard', 'plain', 'collapsible', 'hero', 'title_bar', 'buttons_container', 'inline_dialog', 'inline_drawer', 'wizard'], group: 'Layout', help: 'hero: a large banner (title, text, {"icon":"…"} in the attributes, buttons). title_bar: title and buttons on one line. buttons_container: the buttons only. inline_dialog, inline_drawer: hidden until a dynamic action Open region (or a link to #R<id>) opens it over the page. wizard: a narrow card for one step (a list region with template wizard_progress shows the steps).' },
       { name: 'template_options', label: 'Template options', kind: 'options', choices: REGION_OPTIONS, group: 'Appearance',
         help: 'CSS classes from a fixed list, added to the region (APEX: Template Options). "Hide the header" applies to the standard template.' },
       { name: 'condition', label: 'Server-side condition (SQL)', kind: 'code', group: 'Security', help: 'Boolean expression; the region renders only when true.' },
@@ -448,6 +448,19 @@ export const COMPONENTS: Record<string, ComponentSpec> = {
       buildOption(),
     ],
   },
+  page_group: {
+    table: 'meta.page_group',
+    scope: 'app',
+    label: 'Page group',
+    plural: 'Page groups',
+    icon: 'layers',
+    summary: (o) => o.name,
+    defaults: {},
+    fields: [
+      { name: 'name', label: 'Name', kind: 'text', help: 'e.g. Administration. Pages join it in their Page group property; renaming the group renames it on its pages.' },
+      { name: 'description', label: 'Description', kind: 'text', wide: true },
+    ],
+  },
   build_option: {
     table: 'meta.build_option',
     scope: 'app',

package/src/builder/dataload.ts

@@ -26,6 +26,7 @@ import { readMultipart } from '../runtime/files.ts';
 import type { Session } from '../session.ts';
 import type { ComponentSpec } from './components.ts';
 import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Body, type Req } from './ui.ts';
+import { appWorkspace, currentWorkspace, workshopDb } from './workspaces.ts';
 
 // SQL Workshop → Load Data: upload a CSV/TSV/XLSX/JSON/XML file, preview it,
 // and load it into a new table (column types inferred) or an existing one
@@ -73,17 +74,23 @@ export const DATA_LOAD_DEF_SPEC: ComponentSpec = {
 export const dataLoadDefExtras = (row: { id: number }) =>
   html`<p class="u-mt1"><a class="btn" href="${BASE}/sql/load?definition=${row.id}">${icon('upload')} Load a file with this definition</a></p>`;
 
-async function definitions() {
+/** The data load definitions of the current workspace's applications. */
+async function definitions(s: Session) {
   return (
     await owner.query<{ id: number; app_id: number; app_name: string; name: string; table_name: string }>(
-      'select d.id, d.app_id, a.name as app_name, d.name, d.table_name from meta.data_load_def d join meta.app a on a.id = d.app_id order by a.name, d.name',
+      `select d.id, d.app_id, a.name as app_name, d.name, d.table_name from meta.data_load_def d join meta.app a on a.id = d.app_id
+        where meta.app_workspace(a.id) = $1 order by a.name, d.name`,
+      [currentWorkspace(s)],
     )
   ).rows;
 }
 
-async function definition(id: unknown) {
+async function definition(s: Session, id: unknown) {
   if (!/^\d+$/.test(String(id ?? ''))) return undefined;
-  return owner.one<DataLoadDefinition & { id: number; app_id: number }>('select * from meta.data_load_def where id = $1', [id]);
+  return owner.one<DataLoadDefinition & { id: number; app_id: number }>(
+    'select * from meta.data_load_def where id = $1 and meta.app_workspace(app_id) = $2',
+    [id, currentWorkspace(s)],
+  );
 }
 
 export const MAX_MB = Number(process.env.DATA_LOAD_MAX_MB ?? 50);
@@ -142,7 +149,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
   });
 
