pgkiln 0.36.0 → 0.38.0

package/public/builder.css

@@ -437,6 +437,41 @@ kbd { display: inline-block; padding: 0 0.35em; border: 1px solid var(--border);
 .ide-login { background: linear-gradient(180deg, var(--chrome) 0 40%, var(--bg) 40%); color: var(--text); }
 .ide-login .btn-hot { background: var(--hot); border-color: var(--hot); color: var(--hot-text); }
 .ide-login .btn-hot:hover { background: var(--hot-hover); }
+.signin-body.ide-login { display: block; background: var(--bg); }
+.signin { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1fr); width: 100%; max-width: none; min-height: 100vh; min-height: 100dvh; margin: 0; padding: 0; }
+.signin-hero {
+  display: flex; flex-direction: column; justify-content: flex-start; gap: 0.75rem; padding: 3rem;
+  color: var(--chrome-text); background-color: var(--chrome);
+  background-image: repeating-linear-gradient(135deg, rgb(255 255 255 / 0.025) 0 2px, transparent 2px 14px),
+                    repeating-linear-gradient(45deg, rgb(255 255 255 / 0.02) 0 1px, transparent 1px 22px);
+}
+.signin-logo { display: grid; place-items: center; width: 44px; height: 44px; border-radius: 8px; background: var(--hot); color: var(--hot-text); font-weight: 700; font-size: 18px; margin-bottom: 2rem; }
+.signin-title { margin: 0; font-size: clamp(2rem, 4vw, 2.75rem); font-weight: 750; color: var(--chrome-text); }
+.signin-tagline { margin: 0; font-size: 1.2rem; color: var(--chrome-muted); max-width: 30ch; }
+.signin-foot { margin: auto 0 0; font-size: 0.85rem; color: var(--chrome-muted); }
+.signin-panel { display: grid; place-items: center; padding: 2rem 1rem; background: var(--surface); }
+.signin-form { display: flex; flex-direction: column; gap: 0.85rem; width: 100%; max-width: 420px; }
+.signin-form h2 { margin: 0; font-size: 1.5rem; }
+.signin-form .field { margin: 0; }
+.signin-input { display: flex; align-items: center; gap: 0.6rem; padding: 0 0.75rem; border: 1px solid var(--border); border-radius: 6px; background: var(--bg); }
+.signin-input:focus-within { border-color: var(--accent); outline: 2px solid var(--accent); outline-offset: -1px; }
+.signin-input > .icon { flex: none; width: 18px; height: 18px; color: var(--muted); }
+.ide-login .signin-input input { flex: 1; width: auto; min-width: 0; border: 0; border-radius: 0; box-shadow: none; background: transparent; padding: 0.7rem 0; font-size: 1rem; color: var(--text); outline: none; }
+.signin-reveal { flex: none; border: 0; background: none; color: var(--accent); cursor: pointer; font-size: 0.85rem; padding: 0.25rem; }
+.signin-remember { font-size: 0.9rem; }
+.signin-submit { padding: 0.75rem; font-size: 1rem; }
+.signin-hint { margin: 0; text-align: center; }
+.signin-actions { display: flex; flex-wrap: wrap; justify-content: center; gap: 0.5rem 1.5rem; margin-top: 1rem; padding-top: 1rem; border-top: 1px solid var(--border); }
+.signin-actions a { display: inline-flex; align-items: center; gap: 0.4rem; color: var(--gold); text-decoration: none; }
+.signin-actions a:hover { text-decoration: underline; }
+@media (max-width: 760px) {
+  .signin { grid-template-columns: 1fr; }
+  .signin-hero { padding: 1.25rem 1rem; gap: 0.25rem; }
+  .signin-logo { margin-bottom: 0.5rem; width: 36px; height: 36px; font-size: 15px; }
+  .signin-tagline { font-size: 1rem; }
+  .signin-foot { display: none; }
+  .signin-panel { place-items: start center; }
+}
 
