pgkiln 0.46.0 → 0.48.0

package/db/migrations/108_sql_history.sql

@@ -0,0 +1,25 @@
+-- ---------------------------------------------------------------------
+-- 108: the SQL Worksheet's history (sprint 92, Database Actions DA-5:
+-- SQL History). One row per statement a developer ran in the worksheet:
+-- the text, how it ended (ok or error), the rows and the time. Running
+-- the same statement again right after counts on the same row (runs,
+-- at), so repeated runs don't flood the list. Kept per developer and
+-- workspace, at most 500 rows each (the builder deletes older ones).
+-- The builder reads and writes it as the owner; nobody else has grants.
+-- The activity log keeps its own 'sql_command' entries (the SQL Workshop
+-- home's Recent SQL Commands).
+-- ---------------------------------------------------------------------
+create table meta.sql_history (
+  id            bigint generated always as identity primary key,
+  username      text not null,
+  workspace_id  int not null default 1 references meta.workspace on delete cascade,
+  sql           text not null check (length(sql) <= 20000),
+  status        text not null check (status in ('ok', 'error')),
+  rows          bigint,
+  ms            int,
+  error         text,
+  runs          int not null default 1,
+  at            timestamptz not null default now()
+);
+create index sql_history_user_idx on meta.sql_history (username, workspace_id, id desc);
+comment on table meta.sql_history is 'The SQL Worksheet''s history per developer and workspace (108); installation data, not exported';

package/db/migrations/109_builder_pins.sql

@@ -0,0 +1,19 @@
+-- ---------------------------------------------------------------------
+-- 109: pins on the SQL Workshop's Launchpad (sprint 96, Database Actions
+-- DA-15: Pinned & Recently Visited). A developer pins a tool, a database
+-- object or a saved worksheet; the home page lists them first. Per
+-- developer and workspace, at most 24 (the builder refuses more). Only
+-- builder paths (/builder/…) are kept. The builder reads and writes it as
+-- the owner; installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.builder_pin (
+  id            bigint generated always as identity primary key,
+  username      text not null,
+  workspace_id  int not null default 1 references meta.workspace on delete cascade,
+  href          text not null check (href ~ '^/builder/' and length(href) <= 400),
+  label         text not null check (length(label) between 1 and 120),
+  icon          text not null default 'bookmark' check (icon ~ '^[a-z0-9-]{1,40}$'),
+  at            timestamptz not null default now(),
+  unique (username, workspace_id, href)
+);
+comment on table meta.builder_pin is 'The SQL Workshop Launchpad''s pins per developer and workspace (109); installation data, not exported';

package/db/migrations/110_sql_charts.sql

@@ -0,0 +1,23 @@
+-- ---------------------------------------------------------------------
+-- 110: SQL Workshop charts (sprint 97, Database Actions DA-6: Charts).
+-- A chart is a SELECT with how to draw it: the chart type, the label
+-- column and the value columns. The worksheet's Chart tab saves one; SQL
+-- Workshop → Charts lists them and shows the ones on the dashboard. Shared
+-- by the workspace's developers, like SQL Scripts. The builder runs the
+-- SELECT read-only with the workshop's connection when it draws a chart.
+-- Installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.sql_chart (
+  id            int generated always as identity primary key,
+  workspace_id  int not null default 1 references meta.workspace on delete cascade,
+  name          text not null check (length(name) between 1 and 120),
+  sql           text not null check (length(sql) between 1 and 20000),
+  kind          text not null default 'bar' check (kind in ('bar', 'column', 'line', 'area', 'donut', 'pie', 'scatter', 'stacked')),
+  label_col     text not null default '',
+  value_cols    text[] not null default '{}',
+  on_dashboard  boolean not null default true,
+  created_by    text,
+  updated_at    timestamptz not null default now(),
+  unique (workspace_id, name)
+);
+comment on table meta.sql_chart is 'SQL Workshop charts: a SELECT drawn as a chart (110); installation data, not exported';

package/db/migrations/111_sql_diagram.sql

@@ -0,0 +1,24 @@
+-- ---------------------------------------------------------------------
+-- 111: the SQL Workshop's Data Modeler (sprint 98, Database Actions
+-- DA-10: relational diagrams). A diagram is a named picture of some
+-- tables and views of one schema: which objects it shows and where each
+-- box stands. objects is a jsonb array of {"name", "x", "y"} (the
+-- object's name in the schema, the box's position). The objects are only
+-- names: the columns, keys and foreign keys are read from the catalog
+-- whenever the diagram is shown, so a diagram never goes stale. Per
+-- workspace, shared by its developers. The builder reads and writes it
+-- as the owner; installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.sql_diagram (
+  id            bigint generated always as identity primary key,
+  workspace_id  int not null default 1 references meta.workspace on delete cascade,
+  name          text not null check (length(name) between 1 and 120),
+  schema_name   text not null check (length(schema_name) between 1 and 63),
+  objects       jsonb not null default '[]' check (jsonb_typeof(objects) = 'array' and jsonb_array_length(objects) <= 500),
+  created_by    text not null,
+  created_at    timestamptz not null default now(),
+  updated_by    text,
+  updated_at    timestamptz not null default now(),
+  unique (workspace_id, name)
+);
+comment on table meta.sql_diagram is 'The SQL Workshop Data Modeler''s diagrams per workspace (111); installation data, not exported';

