pgkiln 0.36.0 → 0.37.0

package/docs/apex-feature-parity.md

@@ -7,7 +7,7 @@ open item and open an issue or pull request; see [CONTRIBUTING.md](../CONTRIBUTI
 Legend: ✅ available · 🟡 partial (see notes) · ❌ not yet · ➖ not planned (a deliberate choice,
 or better served by the PostgreSQL ecosystem; see the notes and [extensions](guide/15-extensions.md))
 
-Last reviewed: 2026-10-12 (sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
+Last reviewed: 2026-10-13 (sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
 
 ## At a glance
 
@@ -22,8 +22,8 @@ Last reviewed: 2026-10-12 (sprint 59: the Page Designer's help pane, Quick edit
 | Globalization | 6 | 0 | 0 | 0 | One translated app like 26.1 with dynamic translations of table values; number format masks and automatic time zone; twenty-two built-in languages |
 | Data and integration | 12 | 0 | 0 | 2 | Generate DDL and schema comparison; `meta.data_export` and data export downloads (CSV, JSON, XML, HTML, Excel, PDF); e-mail through SMTP (password or OAuth2), Microsoft Graph, Amazon SES and HTTP APIs; REST APIs via PostgREST, REST data sources that write back and synchronise, web credentials with OAuth2 grants, CSV/XLSX/JSON/XML loading with saved definitions and unloading, SQL scripts and Quick SQL, report PDFs and document templates |
 | Workflow, automation and AI | 6 | 0 | 0 | 0 | Scheduled automations with several actions and runs from SQL, approvals, a task list and workflows with parallel branches, versions and invoke-API steps; AI with Claude or OpenAI: *Generate text with AI*, an assistant region with tools, natural-language report filters and blueprints |
-| Administration | 8 | 1 | 0 | 0 | Application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Workspaces that group applications and developers (not a tenant boundary); Top SQL per app; debug messages per request; an install/upgrade log |
-| **Total** | **136** | **1** | **0** | **3** | 140 APEX features compared: 97% available, 1% partial |
+| Administration | 9 | 0 | 0 | 0 | Isolated workspaces with their own database logins and roles, and workspace administrators; application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Top SQL per app; debug messages per request; an install/upgrade log |
+| **Total** | **137** | **0** | **0** | **3** | 140 APEX features compared: 98% available, none partial or missing |
 
 (Counts are of the rows in the tables below. A review on 2026-10-06 added 18 rows for APEX features that were
 not compared before, and one on 2026-10-12 added two more (property help, application availability), so the share
@@ -212,12 +212,12 @@ available dropped without anything being removed.)
 | Developer accounts | ✅ | |
 | Instance administration, install/upgrade logs (26.1) | ✅ | Versioned migrations (`npm run db:migrate`), every run logged; Workspace utilities → **Installation** (administrators): server version, install and upgrade runs with errors, applied migrations, and warnings for migrations the database misses or the server doesn't know ([chapter 3](guide/03-builder.md)). Workspace utilities → **Instance settings**: session length and sign-in throttling (stored in the database, over the environment variables) and an overview of the server's configuration without secrets; a server whose database lacks migrations says so (503) or applies them (`MIGRATE_ON_START`). Other settings stay environment variables |
 | Debug messages | ✅ | Debug levels 1–9 per app; `meta.debug(level, text)` and `meta.debug_enabled(level)` from application SQL (APEX_DEBUG); timed entries per request (page steps, regions, processes, branches, errors, SQL notices); Activity → **Debug messages** viewer per page view with filters and the slowest step highlighted; retention 1–90 days; password item values are never recorded ([chapter 6](guide/06-processing.md)). (sprint 50) Debug for **one session** from the developer toolbar, the application staying out of debug. **Missing:** debug entries for background jobs and REST requests |
-| Developer toolbar, session state viewer | ✅ | (sprint 50) Developers signed in to the builder see a toolbar on the pages of their applications in the same browser: App Builder, the application, **Edit page** (Page Designer), **Session** (the session state viewer: user, roles, session, language, time zone, debug level, this page's items, application items and other pages' items; passwords never shown; clear the page's items) **Quick edit** (sprint 59: click a region, item or button to open it in the Page Designer) and **Debug** for this session only. A separate random token (cookie path `/a`, HttpOnly) of a live builder session of a developer of the application's workspace ([chapter 3](guide/03-builder.md#developer-toolbar)). **Missing:** Quick Edit (pick a component on the page), Theme Roller from the page |
+| Developer toolbar, session state viewer | ✅ | (sprint 50) Developers signed in to the builder see a toolbar on the pages of their applications in the same browser: App Builder, the application, **Edit page** (Page Designer), **Session** (the session state viewer: user, roles, session, language, time zone, debug level, this page's items, application items and other pages' items; passwords never shown; clear the page's items) **Quick edit** (sprint 59: click a region, item or button to open it in the Page Designer) and **Debug** for this session only. A separate random token (cookie path `/a`, HttpOnly) of a live builder session of a developer of the application's workspace ([chapter 3](guide/03-builder.md#developer-toolbar)). **Missing:** Theme Roller from the page |
 | Feedback (users send feedback from a page, developers answer) | ✅ | (sprint 51) With *Users can send feedback* on, the navigation bar's **Feedback** link opens a page for a comment, idea or problem about the page (optional rating), with the user's earlier feedback and the developers' answers; developers read, filter, set a status and answer under Application → Feedback ([chapter 3](guide/03-builder.md#feedback)). No screenshots, no e-mail to developers |
 | Automatic application backups, page groups | ✅ | (sprint 51) **Backups**: before every import that replaces an application (CLI, MCP, working copy merge, restore), daily when it changed, and by hand; the newest 25 (configurable) are kept; download and restore from the builder ([chapter 3](guide/03-builder.md#backups)). (sprint 58) **Page groups**: Shared Components → Page groups, a page's *Page group*, the page list by group with a filter ([chapter 3](guide/03-builder.md#page-groups)) |
 | Application availability (Available, Developers only, Restricted access, Unavailable; build status *Run only*) | ✅ | (sprint 51) Available, available to developers only (a builder session in the same browser), restricted to named users, or unavailable with a message, for pages, file downloads, REST modules and PostgREST; build status **Run only** refuses builder changes as if the application were locked, while `pgkiln import --replace` still deploys. Installation settings: not exported, kept by an import ([chapter 3](guide/03-builder.md#availability-and-build-status)) |
 | Monitoring (top SQL) | ✅ | Activity per app; Top SQL per app's database role from `pg_stat_statements` (sortable, resettable) |
-| Workspaces (multi-tenant) | 🟡 | Workspaces group applications and developers: the builder shows and opens only the applications of a developer's workspaces (administrators: all), a current workspace with a switcher, new and imported applications go into it, administrators add workspaces, choose their developers and move applications ([chapter 3](guide/03-builder.md#workspaces)). **Missing:** isolation between tenants (the SQL Workshop and application code run with installation-wide rights; use separate installations), per-workspace user accounts, schemas and workspace administrators |
+| Workspaces (multi-tenant) | ✅ | Workspaces group applications and developers: the builder shows and opens only the applications of a developer's workspaces (administrators: all), a current workspace with a switcher, new and imported applications go into it, administrators add workspaces, choose their developers and move applications ([chapter 3](guide/03-builder.md#workspaces)). (sprint 60) **Isolated workspaces** are a tenant boundary: the applications run on a PostgreSQL login of the workspace's own and its developers' SQL Workshop on another, with row-level security on pgkiln's tables, so SQL that resets its role can't reach other workspaces' applications, data, sessions or accounts; **workspace database roles** (APEX: workspace schemas) assigned by administrators; **workspace administrators** who manage their workspace's developers; SQL scripts, blueprints and sample data per workspace ([isolated workspaces](guide/03-builder.md#isolated-workspaces)). **Missing:** user directories per workspace (accounts are installation-wide, visible to the workspaces whose applications they use), developers created by a workspace administrator |
 