   const uploadForm = async (s: Session, error?: string, chosen?: string) => {
-    const defs = await definitions();
+    const defs = await definitions(s);
     return region(
       'Load data from a file',
       html`${error ? html`<div class="alert alert-error" role="alert">${error}</div>` : ''}
@@ -180,7 +187,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
     if (!s) return;
     if (!file) return page(s, reply, await uploadForm(s, 'Choose a file.'));
     if (file.truncated) return page(s, reply, await uploadForm(s, `The file is larger than ${MAX_MB} MB.`));
-    const def = await definition(req.body?.definition);
+    const def = await definition(s, req.body?.definition);
     const rowTag = (req.body?.row_tag ?? '').trim();
     try {
       if (def) await parseFile(file.filename, file.data, { headers: def.headers, format: def.format, rowTag: def.row_tag });
@@ -203,7 +210,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
     if (!f) return reply.redirect(`${BASE}/sql/load`);
     const headers = (req.query.h ?? req.body?.h) !== '0';
     const rowTag = (req.query.rt ?? req.body?.rt ?? '').trim();
-    const def = await definition(req.query.d ?? req.body?.d);
+    const def = await definition(s, req.query.d ?? req.body?.d);
     let sheet: Sheet;
     try {
       sheet = def
@@ -256,17 +263,19 @@ export async function dataLoadRoutes(app: FastifyInstance) {
       ${skip}
       <div class="buttons"><button class="btn btn-hot">Create table and load</button></div></form>`;
 
+    const db = await workshopDb(s);
     const tables = (
-      await owner.query(
+      await db.query(
         `select c.oid::regclass::text as name from pg_class c join pg_namespace n on n.oid = c.relnamespace
-          where c.relkind in ('r', 'p') and n.nspname !~ '^pg_' and n.nspname not in ('information_schema', 'meta') order by 1`,
+          where c.relkind in ('r', 'p') and n.nspname !~ '^pg_' and n.nspname not in ('information_schema', 'meta')
+            and has_table_privilege(c.oid, 'INSERT') order by 1`,
       )
     ).rows.map((r) => r.name as string);
     const chosen = tables.find((t) => t === (req.query.table ?? req.body?.table));
-    const apps = (await owner.query<{ id: number; name: string }>('select id, name from meta.app order by name')).rows;
+    const apps = (await owner.query<{ id: number; name: string }>('select id, name from meta.app where meta.app_workspace(id) = $1 order by name', [currentWorkspace(s)])).rows;
     let mapping: Raw | '' = '';
     if (chosen) {
-      const cols = await owner.tx((c) => tableColumns(c, chosen));
+      const cols = await db.tx((c) => tableColumns(c, chosen));
       const auto = autoMap(sheet.headers, cols);
       const hasPk = cols.some((c) => c.pk);
       mapping = html`<form method="post" action="${action}">${hidden}<input type="hidden" name="target" value="existing"><input type="hidden" name="table" value="${chosen}">
@@ -335,6 +344,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
       const mode = ['append', 'replace', 'merge'].includes(b.mode ?? '') ? b.mode : 'append';
       const format = sheet instanceof Error ? 'auto' : sheet.format;
       try {
+        if (!/^\d{1,9}$/.test(String(b.def_app ?? '')) || (await appWorkspace(String(b.def_app))) !== currentWorkspace(s)) throw new LoadError('Choose an application of this workspace.');
         const r = await owner.one(
           `insert into meta.data_load_def (app_id, name, table_name, format, headers, row_tag, mode, skip_errors, columns)
            values ($1, $2, $3, $4, $5, $6, $7, $8, $9) returning id, app_id`,
@@ -344,7 +354,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
         return back(reply, s, `${BASE}/apps/${r!.app_id}/shared?c=data_load_def-${r!.id}`);
       } catch (e) {
         const code = (e as { code?: string }).code;
-        if (!code?.startsWith('23') && code !== '22P02') throw e;
+        if (!(e instanceof LoadError) && !code?.startsWith('23') && code !== '22P02') throw e;
         reply.code(422);
         return targetPage(req, reply, s, html`<div class="alert alert-error" role="alert">The definition could not be saved: ${
           code === '23505' ? `the application already has a definition named ${name}.` : (e as Error).message}</div>`);
@@ -354,10 +364,10 @@ export async function dataLoadRoutes(app: FastifyInstance) {
     let error: string | undefined;
     let failed = false;
     try {
-      const def = b.target === 'definition' ? await definition(b.d) : undefined;
+      const def = b.target === 'definition' ? await definition(s, b.d) : undefined;
       const sheet = def ? null : await parseFile(f.filename, f.content, { headers, rowTag });
       const opts = { skipErrors: b.skip_errors === 'true', firstRow: headers && sheet && (sheet.format === 'csv' || sheet.format === 'xlsx') ? 2 : 1 };
-      result = await owner.tx(async (c) => {
+      result = await (await workshopDb(s)).tx(async (c) => {
         if (def) return loadWithDefinition(c, def, f);
         if (!sheet) throw new LoadError('The data load definition no longer exists.');
         if (b.target === 'new') {