package/db/migrations/113_rest_objects.sql

@@ -0,0 +1,49 @@
+-- ---------------------------------------------------------------------
+-- 113: AutoREST (sprint 100, Database Actions DA-11 part 1; ORDS: REST ›
+-- Enable on a table or view). SQL Workshop › RESTful Services publishes a
+-- table or view through an application of the workspace:
+--
+--   /a/<alias>/autorest/<object>/            GET (paged, filters), POST
+--   /a/<alias>/autorest/<object>/<key>       GET, PUT, DELETE (tables with a primary key)
+--   /a/<alias>/autorest/openapi.json         the OpenAPI description of them all
+--
+-- The application decides how a request runs: its database role (never the
+-- object's owner, a superuser or a role that bypasses row level security,
+-- checked when the object is enabled and at every request), its tokens and
+-- OAuth clients (App › REST API), its accounts' roles (meta.has_role) and
+-- its availability. Without a bearer token an object answers 401 unless the
+-- developer chose "public" for it explicitly.
+--
+-- The builder writes the rows as the owner; the runtime reads them.
+-- Installation data like the application's OAuth clients: not exported (an
+-- in-place import keeps them); the application's own REST modules are what
+-- travels with an export.
+-- ---------------------------------------------------------------------
+create table meta.rest_object (
+  id           int generated always as identity primary key,
+  app_id       int  not null references meta.app on delete cascade,
+  schema_name  text not null check (length(schema_name) between 1 and 63),
+  object_name  text not null check (length(object_name) between 1 and 63),
+  -- the URL segment: /a/<alias>/autorest/<alias>/
+  alias        text not null check (alias ~ '^[a-z][a-z0-9_-]{0,62}$' and alias <> 'openapi.json'),
+  methods      text[] not null default '{GET}' check (methods <@ '{GET,POST,PUT,DELETE}'::text[] and cardinality(methods) > 0),
+  -- token: a bearer token of the application (default); public: no token needed, meta.app_user() = nobody
+  auth         text not null default 'token' check (auth in ('token', 'public')),
+  -- the caller needs one of these application roles (meta.has_role); empty: any caller the auth allows
+  roles        text[] not null default '{}',
+  page_size    int  not null default 25 check (page_size between 1 and 500),
+  enabled      boolean not null default true,
+  created_by   text,
+  created_at   timestamptz not null default now(),
+  updated_at   timestamptz not null default now(),
+  unique (app_id, alias),
+  unique (app_id, schema_name, object_name)
+);
+revoke all on meta.rest_object from public;
+grant select on meta.rest_object to pgkiln_runtime;
+-- isolated workspaces (090): a workspace's logins see the rows of their own applications only
+alter table meta.rest_object enable row level security;
+create policy workspace on meta.rest_object
+  using ((select meta.isolation_off()) or app_id in (select meta.visible_apps()))
+  with check ((select meta.isolation_off()) or app_id in (select meta.visible_apps()));
+comment on table meta.rest_object is 'AutoREST (113): tables and views published through an application at /a/<alias>/autorest/<alias>/; installation data, not exported';

package/docs/apex-feature-parity.md

@@ -7,7 +7,7 @@ open item and open an issue or pull request; see [CONTRIBUTING.md](../CONTRIBUTI
 Legend: ✅ available · 🟡 partial (see notes) · ❌ not yet · ➖ not planned (a deliberate choice,
 or better served by the PostgreSQL ecosystem; see the notes and [extensions](guide/15-extensions.md))
 
-Last reviewed: 2026-10-15 (sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
+Last reviewed: 2026-10-16 (sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
 
 ## At a glance
 
@@ -184,7 +184,7 @@ two, REST source catalogs and the workspace export, with their features.)
 