 ## Different on purpose
 
@@ -291,7 +291,7 @@ report filters, App Builder AI and blueprints.
    translations, display image and geocoded address items~~ (done in sprint 53).
 8. ~~Interactive grid views (single row view, chart view, group by)~~ (done in sprint 54).
 9. ~~Schema comparison and DDL generation in SQL Workshop~~ (done in sprint 56): no ❌ rows left.
-10. ~~Region templates~~ (done in sprint 57); ~~page groups~~ (sprint 58); ~~the help pane and Quick edit~~ (sprint 59); then the last 🟡 row: workspace isolation. (2026-10-12, owner: more built-in runtime languages are not planned; the row was removed. Other languages come from an application's own text messages.)
+10. ~~Region templates~~ (done in sprint 57); ~~page groups~~ (sprint 58); ~~the help pane and Quick edit~~ (sprint 59); ~~then the last 🟡 row: workspace isolation~~ (done in sprint 60: no 🟡 rows left). (2026-10-12, owner: more built-in runtime languages are not planned; the row was removed. Other languages come from an application's own text messages.)
 
 Sources: [APEX 26.1 new features](https://docs.oracle.com/en/database/oracle/apex/26.1/htmrn/new-features.html),
 [What's new in APEX 24.2](https://apex.oracle.com/en/platform/features/whats-new-242/),