package/src/builder/ddl-tools.ts

@@ -0,0 +1,117 @@
+import type { FastifyInstance } from 'fastify';
+import { unifiedDiff } from '../cli/diff.ts';
+import { owner } from '../db.ts';
+import { changeScript, compare, ddlScript, OBJECT_TYPES, pick, readSchema, userSchemas, type Difference } from '../ddl.ts';
+import { html, raw, type Raw } from '../html.ts';
+import { icon } from '../icons.ts';
+import { clientIp, logActivity } from '../session.ts';
+import { BASE, developer, region, send, shell, workshopTabs, type Req } from './ui.ts';
+import { workshopDb } from './workspaces.ts';
+
+// SQL Workshop → Generate DDL and Schema Comparison (APEX: SQL Workshop →
+// Utilities). Both only read the catalog (src/ddl.ts); the scripts they
+// write are shown and downloaded, never run.
+
+const TYPE_LABELS: Record<(typeof OBJECT_TYPES)[number], string> = {
+  types: 'Types and domains', sequences: 'Sequences', tables: 'Tables (constraints, indexes)', views: 'Views and materialized views',
+  functions: 'Functions and procedures', triggers: 'Triggers', policies: 'Row level security and policies',
+};
+const STATE_LABELS: Record<Difference['state'], string> = { source: 'Only in the source', target: 'Only in the target', different: 'Different' };
+
+const many = (v: unknown) => ([] as string[]).concat((v as string | string[] | undefined) ?? []);
+const schemaSelect = (name: string, label: string, schemas: string[], current: string) =>
+  html`<div class="field"><label class="label" for="f_${name}">${label}</label>
+    <select id="f_${name}" name="${name}" required><option value="">- choose a schema -</option>${schemas.map((x) => html`<option value="${x}"${x === current ? raw(' selected') : ''}>${x}</option>`)}</select></div>`;
+
+/** A unified diff with added and removed lines marked. */
+const diffBlock = (d: Difference, source: string, target: string) => {
+  const text = unifiedDiff(d.name, Buffer.from(`${d.target ?? ''}\n`), Buffer.from(`${d.source ?? ''}\n`), [target, source]);
+  return html`<pre class="diff">${text.trimEnd().split('\n').map((l, i) => html`${i ? '\n' : ''}<span class="${l.startsWith('+') && !l.startsWith('+++') ? 'diff-add' : l.startsWith('-') && !l.startsWith('---') ? 'diff-del' : null}">${l}</span>`)}</pre>`;
+};
+
+export async function ddlToolRoutes(app: FastifyInstance) {
+  app.get(`${BASE}/sql/ddl`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const db = await workshopDb(s);
+    const schemas = await userSchemas(db, { usable: db !== owner });
+    const q = req.query ?? {};
+    const schema = schemas.includes(q.schema ?? '') ? q.schema! : '';
+    // the first visit: every type, comments and grants
+    const fresh = !q.schema;
+    const types = new Set(fresh ? OBJECT_TYPES : many(q.t).filter((x) => (OBJECT_TYPES as readonly string[]).includes(x)));
+    const opts = { comments: fresh || q.comments === '1', grants: fresh || q.grants === '1' };
+    let result: Raw | '' = '';
+    if (schema) {
+      try {
+        const objects = pick(await readSchema(db.pool, schema), types, opts);
+        const script = ddlScript(schema, objects);
+        await logActivity({ username: s.username, event: 'generate_ddl', ip: clientIp(req), detail: `${schema}: ${objects.length} objects` });
+        if (q.download === '1')
+          return reply.header('content-disposition', `attachment; filename="${schema}.sql"`).type('application/sql; charset=utf-8').send(script);
+        const qs = new URLSearchParams([['schema', schema], ...[...types].map((x) => ['t', x]), ...(opts.comments ? [['comments', '1']] : []), ...(opts.grants ? [['grants', '1']] : []), ['download', '1']]);
+        result = region(`DDL of ${schema}`, html`<p class="muted">${objects.length} object(s). Review the script before you run it (SQL Workshop → SQL Scripts).</p>
+          <textarea class="code" rows="24" spellcheck="false" readonly aria-label="DDL of ${schema}" data-code="plpgsql">${script}</textarea>`,
+          html`<a class="btn" href="${BASE}/sql/ddl?${qs.toString()}">${icon('download')} Download ${schema}.sql</a>`);
+      } catch (e) {
+        result = html`<div class="alert alert-error" role="alert">${(e as Error).message}</div>`;
+      }
+    }
+    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ddl')}
+      <p class="muted">The DDL of a schema's objects, from the database catalog, in an order that runs: types, sequences, tables, functions, views, constraints, indexes, triggers, row level security, comments and grants (APEX: Generate DDL). Objects of extensions are left out.</p>
+      <form method="get" class="u-mb1">
+        <div class="form-grid">${schemaSelect('schema', 'Schema', schemas, schema)}</div>
