pgkiln 0.36.0 → 0.38.0

package/docs/apex-feature-parity.md

@@ -7,13 +7,13 @@ open item and open an issue or pull request; see [CONTRIBUTING.md](../CONTRIBUTI
 Legend: ✅ available · 🟡 partial (see notes) · ❌ not yet · ➖ not planned (a deliberate choice,
 or better served by the PostgreSQL ecosystem; see the notes and [extensions](guide/15-extensions.md))
 
-Last reviewed: 2026-10-12 (sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
+Last reviewed: 2026-10-13 (sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
 
 ## At a glance
 
 | Area | ✅ | 🟡 | ❌ | ➖ | In short |
 |---|---:|---:|---:|---:|---|
-| App Builder and development | 17 | 0 | 0 | 0 | Page Designer with drag-and-drop and a code editor, wizards, search, where used, an Advisor, a CLI with one file per component, page locks and comments, supporting objects, working copies with a three-way merge, theme/library/boilerplate apps with subscriptions; App Builder AI (pages, SQL and table descriptions) |
+| App Builder and development | 20 | 0 | 0 | 0 | Page Designer with drag-and-drop and a code editor, wizards, search, where used, an Advisor, a CLI with one file per component, page locks and comments, supporting objects, working copies with a three-way merge, theme/library/boilerplate apps with subscriptions; App Builder AI (pages, SQL and table descriptions) |
 | Regions | 23 | 0 | 0 | 0 | All everyday regions, a search region over search configurations and a URL region; sixteen chart types with drill-down; calendars with week/day/list views and drag and drop; faceted search, smart filters and a region display selector; interactive reports with breaks, aggregates, highlights, compute, group by, pivot, chart view and saved reports; interactive grids with single row, group by and chart views; maps (with vector tiles) and trees; template components; row ranges, lazy loading and region caching for large tables |
 | Items | 13 | 0 | 0 | 0 | All common items, file upload (several files per item), rich text and Markdown editors, star rating, combobox, date range, QR code, password reveal, display image and geocoded address |
 | Logic and processing | 17 | 0 | 0 | 1 | User preferences and application settings; all dynamic action events and actions, Ajax callbacks and an error handling function; Core APEX model complete with computations, conditional branches, build options and menu buttons, download, chain and workflow processes; JavaScript from static application files in dynamic actions; region, item, dynamic action and process plug-ins |
@@ -22,12 +22,13 @@ Last reviewed: 2026-10-12 (sprint 59: the Page Designer's help pane, Quick edit
 | Globalization | 6 | 0 | 0 | 0 | One translated app like 26.1 with dynamic translations of table values; number format masks and automatic time zone; twenty-two built-in languages |
 | Data and integration | 12 | 0 | 0 | 2 | Generate DDL and schema comparison; `meta.data_export` and data export downloads (CSV, JSON, XML, HTML, Excel, PDF); e-mail through SMTP (password or OAuth2), Microsoft Graph, Amazon SES and HTTP APIs; REST APIs via PostgREST, REST data sources that write back and synchronise, web credentials with OAuth2 grants, CSV/XLSX/JSON/XML loading with saved definitions and unloading, SQL scripts and Quick SQL, report PDFs and document templates |
 | Workflow, automation and AI | 6 | 0 | 0 | 0 | Scheduled automations with several actions and runs from SQL, approvals, a task list and workflows with parallel branches, versions and invoke-API steps; AI with Claude or OpenAI: *Generate text with AI*, an assistant region with tools, natural-language report filters and blueprints |
-| Administration | 8 | 1 | 0 | 0 | Application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Workspaces that group applications and developers (not a tenant boundary); Top SQL per app; debug messages per request; an install/upgrade log |
-| **Total** | **136** | **1** | **0** | **3** | 140 APEX features compared: 97% available, 1% partial |
+| Administration | 10 | 0 | 0 | 0 | An APEX-like sign-in with a workspace; workspace message, environment banner and utilization; isolated workspaces with their own database logins and roles, and workspace administrators; application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Top SQL per app; debug messages per request; an install/upgrade log |
+| **Total** | **141** | **0** | **0** | **3** | 144 APEX features compared: 98% available, none partial or missing |
 
 (Counts are of the rows in the tables below. A review on 2026-10-06 added 18 rows for APEX features that were
-not compared before, and one on 2026-10-12 added two more (property help, application availability), so the share
-available dropped without anything being removed.)
+not compared before, one on 2026-10-12 added two more (property help, application availability), and one on
+2026-10-13 compared the builder's screens with APEX 26.1 and added four (App Gallery, application groups, cross
+application reports, Manage Service), so the share available dropped without anything being removed.)
 
 ## App Builder and development
 
@@ -50,6 +51,9 @@ available dropped without anything being removed.)
 | Builder search, "where used" | ✅ | Search over every page and component (names, SQL, settings, help); "Used in" under items, pages, lists of values, schemes and report layouts. No search and replace |
 | AI assistant, pages from natural language, describe tables for LLMs (26.1) | ✅ | **App Builder AI** (administrators choose the builder's AI service): SQL Workshop → AI writes SQL from a question (shown in an editor, never run automatically), explains a query or an error, and describes tables and columns for LLMs (notes, optionally `COMMENT ON`, with AI drafts from names, types and keys only); **Create pages with AI** turns a description into proposed pages that the developer edits and confirms ([chapter 3](guide/03-builder.md)). The model never sees table rows |
 | Sample data source for development (26.1) | ✅ | SQL Workshop → **Sample Data** ([chapter 16](guide/16-files.md#sql-workshop--sample-data)): generators proposed per column from the catalog and column names (names, e-mail addresses, phones, companies, addresses, words and sentences, codes, number/date/time ranges, booleans, value lists from enums and CHECKs, sequences, foreign keys picking existing or newly inserted parent rows, values relative to another column, % nulls; identity/serial/generated columns skipped; unique and simple CHECK constraints respected), rows per table, a seed for repeatable data, preview (inserted and rolled back), insert in one transaction with parents first, download as SQL INSERTs or CSV, saved generator definitions |
+| App Gallery: sample, starter and custom apps | ✅ | (sprint 61) The **App Gallery** in the builder ([chapter 3](guide/03-builder.md#app-gallery)): *Sample Apps* shipped with pgkiln (HR Demo, Tasks) installed by administrators; *Starter Apps* (Team Tasks, Contacts, Expense Claims, Asset Inventory, Event Registrations) shipped as blueprints, created after their review in the current workspace with a role and schema of their own; *Custom Apps*: the workspace's boilerplates. **Missing:** a gallery fed from a remote catalogue |
+| Application groups | ✅ | (sprint 61) Workspace utilities → **Application groups**: a workspace's named groups, a group per application, a group filter and labels on the App Builder home ([chapter 3](guide/03-builder.md#application-groups)) |
+| Cross application reports | ✅ | (sprint 61) In Workspace utilities' side column, over every application of the workspace: application attributes, build options, developer comments, authentication, authorization schemes, password items and theme summary |
 
