pgkiln 0.44.0 → 0.45.0

package/src/builder/subscriptions.ts

@@ -4,8 +4,8 @@ import { html, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { clientIp, logActivity, type Session } from '../session.ts';
 import {
-  APP_TYPE_LABELS, inSync, isKind, KINDS, offers, publish, refresh, subscribe, subscribersOf, subscriptionOf, subscriptionsOf,
-  SubscriptionError, unsubscribe, type AppType, type Kind,
+  APP_TYPE_LABELS, groupsOffered, inSync, isKind, KINDS, offers, publish, refresh, subscribe, subscribersOf, subscriptionOf, subscriptionsOf,
+  SubscriptionError, subscribeGroup, unsubscribe, type AppType, type Kind,
 } from '../subscriptions.ts';
 import { appHeader, back, BASE, csrf, developer, flash, region, send, shell, type Req } from './ui.ts';
 
@@ -59,7 +59,7 @@ export async function subscriptionRoutes(app: FastifyInstance) {
     if (!s) return;
     const a = await appRow(req.params.id);
     if (!a) return reply.code(404).send('Not found');
-    const [subs, subscribers, offered] = await Promise.all([subscriptionsOf(a.id), subscribersOf(a.id), offers(a.id)]);
+    const [subs, subscribers, offered, groupList] = await Promise.all([subscriptionsOf(a.id), subscribersOf(a.id), offers(a.id), groupsOffered(a.id)]);
     const sync = await Promise.all(subs.map((x) => inSync(x)));
     const subSync = await Promise.all(subscribers.map((x) => inSync(x)));
     const hidden = (kind: string, name: string) => html`<input type="hidden" name="kind" value="${kind}"><input type="hidden" name="name" value="${name}">`;
@@ -93,7 +93,17 @@ export async function subscriptionRoutes(app: FastifyInstance) {
                 </select>
                 <small class="help">The component is copied now. A component of this application with the same name is replaced.</small></div>
               <div class="buttons"><button class="btn btn-hot">Subscribe</button></div></form>`
-          : html`<p class="muted">No theme or library applications offer components. Set an application's type under its Settings.</p>`}`)}
+          : html`<p class="muted">No theme or library applications offer components. Set an application's type under its Settings.</p>`}
+        ${groupList.length
+          ? html`<h3>Subscribe to a component group</h3>
+            <form method="post" action="${BASE}/apps/${a.id}/subscriptions/group">${csrf(s)}
+              <div class="field"><label class="label" for="f_group">Component group</label>
+                <select id="f_group" name="group" required><option value="">- choose -</option>
+                  ${groupList.map((g) => html`<option value="${g.master_id}|${g.name}">${g.master_name}: ${g.name} (${g.members.length})</option>`)}
+                </select>
+                <small class="help">Every component of the group is copied now and subscribed (Shared Components → Component Groups of a theme or library application).</small></div>
+              <div class="buttons"><button class="btn btn-hot">Subscribe to the group</button></div></form>`
+          : ''}`)}
       ${a.app_type === 'theme' || a.app_type === 'library' || subscribers.length
         ? region('Subscribers', subscribers.length
             ? html`<div class="table-wrap"><table class="report"><thead><tr><th>Component</th><th>Application</th><th>Refreshed</th><th>State</th></tr></thead><tbody>
@@ -138,6 +148,22 @@ export async function subscriptionRoutes(app: FastifyInstance) {
     });
   });
 
+  // (105) all the components of a master's component group
+  app.post(`${BASE}/apps/:id/subscriptions/group`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const a = await appRow(req.params.id);
+    if (!a) return reply.code(404).send('Not found');
+    const m = /^(\d{1,9})\|(.{1,60})$/s.exec(String(req.body?.group ?? ''));
+    return handle(req, reply, s, a.id, async () => {
+      if (!m) throw new SubscriptionError('Choose a component group.');
+      if (!(await groupsOffered(a.id)).some((g) => g.master_id === Number(m[1]) && g.name === m[2])) throw new SubscriptionError('Choose a component group.');
+      const { done, skipped } = await subscribeGroup(a.id, Number(m[1]), m[2], s.username!);
+      await logActivity({ appId: a.id, username: s.username, event: 'subscription', ip: clientIp(req), detail: `subscribed component group ${m[2]} from application ${m[1]}: ${done.join(', ')}` });
+      return `Subscribed to ${m[2]}: ${done.length} component${done.length === 1 ? '' : 's'} copied${skipped.length ? `; skipped ${skipped.join(', ')}` : ''}.`;
+    });
+  });
+
   app.post(`${BASE}/apps/:id/subscriptions/refresh`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;

package/src/cli/replace.ts

@@ -26,8 +26,12 @@ export const REPLACED = [
   'search_config', 'email_template',
   // (086) application settings (installed values kept, see below), dynamic translations
   'app_setting', 'dynamic_translation',
-  // (089) page groups
-  'page_group',
+  // (089) page groups, (102) application computations
+  'page_group', 'app_computation',
+  // (103) shortcuts, (104) report queries
+  'shortcut', 'report_query',
+  // (105) component groups
+  'component_group',
 ];
 /** Tables of an application that belong to the installation: kept. */
 export const KEPT = ['app_access', 'api_client', 'session', 'sso_pending', 'saved_report', 'persistent_login', 'task', 'workflow', 'process_job',