+        <fieldset class="prop-group"><legend>Objects</legend><div class="form-grid">
+          ${OBJECT_TYPES.map((x) => html`<label class="check"><input type="checkbox" name="t" value="${x}"${types.has(x) ? raw(' checked') : ''}> ${TYPE_LABELS[x]}</label>`)}
+          <label class="check"><input type="checkbox" name="comments" value="1"${opts.comments ? raw(' checked') : ''}> Comments</label>
+          <label class="check"><input type="checkbox" name="grants" value="1"${opts.grants ? raw(' checked') : ''}> Grants</label>
+        </div></fieldset>
+        <div class="buttons"><button class="btn btn-hot">${icon('code')} Generate</button></div>
+      </form>
+      ${result}`;
+    return send(reply, s, shell(s, 'Generate DDL', [['SQL Workshop', `${BASE}/sql`], ['Generate DDL']], main, 'sql'));
+  });
+
+  app.get(`${BASE}/sql/compare`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const db = await workshopDb(s);
+    const schemas = await userSchemas(db, { usable: db !== owner });
+    const q = req.query ?? {};
+    const source = schemas.includes(q.source ?? '') ? q.source! : '';
+    const target = schemas.includes(q.target ?? '') ? q.target! : '';
+    let result: Raw | '' = '';
+    if (source && target && source === target) result = html`<div class="alert alert-error" role="alert">Choose two different schemas.</div>`;
+    else if (source && target) {
+      try {
+        const [a, b] = await Promise.all([readSchema(db.pool, source), readSchema(db.pool, target)]);
+        const { differences, same } = compare(a, b);
+        const script = changeScript(source, target, a, b);
+        await logActivity({ username: s.username, event: 'schema_compare', ip: clientIp(req), detail: `${source} → ${target}: ${differences.length} differences` });
+        if (q.download === '1')
+          return reply.header('content-disposition', `attachment; filename="${target}-like-${source}.sql"`).type('application/sql; charset=utf-8').send(script);
+        const groups = (['source', 'target', 'different'] as const).map((st) => [st, differences.filter((d) => d.state === st)] as const).filter(([, list]) => list.length);
+        result = html`${region('Summary', html`<p>${differences.length
+            ? `${differences.length} difference(s): ${groups.map(([st, list]) => `${list.length} ${STATE_LABELS[st].toLowerCase()}`).join(', ')}; ${same} object(s) the same.`
+            : `The schemas are the same (${same} objects).`}</p>`)}
+          ${groups.map(([st, list]) => html`<div class="u-spacer"></div>${region(`${STATE_LABELS[st]} (${st === 'source' ? source : st === 'target' ? target : `${source} and ${target}`})`,
+            html`<ul class="compare-list">${list.map((d) => html`<li><details><summary><span class="tag">${d.kind}</span> ${d.name}</summary>
+              ${st === 'different' ? diffBlock(d, source, target) : html`<pre class="diff">${d.source ?? d.target}</pre>`}</details></li>`)}</ul>`)}`)}
+          <div class="u-spacer"></div>
+          ${region(`Change script: make ${target} like ${source}`, html`<p class="muted">Creates what only ${source} has, changes what differs, and lists what only ${target} has as commented-out drops; columns that change identity or generation, and types, domains and sequences that differ, are left for review. Nothing is run here.</p>
+            <textarea class="code" rows="20" spellcheck="false" readonly aria-label="Change script" data-code="plpgsql">${script}</textarea>`,
+            html`<a class="btn" href="${BASE}/sql/compare?${new URLSearchParams({ source, target, download: '1' }).toString()}">${icon('download')} Download</a>`)}`;
+      } catch (e) {
+        result = html`<div class="alert alert-error" role="alert">${(e as Error).message}</div>`;
+      }
+    }
+    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('compare')}
+      <p class="muted">Compares the objects of two schemas of this database by their DDL (APEX: Schema Comparison), e.g. a development copy with the schema it came from, and writes a script that makes the target like the source. The order of a table's columns is not compared.</p>
+      <form method="get" class="u-mb1">
+        <div class="form-grid">${schemaSelect('source', 'Source', schemas, source)}${schemaSelect('target', 'Target (to make like the source)', schemas, target)}</div>
+        <div class="buttons"><button class="btn btn-hot">${icon('layers')} Compare</button></div>
+      </form>
+      ${result}`;
+    return send(reply, s, shell(s, 'Schema Comparison', [['SQL Workshop', `${BASE}/sql`], ['Schema Comparison']], main, 'sql'));
+  });
+}