 | APEX | pgkiln | Notes |
 |---|---|---|
-| SQL Workshop: SQL commands, object browser | ✅ | (sprint 61) A **home page** like APEX's: tiles, recently created tables, your recent SQL commands and the workspace's recent scripts, and the session's **default schema** (first in the search path of SQL Commands and Scripts). (sprint 75) The **Object Browser** like APEX's: a schema in the header, a tree by object type (tables, views, materialized views, indexes, sequences, types, functions, procedures, triggers) with a filter and a Create menu, system and extension objects hidden unless asked, and a table in tabs (columns with Add/Rename/Drop column writing the ALTER TABLE to review, data in pages, indexes, constraints, triggers, grants, row level security, dependencies, statistics, DDL); the tools as main tabs and a More menu. (sprint 62) **Utilities** like APEX's: the tools on one page, **Object Reports** (tables without a primary key, unindexed foreign keys, row-level security without policies or not enabled, PUBLIC grants, unused indexes, largest tables, missing comments), **About Database** and a **Database Monitor** of sessions and blocked queries for administrators. **Missing:** a recycle bin (PostgreSQL has none), user interface defaults (pgkiln's wizards read the catalog and comments) |
+| SQL Workshop: SQL commands, object browser | ✅ | (sprint 61) A **home page** like APEX's: tiles, recently created tables, your recent SQL commands and the workspace's recent scripts, and the session's **default schema** (first in the search path of the SQL Worksheet and Scripts). (sprint 91) **SQL Commands is the SQL Worksheet** like Database Actions' SQL: a navigator, the statement at the cursor or a script with a log per statement, Explain Plan and Autotrace, notices and history (see the Database Actions section below). (sprint 75) The **Object Browser** like APEX's: a schema in the header, a tree by object type (tables, views, materialized views, indexes, sequences, types, functions, procedures, triggers) with a filter and a Create menu, system and extension objects hidden unless asked, and a table in tabs (columns with Add/Rename/Drop column writing the ALTER TABLE to review, data in pages, indexes, constraints, triggers, grants, row level security, dependencies, statistics, DDL); the tools as main tabs and a More menu. (sprint 62) **Utilities** like APEX's: the tools on one page, **Object Reports** (tables without a primary key, unindexed foreign keys, row-level security without policies or not enabled, PUBLIC grants, unused indexes, largest tables, missing comments), **About Database** and a **Database Monitor** of sessions and blocked queries for administrators. **Missing:** a recycle bin (PostgreSQL has none), user interface defaults (pgkiln's wizards read the catalog and comments) |
 | RESTful services (ORDS) | ✅ | [PostgREST](https://postgrest.org) next to pgkiln: `api` schema, the same RLS as the UI, per-app API role, tokens in the builder, a pre-request check, and **OAuth clients** (client credentials, like ORDS `oauth.create_client`) so tokens renew themselves |
 | REST handler editor, REST-enabled SQL | ✅ | **REST modules** in the builder: handlers (method, path with parameters, SQL as collection, item or statements, roles, public) served by pgkiln with bearer tokens and an OpenAPI description; plus PostgREST for schema-wide APIs. **Missing:** REST-enabled SQL (rarely desirable) |
 | SQL scripts, query builder, Quick SQL | ✅ | **SQL Scripts**: saved, upload/download, a result per statement, stop or continue on errors, optionally one transaction, run history. **Quick SQL** (a subset: tables, child tables, types, the main column directives, `/auditcols`, settings, views). A graphical **query builder**: tables as boxes on a canvas (dragged, placed where left), joins along foreign keys or drawn from column to column (inner or left), column functions with automatic `group by`, conditions, sort, open in SQL Commands; without JavaScript the same as forms ([chapter 3](guide/03-builder.md#sql-workshop)) |
@@ -334,3 +334,29 @@ Sources: [APEX 26.1 new features](https://docs.oracle.com/en/database/oracle/ape
 | Map Backgrounds | ➖ Not planned per application: the installation's map tile server (`MAP_TILE_URL`) is every map's background |
 | AI Attributes, AI Services, AI Agents | AI Services; AI agents ➖ not planned |
 