package/src/metadata.ts

@@ -106,6 +106,12 @@ export interface App {
   authz_schemes: AuthzScheme[];
   app_items: string[];
   app_processes: AppProcess[];
+  /** (102) application computations: run for every page at their point, before the page's own */
+  app_computations: AppComputation[];
+  /** (105) defaults of the built-in component types (runtime/component-settings.ts) */
+  component_settings: import('./runtime/component-settings.ts').ComponentSettings;
+  /** (103) shortcuts: "NAME" in static content, help texts and confirm messages (runtime/shortcuts.ts) */
+  shortcuts?: { name: string; type: 'text' | 'html' | 'function_body'; value: string }[];
   lovs: { name: string; query: string; rest_source?: string | null }[];
   theme: {
     accent?: string; header?: string; nav?: 'side' | 'top'; mode?: 'auto' | 'light' | 'dark'; user_choice?: boolean;
@@ -238,6 +244,11 @@ export interface Computation extends Condition {
   authz: string | null;
 }
 
+/** (102) An application computation: like a page's, for every page of the application. */
+export interface AppComputation extends Omit<Computation, 'point'> {
+  point: 'after_authentication' | 'before_header' | 'after_submit';
+}
+
 export interface Branch extends Condition {
   id: number;
   seq: number;
@@ -349,7 +360,7 @@ const agg = (table: string, fk: string, parent: string, appId: string) =>
 export async function loadApp(alias: string) {
   return runtime.one<App>(
     `select a.id, a.alias, a.name, a.home_page, a.authentication, a.access_control, a.sso_providers, a.local_login, a.remember_me_days, a.login_page, a.password_reset, a.session_group, a.ldap_directories, a.header_name, a.header_auto_create, a.logout_url, a.db_auth_roles, a.db_auth_member_of, a.custom_auth_function, a.custom_auth_code, a.custom_auth_post_code, a.nav_list, a.navbar_list, a.pwa, a.pwa_short_name, a.pwa_icon is not null as pwa_has_icon, a.pwa_offline_pages, a.pwa_offline_submit, a.pwa_push, a.db_role, a.debug, a.debug_level, a.theme,
-            a.availability, a.availability_message, a.availability_users, a.feedback, a.error_function, a.session_warning_seconds,
+            a.availability, a.availability_message, a.availability_users, a.feedback, a.error_function, a.session_warning_seconds, a.component_settings,
             a.language, a.languages, a.language_from, a.date_format, a.timestamp_format, a.time_zone, a.time_zone_auto, a.currency,
             coalesce((select jsonb_agg(jsonb_build_object('name', l.name, 'query', l.query, 'rest_source', l.rest_source)) from meta.lov l where l.app_id = a.id), '[]') as lovs,
             coalesce((select jsonb_agg(jsonb_build_object('page_no', p.page_no, 'name', p.name, 'title', p.title,
@@ -361,6 +372,8 @@ export async function loadApp(alias: string) {
                         from meta.authz_scheme s where s.app_id = a.id), '[]') as authz_schemes,
             coalesce((select jsonb_agg(i.name) from meta.app_item i where i.app_id = a.id), '[]') as app_items,
             ${agg('meta.app_process', 'app_id', 'a', 'a.id')} as app_processes,
+            ${agg('meta.app_computation', 'app_id', 'a', 'a.id')} as app_computations,
+            coalesce((select jsonb_agg(jsonb_build_object('name', s.name, 'type', s.type, 'value', s.value)) from meta.shortcut s where s.app_id = a.id), '[]') as shortcuts,
             ${includes('a.static_includes', 'a.id')} as static_includes,
             coalesce((select jsonb_agg(to_jsonb(x) - 'id' - 'app_id' - 'install_sql') from meta.plugin x where x.app_id = a.id), '[]') as plugins,
             coalesce((select jsonb_agg(jsonb_build_object('name', f.name, 'v', floor(extract(epoch from f.updated_at))::bigint))