package/src/builder/designer.ts

@@ -5,6 +5,7 @@ import { icon } from '../icons.ts';
 import { COMPONENTS } from './components.ts';
 import { back, BASE, bicon, csrf, developer, flash, input, select, send, shell, type Req } from './ui.ts';
 import { buildOptionChoices, componentForm, lookups, saveComponent } from './forms.ts';
+import { regionConfigHelp } from './region-help.ts';
 import { parseIncludes } from './static-files.ts';
 import { regionSettingsForm } from './region-settings.ts';
 import { usedInPanel } from './search.ts';
@@ -301,6 +302,8 @@ export async function designerRoutes(app: FastifyInstance) {
           </div></fieldset>
           <fieldset class="prop-group"><legend>Appearance</legend><div class="form-grid">
             ${select('mode', 'Page mode', p.mode, [['normal', 'Normal'], ['modal', 'Modal dialog']])}
+            ${select('page_group', 'Page group', p.page_group ?? '', [['', '- none -'], ...lk.pageGroups.map((g): [string, string] => [g, g]), ...(p.page_group && !lk.pageGroups.includes(p.page_group) ? [[p.page_group, `${p.page_group} (no such group)`] as [string, string]] : [])], 'Organises the pages in the App Builder (Shared Components → Page groups). Changes nothing when the application runs.')}
+            ${select('page_template', 'Page template', p.page_template ?? 'standard', [['standard', 'Standard'], ['minimal', 'Minimal (no navigation)']], 'Minimal: no header and navigation menu, e.g. for a login page (Application settings → Login page).')}
             ${select('dialog_position', 'Dialog position', p.dialog_position ?? 'center', [['center', 'Centred dialog'], ['right', 'Drawer from the right'], ['left', 'Drawer from the left'], ['top', 'Drawer from the top'], ['bottom', 'Drawer from the bottom']], 'Modal pages only. On phones dialogs and side drawers fill the screen.')}
             ${select('dialog_size', 'Dialog size', p.dialog_size ?? 'medium', [['small', 'Small'], ['medium', 'Medium'], ['large', 'Large']], 'The width (the height of top and bottom drawers).')}
             ${input('static_includes', 'JavaScript and CSS files', (p.static_includes ?? []).join(', '), { placeholder: 'e.g. page-3.js, page-3.css', help: 'Static application files (.js, .css) this page loads after the application\'s own, in this order.' })}
@@ -322,12 +325,24 @@ export async function designerRoutes(app: FastifyInstance) {
         <form method="post" action="${BASE}/pages/${p.id}/delete" class="danger-zone">${csrf(s)}
           <button class="btn btn-sm btn-danger" data-confirm="Delete page ${p.page_no} and all its components?">Delete page</button></form>`;
     }
+    // (sprint 59) the help pane: the guide section of the selected component's type
+    const guide = (() => {
+      const GUIDE = 'https://pgkiln.vargar.eu/docs';
+      const k = newKind || kind;
+      if (k === 'region') return regionConfigHelp((newKind ? req.query.type : rows.region.find((r: any) => String(r.id) === cid)?.type) ?? null).url ?? `${GUIDE}/pages-and-regions#region-types`;
+      return ({ item: `${GUIDE}/items`, button: `${GUIDE}/processing#buttons`, dynamic_action: `${GUIDE}/dynamic-actions`, validation: `${GUIDE}/processing#validations`,
+        process: `${GUIDE}/processing#processes`, computation: `${GUIDE}/processing#computations`, branch: `${GUIDE}/processing#branches` } as Record<string, string>)[k] ?? `${GUIDE}/pages-and-regions`;
+    })();
     const right = html`
       <div class="pe-head"><div class="pe-title">${heading}</div>
         <div class="pe-filter-row" hidden><label class="sr-only" for="pe-filter">Filter properties</label>${icon('filter')}<input id="pe-filter" class="pe-filter" type="search" placeholder="Filter" autocomplete="off"></div>
       </div>
       ${arrange}
-      <div class="pe">${props}</div>`;
+      <div class="pe">${props}</div>
+      <details class="pe-help" open${guide ? raw(` data-guide="${guide}"`) : ''}>
+        <summary>${icon('help')} Help</summary>
+        <div class="pe-help-body" aria-live="polite" data-pe-help><p class="muted">Select a property to see its help here.</p></div>
+      </details>`;
 