package/docs/guide/03-builder.md

@@ -35,12 +35,55 @@ department. Every installation has the **Default** workspace, which holds the ap
   (`pgkiln import`) go into Default. Exports don't carry the workspace.
 - Workspace utilities → **Workspaces** (administrators): add a workspace (you become its first developer), rename it,
   choose its developers, move applications to another workspace and delete an empty workspace.
-
-**Workspaces are not a security boundary between developers who write SQL.** The SQL Workshop runs as pgkiln's owner,
-and application code (processes, regions, validations) runs on the runtime connection, from which a developer's SQL
-can reach other applications' data and metadata. User accounts, identity providers, LDAP directories and AI services
-also stay installation-wide. Use workspaces to keep teams' applications apart in the builder; give tenants who must
-not see each other's applications or data **separate installations** (databases).
+- **Workspace administrators**: on a workspace's page, administrators tick which of its developers administer it. A
+  workspace administrator opens the page from Workspace utilities (the card names the current workspace) and changes
+  its name, description and developers; isolation, database roles, moving applications and deleting stay with the
+  installation's administrators.
+
+A **shared** workspace (the default) is not a security boundary between developers who write SQL: its SQL Workshop
+runs as pgkiln's owner, and its application code (processes, regions, validations) runs on the shared runtime
+connection, from which SQL can reach other shared applications' data and metadata. Make a workspace **isolated** when
+its developers must not reach other teams' applications or data.
+
+### Isolated workspaces
+
+On a workspace's page an administrator chooses **Isolate this workspace** (Workspace utilities → Workspaces → the
+workspace → *Isolation*). It needs `RUNTIME_DATABASE_URL` (applications don't run on the owner connection) and
+`PGKILN_SECRET_KEY` (the passwords of the workspace's logins are derived from it; nothing is stored). Then:
+
+- **Two PostgreSQL logins of its own**: `pgkiln_ws<id>_run_<suffix>` runs its applications (pages, processes, REST
+  handlers, automations, workflows, background processes, REST synchronisation); `pgkiln_ws<id>_dev_<suffix>` runs its
+  developers' SQL: SQL Commands, SQL Scripts, Quick SQL, Load and Unload Data, Sample Data, DDL and Compare, the
+  Advisor, code checks and document previews. SQL that runs `RESET ROLE` (or `set_config('role', …)`) only gets back to
+  that login, which can use the workspace's database roles and nothing else.
+- **The workspace's database roles** (APEX: workspace schemas): isolating gives the workspace the roles its
+  applications run as; administrators add or remove roles on its page. Its applications can run only as these roles,
+  so an import or a changed *Database role* setting that names another role is refused. A role belongs to one
+  workspace; a superuser, a role that creates roles or bypasses row-level security, and pgkiln's own roles can't
+  belong to one. A **new application** in an isolated workspace gets a new role and a new schema (owned by that role),
+  or a schema of one of the workspace's roles. The developer login starts as the first role (alphabetically), so the
+  tables a developer creates in the SQL Workshop belong to an application role; `set role` picks another of them.
+- **pgkiln's own tables** (`meta`) show each login its own workspace's applications, pages, sessions and accounts
+  (row-level security), and the shared runtime connection no longer sees the isolated workspace's.
+  `meta.app_id()` refuses another workspace's application, so `meta.web_request`, `meta.ai_generate`, mail, push
+  and `meta.page_url` can't act for it. The developer login has no rights in `meta`.
+- **The SQL Workshop's saved work** (scripts and their runs, blueprints, sample data generators) belongs to the
+  workspace it was made in, also in shared workspaces; data load definitions are listed for the current workspace's
+  applications.
+- **Administrators keep the owner** in the SQL Workshop, and a developer who also belongs to a shared workspace has the
+  owner's rights there: make the developers of an isolated workspace members of that workspace only.
+- A workflow step's SQL runs on the workspace's login and commits just before the workflow's own state, so after a
+  crash between the two a step can run again.
+
+Still installation-wide: user accounts (an account with access to an isolated workspace's application is visible only
+to that workspace, other accounts to every workspace), identity providers, LDAP directories, mail and AI services, the
+REST API through PostgREST (use REST modules for isolated applications), and the database catalog (any login can read
+table and function definitions in `pg_catalog`, not their rows). Every login of every workspace counts towards the
+server's `max_connections`: each isolated workspace opens at most `PGKILN_WORKSPACE_POOL_SIZE` (5) connections per
+login and server process.
+
+**Make shared** undoes it: the roles go back to the shared runtime connection and the workspace's logins can no
+longer sign in. Delete a workspace only when it is shared and empty; its logins are dropped with it.
 
 ## The builder window
 

package/docs/guide/12-development.md

@@ -32,7 +32,9 @@ src/
                            read, import), files.ts (directories, zip), diff.ts, replace.ts (import --replace in place),
                            mcp.ts (`pgkiln mcp`: the MCP server for AI coding agents, chapter 20)
   app.ts / server.ts       Fastify setup / entry point
-  db.ts                    the two pools, appTx() (SET LOCAL ROLE + pgkiln.* settings, NOTICEs to the debug log), savepoints
+  db.ts                    the owner and shared runtime pools, `runtime` (the current scope's: runtimeScope), appTx() (SET LOCAL ROLE + pgkiln.* settings, NOTICEs to the debug log), savepoints
+  workspace-db.ts          isolated workspaces (090): the isolated applications (cached 5 s), a pool per workspace login (passwords from
+                           PGKILN_SECRET_KEY), runtimeForApp/runtimeForAlias, withAppDb, devDbForApp; app.ts scopes /a/:alias requests
   security.ts              URL checksums, password policy, security headers (CSP nonce), throttling limits
   ddl.ts                   Generate DDL and Schema Comparison: readSchema (catalog → one DDL per object, unqualified), ddlScript (order), compare, changeScript
   static-version.ts        the version of app.css, app.js, icons.svg and sw.js (?v= in their URLs, the service worker version): content hash, looked at again when a file changes
@@ -232,7 +234,8 @@ src/
     code-editor.ts         code fields (data-code marks), /builder/code/completions (scoped to the app's role), /builder/code/check
     instance.ts            Workspace utilities → Instance settings (src/instance.ts: session and sign-in settings, configuration overview)
     workspaces.ts          workspaces (064): loadWorkspaces/appAllowed (checked in ui.ts developer() for every /apps/:id and /pages/:pid
-                           request), the current workspace (session state __WS), placeApp, the switcher, Workspace utilities → Workspaces
+                           request), the current workspace (session state __WS), placeApp, the switcher, Workspace utilities → Workspaces;
+                           (090) isolation and the workspace's database roles, workshopDb (the SQL Workshop's connection)
     locks.ts               page and application locks (blockingLock, checked in ui.ts developer() for every builder POST; appOfPath), developer comments, administrators
     blueprints.ts          Create → From a blueprint: list, JSON editor, AI draft, review (signed with the session), create in one transaction
     ai-builder.ts          App Builder AI (migration 062): the builder's AI service (meta.builder_ai), SQL Workshop → AI (SQL from a
@@ -290,6 +293,7 @@ test/
   page-wizards.test.ts     create page wizards: catalog defaults, every page type generated and rendered, refusals, the builder steps
   theme-styles.test.ts     Theme Roller style variants (checks, CSS, user choice per app, builder page), template options, base style Iris
   workspaces.test.ts       workspaces (064): Default, administrators' pages, current workspace, refused apps, imports and copies
+  workspace-isolation.test.ts isolated workspaces (090): logins, RLS on meta, app_id, roles, SQL Workshop, scripts, imports
   ai.test.ts               AI services: Generate text with AI (text, structured outputs, errors, limits, keys), its dynamic action,
                            meta.ai_generate, the providers, HR page 37; against ai-mock.ts (no real API calls)
   ai-assistant.test.ts     AI assistant region (context, tools as the app role, writes, REST, histories, limits, sessions), OpenAI,