 ## Regions
 
@@ -179,7 +183,7 @@ available dropped without anything being removed.)
 
 | APEX | pgkiln | Notes |
 |---|---|---|
-| SQL Workshop: SQL commands, object browser | ✅ | The object browser shows columns, RLS policies, grants, data and function source |
+| SQL Workshop: SQL commands, object browser | ✅ | (sprint 61) A **home page** like APEX's: tiles, recently created tables, your recent SQL commands and the workspace's recent scripts, and the session's **default schema** (first in the search path of SQL Commands and Scripts). The object browser shows columns, RLS policies, grants, data and function source |
 | RESTful services (ORDS) | ✅ | [PostgREST](https://postgrest.org) next to pgkiln: `api` schema, the same RLS as the UI, per-app API role, tokens in the builder, a pre-request check, and **OAuth clients** (client credentials, like ORDS `oauth.create_client`) so tokens renew themselves |
 | REST handler editor, REST-enabled SQL | ✅ | **REST modules** in the builder: handlers (method, path with parameters, SQL as collection, item or statements, roles, public) served by pgkiln with bearer tokens and an OpenAPI description; plus PostgREST for schema-wide APIs. **Missing:** REST-enabled SQL (rarely desirable) |
 | SQL scripts, query builder, Quick SQL | ✅ | **SQL Scripts**: saved, upload/download, a result per statement, stop or continue on errors, optionally one transaction, run history. **Quick SQL** (a subset: tables, child tables, types, the main column directives, `/auditcols`, settings, views). A graphical **query builder**: tables as boxes on a canvas (dragged, placed where left), joins along foreign keys or drawn from column to column (inner or left), column functions with automatic `group by`, conditions, sort, open in SQL Commands; without JavaScript the same as forms ([chapter 3](guide/03-builder.md#sql-workshop)) |
@@ -209,15 +213,16 @@ available dropped without anything being removed.)
 
 | APEX | pgkiln | Notes |
 |---|---|---|
-| Developer accounts | ✅ | |
+| Developer accounts, workspace sign-in | ✅ | (sprint 61) The builder's sign-in page like APEX's: workspace (optional; it becomes the current one, a wrong one answers like a wrong password), username, password with a Show button, *Remember workspace and username*, a link to Administration |
+| Workspace message, environment banner, workspace utilization (Manage Service) | ✅ | (sprint 61) An **Administration** menu in the icon rail; administrators and workspace administrators set a **workspace message** (on the App Builder home) and an **environment banner** (a coloured label on every builder page of the workspace), and see **workspace utilization** (applications, pages, page views, users, static files, schema storage) ([chapter 3](guide/03-builder.md#workspace-message-and-environment-banner)). **Missing:** extension links, workspace-level preferences such as disabling the SQL Workshop |
 | Instance administration, install/upgrade logs (26.1) | ✅ | Versioned migrations (`npm run db:migrate`), every run logged; Workspace utilities → **Installation** (administrators): server version, install and upgrade runs with errors, applied migrations, and warnings for migrations the database misses or the server doesn't know ([chapter 3](guide/03-builder.md)). Workspace utilities → **Instance settings**: session length and sign-in throttling (stored in the database, over the environment variables) and an overview of the server's configuration without secrets; a server whose database lacks migrations says so (503) or applies them (`MIGRATE_ON_START`). Other settings stay environment variables |
 | Debug messages | ✅ | Debug levels 1–9 per app; `meta.debug(level, text)` and `meta.debug_enabled(level)` from application SQL (APEX_DEBUG); timed entries per request (page steps, regions, processes, branches, errors, SQL notices); Activity → **Debug messages** viewer per page view with filters and the slowest step highlighted; retention 1–90 days; password item values are never recorded ([chapter 6](guide/06-processing.md)). (sprint 50) Debug for **one session** from the developer toolbar, the application staying out of debug. **Missing:** debug entries for background jobs and REST requests |
-| Developer toolbar, session state viewer | ✅ | (sprint 50) Developers signed in to the builder see a toolbar on the pages of their applications in the same browser: App Builder, the application, **Edit page** (Page Designer), **Session** (the session state viewer: user, roles, session, language, time zone, debug level, this page's items, application items and other pages' items; passwords never shown; clear the page's items) **Quick edit** (sprint 59: click a region, item or button to open it in the Page Designer) and **Debug** for this session only. A separate random token (cookie path `/a`, HttpOnly) of a live builder session of a developer of the application's workspace ([chapter 3](guide/03-builder.md#developer-toolbar)). **Missing:** Quick Edit (pick a component on the page), Theme Roller from the page |
+| Developer toolbar, session state viewer | ✅ | (sprint 50) Developers signed in to the builder see a toolbar on the pages of their applications in the same browser: App Builder, the application, **Edit page** (Page Designer), **Session** (the session state viewer: user, roles, session, language, time zone, debug level, this page's items, application items and other pages' items; passwords never shown; clear the page's items) **Quick edit** (sprint 59: click a region, item or button to open it in the Page Designer) and **Debug** for this session only. A separate random token (cookie path `/a`, HttpOnly) of a live builder session of a developer of the application's workspace ([chapter 3](guide/03-builder.md#developer-toolbar)). **Missing:** Theme Roller from the page |
 | Feedback (users send feedback from a page, developers answer) | ✅ | (sprint 51) With *Users can send feedback* on, the navigation bar's **Feedback** link opens a page for a comment, idea or problem about the page (optional rating), with the user's earlier feedback and the developers' answers; developers read, filter, set a status and answer under Application → Feedback ([chapter 3](guide/03-builder.md#feedback)). No screenshots, no e-mail to developers |
 | Automatic application backups, page groups | ✅ | (sprint 51) **Backups**: before every import that replaces an application (CLI, MCP, working copy merge, restore), daily when it changed, and by hand; the newest 25 (configurable) are kept; download and restore from the builder ([chapter 3](guide/03-builder.md#backups)). (sprint 58) **Page groups**: Shared Components → Page groups, a page's *Page group*, the page list by group with a filter ([chapter 3](guide/03-builder.md#page-groups)) |
 | Application availability (Available, Developers only, Restricted access, Unavailable; build status *Run only*) | ✅ | (sprint 51) Available, available to developers only (a builder session in the same browser), restricted to named users, or unavailable with a message, for pages, file downloads, REST modules and PostgREST; build status **Run only** refuses builder changes as if the application were locked, while `pgkiln import --replace` still deploys. Installation settings: not exported, kept by an import ([chapter 3](guide/03-builder.md#availability-and-build-status)) |
 | Monitoring (top SQL) | ✅ | Activity per app; Top SQL per app's database role from `pg_stat_statements` (sortable, resettable) |
-| Workspaces (multi-tenant) | 🟡 | Workspaces group applications and developers: the builder shows and opens only the applications of a developer's workspaces (administrators: all), a current workspace with a switcher, new and imported applications go into it, administrators add workspaces, choose their developers and move applications ([chapter 3](guide/03-builder.md#workspaces)). **Missing:** isolation between tenants (the SQL Workshop and application code run with installation-wide rights; use separate installations), per-workspace user accounts, schemas and workspace administrators |
+| Workspaces (multi-tenant) | ✅ | Workspaces group applications and developers: the builder shows and opens only the applications of a developer's workspaces (administrators: all), a current workspace with a switcher, new and imported applications go into it, administrators add workspaces, choose their developers and move applications ([chapter 3](guide/03-builder.md#workspaces)). (sprint 60) **Isolated workspaces** are a tenant boundary: the applications run on a PostgreSQL login of the workspace's own and its developers' SQL Workshop on another, with row-level security on pgkiln's tables, so SQL that resets its role can't reach other workspaces' applications, data, sessions or accounts; **workspace database roles** (APEX: workspace schemas) assigned by administrators; **workspace administrators** who manage their workspace's developers; SQL scripts, blueprints and sample data per workspace ([isolated workspaces](guide/03-builder.md#isolated-workspaces)). **Missing:** user directories per workspace (accounts are installation-wide, visible to the workspaces whose applications they use), developers created by a workspace administrator |
 