package/src/runtime/component-settings.ts

@@ -0,0 +1,42 @@
+// Component settings (migration 105; APEX: Shared Components → Component
+// Settings): an application's defaults for its built-in component types, used
+// where a component sets nothing itself. Every value is bounded here, so a
+// hand-edited or imported setting can't make a page read without limits.
+
+export interface ComponentSettings {
+  report_rows?: number;
+  grid_rows?: number;
+  popup_lov_rows?: number;
+  lov_max_rows?: number;
+  rating_max?: number;
+}
+export type ComponentSetting = keyof ComponentSettings;
+
+export const COMPONENT_SETTINGS: { key: ComponentSetting; label: string; group: string; min: number; max: number; def: number; help: string }[] = [
+  { key: 'report_rows', label: 'Rows per page', group: 'Reports', min: 1, max: 1000, def: 15, help: 'Of a classic or interactive report without its own page size (users can still choose).' },
+  { key: 'grid_rows', label: 'Rows per page', group: 'Interactive grids', min: 1, max: 200, def: 25, help: 'Of an interactive grid without its own page size.' },
+  { key: 'popup_lov_rows', label: 'Rows per page', group: 'Popup lists of values', min: 1, max: 100, def: 25, help: 'In a popup list of values\' dialog, for items without their own page size.' },
+  { key: 'lov_max_rows', label: 'Maximum rows', group: 'Lists of values', min: 1, max: 50_000, def: 5000, help: 'Rows a select list, radio group, checkbox group or popup list reads, for items without their own maximum.' },
+  { key: 'rating_max', label: 'Stars', group: 'Star ratings', min: 3, max: 10, def: 5, help: 'Of a star rating item without its own maximum.' },
+];
+
+/** The value of a setting: the application's (bounded), else the built-in default. */
+export function componentSetting(settings: ComponentSettings | null | undefined, key: ComponentSetting): number {
+  const spec = COMPONENT_SETTINGS.find((s) => s.key === key)!;
+  const n = Math.floor(Number(settings?.[key]));
+  return Number.isFinite(n) && n >= spec.min && n <= spec.max ? n : spec.def;
+}
+
+/** The settings from the builder's form: whole numbers within bounds; empty leaves a setting at its default. */
+export function componentSettingsFrom(form: Record<string, unknown>): { settings: ComponentSettings; problems: string[] } {
+  const settings: ComponentSettings = {};
+  const problems: string[] = [];
+  for (const s of COMPONENT_SETTINGS) {
+    const raw = String(form[s.key] ?? '').trim();
+    if (raw === '') continue;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < s.min || n > s.max) problems.push(`${s.group}, ${s.label}: a whole number from ${s.min} to ${s.max.toLocaleString('en')}.`);
+    else settings[s.key] = n;
+  }
+  return { settings, problems };
+}

package/src/runtime/context.ts

@@ -66,6 +66,10 @@ export interface PageContext {
   cacheRefresh?: boolean;
   /** the lazy region the request renders (GET …/region/:id), not as a placeholder */
   loadNow?: number;
+  /** (103) the values of the function-body shortcuts this request used */
+  shortcutValues?: Map<string, string>;
+  /** the whole page is rendered (renderPage), not one region on its own */
+  wholePage?: boolean;
   /** a download process's file, sent instead of the page (processes.ts) */
   download?: Download;
   /** running a background chain (process-jobs.ts): no request, no browser */

package/src/runtime/documents.ts

@@ -4,21 +4,47 @@ import { isAuthorized, Forbidden } from './authz.ts';
 import { bindValues, stripSemicolon, substitute, type PageContext } from './context.ts';
 import { documentData, documentFilename, documentPdf, fillTemplate, type DocumentTemplate } from './document.ts';
 import { layoutFor, layoutText } from './pdf.ts';
+import { exportDownload, type ExportFormat } from './data-export.ts';
+import type { Process } from '../metadata.ts';
 
 // ?doc=NAME on a page: the document template filled with the page's session
-// state (after the URL's checksummed item values), as the app's role.
+// state (after the URL's checksummed item values), as the app's role; (104)
+// without a template of that name, the report query of it.
+
+/** (104) A report query: a named query printed as PDF, Excel, CSV, JSON, XML or HTML. */
+interface ReportQuery {
+  name: string;
+  description: string | null;
+  query: string;
+  format: ExportFormat;
+  layout: string | null;
+  file_name: string | null;
+  title: string | null;
+  authz: string | null;
+}
 
 export async function renderDocument(ctx: PageContext, name: string) {
   const c = ctx.client!;
   // metadata through the runtime connection: the page's transaction already runs as the app's role
   const tpl = await runtime.one<DocumentTemplate>('select * from meta.document_template where app_id = $1 and name = upper($2)', [ctx.app.id, name.slice(0, 100)]);
-  if (!tpl || !(await isAuthorized(ctx, tpl.authz))) throw new Forbidden(ctx.locale.t('error.document_unavailable'));
+  // (104) without a document template of that name, a report query of it
+  const rq = tpl ? null : await runtime.one<ReportQuery>('select * from meta.report_query where app_id = $1 and name = upper($2)', [ctx.app.id, name.slice(0, 100)]);
+  const found = tpl ?? rq;
+  if (!found || !(await isAuthorized(ctx, found.authz))) throw new Forbidden(ctx.locale.t('error.document_unavailable'));
   // without signing in (a public page of an app that has sign-in) only the documents the page itself offers
   // with a visible document button: ?doc= on any public page would otherwise hand out every template
   if (ctx.app.authentication !== 'none' && !ctx.session.username) {
-    const offered = [...(ctx.vis?.buttons.values() ?? [])].some((b) => b.action === 'document' && (b.document ?? '').toUpperCase() === tpl.name);
+    const offered = [...(ctx.vis?.buttons.values() ?? [])].some((b) => b.action === 'document' && (b.document ?? '').toUpperCase() === found.name);
     if (!offered) throw new Forbidden(ctx.locale.t('error.document_unavailable'));
   }
+  if (!tpl) {
+    const q = rq!;
+    const d = await exportDownload(ctx, { name: q.name, code: q.query } as Process, {
+      export: q.format, layout: q.layout ?? undefined, file_name: q.file_name ?? undefined, title: q.title ?? q.description ?? undefined,
+    });
+    // sent like a download process's file (sandboxed, never shown as a page of the application)
+    return { download: { ...d, inline: false } };
+  }
   const now = new Date().toISOString();
   const data = await savepoint(c, () =>
     documentData(c, stripSemicolon(applyBinds(tpl.query, bindValues(ctx))), {