package/examples/hr/hr_40_sample_data.sql

@@ -47,4 +47,4 @@ values ('HR demo staff', 'Departments, employees and leave requests for trying o
     {"column": "decision_note", "generator": "skip", "options": "", "nulls": 0},
     {"column": "created_at", "generator": "timestamp", "options": "2025-10-01..2026-10-01", "nulls": 0}]}
 ]$json$::jsonb, 'admin', 'admin')
-on conflict (name) do nothing;
+on conflict (workspace_id, name) do nothing;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/src/app.ts

@@ -65,6 +65,8 @@ import { ownerUrl, runtime } from './db.ts';
 import { refreshInstanceSettings } from './instance.ts';
 import { loadSecrets, securityHeaders, trustProxySetting } from './security.ts';
 import { lucideSymbol } from './icons.ts';
+import { runtimeForAlias } from './workspace-db.ts';
+import { runtimeScope } from './db.ts';
 
 export async function buildApp(opts: { logger?: boolean } = {}) {
   // a database older than the code: apply the migrations (MIGRATE_ON_START=true)
@@ -104,6 +106,22 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
       );
     });
   }
+  // an application of an isolated workspace runs on its workspace's own login (src/workspace-db.ts):
+  // the rest of the request runs in that scope, so runtime.* uses that pool
+  app.addHook('onRequest', (req, _reply, done) => {
+    const m = /^\/a\/([^/?#]{1,100})/.exec(req.url);
+    if (!m || pending.length) return done();
+    let alias: string;
+    try {
+      alias = decodeURIComponent(m[1]);
+    } catch {
+      return done();
+    }
+    runtimeForAlias(alias).then(
+      (db) => runtimeScope.run(db, done),
+      (err: Error) => done(err),
+    );
+  });
   // debug messages: stored after the response, for requests that have a debug log (src/debug.ts)
   app.addHook('onError', async (req, _reply, err) => {
     debugOf(req)?.add(1, 'error', `unhandled: ${err.message}`);

package/src/automations.ts

@@ -1,5 +1,6 @@
 import pg from 'pg';
 import { owner, runtime } from './db.ts';
+import { withAppDb } from './workspace-db.ts';
 
 // Automations (Shared Components → Automations): SQL or PL/pgSQL on a cron
 // schedule, run by the pgkiln server as the application's database role.
@@ -226,7 +227,7 @@ export async function runAutomation(id: number, trigger: 'schedule' | 'manual' =
 
 /** The actions, as the application's role, through meta.automation_execute() (also used by meta.run_automation). */
 async function execute(def: Definition): Promise<{ rows: number; failed: number; errors: RowError[] }> {
-  return runtime.tx(async (c) => {
+  return withAppDb(def.app_id, () => runtime.tx(async (c) => {
     await c.query(
       `select set_config('pgkiln.app_user', $1, true), set_config('pgkiln.app_id', $2, true),
               set_config('pgkiln.automation_id', $3, true), set_config('pgkiln.session_id', '', true),
@@ -235,7 +236,7 @@ async function execute(def: Definition): Promise<{ rows: number; failed: number;
     );
     if (def.db_role) await c.query(`set local role ${pg.escapeIdentifier(def.db_role)}`);
     return (await c.query('select meta.automation_execute($1::jsonb) as r', [JSON.stringify(def)])).rows[0].r;
-  });
+  }));
 }
 
 // ------------------------------------------------------------------ scheduler

package/src/builder/advisor.ts

@@ -1,7 +1,8 @@
 import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { applyBinds, splitStatements } from '../binds.ts';
-import { owner } from '../db.ts';
+import { owner, type Db } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { templateProblem } from '../runtime/document.ts';
@@ -156,7 +157,7 @@ const BUILT_IN = new Set(['MUST_NOT_BE_PUBLIC_USER']);
  * e.g. an import that hasn't committed yet) everything is read and checked
  * on that client, inside a savepoint that is rolled back.
  */
-export async function advise(appId: number, tx?: pg.ClientBase): Promise<{ findings: Finding[]; checked: number; plpgsqlCheck: boolean }> {
+export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db } = {}): Promise<{ findings: Finding[]; checked: number; plpgsqlCheck: boolean }> {
   const query = (sql: string, params: unknown[] = []) => (tx ? tx.query(sql, params) : owner.query(sql, params));
   const one = async (sql: string, params: unknown[] = []) => (await query(sql, params)).rows[0];
   const app = await one('select * from meta.app where id = $1', [appId]);
@@ -188,9 +189,14 @@ export async function advise(appId: number, tx?: pg.ClientBase): Promise<{ findi
                                    and not exists (select 1 from meta.page_group g where g.app_id = p.app_id and g.name = p.page_group) order by 1`, [appId])).rows)
     findings.push({ severity: 'warning', entry: null, field: `Page ${p.page_no} → Page group`, message: `Page group ${p.page_group} doesn't exist (Shared Components → Page groups).` });
   // ---- SQL, as the application's role, rolled back (a savepoint in the caller's transaction)
-  const c = (tx ?? (await owner.pool.connect())) as pg.PoolClient;
+  // (090) an isolated workspace's application: planned on the workspace's developer login, in a
+  // transaction of its own (planning can run the application's functions; RESET ROLE there only
+  // reaches that login, never the owner); `opts.db` names the login for an import into the workspace
+  const own = opts.db && opts.db !== owner ? opts.db : await devDbForApp(appId);
+  const inTx = !!tx && own === owner;
+  const c = (inTx ? tx : await (own === owner ? owner : own).pool.connect()) as pg.PoolClient;
   try {
-    await c.query(tx ? 'savepoint advisor_all' : 'begin');
+    await c.query(inTx ? 'savepoint advisor_all' : 'begin');
     await c.query(`set local statement_timeout = '5s'`);
     await c.query(`select set_config('pgkiln.app_id', $1, true)`, [String(appId)]);
     if (app.db_role) await c.query(`set local role ${pg.escapeIdentifier(app.db_role)}`);
@@ -263,7 +269,7 @@ export async function advise(appId: number, tx?: pg.ClientBase): Promise<{ findi
       }
     }
   } finally {
-    if (tx) {
+    if (inTx) {
       await c.query('rollback to savepoint advisor_all');
       await c.query('release savepoint advisor_all');
     } else {