     // ------------------------------------------------------------ toolbar
     const idx = pages.findIndex((x) => x.id === p.id);
@@ -380,6 +395,17 @@ export async function designerRoutes(app: FastifyInstance) {
     return send(reply, s, shell(s, `Page ${p.page_no}`, [['App Builder', BASE], [p.app_name, `${BASE}/apps/${p.app_id}`], [`Page ${p.page_no}: ${p.name}`]], main, 'apps', { toolbar, full: true }));
   });
 
+  // (sprint 59) Quick edit from the developer toolbar: an item or button of the page by its name
+  app.get(`${BASE}/pages/:pid/quick`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    if (!/^\d{1,9}$/.test(req.params.pid)) return reply.code(404).send('Not found');
+    const q = req.query ?? {};
+    const [kind, table, name] = q.item ? ['item', 'meta.item', String(q.item).toUpperCase()] : q.button ? ['button', 'meta.button', String(q.button).toUpperCase()] : [null, null, null];
+    const row = kind ? await owner.one(`select id from ${table} where page_id = $1 and name = $2 order by id limit 1`, [req.params.pid, name]) : null;
+    return reply.redirect(`${BASE}/pages/${req.params.pid}${row ? `?c=${kind}-${row.id}` : ''}`);
+  });
+
   app.post(`${BASE}/pages/:pid`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
@@ -388,9 +414,9 @@ export async function designerRoutes(app: FastifyInstance) {
       const before = await owner.one('select app_id, page_no from meta.page where id = $1', [req.params.pid]);
       await owner.query(
         `update meta.page set page_no = $2, name = $3, title = $4, requires_auth = $5, mode = $6, parent_page = $7, authz = $8, protection = $9, build_option = $10,
-                dialog_position = $11, dialog_size = $12, static_includes = $13, warn_unsaved = $14 where id = $1`,
+                dialog_position = $11, dialog_size = $12, static_includes = $13, warn_unsaved = $14, page_template = $15, page_group = $16 where id = $1`,
         [req.params.pid, Number(b.page_no), b.name?.trim(), b.title?.trim() || null, b.requires_auth === 'true', b.mode, b.parent_page ? Number(b.parent_page) : null, b.authz || null, b.protection, b.build_option?.trim().toUpperCase() || null,
-         ['left', 'right', 'top', 'bottom'].includes(b.dialog_position ?? '') ? b.dialog_position : 'center', ['small', 'large'].includes(b.dialog_size ?? '') ? b.dialog_size : 'medium', parseIncludes(b.static_includes), b.warn_unsaved === 'true'],
+         ['left', 'right', 'top', 'bottom'].includes(b.dialog_position ?? '') ? b.dialog_position : 'center', ['small', 'large'].includes(b.dialog_size ?? '') ? b.dialog_size : 'medium', parseIncludes(b.static_includes), b.warn_unsaved === 'true', b.page_template === 'minimal' ? 'minimal' : 'standard', b.page_group?.trim() || null],
       );
       // the page's lock and comments follow a new page number
       if (before && before.page_no !== Number(b.page_no))

package/src/builder/documents.ts

@@ -2,6 +2,7 @@ import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { applyBinds } from '../binds.ts';
 import { owner } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html } from '../html.ts';
 import { english } from '../i18n.ts';
 import { documentData, documentPdf, fillTemplate, TemplateError } from '../runtime/document.ts';
@@ -42,7 +43,7 @@ export async function documentRoutes(app: FastifyInstance) {
     const tpl = a && /^\d+$/.test(tid) ? await owner.one('select * from meta.document_template where id = $1 and app_id = $2', [tid, a.id]) : undefined;
     if (!a || !tpl) return reply.code(404).send('Not found');
     const binds = previewBinds(String(req.query.binds ?? ''));
-    const c = await owner.pool.connect();
+    const c = await (await devDbForApp(a.id)).pool.connect();
     try {
       await c.query('begin');
       await c.query(`set local statement_timeout = '10s'`);