 /* ------------------------------------------------------------ small screens */
 /* ------------------------------------------------------------ status bar (every builder page, like APEX's footer) */
@@ -781,3 +816,59 @@ details.prop-group-more[open] > summary { margin-bottom: 8px; }
 .pe-help-body { padding-top: 0.4rem; overflow-wrap: anywhere; }
 .pe-help-body h3 { font-size: 0.95rem; margin: 0 0 0.3rem; }
 .pe-help-body p { margin: 0 0 0.4rem; }
+
+/* ------------------------------------------------------------ environment banner, workspace message (091), Administration menu */
+.ide-banner { padding: 3px 12px; font-size: 12px; font-weight: 700; letter-spacing: 0.06em; text-transform: uppercase; text-align: center; }
+.ide-banner-red { background: #b42318; color: #fff; }
+.ide-banner-orange { background: #c4520f; color: #fff; }
+.ide-banner-yellow { background: #e6b400; color: #1e1d1b; }
+.ide-banner-green { background: #2f7d32; color: #fff; }
+.ide-banner-teal { background: #0e7a74; color: #fff; }
+.ide-banner-blue { background: #1a5f99; color: #fff; }
+.ide-banner-purple { background: #6941c6; color: #fff; }
+.ide-banner-gray { background: #5e5a54; color: #fff; }
+.ab-message { display: flex; gap: 0.6rem; align-items: flex-start; margin-bottom: 12px; }
+.ab-message p { margin: 0.15rem 0 0; white-space: pre-line; }
+.rail-admin { padding: 0; }
+.rail-admin > summary { list-style: none; cursor: pointer; }
+.rail-admin > summary::-webkit-details-marker { display: none; }
+.rail-admin .menu-panel { bottom: 56px; }
+.rail-admin .menu-links strong { padding: 2px 0 4px; }
+.ide .alert-info { background: var(--accent-soft); border-color: var(--accent); color: var(--text); }
+
+/* ------------------------------------------------------------ SQL Workshop home (sprint 61) */
+.sw-tiles { grid-template-columns: repeat(5, minmax(0, 1fr)); }
+.sw-tile-icon { background: #2f7d32; }
+.sw-recents { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); border: 1px solid var(--border); border-radius: var(--radius); background: var(--surface); }
+.sw-recent { min-width: 0; border-left: 1px solid var(--border); }
+.sw-recent:first-child { border-left: 0; }
+.sw-recent h2 { margin: 0; padding: 10px 12px; font-size: 13.5px; border-bottom: 1px solid var(--border); }
+.sw-recent ul { list-style: none; margin: 0; padding: 0; max-height: 440px; overflow-y: auto; }
+.sw-recent li { display: flex; justify-content: space-between; gap: 12px; padding: 7px 12px; border-bottom: 1px solid var(--border); }
+.sw-recent li a { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--gold); text-decoration: none; }
+.sw-recent li a:hover { text-decoration: underline; }
+.sw-recent li .muted { flex: none; font-size: 12px; }
+.sw-recent > p { padding: 0 12px; }
+.sw-schema { display: flex; gap: 6px; }
+.sw-schema select { flex: 1; min-width: 0; }
+@media (max-width: 1100px) { .sw-tiles { grid-template-columns: repeat(auto-fill, minmax(min(100%, 200px), 1fr)); } .sw-recents { grid-template-columns: 1fr; } .sw-recent { border-left: 0; border-top: 1px solid var(--border); } .sw-recent:first-child { border-top: 0; } }
+
+/* ------------------------------------------------------------ App Gallery (sprint 61) */
+.gal-bar { display: flex; flex-wrap: wrap; gap: 10px; align-items: center; margin-bottom: 8px; }
+.gal-search { flex: 1 1 320px; }
+.gal-tabs { display: inline-flex; }
+.gal-tabs a { padding: 6px 12px; text-decoration: none; color: var(--text); border: 1px solid var(--border); background: var(--surface); }
+.gal-tabs a + a { border-left: 0; }
+.gal-tabs a:first-child { border-radius: var(--radius) 0 0 var(--radius); }
+.gal-tabs a:last-child { border-radius: 0 var(--radius) var(--radius) 0; }
+.gal-tabs a[aria-current] { background: var(--surface-3); font-weight: 650; }
+.gal-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(min(100%, 280px), 1fr)); gap: 12px; }
+.gal-card { display: flex; flex-direction: column; gap: 10px; padding: 16px; border: 1px solid var(--border); border-radius: 6px; background: var(--surface); min-width: 0; }
+.gal-head { display: flex; gap: 12px; align-items: center; }
+.gal-head h2 { margin: 0; font-size: 15px; }
+.gal-icon { flex: none; display: grid; place-items: center; width: 48px; height: 48px; border-radius: 8px; background: var(--accent-soft); color: var(--accent); }
+.gal-icon .icon { width: 26px; height: 26px; }
+.gal-card > p { margin: 0; flex: 1; line-height: 1.5; }
+.gal-foot { display: flex; flex-wrap: wrap; align-items: center; justify-content: flex-end; gap: 8px; }
+.gal-foot form { margin: 0; }
+.ab-group select { min-width: 140px; }

package/src/app.ts

@@ -65,6 +65,11 @@ import { ownerUrl, runtime } from './db.ts';
 import { refreshInstanceSettings } from './instance.ts';
 import { loadSecrets, securityHeaders, trustProxySetting } from './security.ts';
 import { lucideSymbol } from './icons.ts';
+import { runtimeForAlias } from './workspace-db.ts';
+import { galleryRoutes } from './builder/gallery.ts';
+import { appGroupRoutes } from './builder/app-groups.ts';
+import { crossAppRoutes } from './builder/cross-app.ts';
+import { runtimeScope } from './db.ts';
 