package/src/runtime/engine.ts

@@ -173,8 +173,8 @@ export async function validate(ctx: PageContext) {
     const v = state[i.name];
     if (!v || !vis.editable.has(i.name) || errors.items[i.name]) continue;
     const label = i.label ?? i.name;
-    if (i.type === 'rating' && !(/^\d{1,2}$/.test(v) && Number(v) >= 1 && Number(v) <= ratingMax(i)))
-      fail(i.name, ctx.locale.t('error.rating', { label, max: ratingMax(i) }));
+    if (i.type === 'rating' && !(/^\d{1,2}$/.test(v) && Number(v) >= 1 && Number(v) <= ratingMax(i, ctx.app.component_settings)))
+      fail(i.name, ctx.locale.t('error.rating', { label, max: ratingMax(i, ctx.app.component_settings) }));
     // a list item posts return values: each must be one its list of values returns (config.any_value: true allows others)
     if (LOV_CHECKED.has(i.type) && i.lov && i.config?.any_value !== true && !(await lovContains(ctx, i.lov, MULTI_VALUE.has(i.type) ? splitValues(v) : [v])))
       fail(i.name, ctx.locale.t('error.lov_value', { label }));

package/src/runtime/grid.ts

@@ -1,3 +1,4 @@
+import { componentSetting } from './component-settings.ts';
 import pg from 'pg';
 import { literal } from '../binds.ts';
 import { savepoint, type Client } from '../db.ts';
@@ -116,6 +117,17 @@ function control(col: GridColumn, name: string, value: string, label: string) {
   return html`<input type="text" name="${name}" value="${value}"${aria}>`;
 }
 
+/**
+ * (APEX: cell navigation mode) An editable cell's value as text, with its column's format mask or the
+ * option's display value: with JavaScript the cell reads as this text until it is edited (app.css,
+ * app.js); the control holds the raw value. Not for a checkbox, which reads as itself.
+ */
+function cellText(col: GridColumn, value: string, shown: string) {
+  if (col.typeOid === 16 || value === '') return '';
+  const text = col.options ? col.options.find((o) => o.value === value)?.display ?? value : shown;
+  return html`<span class="grid-text${NUMERIC.has(col.typeOid) && !col.options ? ' num' : ''}" aria-hidden="true">${text}</span>`;
+}
+
 /** Width of each leading column (master selection, delete, row actions), see app.css .grid-lead. */
 const LEAD_WIDTH = 44;
 
@@ -169,7 +181,7 @@ export async function renderGrid(ctx: PageContext, r: Region): Promise<Raw> {
   const base = reportState(ctx, r);
   const views = gridViews(r);
   const view: View = views.includes(base.view) ? base.view : 'report';
-  const pageSize = Math.max(1, Math.min(200, Number(r.config.page_size) || 25));
+  const pageSize = Math.max(1, Math.min(200, Number(r.config.page_size) || componentSetting(ctx.app.component_settings, 'grid_rows')));
   // the single row view: one row of the search at a time (r<id>_row=N from 1), or a new row (r<id>_row=new)
   const rowParam = ctx.params.get(key(r, 'row'));
   const adding = view === 'row' && rowParam === 'new';
@@ -240,7 +252,13 @@ export async function renderGrid(ctx: PageContext, r: Region): Promise<Raw> {
   // master-detail: this grid selects rows for detail regions; or it follows a master
   const select = selectRowOf(ctx.page, r);
   const selIdx = select ? fields.findIndex((f) => f.name.toLowerCase() === select.column.toLowerCase()) : -1;
-  const selected = select ? ctx.session.state[select.item] ?? null : null;
+  let selected = select ? ctx.session.state[select.item] ?? null : null;
+  // as in APEX, a page shows the first master row selected: when nothing is selected, or the
+  // selected row is not among the rows shown (after a search or filter); the regions below follow it
+  if (select && selIdx >= 0 && ctx.wholePage && view === 'report' && info.rows.length) {
+    const shown = info.rows.map((row) => toState(row[selIdx]) ?? '');
+    if (selected === null || !shown.includes(selected)) ctx.session.state[select.item] = selected = shown[0];
+  }
   const details = select ? detailsOf(ctx.page, r, ctx.vis!.regions) : [];
   const masterCol = masterColumnOf(r);
   const masterValue = masterItemOf(r) ? ctx.session.state[masterItemOf(r)!] ?? '' : '';
@@ -297,7 +315,7 @@ export async function renderGrid(ctx: PageContext, r: Region): Promise<Raw> {
       return i === -1 ? undefined : (toState(row[i]) ?? '');
     });
 