+## Database Actions (SQL Developer Web) and the SQL Workshop
+
+(sprint 91) Oracle's Database Actions, the ORDS tool next to APEX, is the standard for pgkiln's SQL Workshop, mapped
+to PostgreSQL. pgkiln's own extras stay: Quick SQL, the Query Builder, Sample Data, Schema Comparison, Object Reports,
+AI and row level security badges.
+
+| Database Actions | pgkiln | |
+|---|---|---|
+| SQL worksheet: navigator, editor, output tabs, status bar | SQL Workshop → SQL Worksheet (sprint 91): navigator by schema and object type with columns, drag and drop and SELECT / INSERT / UPDATE / DELETE; Query Result, Script Output, Notices (DBMS Output), Explain Plan, Autotrace, SQL History; resizable panes, fullscreen | ✅ |
+| Run Statement (Ctrl+Enter), Run Script (F5) | The statement at the cursor or the selection; a script with a log per statement (psql command tags, error line and column), stop or continue on error; Run as an application's role | ✅ |
+| Explain Plan (F10), Autotrace (F6) | A tree of steps (sprint 92): cost, rows, conditions; with Autotrace (`EXPLAIN ANALYZE, BUFFERS`, rolled back) actual time, rows, loops, buffers, each step's own time, the slowest step and 10× misestimates; the text plan too | ✅ |
+| Query Result grid (paging, download, sharing) | 500 rows (All rows: 10,000) with row numbers, numbers right-aligned, sort, a value dialog, copy, Download as CSV, JSON, XML, Excel or SQL inserts (sprint 92); no sharing links | ✅ |
+| SQL History, DBMS Output | SQL History per developer with status, rows, time, search and run again; Notices with their time (sprint 92) | ✅ |
+| Worksheets saved as files, tabs | Save, Save as, Rename, Download as SQL Scripts, a Files tab, worksheet tabs that survive a reload (sprint 93) | ✅ |
+| Create Chart from a query, Charts | The worksheet's Chart tab (Ctrl+F11) and SQL Workshop → Charts with a dashboard (sprint 97); no page made from a chart yet | ✅ |
+| Object context menu, table properties dialog, Quick DDL | An object's menu (sprint 94): Open in a panel, Quick DDL to the worksheet or a file, Load data, Add index / trigger / policy, Drop with its dependents; **Table Properties** (sprint 95): columns, keys, foreign keys, checks, indexes, comment, RLS, partitioning, DDL preview, Apply in one transaction, use as template | ✅ |
+| Format, Convert Case, Find and replace, bind variables | Format (Ctrl+F7), Convert case, find and replace, Go to line, comment lines, `:NAME` and `&NAME.` asked for before a run (sprint 93); no guided tour | ✅ |
+| Data Modeler (relational diagrams) | SQL Workshop → Data Modeler (sprint 98): diagrams per schema, boxes with columns and keys, foreign key lines with crow's feet, positions saved, zoom, fit, auto layout, mini-map, SVG / PNG export, DDL of the shown objects, a data dictionary | ✅ |
+| REST (modules, AutoREST) | SQL Workshop → RESTful Services (sprint 100): a table or view published through an application with GET (paging, filters, search, order), item GET, POST, PUT, DELETE as the app role with its tokens and RLS, OpenAPI; custom modules, templates and handlers are application REST modules (Shared Components), not yet managed from the SQL Workshop | 🟡 |
+| Scheduling | pgkiln's own jobs and automations | ❌ |
+| Database Users | Administration → Database users (sprint 99): roles with sign-in, attributes, expiry, memberships and owned objects; create and edit with the SQL reviewed (password masked, a SCRAM verifier) and applied in one transaction; drop with reassign or drop owned; pgkiln's roles protected. PostgreSQL has no created date or quota | ✅ |
+| Real Time SQL Monitor | Database Monitor (sessions) and Top SQL per application role | 🟡 |
+| Launchpad, Search Database (Ctrl+K) | The SQL Workshop home as a Launchpad (sprint 96): pinned and recently visited, Development / Administration / Monitoring tabs; Search (Ctrl+K) for tools, applications, pages and database objects; no guided walk-through | ✅ |
+| Data Pump | Application backups and Unload Data | 🟡 |
+| Liquibase | Schema Comparison | 🟡 |
+| JavaScript (MLE) | ➖ Not planned: PostgreSQL has plv8 as an extension | ➖ |

package/docs/guide/03-builder.md

@@ -84,7 +84,7 @@ builder page while the workspace is current.
 Administrators and the workspace's administrators set them on the workspace's page (Administration menu →
 *Workspace preferences*; APEX: Set Workspace Preferences):
 
-- **Enable the SQL Workshop**: off, every SQL Workshop page (SQL Commands, the Object Browser, SQL scripts, Load and
+- **Enable the SQL Workshop**: off, every SQL Workshop page (the SQL Worksheet, the Object Browser, SQL scripts, Load and
   Unload Data, Quick SQL, the query builder, Sample Data, DDL, Compare, AI) answers *403* while the workspace is
   current, for every developer including administrators; the rail and Workspace utilities no longer show it. A
   developer who belongs to another workspace can still use it there. Turn it off for a workspace whose developers
@@ -143,7 +143,7 @@ workspace → *Isolation*). It needs `RUNTIME_DATABASE_URL` (applications don't
 
 - **Two PostgreSQL logins of its own**: `pgkiln_ws<id>_run_<suffix>` runs its applications (pages, processes, REST
   handlers, automations, workflows, background processes, REST synchronisation); `pgkiln_ws<id>_dev_<suffix>` runs its
-  developers' SQL: SQL Commands, SQL Scripts, Quick SQL, Load and Unload Data, Sample Data, DDL and Compare, the
+  developers' SQL: the SQL Worksheet, SQL Scripts, Quick SQL, Load and Unload Data, Sample Data, DDL and Compare, the
   Advisor, code checks and document previews. SQL that runs `RESET ROLE` (or `set_config('role', …)`) only gets back to
   that login, which can use the workspace's database roles and nothing else.
 - **The workspace's database roles** (APEX: workspace schemas): isolating gives the workspace the roles its
@@ -183,7 +183,7 @@ Every builder page has the same frame, modelled on an IDE:
   pages of an application); at the bottom the **Administration** menu (Workspace utilities; for administrators of the
   current workspace *Manage service*: [workspace message and environment banner](#workspace-message-and-environment-banner),
   [workspace utilization](#workspace-utilization) and the workspace's page; Manage users and groups, Developers,
-  Monitor activity, Change my password), Help, and your account menu (the circle with your initials) with the
+  Monitor activity, [Database users](#database-users) for administrators, Change my password), Help, and your account menu (the circle with your initials) with the
   **builder theme** (*Dark*, the default; *Light*; or *System*, which follows the operating system),
   Change password and Sign out. The theme is remembered on this device, also after signing out;
   it only changes the builder, not your applications.
@@ -1191,8 +1191,8 @@ administrator chooses it under **SQL Workshop → AI** (any enabled [AI service]
 switches the builder's AI off). What it is used for:
 