package/src/builder/forms.ts

@@ -19,10 +19,11 @@ export interface Lookups {
   lists: string[];
   listEntries: { id: number; list_name: string; label: string }[];
   automations: string[];
+  pageGroups: string[];
 }
 
 export async function lookups(appId: number, pageId?: number): Promise<Lookups> {
-  const [regions, pages, authz, nav, buildOptions, rest, lists, listEntries, automations] = await Promise.all([
+  const [regions, pages, authz, nav, buildOptions, rest, lists, listEntries, automations, pageGroups] = await Promise.all([
     pageId ? owner.query('select id, title, type from meta.region where page_id = $1 order by seq, id', [pageId]) : Promise.resolve({ rows: [] }),
     owner.query('select page_no, name from meta.page where app_id = $1 order by page_no', [appId]),
     owner.query('select name from meta.authz_scheme where app_id = $1 order by name', [appId]),
@@ -32,8 +33,9 @@ export async function lookups(appId: number, pageId?: number): Promise<Lookups>
     owner.query('select name from meta.list where app_id = $1 order by name', [appId]),
     owner.query('select id, list_name, label from meta.list_entry where app_id = $1 order by list_name, seq, id', [appId]),
     owner.query('select name from meta.automation where app_id = $1 order by name', [appId]),
+    owner.query('select name from meta.page_group where app_id = $1 order by name', [appId]),
   ]);
-  return { regions: regions.rows, pages: pages.rows, authz: authz.rows.map((r) => r.name), nav: nav.rows, buildOptions: buildOptions.rows, restSources: rest.rows.map((r) => r.name), lists: lists.rows.map((r) => r.name), listEntries: listEntries.rows, automations: automations.rows.map((r) => r.name) };
+  return { regions: regions.rows, pages: pages.rows, authz: authz.rows.map((r) => r.name), nav: nav.rows, buildOptions: buildOptions.rows, restSources: rest.rows.map((r) => r.name), lists: lists.rows.map((r) => r.name), listEntries: listEntries.rows, automations: automations.rows.map((r) => r.name), pageGroups: pageGroups.rows.map((r) => r.name) };
 }
 
 /** Choices of a build option field: each option and its negation, plus a missing current value. */
@@ -84,7 +86,7 @@ export function componentForm(spec: ComponentSpec, kind: string, row: any, lk: L
       html`<select id="${id}" name="${f.name}">${list.map(([val, label]) => html`<option value="${val}"${String(v ?? '') === val ? raw(' selected') : ''}>${label}</option>`)}</select>`;
     switch (f.kind) {
       case 'bool':
-        return html`<div class="field"><span class="label" aria-hidden="true"></span><label class="check"><input type="checkbox" name="${f.name}" value="true"${v ? raw(' checked') : ''}> ${f.label}</label>${help}</div>`;
+        return html`<div class="field" data-prop="${f.name}"><span class="label" aria-hidden="true"></span><label class="check"><input type="checkbox" name="${f.name}" value="true"${v ? raw(' checked') : ''}> ${f.label}</label>${help}</div>`;
       case 'options': {
         const chosen: unknown[] = Array.isArray(v) ? v : [];
         return html`<fieldset class="field options-field"${f.wide ? raw(' data-wide') : ''}><legend class="label">${f.label}</legend>
@@ -159,7 +161,7 @@ export function componentForm(spec: ComponentSpec, kind: string, row: any, lk: L
       default:
         control = html`<input id="${id}" name="${f.name}" type="${f.kind === 'int' ? 'number' : 'text'}" value="${v ?? ''}">`;
     }
-    return html`<div class="field"${f.wide ? raw(' data-wide') : ''}><label class="label" for="${id}">${f.label}</label>${control}${help}</div>`;
+    return html`<div class="field" data-prop="${f.name}"${f.wide ? raw(' data-wide') : ''}><label class="label" for="${id}">${f.label}</label>${control}${help}</div>`;
   };
   const groups = [...new Set(spec.fields.map((f) => f.group ?? ''))];
   return html`<form method="post" action="${action}" class="component-form"${opts.id ? html` id="${opts.id}"` : ''}>