-  // read-only cells show their column's format mask; editable cells keep the raw value
+  // read-only cells show their column's format mask; an editable cell's control keeps the raw value
   const fmtOf = columnFormats(ctx, r);
   const rows = info.rows.map((row, i) => {
     const pk = toState(row[pkIdx]) ?? '';
@@ -311,7 +329,7 @@ export async function renderGrid(ctx: PageContext, r: Region): Promise<Raw> {
       if (!col.editable) return html`<td class="${colCls(p, pIdx, NUMERIC.has(col.typeOid) ? 'num' : null)}" data-col="${col.ci}" data-label="${lbl}"${hiddenAttr(p)}>${cell(row[col.idx], col.typeOid, fmtOf(col.name))}</td>`;
       const name = `${g}_${i}_c${col.ci}`;
       const value = pi !== undefined ? (col.typeOid === 16 ? (pv(`${g}_${pi}_c${col.ci}`) === 'true' ? 'true' : 'false') : (pv(`${g}_${pi}_c${col.ci}`) ?? dbValue)) : dbValue;
-      return html`<td class="${colCls(p, pIdx)}" data-col="${col.ci}" data-label="${lbl}"${hiddenAttr(p)}>${control(col, name, value, `${lbl}, row ${i + 1}`)}</td>`;
+      return html`<td class="${colCls(p, pIdx)}" data-col="${col.ci}" data-label="${lbl}"${hiddenAttr(p)}>${cellText(col, value, value === dbValue ? cell(row[col.idx], col.typeOid, fmtOf(col.name)) : value)}${control(col, name, value, `${lbl}, row ${i + 1}`)}</td>`;
     });
     const deleted = pi !== undefined && pv(`${g}_${pi}_del`) === 'true';
     const selValue = selIdx >= 0 ? toState(row[selIdx]) ?? '' : null;

package/src/runtime/items.ts

@@ -8,6 +8,8 @@ import type { Item } from '../metadata.ts';
 import { bindValues, publicError, stripSemicolon, toState, type PageContext } from './context.ts';
 import { canPreview, fileInfo, fileList, fileUrl, formatSize, isMultiple, maxFiles, removals } from './files.ts';
 import { restSql } from './rest-sources.ts';
+import { expandShortcuts } from './shortcuts.ts';
+import { componentSetting, type ComponentSettings } from './component-settings.ts';
 import { markdownHtml, sanitizeHtml } from '../richtext.ts';
 import { qrSvg, type Ecc } from '../qrcode.ts';
 import { formatNumber, isPlainNumber, maskError } from '../numformat.ts';
@@ -77,9 +79,10 @@ async function lovColumns(ctx: PageContext, sql: string) {
 
 /** Rows of a popup LOV's dialog: at most 100 per page. */
 export const POPUP_PAGE_MAX = 100;
-export const popupPageSize = (item: Item, asked?: unknown) => {
-  const n = Math.floor(Number(asked ?? item.config?.page_size ?? 25));
-  return Number.isFinite(n) && n >= 1 ? Math.min(n, POPUP_PAGE_MAX) : 25;
+export const popupPageSize = (item: Item, asked?: unknown, settings?: ComponentSettings) => {
+  const def = componentSetting(settings, 'popup_lov_rows');
+  const n = Math.floor(Number(asked ?? item.config?.page_size ?? def));
+  return Number.isFinite(n) && n >= 1 ? Math.min(n, POPUP_PAGE_MAX) : def;
 };
 
 export interface LovPage {
@@ -160,9 +163,9 @@ export const LOV_CHECKED = new Set(['select', 'radio', 'checkbox_group', 'multis
 
 /** Rows a list of values reads when its item sets no config.max_rows (1 to 50,000). */
 export const LOV_MAX_ROWS = 5000;
-export const lovMax = (item: Item) => {
+export const lovMax = (item: Item, settings?: ComponentSettings) => {
   const n = Math.floor(Number(item.config?.max_rows));
-  return Number.isFinite(n) && n >= 1 ? Math.min(n, 50_000) : LOV_MAX_ROWS;
+  return Number.isFinite(n) && n >= 1 ? Math.min(n, 50_000) : settings ? componentSetting(settings, 'lov_max_rows') : LOV_MAX_ROWS;
 };
 