package/src/builder/ai-builder.ts

@@ -9,6 +9,7 @@ import type { Session } from '../session.ts';
 import { appOr404 } from './forms.ts';
 import { isAdmin } from './locks.ts';
 import { appHeader, back, BASE, csrf, developer, flash, region, select, send, shell, workshopTabs, type Req } from './ui.ts';
+import { workshopDb } from './workspaces.ts';
 import { WIZARD_KINDS, wizardTables } from './wizards.ts';
 
 // App Builder AI (migration 062), with the AI service an administrator
@@ -43,10 +44,20 @@ async function ask(s: Session, req: Parameters<typeof generate>[1]) {
   return generate(svc.name, req, { appId: null, user: s.username, source: 'builder' });
 }
 
-/** Schemas a developer may describe or ask about (not pgkiln's, not the system's). */
-async function schemas() {
-  return (await owner.query<{ n: string }>(
-    `select nspname as n from pg_namespace where nspname !~ '^pg_' and nspname not in ('information_schema', 'meta') order by 1`)).rows.map((r) => r.n);
+/** Schemas a developer may describe or ask about (not pgkiln's, not the system's; in an isolated workspace, its own). */
+async function schemas(s: Session) {
+  const db = await workshopDb(s);
+  return (await db.query<{ n: string }>(
+    `select nspname as n from pg_namespace where nspname !~ '^pg_' and nspname not in ('information_schema', 'meta')
+       ${db === owner ? '' : `and has_schema_privilege(oid, 'USAGE')`} order by 1`)).rows.map((r) => r.n);
+}
+
+/** A table's descriptions as database comments. */
+async function comment(c: { query: (sql: string) => Promise<unknown> }, t: TableInfo, notes: [string, string][]) {
+  const rel = `${pg.escapeIdentifier(t.schema)}.${pg.escapeIdentifier(t.table)}`;
+  const what = t.kind === 'view' ? 'view' : t.kind === 'materialized view' ? 'materialized view' : 'table';
+  for (const [col, note] of notes)
+    await c.query(col ? `comment on column ${rel}.${pg.escapeIdentifier(col)} is ${note ? pg.escapeLiteral(note) : 'null'}` : `comment on ${what} ${rel} is ${note ? pg.escapeLiteral(note) : 'null'}`);
 }
 
 interface TableInfo {
@@ -130,7 +141,7 @@ const SQL_SCHEMA = {
 };
 
 async function workshopPage(s: Session, reply: FastifyReply, out: { question?: string; schema?: string; sql?: string; error?: string; result?: Raw }) {
-  const list = await schemas();
+  const list = await schemas(s);
   const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ai')}
     ${await serviceBox(s)}
     <p><a href="${BASE}/sql/ai/describe">Describe tables for AI ▸</a> <span class="muted">(better answers: say what tables and columns mean)</span></p>
@@ -162,7 +173,7 @@ async function workshopPage(s: Session, reply: FastifyReply, out: { question?: s
 const isName = (v: unknown): v is string => typeof v === 'string' && v.length > 0 && v.length <= 63;
 
 async function describePage(s: Session, reply: FastifyReply, schema: string, table: string, draft: { table?: string; columns?: Record<string, string> } | null, message?: Raw) {
-  const list = await schemas();
+  const list = await schemas(s);
   const tables = schema && list.includes(schema) ? await tableInfo({ schema }) : [];
   const t = table ? tables.find((x) => x.table === table) : undefined;
   const noted = new Set((await owner.query<{ t: string }>(`select distinct table_name as t from meta.ai_table_note where schema_name = $1`, [schema])).rows.map((r) => r.t));
@@ -299,7 +310,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     let result: Raw;
     try {
       if (!question) throw new AiError('config', 'Type a question.');
-      if (!(await schemas()).includes(schema)) throw new AiError('config', 'Choose a schema.');
+      if (!(await schemas(s)).includes(schema)) throw new AiError('config', 'Choose a schema.');
       const res = await ask(s, {
         system: `You write PostgreSQL ${(await owner.one<{ v: number }>(`select current_setting('server_version_num')::int / 10000 as v`))!.v} SQL for a developer, for these tables and views:\n\n${describeTables(await tableInfo({ schema }))}\n\n` +
           'Use only those tables and columns, qualified with their schema. Write a SELECT unless the question clearly asks to change data. The developer reviews the SQL before anything runs.',
@@ -331,7 +342,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     let result: Raw;
     try {
       if (!sql.trim() && !error.trim()) throw new AiError('config', 'Paste a query, an error message or both.');
-      const tables = schema && (await schemas()).includes(schema) ? describeTables(await tableInfo({ schema })) : '';
+      const tables = schema && (await schemas(s)).includes(schema) ? describeTables(await tableInfo({ schema })) : '';
       const res = await ask(s, {
         system: 'You explain PostgreSQL to a developer: what a query does, why an error happens and how to fix it. Be concise; show corrected SQL when it helps.' +
           (tables ? `\n\nThe tables and views of the schema:\n\n${tables}` : ''),
@@ -352,10 +363,10 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
   });
 