 ## Different on purpose
 
@@ -291,7 +296,7 @@ report filters, App Builder AI and blueprints.
    translations, display image and geocoded address items~~ (done in sprint 53).
 8. ~~Interactive grid views (single row view, chart view, group by)~~ (done in sprint 54).
 9. ~~Schema comparison and DDL generation in SQL Workshop~~ (done in sprint 56): no ❌ rows left.
-10. ~~Region templates~~ (done in sprint 57); ~~page groups~~ (sprint 58); ~~the help pane and Quick edit~~ (sprint 59); then the last 🟡 row: workspace isolation. (2026-10-12, owner: more built-in runtime languages are not planned; the row was removed. Other languages come from an application's own text messages.)
+10. ~~Region templates~~ (done in sprint 57); ~~page groups~~ (sprint 58); ~~the help pane and Quick edit~~ (sprint 59); ~~then the last 🟡 row: workspace isolation~~ (done in sprint 60: no 🟡 rows left). (2026-10-12, owner: more built-in runtime languages are not planned; the row was removed. Other languages come from an application's own text messages.)
 
 Sources: [APEX 26.1 new features](https://docs.oracle.com/en/database/oracle/apex/26.1/htmrn/new-features.html),
 [What's new in APEX 24.2](https://apex.oracle.com/en/platform/features/whats-new-242/),

package/docs/guide/03-builder.md

@@ -6,7 +6,16 @@ The builder lives at `/builder`. Everything it does is also possible in SQL (see
 ## Signing in and developer accounts
 
 Sign in with a developer account. The first one is `admin` / `admin`, and a red banner reminds you
-to change it. On the **Developers** page you can:
+to change it.
+
+The sign-in page (`/builder/login`) is laid out like APEX's: **Workspace** (optional), **Username** and
+**Password** (with a *Show* button). A workspace you name must be one of yours (administrators: any); it becomes the
+current one, and a wrong one gets the same answer as a wrong password. Left empty, you continue in your first
+workspace and switch in your account menu. **Remember workspace and username** keeps both on this device (an
+HttpOnly cookie for `/builder`, no password); signing in without the tick forgets them. *Administration* under the
+form signs in and opens Workspace utilities.
+
+On the **Developers** page you can:
 