 const LOV_TYPES = new Set(['select', 'radio', 'checkbox_group', 'multiselect', 'popup_lov', 'combobox']);
@@ -174,7 +177,7 @@ export const splitValues = (v: string) => (v ? v.split(':') : []);
 /** A combobox holds several values (colon-separated) unless {"multiple": false}. */
 export const comboMultiple = (item: Item) => item.config?.multiple !== false;
 /** The highest star of a rating item ({"max": 5}, 3 to 10). */
-export const ratingMax = (item: Item) => Math.min(Math.max(Math.round(Number(item.config?.max)) || 5, 3), 10);
+export const ratingMax = (item: Item, settings?: ComponentSettings) => Math.min(Math.max(Math.round(Number(item.config?.max)) || componentSetting(settings, 'rating_max'), 3), 10);
 /** A date range item's value "from:to" (ISO dates, either may be empty). */
 export const splitRange = (v: string | null | undefined): [string, string] => {
   const [from = '', to = ''] = (v ?? '').split(':');
@@ -226,7 +229,7 @@ export async function renderItem(ctx: PageContext, item: Item, hiddenByDa = fals
   let lovError: Raw | '' = '';
   if (hasLov(item)) {
     try {
-      options = await lovOptions(ctx, item.lov, lovMax(item));
+      options = await lovOptions(ctx, item.lov, lovMax(item, ctx.app.component_settings));
     } catch (e) {
       lovError = html`<small class="error">${await publicError(ctx, e, `list of values of ${item.name}`)}</small>`;
     }
@@ -249,9 +252,9 @@ export async function renderItem(ctx: PageContext, item: Item, hiddenByDa = fals
     // rebuilt from the allow-list every time: the value may come from the table, not from this form
     control = html`<div class="display-value rich-text" id="${id}">${raw((item.type === 'markdown' ? markdownHtml(value) : sanitizeHtml(value)) || ' ')}</div>`;
   } else if (!editable && item.type === 'rating') {
-    const n = /^\d+$/.test(value) ? Math.min(Number(value), ratingMax(item)) : 0;
+    const n = /^\d+$/.test(value) ? Math.min(Number(value), ratingMax(item, ctx.app.component_settings)) : 0;
     control = n
-      ? html`<div class="display-value rating-value" id="${id}"><span aria-hidden="true">${'★'.repeat(n)}<span class="rating-off">${'★'.repeat(ratingMax(item) - n)}</span></span><span class="sr-only">${ctx.locale.t('item.rating_of', { n, max: ratingMax(item) })}</span></div>`
+      ? html`<div class="display-value rating-value" id="${id}"><span aria-hidden="true">${'★'.repeat(n)}<span class="rating-off">${'★'.repeat(ratingMax(item, ctx.app.component_settings) - n)}</span></span><span class="sr-only">${ctx.locale.t('item.rating_of', { n, max: ratingMax(item, ctx.app.component_settings) })}</span></div>`
       : html`<div class="display-value" id="${id}"> </div>`;
   } else if (!editable && item.type === 'combobox') {
     const values = comboMultiple(item) ? splitValues(value) : value ? [value] : [];
@@ -352,7 +355,7 @@ export async function renderItem(ctx: PageContext, item: Item, hiddenByDa = fals
       case 'rating': {
         // radio buttons (keyboard and screen readers as usual); CSS draws them as stars
         useLegend = true;
-        const max = ratingMax(item);
+        const max = ratingMax(item, ctx.app.component_settings);
         const stars = [];
         for (let n = 1; n <= max; n++)
           stars.push(
@@ -461,7 +464,7 @@ export async function renderItem(ctx: PageContext, item: Item, hiddenByDa = fals
   const tag = useLegend ? 'fieldset' : 'div';
   return html`${raw(`<${tag}`)} class="field field-${item.type}${error ? ' has-error' : ''}${editable ? '' : ' readonly'}${templateClasses('item', item.template_options)}" data-item="${item.name}"${attrs}${pluginAttrs}>
     ${labelHtml}${control}${lovError}
-    ${item.help ? html`<small class="help" id="${id}_help">${item.help}</small>` : ''}
+    ${item.help ? html`<small class="help" id="${id}_help">${await expandShortcuts(ctx, item.help, 'text')}</small>` : ''}
     ${error ? html`<small class="error" id="${id}_error">${error}</small>` : ''}
   ${raw(`</${tag}>`)}`;
 }

package/src/runtime/logic.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { applyBinds } from '../binds.ts';
 import { runtime, savepoint } from '../db.ts';
-import type { Branch, Computation, Condition } from '../metadata.ts';
+import type { AppComputation, Branch, Computation, Condition } from '../metadata.ts';
 import { isAuthorized, sqlTrue } from './authz.ts';
 import { bindValues, dbg, publicError, stripSemicolon, substitute, timed, toState, type PageContext } from './context.ts';
 import { pageHref } from './links.ts';
@@ -112,19 +112,24 @@ export class ComputationFailed extends Error {}
  * items only. Before the page is shown, an error becomes a message on the
  * page; after a submit, it stops the submit (ComputationFailed).
  */
-export async function runComputations(ctx: PageContext, point: Computation['point']) {
+export async function runComputations(ctx: PageContext, point: AppComputation['point']) {
   const names = new Set([...ctx.app.app_items, ...ctx.page.items.map((i) => i.name)]);
-  for (const comp of ctx.page.computations ?? []) {
-    if (comp.point !== point) continue;
-    const where = `computation of ${comp.item_name}`;
+  // (102) the application's computations of the point first (as in APEX), then the page's
+  const comps: { comp: Computation | AppComputation; app: boolean }[] = [
+    ...(ctx.app.app_computations ?? []).filter((c) => c.point === point).map((comp) => ({ comp, app: true })),
+    ...(ctx.page.computations ?? []).filter((c) => c.point === point).map((comp) => ({ comp, app: false })),
+  ];
+  for (const { comp, app } of comps) {
+    const where = `${app ? 'application computation' : 'computation'} of ${comp.item_name}`;
     if (!names.has(comp.item_name)) {
-      ctx.errors.page.push(ctx.locale.t('logic.unknown_item', { item: comp.item_name }));
+      // an application computation of a page item computes it on that item's page only
+      if (!app) ctx.errors.page.push(ctx.locale.t('logic.unknown_item', { item: comp.item_name }));
       continue;
     }
     if (!(await isAuthorized(ctx, comp.authz))) continue;
     if (!(await conditionHolds(ctx, comp, `condition of the ${where}`))) continue;
     try {
-      ctx.session.state[comp.item_name] = await timed(ctx, 6, 'computation', `computation of ${comp.item_name} (${comp.type})`, () => computeValue(ctx, comp));
+      ctx.session.state[comp.item_name] = await timed(ctx, 6, 'computation', `${where} (${comp.type})`, () => computeValue(ctx, comp));
       dbg(ctx, 9, 'computation', () => `${comp.item_name} := ${ctx.page.items.some((i) => i.name === comp.item_name && i.type === 'password') ? '(password, not shown)' : JSON.stringify((ctx.session.state[comp.item_name] ?? '').slice(0, 200))}`);
     } catch (e) {
       const message = await publicError(ctx, e, where);