 export async function buildApp(opts: { logger?: boolean } = {}) {
   // a database older than the code: apply the migrations (MIGRATE_ON_START=true)
@@ -104,6 +109,22 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
       );
     });
   }
+  // an application of an isolated workspace runs on its workspace's own login (src/workspace-db.ts):
+  // the rest of the request runs in that scope, so runtime.* uses that pool
+  app.addHook('onRequest', (req, _reply, done) => {
+    const m = /^\/a\/([^/?#]{1,100})/.exec(req.url);
+    if (!m || pending.length) return done();
+    let alias: string;
+    try {
+      alias = decodeURIComponent(m[1]);
+    } catch {
+      return done();
+    }
+    runtimeForAlias(alias).then(
+      (db) => runtimeScope.run(db, done),
+      (err: Error) => done(err),
+    );
+  });
   // debug messages: stored after the response, for requests that have a debug log (src/debug.ts)
   app.addHook('onError', async (req, _reply, err) => {
     debugOf(req)?.add(1, 'error', `unhandled: ${err.message}`);
@@ -153,6 +174,9 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(staticFileRoutes);
   await app.register(restRoutes);
   await app.register(builderRoutes);
+  await app.register(galleryRoutes);
+  await app.register(appGroupRoutes);
+  await app.register(crossAppRoutes);
   await app.register(sharedRoutes);
   await app.register(designerRoutes);
   await app.register(lockRoutes);

package/src/automations.ts

@@ -1,5 +1,6 @@
 import pg from 'pg';
 import { owner, runtime } from './db.ts';
+import { withAppDb } from './workspace-db.ts';
 
 // Automations (Shared Components → Automations): SQL or PL/pgSQL on a cron
 // schedule, run by the pgkiln server as the application's database role.
@@ -226,7 +227,7 @@ export async function runAutomation(id: number, trigger: 'schedule' | 'manual' =
 
 /** The actions, as the application's role, through meta.automation_execute() (also used by meta.run_automation). */
 async function execute(def: Definition): Promise<{ rows: number; failed: number; errors: RowError[] }> {
-  return runtime.tx(async (c) => {
+  return withAppDb(def.app_id, () => runtime.tx(async (c) => {
     await c.query(
       `select set_config('pgkiln.app_user', $1, true), set_config('pgkiln.app_id', $2, true),
               set_config('pgkiln.automation_id', $3, true), set_config('pgkiln.session_id', '', true),
@@ -235,7 +236,7 @@ async function execute(def: Definition): Promise<{ rows: number; failed: number;
     );
     if (def.db_role) await c.query(`set local role ${pg.escapeIdentifier(def.db_role)}`);
     return (await c.query('select meta.automation_execute($1::jsonb) as r', [JSON.stringify(def)])).rows[0].r;
-  });
+  }));
 }
 
 // ------------------------------------------------------------------ scheduler

package/src/builder/advisor.ts

@@ -1,7 +1,8 @@
 import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { applyBinds, splitStatements } from '../binds.ts';
-import { owner } from '../db.ts';
+import { owner, type Db } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { templateProblem } from '../runtime/document.ts';
@@ -156,7 +157,7 @@ const BUILT_IN = new Set(['MUST_NOT_BE_PUBLIC_USER']);
  * e.g. an import that hasn't committed yet) everything is read and checked
  * on that client, inside a savepoint that is rolled back.
  */
-export async function advise(appId: number, tx?: pg.ClientBase): Promise<{ findings: Finding[]; checked: number; plpgsqlCheck: boolean }> {
+export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db } = {}): Promise<{ findings: Finding[]; checked: number; plpgsqlCheck: boolean }> {
   const query = (sql: string, params: unknown[] = []) => (tx ? tx.query(sql, params) : owner.query(sql, params));
   const one = async (sql: string, params: unknown[] = []) => (await query(sql, params)).rows[0];
   const app = await one('select * from meta.app where id = $1', [appId]);
@@ -188,9 +189,14 @@ export async function advise(appId: number, tx?: pg.ClientBase): Promise<{ findi
                                    and not exists (select 1 from meta.page_group g where g.app_id = p.app_id and g.name = p.page_group) order by 1`, [appId])).rows)
     findings.push({ severity: 'warning', entry: null, field: `Page ${p.page_no} → Page group`, message: `Page group ${p.page_group} doesn't exist (Shared Components → Page groups).` });
   // ---- SQL, as the application's role, rolled back (a savepoint in the caller's transaction)
-  const c = (tx ?? (await owner.pool.connect())) as pg.PoolClient;
+  // (090) an isolated workspace's application: planned on the workspace's developer login, in a
+  // transaction of its own (planning can run the application's functions; RESET ROLE there only
+  // reaches that login, never the owner); `opts.db` names the login for an import into the workspace
+  const own = opts.db && opts.db !== owner ? opts.db : await devDbForApp(appId);
+  const inTx = !!tx && own === owner;
+  const c = (inTx ? tx : await (own === owner ? owner : own).pool.connect()) as pg.PoolClient;
   try {
-    await c.query(tx ? 'savepoint advisor_all' : 'begin');
+    await c.query(inTx ? 'savepoint advisor_all' : 'begin');
     await c.query(`set local statement_timeout = '5s'`);
     await c.query(`select set_config('pgkiln.app_id', $1, true)`, [String(appId)]);
     if (app.db_role) await c.query(`set local role ${pg.escapeIdentifier(app.db_role)}`);
@@ -263,7 +269,7 @@ export async function advise(appId: number, tx?: pg.ClientBase): Promise<{ findi
       }
     }
   } finally {
-    if (tx) {
+    if (inTx) {
       await c.query('rollback to savepoint advisor_all');
       await c.query('release savepoint advisor_all');
     } else {