 - change your own password (minimum 8 characters; other builder sessions of yours end);
 - as an **administrator**: add developer accounts (developers or administrators), make a developer
@@ -33,21 +42,89 @@ department. Every installation has the **Default** workspace, which holds the ap
 - **New applications** (Create, from a file, pasted data, existing tables, a blueprint) and **imports** go into the
   current workspace; a working copy stays in its main application's workspace. Imports made with the command line
   (`pgkiln import`) go into Default. Exports don't carry the workspace.
+- **Workspace utilities**: tiles for users and sign-in, application groups, the App Gallery, developers, the SQL
+  Workshop and the dashboard (and, for administrators, instance settings, workspaces, AI and mail services and the
+  installation), with **Cross Application Reports** in the side column (APEX: Cross Application Reports), each over
+  every application of the current workspace: *Application attributes* (type, sign-in, availability, build status,
+  debug level, language, database role), *Build options*, *Developer comments*, *Authentication* (sign-in methods,
+  identity providers, LDAP, access, the login page, Forgot password), *Authorization schemes*, *Password items* and
+  *Theme summary*.
 - Workspace utilities → **Workspaces** (administrators): add a workspace (you become its first developer), rename it,
   choose its developers, move applications to another workspace and delete an empty workspace.
-
-**Workspaces are not a security boundary between developers who write SQL.** The SQL Workshop runs as pgkiln's owner,
-and application code (processes, regions, validations) runs on the runtime connection, from which a developer's SQL
-can reach other applications' data and metadata. User accounts, identity providers, LDAP directories and AI services
-also stay installation-wide. Use workspaces to keep teams' applications apart in the builder; give tenants who must
-not see each other's applications or data **separate installations** (databases).
+- **Workspace administrators**: on a workspace's page, administrators tick which of its developers administer it. A
+  workspace administrator opens the page from Workspace utilities (the card names the current workspace) and changes
+  its name, description and developers; isolation, database roles, moving applications and deleting stay with the
+  installation's administrators.
+
+A **shared** workspace (the default) is not a security boundary between developers who write SQL: its SQL Workshop
+runs as pgkiln's owner, and its application code (processes, regions, validations) runs on the shared runtime
+connection, from which SQL can reach other shared applications' data and metadata. Make a workspace **isolated** when
+its developers must not reach other teams' applications or data.
+
+### Workspace message and environment banner
+
+Administrators and the workspace's administrators set them on the workspace's page (*Manage service*, or the
+Administration menu → *Workspace message and environment banner*; APEX: Define Workspace Message, Define Environment
+Banner): a **message** (plain text, up to 2000 characters) shown to the workspace's developers on the App Builder home,
+and an **environment banner**: a label of up to 40 characters in one of eight colours, shown at the top of every
+builder page while the workspace is current.
+
+### Workspace utilization
+
+Administration menu → **Workspace utilization** (`/builder/workspaces/<id>/utilization`; APEX: Workspace
+Utilization), for administrators and the workspace's administrators: the number of applications, pages, developers,
+page views of the last 30 days and SQL scripts; per application its pages, regions, items, page views, users and the
+size of its static files; and the schemas the workspace's database roles use with their tables and storage.
+
+### Isolated workspaces
+
+On a workspace's page an administrator chooses **Isolate this workspace** (Workspace utilities → Workspaces → the
+workspace → *Isolation*). It needs `RUNTIME_DATABASE_URL` (applications don't run on the owner connection) and
+`PGKILN_SECRET_KEY` (the passwords of the workspace's logins are derived from it; nothing is stored). Then:
+
+- **Two PostgreSQL logins of its own**: `pgkiln_ws<id>_run_<suffix>` runs its applications (pages, processes, REST
+  handlers, automations, workflows, background processes, REST synchronisation); `pgkiln_ws<id>_dev_<suffix>` runs its
+  developers' SQL: SQL Commands, SQL Scripts, Quick SQL, Load and Unload Data, Sample Data, DDL and Compare, the
+  Advisor, code checks and document previews. SQL that runs `RESET ROLE` (or `set_config('role', …)`) only gets back to
+  that login, which can use the workspace's database roles and nothing else.
+- **The workspace's database roles** (APEX: workspace schemas): isolating gives the workspace the roles its
+  applications run as; administrators add or remove roles on its page. Its applications can run only as these roles,
+  so an import or a changed *Database role* setting that names another role is refused. A role belongs to one
+  workspace; a superuser, a role that creates roles or bypasses row-level security, and pgkiln's own roles can't
+  belong to one. A **new application** in an isolated workspace gets a new role and a new schema (owned by that role),
+  or a schema of one of the workspace's roles. The developer login starts as the first role (alphabetically), so the
+  tables a developer creates in the SQL Workshop belong to an application role; `set role` picks another of them.
+- **pgkiln's own tables** (`meta`) show each login its own workspace's applications, pages, sessions and accounts
+  (row-level security), and the shared runtime connection no longer sees the isolated workspace's.
+  `meta.app_id()` refuses another workspace's application, so `meta.web_request`, `meta.ai_generate`, mail, push
+  and `meta.page_url` can't act for it. The developer login has no rights in `meta`.
+- **The SQL Workshop's saved work** (scripts and their runs, blueprints, sample data generators) belongs to the
+  workspace it was made in, also in shared workspaces; data load definitions are listed for the current workspace's
+  applications.
+- **Administrators keep the owner** in the SQL Workshop, and a developer who also belongs to a shared workspace has the
+  owner's rights there: make the developers of an isolated workspace members of that workspace only.
+- A workflow step's SQL runs on the workspace's login and commits just before the workflow's own state, so after a
+  crash between the two a step can run again.
+
+Still installation-wide: user accounts (an account with access to an isolated workspace's application is visible only
+to that workspace, other accounts to every workspace), identity providers, LDAP directories, mail and AI services, the
+REST API through PostgREST (use REST modules for isolated applications), and the database catalog (any login can read
+table and function definitions in `pg_catalog`, not their rows). Every login of every workspace counts towards the
+server's `max_connections`: each isolated workspace opens at most `PGKILN_WORKSPACE_POOL_SIZE` (5) connections per
+login and server process.
+
+**Make shared** undoes it: the roles go back to the shared runtime connection and the workspace's logins can no
+longer sign in. Delete a workspace only when it is shared and empty; its logins are dropped with it.
 
 ## The builder window
 
 Every builder page has the same frame, modelled on an IDE:
 
-- **The icon rail** on the left: App Builder, SQL Workshop, Users, Developers, **Search** (on the
-  pages of an application), Help, and your account menu (the circle with your initials) with the
+- **The icon rail** on the left: App Builder, SQL Workshop, [App Gallery](#app-gallery), **Search** (on the
+  pages of an application); at the bottom the **Administration** menu (Workspace utilities; for administrators of the
+  current workspace *Manage service*: [workspace message and environment banner](#workspace-message-and-environment-banner),
+  [workspace utilization](#workspace-utilization) and the workspace's page; Manage users and groups, Developers,
+  Monitor activity, Change my password), Help, and your account menu (the circle with your initials) with the
   **builder theme** (*Dark*, the default; *Light*; or *System*, which follows the operating system),
   Change password and Sign out. The theme is remembered on this device, also after signing out;
   it only changes the builder, not your applications.
@@ -58,6 +135,8 @@ Every builder page has the same frame, modelled on an IDE:
 
 - **The status bar** at the bottom: who is signed in, the current [workspace](#workspaces), the database, the
   builder's language and the pgkiln version.
+- **An environment banner** (when the current workspace has one) across the top: a coloured band with a label such as
+  DEVELOPMENT or TEST, so nobody mistakes one environment for another.
 
 On phones the rail gets narrower and the breadcrumb shows only the current page.
 