package/src/runtime/regions.ts

@@ -8,6 +8,7 @@ import type { Button, Region } from '../metadata.ts';
 import { isAuthorized, pageAllowed } from './authz.ts';
 import { bindValues, dbg, publicError, stripSemicolon, substitute, timed, type PageContext } from './context.ts';
 import { renderItems } from './items.ts';
+import { expandShortcuts } from './shortcuts.ts';
 import { fillItems, linkAttrs, linkColumns } from './links.ts';
 import { renderCalendar } from './calendar.ts';
 import { CHART_KINDS, renderChartBody, wallClockIn, type GaugeConfig } from './charts.ts';
@@ -66,7 +67,7 @@ async function renderMenu(ctx: PageContext, b: Button, cls: string, badge: Raw |
   for (const e of b.menu ?? []) {
     if (!(await isAuthorized(ctx, e.authz))) continue;
     const ic = e.icon ? html`${icon(e.icon)} ` : '';
-    const confirm = e.confirm ? raw(` data-confirm="${esc(e.confirm)}"`) : '';
+    const confirm = e.confirm ? raw(` data-confirm="${esc(await expandShortcuts(ctx, e.confirm, 'text'))}"`) : '';
     if (e.page) {
       if (!(await pageAllowed(ctx, e.page))) continue;
       entries.push(html`<a ${linkAttrs(ctx, e.page, e.items ?? {})}${confirm}>${ic}${e.label}</a>`);
@@ -82,7 +83,7 @@ async function renderMenu(ctx: PageContext, b: Button, cls: string, badge: Raw |
 
 export async function renderButton(ctx: PageContext, b: Button) {
   const cls = `btn${b.hot ? ' btn-hot' : ''}${b.name === 'DELETE' ? ' btn-danger' : ''}${templateClasses('button', b.template_options)}`;
-  const confirm = b.confirm ? raw(` data-confirm="${esc(b.confirm)}"`) : '';
+  const confirm = b.confirm ? raw(` data-confirm="${esc(await expandShortcuts(ctx, b.confirm, 'text'))}"`) : '';
   const badge = b.badge || b.badge_query ? await badgeOf(ctx, b) : '';
   if (b.action === 'menu') return renderMenu(ctx, b, cls, badge);
   if (b.action === 'redirect') {
@@ -401,7 +402,7 @@ async function renderBody(ctx: PageContext, r: Region, hidden: Set<string>): Pro
       break;
     case 'static': {
       const itemsHtml = await renderItems(ctx, items, hidden);
-      body = html`${raw(substitute(r.source ?? '', ctx, esc))}${itemsHtml.length ? html`<div class="form-grid">${itemsHtml}</div>` : ''}`;
+      body = html`${raw(substitute(await expandShortcuts(ctx, r.source ?? '', 'html'), ctx, esc))}${itemsHtml.length ? html`<div class="form-grid">${itemsHtml}</div>` : ''}`;
       break;
     }
   }

package/src/runtime/render.ts

@@ -364,6 +364,7 @@ const timeZoneMeta = (ctx: PageContext) =>
 
 export async function renderPage(ctx: PageContext) {
   const t = ctx.locale.t;
+  ctx.wholePage = true;
   const hidden = initiallyHidden(ctx);
   const defaultButton = [...ctx.vis!.buttons.values()].find((b) => b.hot && b.action === 'submit');
   const pageItems = await renderItems(ctx, ctx.page.items.filter((i) => i.region_id === null), hidden);

package/src/runtime/report.ts

@@ -1,3 +1,4 @@
+import { componentSetting } from './component-settings.ts';
 import { icon } from '../icons.ts';
 import pg from 'pg';
 import { templateClasses } from './template-options.ts';
@@ -237,7 +238,7 @@ export function selectionOf(page: { items: { name: string }[] }, r: Region) {
 
 export function reportState(ctx: PageContext, r: Region): ReportState {
   const p = ctx.params;
-  const size = parseInt(p.get(key(r, 'n')) ?? '', 10) || Number(r.config.page_size) || 15;
+  const size = parseInt(p.get(key(r, 'n')) ?? '', 10) || Number(r.config.page_size) || componentSetting(ctx.app.component_settings, 'report_rows');
   const st: ReportState = {
     search: (p.get(key(r, 'q')) ?? '').trim(),
     searchCol: (p.get(key(r, 'qc')) ?? '').trim() || null,

package/src/runtime/routes.ts

@@ -141,7 +141,8 @@ export async function signIn(req: FastifyRequest, reply: FastifyReply, a: App, o
   if (shared) s.state.__SHARED = shared;
   await saveState(s);
 