 - **SQL from a question** (SQL Workshop → AI): pick a schema and ask; the answer is a statement and
-  a short explanation. It is **shown, never run**: check it, change it and run it in SQL Commands
-  yourself (*Run in SQL Commands*).
+  a short explanation. It is **shown, never run**: check it, change it and run it in the SQL Worksheet
+  yourself (*Run in the SQL Worksheet*).
 - **Explain a query or an error** (SQL Workshop → AI): paste a query, an error message or both
   (optionally with a schema for context); the explanation is shown with simple formatting.
 - **Describe tables for AI** (SQL Workshop → AI → *Describe tables*): per table or view, a
@@ -1246,34 +1246,124 @@ may use), a form to **issue a token** for an account, and `curl` examples. See
 
 ## SQL Workshop
 
-The SQL Workshop opens on its **home** (`/builder/sql`; APEX: the SQL Workshop home): tiles for the Object Browser,
-SQL Commands, SQL Scripts, the utilities and Quick SQL; **Recently created tables** (the newest tables you can read:
-PostgreSQL keeps no creation time, so object ids decide), your **recent SQL commands** (click one to open it in SQL
-Commands; other developers' are never shown) and the workspace's **recent SQL scripts**. The side column sets the
-session's **schema** (APEX: the default schema): it goes first in the search path of SQL Commands and SQL Scripts until
+The SQL Workshop opens on its **home** (`/builder/sql`; APEX: the SQL Workshop home): tiles for the SQL Worksheet,
+the Object Browser, SQL Scripts, the utilities and Quick SQL; **Recently created tables** (the newest tables you can read:
+PostgreSQL keeps no creation time, so object ids decide), your **recent SQL commands** (click one to open it in the SQL
+Worksheet; other developers' are never shown) and the workspace's **recent SQL scripts**. The side column sets the
+session's **schema** (APEX: the default schema): it goes first in the search path of the SQL Worksheet and SQL Scripts until
 you sign out. Tasks link to Quick SQL, blueprints, table descriptions, sample data and Generate DDL.
 