@@ -77,6 +156,34 @@ The home page is laid out like APEX's App Builder:
   **Actions**, to sort. The view and the sort are remembered until you sign out.
 - **A side column** (on the right on wide screens, below the list otherwise): About, **Recent** (the
   applications you opened last) and Tasks.
+- **The workspace message**, when the workspace has one, above the tiles.
+- **Application groups**: when the workspace has [groups](#application-groups), a select next to the views shows one
+  group; each application shows its group.
+
+### Application groups
+
+Workspace utilities → **Application groups** (`/builder/app-groups`; APEX: Application Groups) organises the
+applications of the current workspace into named groups: add, rename and delete groups, and choose each
+application's group. The App Builder home then filters by group. Groups belong to the workspace, not to the
+applications: they are not exported, an in-place import keeps them, and an application moved to another workspace
+leaves its group. Every developer of the workspace manages them.
+
+## App Gallery
+
+The **App Gallery** (the cube in the icon rail, `/builder/gallery`; APEX: App Gallery) has three tabs:
+
+- **Sample Apps**: applications shipped with pgkiln (HR Demo, Tasks) with their own schema, data and **demo accounts
+  with known passwords**, so install them on a development or demo instance only. Administrators install them (the
+  same scripts as `pgkiln migrate --example hr`); they go into the current workspace. An installed one shows Run and
+  Edit.
+- **Starter Apps**: small applications (Team Tasks, Contacts, Expense Claims, Asset Inventory, Event Registrations)
+  shipped as [blueprints](#creating-an-application-from-a-blueprint). **Install** opens the blueprint's review:
+  nothing is created before you confirm, the application gets a new role and schema in the current workspace, and you
+  may edit the blueprint first (another alias, more columns). Any developer installs them.
+- **Custom Apps**: the workspace's boilerplate applications (Application type *Boilerplate*): *Create from it* opens
+  Create with that boilerplate chosen.
+
+The list is `examples/gallery/gallery.json`; add your own starters there as blueprint files.
 
 ### Creating an application
 
@@ -907,14 +1014,21 @@ may use), a form to **issue a token** for an account, and `curl` examples. See
 
 ## SQL Workshop
 
-- **SQL Commands**: run any SQL as the **owner connection**, not as an application role. Multiple
+The SQL Workshop opens on its **home** (`/builder/sql`; APEX: the SQL Workshop home): tiles for the Object Browser,
+SQL Commands, SQL Scripts, the utilities and Quick SQL; **Recently created tables** (the newest tables you can read:
+PostgreSQL keeps no creation time, so object ids decide), your **recent SQL commands** (click one to open it in SQL
+Commands; other developers' are never shown) and the workspace's **recent SQL scripts**. The side column sets the
+session's **schema** (APEX: the default schema): it goes first in the search path of SQL Commands and SQL Scripts until
+you sign out. Tasks link to Quick SQL, blueprints, table descriptions, sample data and Generate DDL.
+
+- **SQL Commands** (`/builder/sql/commands`): run any SQL as the **owner connection**, not as an application role. Multiple
   statements are allowed; the result of the last one is shown (up to 500 rows). Press
   **Ctrl/Cmd + Enter** to run. The [code editor](#the-code-editor) suggests every schema, table,
   column and function the owner sees.
 - **Object Browser**: tables, views and functions per schema. For a table you see columns, types
   and defaults, **row level security policies**, **grants** and the first 25 rows; for a
   function, its source.
-- **SQL Scripts**: saved scripts, shared by all developers. Create one in the editor, upload a
+- **SQL Scripts**: saved scripts, shared by the developers of the workspace. Create one in the editor, upload a
   `.sql` file (UTF-8, up to 5 MB) or save one from Quick SQL; download it again as `.sql`. **Run**
   splits the script into statements at semicolons (outside strings, comments, quoted identifiers,
   `$$` bodies and `BEGIN ATOMIC … END`) and runs them one after another, with a **result per

package/docs/guide/12-development.md

@@ -32,7 +32,9 @@ src/
                            read, import), files.ts (directories, zip), diff.ts, replace.ts (import --replace in place),
                            mcp.ts (`pgkiln mcp`: the MCP server for AI coding agents, chapter 20)
   app.ts / server.ts       Fastify setup / entry point
-  db.ts                    the two pools, appTx() (SET LOCAL ROLE + pgkiln.* settings, NOTICEs to the debug log), savepoints
+  db.ts                    the owner and shared runtime pools, `runtime` (the current scope's: runtimeScope), appTx() (SET LOCAL ROLE + pgkiln.* settings, NOTICEs to the debug log), savepoints
+  workspace-db.ts          isolated workspaces (090): the isolated applications (cached 5 s), a pool per workspace login (passwords from
+                           PGKILN_SECRET_KEY), runtimeForApp/runtimeForAlias, withAppDb, devDbForApp; app.ts scopes /a/:alias requests
   security.ts              URL checksums, password policy, security headers (CSP nonce), throttling limits
   ddl.ts                   Generate DDL and Schema Comparison: readSchema (catalog → one DDL per object, unqualified), ddlScript (order), compare, changeScript
   static-version.ts        the version of app.css, app.js, icons.svg and sw.js (?v= in their URLs, the service worker version): content hash, looked at again when a file changes
@@ -231,8 +233,13 @@ src/
     templates.ts           template components: preview, plug-in export/import, region settings, report column templates
     code-editor.ts         code fields (data-code marks), /builder/code/completions (scoped to the app's role), /builder/code/check
     instance.ts            Workspace utilities → Instance settings (src/instance.ts: session and sign-in settings, configuration overview)
+    gallery.ts             the App Gallery (sprint 61): examples/gallery/gallery.json, sample apps (administrators, migrate --example),
+                           starter apps (blueprints → openBlueprint's review), custom apps (the workspace's boilerplates)
+    app-groups.ts          application groups (092): a workspace's groups, a group per application (the App Builder home filters)
+    cross-app.ts           Cross Application Reports (sprint 61): REPORTS (one SQL per topic over the workspace's applications)
     workspaces.ts          workspaces (064): loadWorkspaces/appAllowed (checked in ui.ts developer() for every /apps/:id and /pages/:pid
-                           request), the current workspace (session state __WS), placeApp, the switcher, Workspace utilities → Workspaces
+                           request), the current workspace (session state __WS), placeApp, the switcher, Workspace utilities → Workspaces;
+                           (090) isolation and the workspace's database roles, workshopDb (the SQL Workshop's connection)
     locks.ts               page and application locks (blockingLock, checked in ui.ts developer() for every builder POST; appOfPath), developer comments, administrators
     blueprints.ts          Create → From a blueprint: list, JSON editor, AI draft, review (signed with the session), create in one transaction
     ai-builder.ts          App Builder AI (migration 062): the builder's AI service (meta.builder_ai), SQL Workshop → AI (SQL from a
@@ -290,6 +297,9 @@ test/
   page-wizards.test.ts     create page wizards: catalog defaults, every page type generated and rendered, refusals, the builder steps
   theme-styles.test.ts     Theme Roller style variants (checks, CSS, user choice per app, builder page), template options, base style Iris
   workspaces.test.ts       workspaces (064): Default, administrators' pages, current workspace, refused apps, imports and copies
+  gallery.test.ts          the App Gallery: every starter created from its review with all its pages rendering; sample apps (admins)
+  builder-apex-screens.test.ts sprint 61: sign-in with a workspace, message and banner, utilization, SQL Workshop home, groups, reports
+  workspace-isolation.test.ts isolated workspaces (090): logins, RLS on meta, app_id, roles, SQL Workshop, scripts, imports
   ai.test.ts               AI services: Generate text with AI (text, structured outputs, errors, limits, keys), its dynamic action,
                            meta.ai_generate, the providers, HR page 37; against ai-mock.ts (no real API calls)
   ai-assistant.test.ts     AI assistant region (context, tools as the app role, writes, REST, histories, limits, sessions), OpenAI,