package/src/builder/ai-builder.ts

@@ -9,6 +9,7 @@ import type { Session } from '../session.ts';
 import { appOr404 } from './forms.ts';
 import { isAdmin } from './locks.ts';
 import { appHeader, back, BASE, csrf, developer, flash, region, select, send, shell, workshopTabs, type Req } from './ui.ts';
+import { workshopDb } from './workspaces.ts';
 import { WIZARD_KINDS, wizardTables } from './wizards.ts';
 
 // App Builder AI (migration 062), with the AI service an administrator
@@ -43,10 +44,20 @@ async function ask(s: Session, req: Parameters<typeof generate>[1]) {
   return generate(svc.name, req, { appId: null, user: s.username, source: 'builder' });
 }
 
-/** Schemas a developer may describe or ask about (not pgkiln's, not the system's). */
-async function schemas() {
-  return (await owner.query<{ n: string }>(
-    `select nspname as n from pg_namespace where nspname !~ '^pg_' and nspname not in ('information_schema', 'meta') order by 1`)).rows.map((r) => r.n);
+/** Schemas a developer may describe or ask about (not pgkiln's, not the system's; in an isolated workspace, its own). */
+async function schemas(s: Session) {
+  const db = await workshopDb(s);
+  return (await db.query<{ n: string }>(
+    `select nspname as n from pg_namespace where nspname !~ '^pg_' and nspname not in ('information_schema', 'meta')
+       ${db === owner ? '' : `and has_schema_privilege(oid, 'USAGE')`} order by 1`)).rows.map((r) => r.n);
+}
+
+/** A table's descriptions as database comments. */
+async function comment(c: { query: (sql: string) => Promise<unknown> }, t: TableInfo, notes: [string, string][]) {
+  const rel = `${pg.escapeIdentifier(t.schema)}.${pg.escapeIdentifier(t.table)}`;
+  const what = t.kind === 'view' ? 'view' : t.kind === 'materialized view' ? 'materialized view' : 'table';
+  for (const [col, note] of notes)
+    await c.query(col ? `comment on column ${rel}.${pg.escapeIdentifier(col)} is ${note ? pg.escapeLiteral(note) : 'null'}` : `comment on ${what} ${rel} is ${note ? pg.escapeLiteral(note) : 'null'}`);
 }
 
 interface TableInfo {
@@ -130,7 +141,7 @@ const SQL_SCHEMA = {
 };
 
 async function workshopPage(s: Session, reply: FastifyReply, out: { question?: string; schema?: string; sql?: string; error?: string; result?: Raw }) {
-  const list = await schemas();
+  const list = await schemas(s);
   const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ai')}
     ${await serviceBox(s)}
     <p><a href="${BASE}/sql/ai/describe">Describe tables for AI ▸</a> <span class="muted">(better answers: say what tables and columns mean)</span></p>
@@ -162,7 +173,7 @@ async function workshopPage(s: Session, reply: FastifyReply, out: { question?: s
 const isName = (v: unknown): v is string => typeof v === 'string' && v.length > 0 && v.length <= 63;
 