-(sprint 75) The tools are tabs: Home, Object Browser, SQL Commands, SQL Scripts and Utilities; **More** opens the
-others (Quick SQL, Query Builder, Load and Unload Data, Sample Data, DDL, Compare, AI), and the open one is a tab too.
-
-- **SQL Commands** (`/builder/sql/commands`): run any SQL as the **owner connection**, not as an application role. Multiple
-  statements are allowed; the result of the last one is shown (up to 500 rows). Press
-  **Ctrl/Cmd + Enter** to run. The [code editor](#the-code-editor) suggests every schema, table,
-  column and function the owner sees.
+(sprint 75) The tools are tabs: Home, SQL Worksheet, Object Browser, SQL Scripts and Utilities; **More** opens the
+others (Quick SQL, Query Builder, Load and Unload Data, Sample Data, DDL, Compare, Data Modeler, AI), and the open one is a tab too.
+
+(sprint 96; Database Actions: the Launchpad) The home page starts with **Pinned & recently visited**: the pages you
+pinned (a tool, a database object from the Object Browser, a saved worksheet from its file menu; at most 24, per
+workspace) and the SQL Workshop pages you opened last in this browser. Below, the tools are in three tabs,
+**Development**, **Administration** and **Monitoring**, each with a line about what it does and a pin; the **More**
+menu uses the same headings.
+
+**Search** (**Ctrl/Cmd + K** on any builder page, or the field in the header) finds tools, applications, pages
+(by name or number) and database objects (tables, views, materialized views, functions and procedures) by name;
+the arrow keys and Enter open one. Applications and pages come from your workspace only; objects from the schemas
+the SQL Workshop's connection may use. Without JavaScript the header's field opens a page of results.
+
+- **SQL Worksheet** (`/builder/sql/worksheet`, sprint 91; Database Actions: SQL; was SQL Commands, whose address
+  `/builder/sql/commands` opens the same page): one screen with a **navigator** on the left, the **editor** with a
+  toolbar, **output tabs** below and a **status bar**.
+  - The navigator has a schema (the same one as the Object Browser), an object type (*All Objects*, tables, views,
+    materialized views, indexes, sequences, types, functions, procedures, triggers, policies) and a search field.
+    A table or view opens to its columns with their types (a key marks the primary key); drag it into the editor
+    for a `SELECT` of all its columns, or use its **SELECT**, **INSERT**, **UPDATE** and **DELETE** buttons, which
+    insert the statement at the cursor. Columns are listed for the first 400 tables and views of a schema.
+  - (sprint 94) Each object has a **⋯ menu** (or right-click it; Shift+right-click keeps the browser's menu), in
+    the Object Browser's tree too: **Open** shows the Object Browser's tabs in a panel at the side, without leaving
+    the worksheet; **Quick DDL** puts the object's DDL into a new worksheet tab (with the search path set to its
+    schema) or downloads it as a `.sql` file; for a table **Load data**, **Add index**, **Add trigger** (a trigger
+    function and the trigger) and **Add policy** (row level security on, a policy to fill in); **Drop…** writes the
+    DROP statement with a comment that lists what depends on the object (views, foreign keys…). Nothing runs: you
+    review the statement and run it.
+    (sprint 100) Tables and views also have **REST › Enable / Disable**: it opens the object's page in **RESTful
+    Services** when it is published, or the Enable form for it (below).
+  - (sprint 95) **Table Properties** (a table's **Edit…**, **Use as template**, the Object Browser's *Edit table* and
+    its *Table (form)* tile): a form with **Columns** (name, type, primary key, not null, default, identity,
+    comment; move them up or down for a new table, remove them), **Unique keys**, **Foreign keys** (the table it refers
+    to, its columns, on delete), **Checks**, **Indexes** (columns or expressions, unique; indexes with another method or
+    a condition are kept as they are), the table's **comment**, **row level security** (and forcing it for the owner)
+    and, for a new table, **partitioning** (range, list or hash and its key). **Preview DDL** shows the exact CREATE
+    TABLE, or for an existing table the ALTER statements from what the catalog says now; **Apply** runs them in one
+    transaction (nothing changes when one fails, and the error shows under *Output*); **Open in the worksheet** puts
+    them there instead. *Use as template* starts a new table with the same columns and keys (names with `_copy`).
+    Defaults, checks and index expressions are single expressions (no `;` or comments).
+  - **Run Statement** (**Ctrl/Cmd + Enter**) runs the statement at the cursor: the one the cursor is in, else the
+    nearest one before it. A selection runs as it is, even when it holds several statements. The rows of the last
+    query show in **Query Result**, up to 500, with row numbers, numbers right-aligned and NULL as *(null)*. The
+    statement that ran is selected again afterwards. (sprint 92) Click a column heading to sort the rows, a cell to
+    see its whole value (JSON indented), **Copy** for the rows as tab-separated text, and **All rows** to run the
+    statement again for up to 10,000 rows. **Download** saves a SELECT as CSV, JSON, XML, Excel or SQL inserts
+    through Unload Data (a read-only transaction, so the query runs once more).
+  - **Run Script** (**F5**) runs every statement in order and writes **Script Output**: for each statement its line,
+    the rows as text (up to 50), its notices, and its command tag like psql's (`CREATE TABLE`, `INSERT 0 2`,
+    `SELECT 14`) with its time. An error says its line and column in the worksheet; the cursor goes to that line.
+    The script stops at the first error unless **Continue on error** is on. psql meta-commands and `COPY … FROM
+    STDIN` / `TO STDOUT` are skipped (use Load Data and Unload Data).
+  - **Explain Plan** (**F10**) shows the plan of the statement at the cursor; nothing runs. **Autotrace** (**F6**) runs
+    it with `EXPLAIN (ANALYZE, BUFFERS)` in a transaction that is rolled back, so an UPDATE or DELETE changes
+    nothing. (sprint 92) The plan is a tree of steps: the operation, the table or index, cost, estimated rows and
+    width, and the step's conditions (filter, index and join conditions, sort keys). Autotrace adds the actual time,
+    rows, loops and buffers, the time spent in the step itself, marks the **slowest step**, and flags estimates that
+    are 10 times too high or too low (run `ANALYZE` on the table). **Text plan** shows it like psql.
+  - (sprint 97) **Chart** (**Ctrl + F11**, or *Chart* above the Query Result) draws the last query with pgkiln's
+    own charts: the first text or date column gives the labels, the number columns the values; change the type (bar,
+    column, stacked bar, line, area, donut, pie, scatter), the label column or the values and it draws again. Name it
+    and **Save chart**: SQL Workshop → **Charts** lists the saved charts (shared by the workspace) and draws the ones
+    on its dashboard; a chart's page changes its settings, opens its query in the worksheet or deletes it. A saved
+    chart's SELECT runs read-only with a 10 second timeout and at most 500 rows.
+  - **Notices** lists the `RAISE NOTICE`, `INFO` and `WARNING` messages of the last run with their time.
+    **SQL History** (sprint 92) lists your last 200 statements in this workspace with how they ended, their rows and
+    time; running the same statement again counts on its row (*3×*). Search it, show only the ones that failed or
+    succeeded, click one to insert it at the cursor, **Run** to run it again, or copy it. Other developers' history
+    never shows; 500 statements are kept per developer. The home page's *Recent SQL commands* opens it.
+  - The status bar counts errors and warnings and shows the last message and its time.
+  - (sprint 93) **Worksheets and files**: the worksheet's name is a menu with **Save** (**Ctrl/Cmd + S**), *Save as
+    new*, *Rename*, **Download** (a `.sql` file), **New** and *Open…*. A worksheet is saved as a script of SQL Scripts
+    (shared by the workspace's developers); the navigator's **Files** tab lists them, and SQL Scripts opens one in the
+    worksheet. Several worksheets stay open as **tabs** above the editor (at most 20); a `*` marks text not saved yet.
+    The tabs and their unsaved text are kept in the browser, so they survive a reload.
+  - **Bind variables** (`:NAME`) and **substitution variables** (`&NAME.`) are asked for in a dialog before the run.
+    A bind variable's value is a quoted literal (empty is NULL), so it can never change the statement; a substitution
+    variable's text goes into the statement as it is (a table or column name, for instance). The values are
+    remembered for the session; the history and the log keep the statement as written.
+  - **Format** (**Ctrl + F7**) lays out the selection or the whole worksheet: a clause per line, the columns of a select
+    list and the conditions of a WHERE one per line, joins and subqueries indented, keywords in lower or UPPER case