package/examples/gallery/README.md

@@ -0,0 +1,13 @@
+# App Gallery
+
+The builder's **App Gallery** (`/builder/gallery`) lists what `gallery.json` names:
+
+- `samples`: applications shipped with pgkiln, installed by an administrator: `example` names a directory of
+  `examples/` (installed like `pgkiln migrate --example <name>`), `file` a single SQL file in `examples/`.
+  `alias` is the application they create (an installed one shows Run and Edit).
+- `starters`: [blueprints](../../docs/guide/03-builder.md#creating-an-application-from-a-blueprint) in `starters/`.
+  Install opens the blueprint's review; the developer creates the application from it.
+
+Add a starter by writing a blueprint file in `starters/` and an entry in `gallery.json` (a key of lower-case
+letters, digits and `-`, a title, an [icon name](../../docs/guide/09-reference.md#icons) and a description).
+`test/gallery.test.ts` creates every starter and opens all its pages.

package/examples/gallery/gallery.json

@@ -0,0 +1,20 @@
+{
+  "samples": [
+    {"key": "hr", "title": "HR Demo", "alias": "hr", "icon": "briefcase", "example": "hr",
+     "description": "The showcase of pgkiln on the classic EMP and DEPT tables: reports and forms, an interactive grid, charts, maps, a calendar, faceted search, approvals and workflows, documents, a REST API, translations and a Progressive Web App. Demo accounts king, blake, jones, allen, scott and demo, with the username as password."},
+    {"key": "tasks", "title": "Tasks", "alias": "tasks", "icon": "check", "file": "tasks-app.sql",
+     "description": "The tutorial application: a personal task list where every user sees only their own tasks (row level security), with a business rule in PL/pgSQL behind a button. Demo accounts ann and bob (password ann-password, bob-password)."}
+  ],
+  "starters": [
+    {"key": "team-tasks", "title": "Team Tasks", "icon": "layout-grid", "file": "starters/team-tasks.json",
+     "description": "Projects and their tasks with status, priority, assignee and due date: reports and forms, a faceted search, a calendar of due dates and a dashboard."},
+    {"key": "contacts", "title": "Contacts", "icon": "contact", "file": "starters/contacts.json",
+     "description": "Companies, their contacts and the interactions with them: contact cards, a faceted search, reports and forms and a dashboard."},
+    {"key": "expense-claims", "title": "Expense Claims", "icon": "receipt", "file": "starters/expense-claims.json",
+     "description": "Claims with their expenses in a master-detail page, an editable grid, a chart by category and a dashboard."},
+    {"key": "asset-inventory", "title": "Asset Inventory", "icon": "package", "file": "starters/asset-inventory.json",
+     "description": "Assets with their tags, locations, owners and purchase data: a faceted search, an editable grid of locations, a chart by category and a dashboard."},
+    {"key": "event-registrations", "title": "Event Registrations", "icon": "calendar-days", "file": "starters/event-registrations.json",
+     "description": "Events in a calendar and the people who registered for them, with reports, forms and a dashboard."}
+  ]
+}

package/examples/gallery/starters/asset-inventory.json

@@ -0,0 +1,30 @@
+{"blueprint": 1, "name": "Asset Inventory", "alias": "asset-inventory", "schema": "asset_inventory",
+ "tables": [
+  {"name": "location", "label": "Locations", "columns": [
+    {"name": "name", "type": "text", "required": true, "unique": true},
+    {"name": "building", "type": "text"},
+    {"name": "floor", "type": "integer"}]},
+  {"name": "asset", "label": "Assets", "columns": [
+    {"name": "location_id", "references": "location"},
+    {"name": "tag", "type": "text", "required": true, "unique": true},
+    {"name": "name", "type": "text", "required": true},
+    {"name": "category", "type": "text", "required": true, "values": ["Laptop", "Monitor", "Phone", "Furniture", "Vehicle", "Other"]},
+    {"name": "assigned_to", "type": "text"},
+    {"name": "purchased_on", "type": "date"},
+    {"name": "price", "type": "number"},
+    {"name": "in_use", "type": "boolean"}]}],
+ "pages": [
+  {"type": "report_form", "table": "asset", "page": 2, "form_page": 3, "label": "Assets", "icon": "list"},
+  {"type": "facets", "table": "asset", "page": 4, "label": "Find assets", "icon": "filter"},
+  {"type": "grid", "table": "location", "page": 5, "label": "Locations", "icon": "map"},
+  {"type": "chart", "table": "asset", "page": 6, "label": "By category", "icon": "chart"}],
+ "dashboard": true,
+ "sample_data": [
+  {"table": "location", "columns": ["id", "name", "building", "floor"], "rows": [
+    [1, "Head office 2nd floor", "Main", 2], [2, "Head office 3rd floor", "Main", 3], [3, "Warehouse", "North", 0]]},
+  {"table": "asset", "columns": ["location_id", "tag", "name", "category", "assigned_to", "purchased_on", "price", "in_use"], "rows": [
+    [1, "A-0001", "ThinkPad T14", "Laptop", "Ann", "2025-03-10", 1249.00, true],
+    [1, "A-0002", "Dell 27\" monitor", "Monitor", "Ann", "2025-03-10", 329.00, true],
+    [2, "A-0003", "MacBook Air", "Laptop", "Ben", "2024-11-02", 1399.00, true],
+    [2, "A-0004", "Standing desk", "Furniture", null, "2023-06-15", 610.00, false],
+    [3, "A-0005", "Delivery van", "Vehicle", "Logistics", "2022-01-20", 32500.00, true]]}]}