 async function describePage(s: Session, reply: FastifyReply, schema: string, table: string, draft: { table?: string; columns?: Record<string, string> } | null, message?: Raw) {
-  const list = await schemas();
+  const list = await schemas(s);
   const tables = schema && list.includes(schema) ? await tableInfo({ schema }) : [];
   const t = table ? tables.find((x) => x.table === table) : undefined;
   const noted = new Set((await owner.query<{ t: string }>(`select distinct table_name as t from meta.ai_table_note where schema_name = $1`, [schema])).rows.map((r) => r.t));
@@ -299,7 +310,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     let result: Raw;
     try {
       if (!question) throw new AiError('config', 'Type a question.');
-      if (!(await schemas()).includes(schema)) throw new AiError('config', 'Choose a schema.');
+      if (!(await schemas(s)).includes(schema)) throw new AiError('config', 'Choose a schema.');
       const res = await ask(s, {
         system: `You write PostgreSQL ${(await owner.one<{ v: number }>(`select current_setting('server_version_num')::int / 10000 as v`))!.v} SQL for a developer, for these tables and views:\n\n${describeTables(await tableInfo({ schema }))}\n\n` +
           'Use only those tables and columns, qualified with their schema. Write a SELECT unless the question clearly asks to change data. The developer reviews the SQL before anything runs.',
@@ -331,7 +342,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     let result: Raw;
     try {
       if (!sql.trim() && !error.trim()) throw new AiError('config', 'Paste a query, an error message or both.');
-      const tables = schema && (await schemas()).includes(schema) ? describeTables(await tableInfo({ schema })) : '';
+      const tables = schema && (await schemas(s)).includes(schema) ? describeTables(await tableInfo({ schema })) : '';
       const res = await ask(s, {
         system: 'You explain PostgreSQL to a developer: what a query does, why an error happens and how to fix it. Be concise; show corrected SQL when it helps.' +
           (tables ? `\n\nThe tables and views of the schema:\n\n${tables}` : ''),
@@ -352,10 +363,10 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
   });
 
   /** The posted table, checked against the catalog (null: unknown or reserved). */
-  const postedTable = async (b: Record<string, any>) => {
+  const postedTable = async (s: Session, b: Record<string, any>) => {
     const schema = String(b.schema ?? '');
     const table = String(b.table ?? '');
-    if (!isName(schema) || !isName(table) || RESERVED.test(schema)) return null;
+    if (!isName(schema) || !isName(table) || RESERVED.test(schema) || !(await schemas(s)).includes(schema)) return null;
     return (await tableInfo({ schema, table }))[0] ?? null;
   };
 
@@ -363,11 +374,14 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     const s = await developer(req, reply);
     if (!s) return;
     const b = (req.body ?? {}) as Record<string, any>;
-    const t = await postedTable(b);
+    const t = await postedTable(s, b);
     if (!t) return reply.code(404).send('Not found');
     const notes: [string, string][] = [['', String(b['note:'] ?? '')], ...t.columns.map((c): [string, string] => [c.name, String(b[`note:${c.name}`] ?? '')])]
       .map(([k, v]) => [k, v.replace(/\s+/g, ' ').trim().slice(0, 2000)]);
     try {
+      // database comments as the developer's SQL connection (an isolated workspace: its own login), then the notes
+      const db = await workshopDb(s);
+      if (b.comments === 'true' && db !== owner) await db.tx((c) => comment(c, t, notes));
       await owner.tx(async (c) => {
         for (const [col, note] of notes) {
           if (note) await c.query(
@@ -376,12 +390,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
             [t.schema, t.table, col, note, s.username]);
           else await c.query('delete from meta.ai_table_note where schema_name = $1 and table_name = $2 and column_name = $3', [t.schema, t.table, col]);
         }
-        if (b.comments === 'true') {
-          const rel = `${pg.escapeIdentifier(t.schema)}.${pg.escapeIdentifier(t.table)}`;
-          const what = t.kind === 'view' ? 'view' : t.kind === 'materialized view' ? 'materialized view' : 'table';
-          for (const [col, note] of notes)
-            await c.query(col ? `comment on column ${rel}.${pg.escapeIdentifier(col)} is ${note ? pg.escapeLiteral(note) : 'null'}` : `comment on ${what} ${rel} is ${note ? pg.escapeLiteral(note) : 'null'}`);
-        }
+        if (b.comments === 'true' && db === owner) await comment(c, t, notes);
       });
       flash(s, `Descriptions of ${t.schema}.${t.table} saved${b.comments === 'true' ? ', also as database comments' : ''}.`);
     } catch (e) {
@@ -394,7 +403,7 @@ export async function aiBuilderRoutes(app: FastifyInstance) {
     const s = await developer(req, reply);
     if (!s) return;
     const b = (req.body ?? {}) as Record<string, any>;
-    const t = await postedTable(b);
+    const t = await postedTable(s, b);
     if (!t) return reply.code(404).send('Not found');
     const names = t.columns.map((c) => c.name);
     try {