+    (chosen in the **?** menu). Strings, comments and `$$` bodies stay as they are. **Convert case** (**Ctrl + B**)
+    cycles the selection (or the word at the cursor) through UPPER, lower and Initial caps. **Find and replace**
+    (**Ctrl + F**, **Ctrl + H**) with a regular expression or exact case, **Go to line** (**Ctrl + G**), and
+    **Ctrl + /** comments the selected lines out or in. The **?** menu lists every key; **F1** opens this help. The
+    upload button opens Load Data for the navigator's schema.
+  - Each statement commits on its own. Statements run as the **owner connection** (an isolated workspace's
+    developer login for its developers), on a connection of their own that is closed afterwards, so `SET ROLE` or
+    `SET search_path` doesn't leak. **Run as** picks an application of your workspace instead: the statements then
+    run as its database role, with `pgkiln.app_id` set, so its grants and row level security policies apply. Use
+    it to test policies; it is no security boundary, since the SQL could `RESET ROLE`.
+  - With script, the panes fill the window. Drag the splitters (or focus one and use the arrow keys) to resize
+    them, hide the navigator, or use **Fullscreen** to see only the editor (**Escape** leaves). Sizes are
+    remembered in the browser. Without script, the buttons post the form and the panes stack; Run Statement then
+    runs every statement. The [code editor](#the-code-editor) suggests every schema, table, column and function
+    you can use.
 - **Object Browser** (APEX's): the **schema** in the header and a tree with a
   folder per object type (tables, views, materialized views, indexes, sequences, types, functions, procedures,
   triggers) and a **filter** by name. pgkiln's own schemas (`meta`, `pgkiln_plugins`) and objects that belong to an
   extension show only with **Show system objects**. **Create** (and the tiles shown when nothing is selected) opens
-  SQL Commands with a CREATE TABLE, VIEW, FUNCTION, SEQUENCE or INDEX statement to fill in. A table opens in tabs:
+  the SQL Worksheet with a CREATE TABLE, VIEW, FUNCTION, SEQUENCE or INDEX statement to fill in. A table opens in tabs:
   **Columns** (with comments; the toolbar's *Add*, *Modify* (type, nulls, default), *Rename* and *Drop column* write
-  the ALTER TABLE statement into SQL Commands to review and run: nothing changes until you press Run), **Data** (25
+  the ALTER TABLE statement into the SQL Worksheet to review and run: nothing changes until you press Run), **Data** (25
   rows a page; NULL is a blank cell), **Indexes**, **Constraints**
   (primary key, foreign keys with the table they refer to, unique, check), **Triggers**, **Grants**, **Row level
   security** (on or off, the policies), **Dependencies** (views and foreign keys that use it, and what it uses),
   **Statistics** (rows, sizes, analyze and vacuum times) and **DDL**. A view has the same tabs where they apply; a
   function or procedure shows its source, a trigger, index, sequence or type its definition. (sprint 89) The tabs stay
   on one row: Columns, Data, Indexes, Constraints and DDL (and the current one), the others under **More**. The
-  schema shown is the one you chose last (remembered for the session), else the session's schema of SQL Commands,
+  schema shown is the one you chose last (remembered for the session), else the session's schema of the SQL Worksheet,
   else the **parsing schema** of the application changed last in your workspace (the schema its database role
   uses).
 - **SQL Scripts**: saved scripts, shared by the developers of the workspace. Create one in the editor, upload a
@@ -1308,10 +1398,31 @@ others (Quick SQL, Query Builder, Load and Unload Data, Sample Data, DDL, Compar
   note. Each join can be inner or left. Drag a table by its handle, or focus the handle and use
   the arrow keys (Shift for bigger steps); it stays where it was left. On phones the tables are
   stacked. Then pick conditions (`=`, `<>`, `<`, `like`, `in (a, b)`, `is null` …, combined with
-  AND or OR), the sort, `distinct` and a row limit. The SELECT is shown and opens in SQL Commands.
+  AND or OR), the sort, `distinct` and a row limit. The SELECT is shown and opens in the SQL Worksheet.
   The state is in the URL (tables in the order chosen, joins, functions and the tables' places), so
   a query can be bookmarked; everything except dragging works without JavaScript. Only names from
   the catalog and the fixed functions are used, and condition values are string literals.
+- **Data Modeler** (SQL Workshop → More → Data Modeler, `/builder/sql/modeler`): named relational
+  **diagrams** of a schema's tables and views, kept per workspace and shared by its developers. Create
+  one with a name, a schema and, optionally, the objects (`orders, customers`, `ord*`, or `*` for all);
+  **Add objects to diagram** searches the schema (part of a name, a pattern with `*`, or `*`) and adds
+  the ticked ones. Each object is a box with its columns, their types, `P` (primary key), `F` (foreign
+  key), `U` (unique) and `*` for not null; a foreign key between two shown tables is a line from the
+  referencing table (a crow's foot: many) to the referenced one (a bar: one), dashed with a circle
+  when the foreign key may be empty. A box's name opens **Table Properties** (a view: the Object
+  Browser). The toolbar: **Save** (Ctrl+S), **Undo** / **Redo** (Ctrl+Z, Ctrl+Y), **Zoom out** / **Zoom
+  in** (or Ctrl+wheel), **Fit**, **Auto layout** (referenced tables to the left of the tables that
+  reference them; undoable), a **Mini-map** (click or drag in it to move around), **SVG** and **PNG**
+  exports of the diagram as shown, **Print**, **Generate DDL** (the CREATE statements of the shown
+  objects with their keys, indexes, triggers, row level security, policies, comments and grants: to
+  download or open in the SQL Worksheet) and **Data dictionary** (each object's columns with type,
+  nullability, default, keys and comments, its constraints and what references it; to print, save as
+  PDF from the print dialog, or download as an HTML file). Drag a box to move it, or focus it and use
+  the arrow keys (Shift for bigger steps). The diagram keeps only the objects' names and positions
+  (`meta.sql_diagram`): columns and keys are read from the catalog each time, so it never goes stale;
+  an object dropped from the schema is reported and left out on the next save. Without JavaScript the
+  diagram shows at its saved positions, and adding, removing, auto layout, Export SVG, DDL and the
+  dictionary all work. Diagrams are installation data, not exported with applications.
 - **Load Data**: load a CSV, TSV, Excel, JSON or XML file into a new table (with inferred column
   types) or an existing one (append, merge by primary key, or replace), with a per-row error
   report, or with a saved **data load definition**; a mapping can be saved as one
@@ -1345,6 +1456,15 @@ others (Quick SQL, Query Builder, Load and Unload Data, Sample Data, DDL, Compar
   has (commented out), columns whose identity or generation differs, and types, domains and
   sequences that differ. The same from the command line (`pgkiln ddl`, `pgkiln compare`,
   [chapter 18](18-cli.md)) and for AI agents (`generate_ddl`, `compare_schemas`).
+- **RESTful Services** (`/builder/sql/rest`, sprint 100; Database Actions: REST › AutoREST): publish a table or
+  view as REST endpoints. Choose the object (of a schema the SQL Workshop may use), the **application** it is
+  published through, a URL name, the **methods** (GET: rows and one row; POST; PUT; DELETE; single rows need a primary
+  key), **who may call it** (a bearer token of the application, or explicitly *public*), optional application
+  **roles** and the page size. The application decides the rest: the statements run as its database role (never the
+  object's owner, a superuser or a role that bypasses row level security), with its tokens and OAuth clients and its
+  accounts' roles. The object's page checks the role's grants per method, row level security and (for a view)
+  `security_invoker`, lists the endpoints with their URLs, and shows cURL and `fetch` examples and the OpenAPI link.
+  Details in [chapter 13](13-rest-api.md#autorest-tables-and-views-from-the-sql-workshop).
 - **Utilities** (`/builder/sql/utilities`; APEX: SQL Workshop → Utilities): tiles for Load and Unload Data, Sample
   Data, the Query Builder, DDL and Compare, and three pages of their own. Each runs in a read-only transaction with a
   15-second statement timeout, on the SQL Workshop's connection (an isolated workspace's developers see only the
@@ -1358,9 +1478,46 @@ others (Quick SQL, Query Builder, Load and Unload Data, Sample Data, DDL, Compar
   - **Database Monitor** (administrators only): the client sessions of this database from `pg_stat_activity`, active
     first, with their state, wait event, running time, the sessions that block them and the query (as far as the
     owner may read other roles' statistics). Read only: it cancels nothing.
+  - **Database Users** (administrators only; Administration menu → *Database users*, `/builder/db-users`; sprint 99,
+    Database Actions: Database Users): see [Database users](#database-users).
 