package/examples/gallery/starters/contacts.json

@@ -0,0 +1,41 @@
+{"blueprint": 1, "name": "Contacts", "alias": "contacts", "schema": "contacts",
+ "tables": [
+  {"name": "company", "label": "Companies", "columns": [
+    {"name": "name", "type": "text", "required": true, "unique": true},
+    {"name": "industry", "type": "text", "values": ["Retail", "Manufacturing", "Services", "Public sector", "Technology"]},
+    {"name": "city", "type": "text"},
+    {"name": "website", "type": "text"}]},
+  {"name": "contact", "label": "Contacts", "columns": [
+    {"name": "company_id", "references": "company"},
+    {"name": "first_name", "type": "text", "required": true},
+    {"name": "last_name", "type": "text", "required": true},
+    {"name": "email", "type": "text", "unique": true},
+    {"name": "phone", "type": "text"},
+    {"name": "role", "type": "text"},
+    {"name": "status", "type": "text", "required": true, "values": ["Lead", "Customer", "Former customer"]}]},
+  {"name": "interaction", "label": "Interactions", "columns": [
+    {"name": "contact_id", "references": "contact", "required": true},
+    {"name": "happened_on", "type": "date", "required": true},
+    {"name": "kind", "type": "text", "required": true, "values": ["Call", "Meeting", "E-mail", "Visit"]},
+    {"name": "notes", "type": "text"}]}],
+ "pages": [
+  {"type": "report_form", "table": "company", "page": 2, "form_page": 3, "label": "Companies", "icon": "building"},
+  {"type": "cards", "table": "contact", "page": 4, "label": "Contacts", "icon": "users"},
+  {"type": "report_form", "table": "contact", "page": 5, "form_page": 6, "label": "Contact list", "icon": "list"},
+  {"type": "facets", "table": "contact", "page": 7, "label": "Find contacts", "icon": "filter"},
+  {"type": "report_form", "table": "interaction", "page": 8, "form_page": 9, "label": "Interactions", "icon": "activity"}],
+ "dashboard": true,
+ "sample_data": [
+  {"table": "company", "columns": ["id", "name", "industry", "city", "website"], "rows": [
+    [1, "Northwind Traders", "Retail", "Utrecht", "https://northwind.example"],
+    [2, "Contoso Machines", "Manufacturing", "Eindhoven", "https://contoso.example"],
+    [3, "Fabrikam Services", "Services", "Rotterdam", null]]},
+  {"table": "contact", "columns": ["id", "company_id", "first_name", "last_name", "email", "phone", "role", "status"], "rows": [
+    [1, 1, "Anna", "de Vries", "anna@northwind.example", "+31 30 123 4567", "Buyer", "Customer"],
+    [2, 1, "Bram", "Jansen", "bram@northwind.example", null, "Director", "Customer"],
+    [3, 2, "Chloe", "Bakker", "chloe@contoso.example", "+31 40 765 4321", "Engineer", "Lead"],
+    [4, 3, "Daan", "Visser", "daan@fabrikam.example", null, "Owner", "Former customer"]]},
+  {"table": "interaction", "columns": ["contact_id", "happened_on", "kind", "notes"], "rows": [
+    [1, "2026-09-12", "Meeting", "Yearly review; wants a quote for spring."],
+    [1, "2026-10-02", "E-mail", "Sent the quote."],
+    [3, "2026-10-05", "Call", "Interested in a demo."]]}]}

package/examples/gallery/starters/event-registrations.json

@@ -0,0 +1,29 @@
+{"blueprint": 1, "name": "Event Registrations", "alias": "event-registrations", "schema": "event_registrations",
+ "authentication": "app_users",
+ "tables": [
+  {"name": "event", "label": "Events", "columns": [
+    {"name": "title", "type": "text", "required": true},
+    {"name": "starts_at", "type": "timestamp", "required": true},
+    {"name": "venue", "type": "text"},
+    {"name": "capacity", "type": "integer"},
+    {"name": "status", "type": "text", "required": true, "values": ["Draft", "Open", "Full", "Closed"]}]},
+  {"name": "registration", "label": "Registrations", "columns": [
+    {"name": "event_id", "references": "event", "required": true},
+    {"name": "attendee", "type": "text", "required": true},
+    {"name": "email", "type": "text", "required": true},
+    {"name": "registered_on", "type": "date", "required": true},
+    {"name": "attended", "type": "boolean"}]}],
+ "pages": [
+  {"type": "calendar", "table": "event", "page": 2, "label": "Calendar", "icon": "calendar"},
+  {"type": "report_form", "table": "event", "page": 3, "form_page": 4, "label": "Events", "icon": "list"},
+  {"type": "report_form", "table": "registration", "page": 5, "form_page": 6, "label": "Registrations", "icon": "users"}],
+ "dashboard": true,
+ "sample_data": [
+  {"table": "event", "columns": ["id", "title", "starts_at", "venue", "capacity", "status"], "rows": [
+    [1, "PostgreSQL meetup", "2026-11-12 18:30", "Utrecht", 60, "Open"],
+    [2, "Low-code workshop", "2026-11-26 09:30", "Amsterdam", 20, "Full"],
+    [3, "Year-end drinks", "2026-12-18 17:00", "Head office", 120, "Draft"]]},
+  {"table": "registration", "columns": ["event_id", "attendee", "email", "registered_on", "attended"], "rows": [
+    [1, "Anna de Vries", "anna@example.com", "2026-10-01", null],
+    [1, "Bram Jansen", "bram@example.com", "2026-10-03", null],
+    [2, "Chloe Bakker", "chloe@example.com", "2026-09-28", null]]}]}