package/src/builder/app-groups.ts

@@ -0,0 +1,132 @@
+import type { FastifyInstance } from 'fastify';
+import { owner } from '../db.ts';
+import { html, raw } from '../html.ts';
+import { icon } from '../icons.ts';
+import { clientIp, logActivity } from '../session.ts';
+import { back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
+import { currentWorkspace } from './workspaces.ts';
+
+// Application groups (092; APEX: Workspace Utilities → Application Groups): a
+// workspace's named groups of applications. The App Builder home filters and
+// labels applications by group. Every developer of the workspace manages them.
+
+const NAME = /^\S(.{0,58}\S)?$/;
+const crumbs = (extra: [string, string?][] = []): [string, string?][] => [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Application groups', `${BASE}/app-groups`], ...extra];
+
+const groupError = (e: unknown) => {
+  const m = (e as Error).message;
+  if (m.includes('app_group_workspace_id_name_key')) return 'A group with this name exists already.';
+  if (m.includes('app_group_name_check')) return 'The name is 1 to 60 characters, without spaces at the start or end.';
+  return m;
+};
+
+export async function appGroupRoutes(app: FastifyInstance) {
+  app.get(`${BASE}/app-groups`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const ws = currentWorkspace(s);
+    const [groups, apps] = await Promise.all([
+      owner.query<{ id: number; name: string; description: string | null; apps: number }>(
+        `select g.id, g.name, g.description, (select count(*) from meta.app_group_member m where m.group_id = g.id)::int as apps
+           from meta.app_group g where g.workspace_id = $1 order by lower(g.name)`,
+        [ws],
+      ),
+      owner.query<{ id: number; name: string; alias: string; group_id: number | null }>(
+        `select a.id, a.name, a.alias, m.group_id from meta.app a left join meta.app_group_member m on m.app_id = a.id
+          where meta.app_workspace(a.id) = $1 order by lower(a.name), a.id`,
+        [ws],
+      ),
+    ]);
+    const main = html`<div class="title-row"><h1>Application groups</h1></div>
+      <p class="muted u-mt0">Groups organise the applications of this workspace (${s.workspace?.name ?? ''}) on the App Builder home, which can show one group at a time. They change nothing in the applications.</p>
+      <div class="columns wide-left">
+        ${region('Groups', groups.rows.length
+          ? html`<div class="table-wrap"><table class="report report-reflow"><thead><tr><th>Group</th><th class="num">Applications</th><th>Rename</th><th></th></tr></thead><tbody>
+              ${groups.rows.map((g) => html`<tr>
+                <td data-label="Group"><a href="${BASE}?group=${g.id}">${g.name}</a>${g.description ? html`<br><span class="muted small">${g.description}</span>` : ''}</td>
+                <td class="num" data-label="Applications">${g.apps}</td>
+                <td data-label="Rename"><form method="post" action="${BASE}/app-groups/${g.id}" class="search u-mwnone">${csrf(s)}
+                  <label class="sr-only" for="g-${g.id}">New name for ${g.name}</label><input id="g-${g.id}" name="name" value="${g.name}" required maxlength="60">
+                  <button class="btn btn-sm">Rename</button></form></td>
+                <td><form method="post" action="${BASE}/app-groups/${g.id}/delete">${csrf(s)}<button class="btn btn-sm btn-danger" data-confirm="Delete the group ${g.name}? Its applications stay, without a group.">${icon('trash')}<span class="sr-only">Delete ${g.name}</span></button></form></td></tr>`)}
+            </tbody></table></div>`
+          : html`<p class="muted">No groups yet.</p>`)}
+        ${region('Add a group', html`<form method="post" action="${BASE}/app-groups">${csrf(s)}
+          ${input('name', 'Name', '', { required: true, placeholder: 'Finance' })}
+          ${input('description', 'Description', '')}
+          <div class="buttons"><button class="btn btn-hot">${icon('plus')} Add group</button></div></form>`)}
+      </div>
+      <div class="u-spacer"></div>
+      ${region('Applications', apps.rows.length
+        ? html`<form method="post" action="${BASE}/app-groups/assign">${csrf(s)}