   /** The posted table, checked against the catalog (null: unknown or reserved). */
-  const postedTable = async (b: Record<string, any>) => {
+  const postedTable = async (s: Session, b: Record<string, any>) => {
     const schema = String(b.schema ?? '');
     const table = String(b.table ?? '');
-    if (!isName(schema) || !isName(table) || RESERVED.test(schema)) return null;
+    if (!isName(schema) || !isName(table) || RESERVED.test(schema) || !(await schemas(s)).includes(schema)) return null;
     return (await tableInfo({ schema, table }))[0] ?? null;
   };
 
@@ -363,11 +374,14 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     const s = await developer(req, reply);
     if (!s) return;
     const b = (req.body ?? {}) as Record<string, any>;
-    const t = await postedTable(b);
+    const t = await postedTable(s, b);
     if (!t) return reply.code(404).send('Not found');
     const notes: [string, string][] = [['', String(b['note:'] ?? '')], ...t.columns.map((c): [string, string] => [c.name, String(b[`note:${c.name}`] ?? '')])]
       .map(([k, v]) => [k, v.replace(/\s+/g, ' ').trim().slice(0, 2000)]);
     try {
+      // database comments as the developer's SQL connection (an isolated workspace: its own login), then the notes
+      const db = await workshopDb(s);
+      if (b.comments === 'true' && db !== owner) await db.tx((c) => comment(c, t, notes));
       await owner.tx(async (c) => {
         for (const [col, note] of notes) {
           if (note) await c.query(
@@ -376,12 +390,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
             [t.schema, t.table, col, note, s.username]);
           else await c.query('delete from meta.ai_table_note where schema_name = $1 and table_name = $2 and column_name = $3', [t.schema, t.table, col]);
         }
-        if (b.comments === 'true') {
-          const rel = `${pg.escapeIdentifier(t.schema)}.${pg.escapeIdentifier(t.table)}`;
-          const what = t.kind === 'view' ? 'view' : t.kind === 'materialized view' ? 'materialized view' : 'table';
-          for (const [col, note] of notes)
-            await c.query(col ? `comment on column ${rel}.${pg.escapeIdentifier(col)} is ${note ? pg.escapeLiteral(note) : 'null'}` : `comment on ${what} ${rel} is ${note ? pg.escapeLiteral(note) : 'null'}`);
-        }
+        if (b.comments === 'true' && db === owner) await comment(c, t, notes);
       });
       flash(s, `Descriptions of ${t.schema}.${t.table} saved${b.comments === 'true' ? ', also as database comments' : ''}.`);
     } catch (e) {
@@ -394,7 +403,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     const s = await developer(req, reply);
     if (!s) return;
     const b = (req.body ?? {}) as Record<string, any>;
-    const t = await postedTable(b);
+    const t = await postedTable(s, b);
     if (!t) return reply.code(404).send('Not found');
     const names = t.columns.map((c) => c.name);
     try {