package/examples/gallery/starters/expense-claims.json

@@ -0,0 +1,32 @@
+{"blueprint": 1, "name": "Expense Claims", "alias": "expense-claims", "schema": "expense_claims",
+ "tables": [
+  {"name": "claim", "label": "Claims", "columns": [
+    {"name": "employee", "type": "text", "required": true},
+    {"name": "purpose", "type": "text", "required": true},
+    {"name": "submitted_on", "type": "date", "required": true},
+    {"name": "status", "type": "text", "required": true, "values": ["Draft", "Submitted", "Approved", "Rejected", "Paid"]},
+    {"name": "approver", "type": "text"}]},
+  {"name": "expense", "label": "Expenses", "columns": [
+    {"name": "claim_id", "references": "claim", "required": true},
+    {"name": "spent_on", "type": "date", "required": true},
+    {"name": "category", "type": "text", "required": true, "values": ["Travel", "Lodging", "Meals", "Supplies", "Other"]},
+    {"name": "description", "type": "text"},
+    {"name": "amount", "type": "number", "required": true}]}],
+ "pages": [
+  {"type": "master_detail", "table": "claim", "page": 2, "label": "Claims", "icon": "file"},
+  {"type": "report_form", "table": "expense", "page": 3, "form_page": 4, "label": "Expenses", "icon": "list"},
+  {"type": "chart", "table": "expense", "page": 5, "label": "By category", "icon": "chart"},
+  {"type": "grid", "table": "claim", "page": 6, "label": "Edit claims", "icon": "grid"}],
+ "dashboard": true,
+ "sample_data": [
+  {"table": "claim", "columns": ["id", "employee", "purpose", "submitted_on", "status", "approver"], "rows": [
+    [1, "Ann", "Customer visit Hamburg", "2026-09-30", "Approved", "Ben"],
+    [2, "Cleo", "Conference in Lisbon", "2026-10-06", "Submitted", null],
+    [3, "Dana", "Office supplies", "2026-10-08", "Draft", null]]},
+  {"table": "expense", "columns": ["claim_id", "spent_on", "category", "description", "amount"], "rows": [
+    [1, "2026-09-24", "Travel", "Train Utrecht-Hamburg return", 189.40],
+    [1, "2026-09-24", "Lodging", "Hotel, one night", 132.00],
+    [1, "2026-09-25", "Meals", "Lunch with the customer", 64.50],
+    [2, "2026-10-01", "Travel", "Flight", 245.00],
+    [2, "2026-10-01", "Lodging", "Hotel, three nights", 420.00],
+    [3, "2026-10-07", "Supplies", "Notebooks and pens", 38.95]]}]}

package/examples/gallery/starters/team-tasks.json

@@ -0,0 +1,35 @@
+{"blueprint": 1, "name": "Team Tasks", "alias": "team-tasks", "schema": "team_tasks",
+ "tables": [
+  {"name": "project", "label": "Projects", "columns": [
+    {"name": "name", "type": "text", "required": true, "unique": true},
+    {"name": "owner", "type": "text"},
+    {"name": "status", "type": "text", "required": true, "values": ["Planned", "Active", "On hold", "Done"]},
+    {"name": "start_date", "type": "date"},
+    {"name": "end_date", "type": "date"}]},
+  {"name": "task", "label": "Tasks", "columns": [
+    {"name": "project_id", "references": "project", "required": true},
+    {"name": "title", "type": "text", "required": true},
+    {"name": "assignee", "type": "text"},
+    {"name": "status", "type": "text", "required": true, "values": ["To do", "In progress", "Blocked", "Done"]},
+    {"name": "priority", "type": "text", "values": ["Low", "Normal", "High"]},
+    {"name": "due", "type": "date"},
+    {"name": "hours", "type": "number"}]}],
+ "pages": [
+  {"type": "report_form", "table": "project", "page": 2, "form_page": 3, "label": "Projects", "icon": "layers"},
+  {"type": "report_form", "table": "task", "page": 4, "form_page": 5, "label": "Tasks", "icon": "check"},
+  {"type": "facets", "table": "task", "page": 6, "label": "Find tasks", "icon": "filter"},
+  {"type": "calendar", "table": "task", "page": 7, "label": "Due dates", "icon": "calendar"}],
+ "dashboard": true,
+ "sample_data": [
+  {"table": "project", "columns": ["id", "name", "owner", "status", "start_date", "end_date"], "rows": [
+    [1, "Website relaunch", "Ann", "Active", "2026-09-01", "2026-12-15"],
+    [2, "Customer portal", "Ben", "Planned", "2026-11-01", "2027-03-31"],
+    [3, "Office move", "Cleo", "Done", "2026-05-01", "2026-08-30"]]},
+  {"table": "task", "columns": ["project_id", "title", "assignee", "status", "priority", "due", "hours"], "rows": [
+    [1, "Design the home page", "Dana", "Done", "High", "2026-09-20", 16],
+    [1, "Write the copy", "Eli", "In progress", "Normal", "2026-10-25", 12],
+    [1, "Move the content", "Dana", "To do", "Normal", "2026-11-15", 24],
+    [1, "Test on phones", "Finn", "To do", "High", "2026-12-01", 8],
+    [2, "Gather requirements", "Ben", "In progress", "High", "2026-11-10", 20],
+    [2, "Choose the sign-in", "Gus", "Blocked", "Normal", "2026-11-20", 4],
+    [3, "Pack the archive", "Cleo", "Done", "Low", "2026-08-10", 10]]}]}

package/examples/hr/hr_40_sample_data.sql

@@ -47,4 +47,4 @@ values ('HR demo staff', 'Departments, employees and leave requests for trying o
     {"column": "decision_note", "generator": "skip", "options": "", "nulls": 0},
     {"column": "created_at", "generator": "timestamp", "options": "2025-10-01..2026-10-01", "nulls": 0}]}
 ]$json$::jsonb, 'admin', 'admin')
-on conflict (name) do nothing;
+on conflict (workspace_id, name) do nothing;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",