+            <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>Application</th><th>Group</th></tr></thead><tbody>
+            ${apps.rows.map((a) => html`<tr><td data-label="Application"><a href="${BASE}/apps/${a.id}">${a.name}</a> <span class="muted">/a/${a.alias}</span></td>
+              <td data-label="Group"><label class="sr-only" for="a-${a.id}">Group of ${a.name}</label>
+                <select id="a-${a.id}" name="app_${a.id}"><option value="">(no group)</option>${groups.rows.map((g) => html`<option value="${g.id}"${a.group_id === g.id ? raw(' selected') : ''}>${g.name}</option>`)}</select></td></tr>`)}
+            </tbody></table></div>
+            <div class="buttons"><button class="btn"${groups.rows.length ? '' : raw(' disabled')}>Save groups</button></div></form>`
+        : html`<p class="muted">No applications in this workspace.</p>`)}`;
+    return send(reply, s, shell(s, 'Application groups', crumbs(), main));
+  });
+
+  app.post(`${BASE}/app-groups`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const name = String(req.body?.name ?? '').trim();
+    try {
+      if (!NAME.test(name)) throw new Error('The name is 1 to 60 characters, without spaces at the start or end.');
+      await owner.query('insert into meta.app_group (workspace_id, name, description) values ($1, $2, $3)', [currentWorkspace(s), name, String(req.body?.description ?? '').trim().slice(0, 2000) || null]);
+      await logActivity({ username: s.username, event: 'app_group', ip: clientIp(req), detail: `added ${name}` });
+      flash(s, `Group ${name} added.`);
+    } catch (e) {
+      flash(s, groupError(e), 'error');
+    }
+    return back(reply, s, `${BASE}/app-groups`);
+  });
+
+  app.post(`${BASE}/app-groups/:id(^\\d{1,9}$)`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const name = String(req.body?.name ?? '').trim();
+    try {
+      if (!NAME.test(name)) throw new Error('The name is 1 to 60 characters, without spaces at the start or end.');
+      const r = await owner.query('update meta.app_group set name = $3 where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s), name]);
+      if (!r.rowCount) return reply.code(404).send('Not found');
+      flash(s, `Group renamed to ${name}.`);
+    } catch (e) {
+      flash(s, groupError(e), 'error');
+    }
+    return back(reply, s, `${BASE}/app-groups`);
+  });
+
+  app.post(`${BASE}/app-groups/:id(^\\d{1,9}$)/delete`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const r = await owner.one<{ name: string }>('delete from meta.app_group where id = $1 and workspace_id = $2 returning name', [req.params.id, currentWorkspace(s)]);
+    if (!r) return reply.code(404).send('Not found');
+    await logActivity({ username: s.username, event: 'app_group', ip: clientIp(req), detail: `deleted ${r.name}` });
+    flash(s, `Group ${r.name} deleted.`);
+    return back(reply, s, `${BASE}/app-groups`);
+  });
+
+  // the group of each application of the workspace (only this workspace's groups and applications)
+  app.post(`${BASE}/app-groups/assign`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const ws = currentWorkspace(s);
+    const pairs = Object.entries(req.body ?? {}).flatMap(([k, v]) => {
+      const m = /^app_(\d{1,9})$/.exec(k);
+      return m ? [[Number(m[1]), /^\d{1,9}$/.test(String(v)) ? Number(v) : null] as [number, number | null]] : [];
+    }).slice(0, 5000);
+    await owner.tx(async (c) => {
+      for (const [appId, groupId] of pairs) {
+        if (!(await c.query('select 1 from meta.app where id = $1 and meta.app_workspace(id) = $2', [appId, ws])).rowCount) continue;
+        if (groupId === null) await c.query('delete from meta.app_group_member where app_id = $1', [appId]);
+        else if ((await c.query('select 1 from meta.app_group where id = $1 and workspace_id = $2', [groupId, ws])).rowCount)
+          await c.query('insert into meta.app_group_member (app_id, group_id) values ($1, $2) on conflict (app_id) do update set group_id = excluded.group_id', [appId, groupId]);
+      }
+    });
+    flash(s, 'Groups saved.');
+    return back(reply, s, `${BASE}/app-groups`);
+  });
+}