package/src/builder/blueprints.ts

@@ -133,7 +133,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.get(`${BASE}/blueprints`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const list = (await owner.query(`select b.id, b.name, b.created_by, b.updated_at::text as updated, a.id as app_id, a.alias from meta.blueprint b left join meta.app a on a.id = b.app_id order by lower(b.name), b.id`)).rows;
+    const list = (await owner.query(`select b.id, b.name, b.created_by, b.updated_at::text as updated, a.id as app_id, a.alias from meta.blueprint b left join meta.app a on a.id = b.app_id where b.workspace_id = $1 order by lower(b.name), b.id`, [currentWorkspace(s)])).rows;
     return page(s, reply, '', html`<h1>Blueprints</h1>
       <p class="muted">Describe an application as a blueprint (tables, pages, menu, sample rows), review it and create it. <a class="btn btn-hot" href="${BASE}/blueprints/new">${icon('plus')} New blueprint</a></p>
       ${list.length
@@ -154,7 +154,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.get(`${BASE}/blueprints/:id(^\\d+$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const b = await owner.one('select id, name, spec from meta.blueprint where id = $1', [req.params.id]);
+    const b = await owner.one('select id, name, spec from meta.blueprint where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]);
     if (!b) return reply.code(404).send('Not found');
     return editor(s, reply, { id: b.id, name: b.name, spec: JSON.stringify(b.spec, null, 2) });
   });
@@ -178,8 +178,8 @@ export async function blueprintRoutes(app: FastifyInstance) {
     if (error || !json || typeof json !== 'object' || Array.isArray(json))
       return editor(s, reply, { ...o, message: html`<div class="alert alert-error" role="alert">${error ?? 'A blueprint is a JSON object.'}</div>` });
     const id = o.id
-      ? (await owner.one('update meta.blueprint set name = $2, spec = $3, updated_at = now() where id = $1 returning id', [o.id, o.name, JSON.stringify(json)]))?.id
-      : (await owner.one('insert into meta.blueprint (name, spec, created_by) values ($1, $2, $3) returning id', [o.name, JSON.stringify(json), s.username])).id;
+      ? (await owner.one('update meta.blueprint set name = $2, spec = $3, updated_at = now() where id = $1 and workspace_id = $4 returning id', [o.id, o.name, JSON.stringify(json), currentWorkspace(s)]))?.id
+      : (await owner.one('insert into meta.blueprint (name, spec, created_by, workspace_id) values ($1, $2, $3, $4) returning id', [o.name, JSON.stringify(json), s.username, currentWorkspace(s)])).id;
     if (!id) return reply.code(404).send('Not found');
     flash(s, `Blueprint ${o.name} saved.`);
     return back(reply, s, `${BASE}/blueprints/${id}`);
@@ -240,8 +240,8 @@ export async function blueprintRoutes(app: FastifyInstance) {
           throw new Error(createAppError(e, checked.alias));
         });
         const r = await buildBlueprint(c, blueprint, checked.role, { dashboard: (tables, no) => addDashboard(c, checked.alias, tables, no) });
-        if (o.id) await c.query('update meta.blueprint set app_id = $2, spec = $3, updated_at = now() where id = $1', [o.id, a.id, JSON.stringify(json)]);
-        else await c.query('insert into meta.blueprint (name, spec, created_by, app_id) values ($1, $2, $3, $4)', [o.name, JSON.stringify(json), s.username, a.id]);
+        if (o.id) await c.query('update meta.blueprint set app_id = $2, spec = $3, updated_at = now() where id = $1 and workspace_id = $4', [o.id, a.id, JSON.stringify(json), currentWorkspace(s)]);
+        else await c.query('insert into meta.blueprint (name, spec, created_by, app_id, workspace_id) values ($1, $2, $3, $4, $5)', [o.name, JSON.stringify(json), s.username, a.id, currentWorkspace(s)]);
         return { ...r, existing: a.existingAccount };
       });
       await logActivity({ username: s.username, event: 'blueprint', ip: clientIp(req), detail: `created ${blueprint.alias} from blueprint ${o.name}` });
@@ -255,7 +255,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.post(`${BASE}/blueprints/:id(^\\d+$)/delete`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const r = await owner.query('delete from meta.blueprint where id = $1', [req.params.id]);
+    const r = await owner.query('delete from meta.blueprint where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]);
     flash(s, r.rowCount ? 'Blueprint deleted (applications created from it stay).' : 'There is no such blueprint.');
     return back(reply, s, `${BASE}/blueprints`);
   });

package/src/builder/code-editor.ts

@@ -1,10 +1,11 @@
 import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { owner, runtime } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html, raw, type Raw } from '../html.ts';
 import { checkSql, type SqlShape } from './advisor.ts';
 import { BASE, developer, type Req } from './ui.ts';
-import { appAllowed } from './workspaces.ts';
+import { appAllowed, workshopDb } from './workspaces.ts';
 
 // The builder's code editor (public/code-editor.js) and its SQL completions.
 //
@@ -215,7 +216,7 @@ export async function codeEditorRoutes(app: FastifyInstance) {
     if (!sql.trim()) return reply.send({ ok: true, message: 'Nothing to check.' });
     if (/^\s*(STATIC|LOV):/i.test(sql)) return reply.send({ ok: true, message: 'Not SQL: a static or shared list of values.' });
     const role = target ? (await owner.one('select db_role from meta.app where id = $1', [target.id]))?.db_role : null;
-    const c = await owner.pool.connect();
+    const c = await (target ? await devDbForApp(target.id) : await workshopDb(s)).pool.connect();
     try {
       await c.query('begin');
       await c.query(`set local statement_timeout = '5s'`);

package/src/builder/dataload.ts

@@ -26,6 +26,7 @@ import { readMultipart } from '../runtime/files.ts';
 import type { Session } from '../session.ts';
 import type { ComponentSpec } from './components.ts';
 import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Body, type Req } from './ui.ts';
+import { appWorkspace, currentWorkspace, workshopDb } from './workspaces.ts';
 
 // SQL Workshop → Load Data: upload a CSV/TSV/XLSX/JSON/XML file, preview it,
 // and load it into a new table (column types inferred) or an existing one
@@ -73,17 +74,23 @@ export const DATA_LOAD_DEF_SPEC: ComponentSpec = {
 export const dataLoadDefExtras = (row: { id: number }) =>
   html`<p class="u-mt1"><a class="btn" href="${BASE}/sql/load?definition=${row.id}">${icon('upload')} Load a file with this definition</a></p>`;
 
-async function definitions() {
+/** The data load definitions of the current workspace's applications. */
+async function definitions(s: Session) {
   return (
     await owner.query<{ id: number; app_id: number; app_name: string; name: string; table_name: string }>(
-      'select d.id, d.app_id, a.name as app_name, d.name, d.table_name from meta.data_load_def d join meta.app a on a.id = d.app_id order by a.name, d.name',
+      `select d.id, d.app_id, a.name as app_name, d.name, d.table_name from meta.data_load_def d join meta.app a on a.id = d.app_id
+        where meta.app_workspace(a.id) = $1 order by a.name, d.name`,
+      [currentWorkspace(s)],
     )
   ).rows;
 }
 