-  if (a.app_processes.some((p) => p.point === 'after_login')) {
+  // the application processes "after login", then (102) the application computations "after authentication"
+  if (a.app_processes.some((p) => p.point === 'after_login') || (a.app_computations ?? []).some((c) => c.point === 'after_authentication')) {
     const home = (await loadPage(a.id, a.home_page)) ?? ({ page_no: a.home_page, items: [], regions: [], buttons: [], dynamic_actions: [], validations: [], processes: [], computations: [], branches: [] } as unknown as Page);
     const ctx: PageContext = {
       app: a, page: home, session: s, base, params: new URLSearchParams(), request: '', user: username,
@@ -151,6 +152,7 @@ export async function signIn(req: FastifyRequest, reply: FastifyReply, a: App, o
     await appTx(txContext(ctx), async (c) => {
       ctx.client = c;
       await runAppProcesses(ctx, 'after_login');
+      await runComputations(ctx, 'after_authentication');
     });
     await saveState(s);
   }
@@ -1025,7 +1027,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
         if (!item || !vis.editable.has(item.name)) throw new Forbidden(ctx.locale.t('error.unknown_item'));
         if (item.config?.cascade_parents) applyPostedItems(ctx, body, list(item.config.cascade_parents));
         const page = Math.min(Math.max(Math.floor(Number(body.p)) || 0, 0), 10_000);
-        return searchLov(ctx, item, String(body.q ?? '').slice(0, 200), page, popupPageSize(item, body.n));
+        return searchLov(ctx, item, String(body.q ?? '').slice(0, 200), page, popupPageSize(item, body.n, ctx.app.component_settings));
       });
       return reply.send(out);
     } catch (e) {

package/src/runtime/shortcuts.ts

@@ -0,0 +1,43 @@
+import { esc } from '../html.ts';
+import { publicError, type PageContext } from './context.ts';
+import { computeValue } from './logic.ts';
+
+// Shortcuts (migration 103; APEX: Shared Components → Shortcuts). "NAME" (an
+// upper-case name in double quotes) in a static region's content, an item's
+// help text and a button's or menu entry's confirm message is replaced by the
+// application's shortcut of that name, before &ITEM. substitutions. Other
+// quoted words (class="NAV" with no shortcut NAV) stay as they are.
+//
+//   text           the value; escaped where it goes into HTML
+//   html           the value as HTML
+//   function_body  PL/pgSQL returning the text (HTML), run once per request
+//                  as the application's role
+
+const NAME = /"([A-Z][A-Z0-9_]{0,59})"/g;
+
+/** A shortcut's text (html: as it goes into HTML), computed once per request; null: no such shortcut. */
+async function valueOf(ctx: PageContext, name: string, asHtml: boolean): Promise<string | null> {
+  const s = ctx.app.shortcuts?.find((x) => x.name === name);
+  if (!s) return null;
+  if (s.type === 'text') return asHtml ? esc(s.value) : s.value;
+  if (s.type === 'html') return s.value;
+  const cache = (ctx.shortcutValues ??= new Map());
+  if (!cache.has(name)) {
+    try {
+      cache.set(name, (await computeValue(ctx, { type: 'function_body', expression: s.value })) ?? '');
+    } catch (e) {
+      ctx.errors.page.push(await publicError(ctx, e, `shortcut "${name}"`));
+      cache.set(name, '');
+    }
+  }
+  return cache.get(name)!;
+}
+
+/** The text with its "NAME" shortcuts replaced (as HTML or as plain text). */
+export async function expandShortcuts(ctx: PageContext, text: string, as: 'html' | 'text'): Promise<string> {
+  if (!ctx.app.shortcuts?.length || !text.includes('"')) return text;
+  const names = new Set([...text.matchAll(NAME)].map((m) => m[1]));
+  const values = new Map<string, string | null>();
+  for (const n of names) values.set(n, await valueOf(ctx, n, as === 'html'));
+  return text.replace(NAME, (m, n: string) => values.get(n) ?? m);
+}

package/src/security.ts

@@ -96,7 +96,8 @@ export function securityHeaders(app: FastifyInstance) {
     // the app's own pages may use the camera (photos, scanning) and the position (location items); nothing else may
     reply.header('Permissions-Policy', 'camera=(self), microphone=(), geolocation=(self)');
     const type = String(reply.getHeader('content-type') ?? '');
-    if (type.startsWith('text/html')) {
+    // a file's own stricter policy (downloads, uploaded files: default-src 'none'; sandbox) is kept
+    if (type.startsWith('text/html') && !reply.hasHeader('content-security-policy')) {
       // No inline scripts and no inline styles: behaviour lives in /static/app.js,
       // styling in /static/app.css. The only <style> a page has (theme colours,
       // chart geometry) carries this response's nonce; style="" attributes are refused.