package/src/builder/blueprints.ts

@@ -129,11 +129,25 @@ function review(s: Session, bp: Blueprint, spec: string, id: number | null, name
     </form>`)}`;
 }
 
+/**
+ * (sprint 61) Open a blueprint (e.g. a starter app of the App Gallery): its review when it can be
+ * created, else the editor with its problems. Nothing is created before the developer confirms.
+ */
+export async function openBlueprint(s: Session, reply: FastifyReply, name: string, spec: string) {
+  const { json, error } = parse(spec);
+  const { blueprint, problems } = error ? { blueprint: null, problems: [error] } : checkBlueprint(json);
+  const taken = blueprint ? await owner.one('select 1 from meta.app where alias = $1', [blueprint.alias]) : null;
+  if (taken) problems.push(`An application with the alias ${blueprint!.alias} already exists: change "alias" and "schema" in the blueprint.`);
+  if (!blueprint || problems.length)
+    return editor(s, reply, { name, spec, message: html`<div class="alert alert-error" role="alert"><p>The blueprint can't be created yet:</p><ul>${problems.map((p) => html`<li>${p}</li>`)}</ul></div>` });
+  return page(s, reply, 'Review', review(s, blueprint, spec, null, name));
+}
+
 export async function blueprintRoutes(app: FastifyInstance) {
   app.get(`${BASE}/blueprints`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const list = (await owner.query(`select b.id, b.name, b.created_by, b.updated_at::text as updated, a.id as app_id, a.alias from meta.blueprint b left join meta.app a on a.id = b.app_id order by lower(b.name), b.id`)).rows;
+    const list = (await owner.query(`select b.id, b.name, b.created_by, b.updated_at::text as updated, a.id as app_id, a.alias from meta.blueprint b left join meta.app a on a.id = b.app_id where b.workspace_id = $1 order by lower(b.name), b.id`, [currentWorkspace(s)])).rows;
     return page(s, reply, '', html`<h1>Blueprints</h1>
       <p class="muted">Describe an application as a blueprint (tables, pages, menu, sample rows), review it and create it. <a class="btn btn-hot" href="${BASE}/blueprints/new">${icon('plus')} New blueprint</a></p>
       ${list.length
@@ -154,7 +168,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.get(`${BASE}/blueprints/:id(^\\d+$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const b = await owner.one('select id, name, spec from meta.blueprint where id = $1', [req.params.id]);
+    const b = await owner.one('select id, name, spec from meta.blueprint where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]);
     if (!b) return reply.code(404).send('Not found');
     return editor(s, reply, { id: b.id, name: b.name, spec: JSON.stringify(b.spec, null, 2) });
   });
@@ -178,8 +192,8 @@ export async function blueprintRoutes(app: FastifyInstance) {
     if (error || !json || typeof json !== 'object' || Array.isArray(json))
       return editor(s, reply, { ...o, message: html`<div class="alert alert-error" role="alert">${error ?? 'A blueprint is a JSON object.'}</div>` });
     const id = o.id
-      ? (await owner.one('update meta.blueprint set name = $2, spec = $3, updated_at = now() where id = $1 returning id', [o.id, o.name, JSON.stringify(json)]))?.id
-      : (await owner.one('insert into meta.blueprint (name, spec, created_by) values ($1, $2, $3) returning id', [o.name, JSON.stringify(json), s.username])).id;
+      ? (await owner.one('update meta.blueprint set name = $2, spec = $3, updated_at = now() where id = $1 and workspace_id = $4 returning id', [o.id, o.name, JSON.stringify(json), currentWorkspace(s)]))?.id
+      : (await owner.one('insert into meta.blueprint (name, spec, created_by, workspace_id) values ($1, $2, $3, $4) returning id', [o.name, JSON.stringify(json), s.username, currentWorkspace(s)])).id;
     if (!id) return reply.code(404).send('Not found');
     flash(s, `Blueprint ${o.name} saved.`);
     return back(reply, s, `${BASE}/blueprints/${id}`);
@@ -240,8 +254,8 @@ export async function blueprintRoutes(app: FastifyInstance) {
           throw new Error(createAppError(e, checked.alias));
         });
         const r = await buildBlueprint(c, blueprint, checked.role, { dashboard: (tables, no) => addDashboard(c, checked.alias, tables, no) });
-        if (o.id) await c.query('update meta.blueprint set app_id = $2, spec = $3, updated_at = now() where id = $1', [o.id, a.id, JSON.stringify(json)]);
-        else await c.query('insert into meta.blueprint (name, spec, created_by, app_id) values ($1, $2, $3, $4)', [o.name, JSON.stringify(json), s.username, a.id]);
+        if (o.id) await c.query('update meta.blueprint set app_id = $2, spec = $3, updated_at = now() where id = $1 and workspace_id = $4', [o.id, a.id, JSON.stringify(json), currentWorkspace(s)]);
+        else await c.query('insert into meta.blueprint (name, spec, created_by, app_id, workspace_id) values ($1, $2, $3, $4, $5)', [o.name, JSON.stringify(json), s.username, a.id, currentWorkspace(s)]);
         return { ...r, existing: a.existingAccount };
       });
       await logActivity({ username: s.username, event: 'blueprint', ip: clientIp(req), detail: `created ${blueprint.alias} from blueprint ${o.name}` });
@@ -255,7 +269,7 @@ export async function blueprintRoutes(app: FastifyInstance) {
   app.post(`${BASE}/blueprints/:id(^\\d+$)/delete`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const r = await owner.query('delete from meta.blueprint where id = $1', [req.params.id]);
+    const r = await owner.query('delete from meta.blueprint where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]);
     flash(s, r.rowCount ? 'Blueprint deleted (applications created from it stay).' : 'There is no such blueprint.');
     return back(reply, s, `${BASE}/blueprints`);
   });

package/src/builder/code-editor.ts

@@ -1,10 +1,11 @@
 import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { owner, runtime } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html, raw, type Raw } from '../html.ts';
 import { checkSql, type SqlShape } from './advisor.ts';
 import { BASE, developer, type Req } from './ui.ts';
-import { appAllowed } from './workspaces.ts';
+import { appAllowed, workshopDb } from './workspaces.ts';
 
 // The builder's code editor (public/code-editor.js) and its SQL completions.
 //
@@ -215,7 +216,7 @@ export async function codeEditorRoutes(app: FastifyInstance) {
     if (!sql.trim()) return reply.send({ ok: true, message: 'Nothing to check.' });
     if (/^\s*(STATIC|LOV):/i.test(sql)) return reply.send({ ok: true, message: 'Not SQL: a static or shared list of values.' });
     const role = target ? (await owner.one('select db_role from meta.app where id = $1', [target.id]))?.db_role : null;
-    const c = await owner.pool.connect();
+    const c = await (target ? await devDbForApp(target.id) : await workshopDb(s)).pool.connect();
     try {
       await c.query('begin');
       await c.query(`set local statement_timeout = '5s'`);