-async function definition(id: unknown) {
+async function definition(s: Session, id: unknown) {
   if (!/^\d+$/.test(String(id ?? ''))) return undefined;
-  return owner.one<DataLoadDefinition & { id: number; app_id: number }>('select * from meta.data_load_def where id = $1', [id]);
+  return owner.one<DataLoadDefinition & { id: number; app_id: number }>(
+    'select * from meta.data_load_def where id = $1 and meta.app_workspace(app_id) = $2',
+    [id, currentWorkspace(s)],
+  );
 }
 
 export const MAX_MB = Number(process.env.DATA_LOAD_MAX_MB ?? 50);
@@ -142,7 +149,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
   });
 
   const uploadForm = async (s: Session, error?: string, chosen?: string) => {
-    const defs = await definitions();
+    const defs = await definitions(s);
     return region(
       'Load data from a file',
       html`${error ? html`<div class="alert alert-error" role="alert">${error}</div>` : ''}
@@ -180,7 +187,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
     if (!s) return;
     if (!file) return page(s, reply, await uploadForm(s, 'Choose a file.'));
     if (file.truncated) return page(s, reply, await uploadForm(s, `The file is larger than ${MAX_MB} MB.`));
-    const def = await definition(req.body?.definition);
+    const def = await definition(s, req.body?.definition);
     const rowTag = (req.body?.row_tag ?? '').trim();
     try {
       if (def) await parseFile(file.filename, file.data, { headers: def.headers, format: def.format, rowTag: def.row_tag });
@@ -203,7 +210,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
     if (!f) return reply.redirect(`${BASE}/sql/load`);
     const headers = (req.query.h ?? req.body?.h) !== '0';
     const rowTag = (req.query.rt ?? req.body?.rt ?? '').trim();
-    const def = await definition(req.query.d ?? req.body?.d);
+    const def = await definition(s, req.query.d ?? req.body?.d);
     let sheet: Sheet;
     try {
       sheet = def
@@ -256,17 +263,19 @@ export async function dataLoadRoutes(app: FastifyInstance) {
       ${skip}
       <div class="buttons"><button class="btn btn-hot">Create table and load</button></div></form>`;
 
+    const db = await workshopDb(s);
     const tables = (
-      await owner.query(
+      await db.query(
         `select c.oid::regclass::text as name from pg_class c join pg_namespace n on n.oid = c.relnamespace
-          where c.relkind in ('r', 'p') and n.nspname !~ '^pg_' and n.nspname not in ('information_schema', 'meta') order by 1`,
+          where c.relkind in ('r', 'p') and n.nspname !~ '^pg_' and n.nspname not in ('information_schema', 'meta')
+            and has_table_privilege(c.oid, 'INSERT') order by 1`,
       )
     ).rows.map((r) => r.name as string);
     const chosen = tables.find((t) => t === (req.query.table ?? req.body?.table));
-    const apps = (await owner.query<{ id: number; name: string }>('select id, name from meta.app order by name')).rows;
+    const apps = (await owner.query<{ id: number; name: string }>('select id, name from meta.app where meta.app_workspace(id) = $1 order by name', [currentWorkspace(s)])).rows;
     let mapping: Raw | '' = '';
     if (chosen) {
-      const cols = await owner.tx((c) => tableColumns(c, chosen));
+      const cols = await db.tx((c) => tableColumns(c, chosen));
       const auto = autoMap(sheet.headers, cols);
       const hasPk = cols.some((c) => c.pk);
       mapping = html`<form method="post" action="${action}">${hidden}<input type="hidden" name="target" value="existing"><input type="hidden" name="table" value="${chosen}">
@@ -335,6 +344,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
       const mode = ['append', 'replace', 'merge'].includes(b.mode ?? '') ? b.mode : 'append';
       const format = sheet instanceof Error ? 'auto' : sheet.format;
       try {
+        if (!/^\d{1,9}$/.test(String(b.def_app ?? '')) || (await appWorkspace(String(b.def_app))) !== currentWorkspace(s)) throw new LoadError('Choose an application of this workspace.');
         const r = await owner.one(
           `insert into meta.data_load_def (app_id, name, table_name, format, headers, row_tag, mode, skip_errors, columns)
            values ($1, $2, $3, $4, $5, $6, $7, $8, $9) returning id, app_id`,
@@ -344,7 +354,7 @@ export async function dataLoadRoutes(app: FastifyInstance) {
         return back(reply, s, `${BASE}/apps/${r!.app_id}/shared?c=data_load_def-${r!.id}`);
       } catch (e) {
         const code = (e as { code?: string }).code;
-        if (!code?.startsWith('23') && code !== '22P02') throw e;
+        if (!(e instanceof LoadError) && !code?.startsWith('23') && code !== '22P02') throw e;
         reply.code(422);
         return targetPage(req, reply, s, html`<div class="alert alert-error" role="alert">The definition could not be saved: ${
           code === '23505' ? `the application already has a definition named ${name}.` : (e as Error).message}</div>`);
@@ -354,10 +364,10 @@ export async function dataLoadRoutes(app: FastifyInstance) {
     let error: string | undefined;
     let failed = false;
     try {
-      const def = b.target === 'definition' ? await definition(b.d) : undefined;
+      const def = b.target === 'definition' ? await definition(s, b.d) : undefined;
       const sheet = def ? null : await parseFile(f.filename, f.content, { headers, rowTag });
       const opts = { skipErrors: b.skip_errors === 'true', firstRow: headers && sheet && (sheet.format === 'csv' || sheet.format === 'xlsx') ? 2 : 1 };
-      result = await owner.tx(async (c) => {
+      result = await (await workshopDb(s)).tx(async (c) => {
         if (def) return loadWithDefinition(c, def, f);
         if (!sheet) throw new LoadError('The data load definition no longer exists.');
         if (b.target === 'new') {