 Because the SQL Workshop runs as the owner, restrict who gets a developer account.
 
+### Database users
+
+(sprint 99; Database Actions: Database Users) **Administration → Database users** (administrators only; also on the
+SQL Workshop's Launchpad under *Administration*) lists the PostgreSQL roles of the server (`pg_roles`; the predefined
+`pg_` roles are left out): whether they can sign in, superuser / create DB / create role / bypass RLS / replication,
+the connection limit, **valid until** (with *in N days* or *expired*), the roles they are a member of and what they own
+(schemas, objects in this database, objects elsewhere). PostgreSQL doesn't record when a role was created.
+The tiles on top filter the list: roles that can sign in, **passwords that expire within 30 days**, roles with
+**BYPASSRLS**, roles **without sign-in that own objects**, and pgkiln's own roles; a search field filters by name.
+
+**Create database user** (or a role's page) is a form: name, *Can sign in* (LOGIN), the password (*No password* /
+*Set a password*; for an existing role *Keep*, *Set a new password* or *Remove*), **valid until** (a date; empty: no
+expiry), the connection limit, the roles it is a **member of** (group roles and the predefined roles; not pgkiln's own,
+superusers, login roles or the roles that reach the server's files), its **default schema** (the search path in this
+database: `ALTER ROLE … IN DATABASE … SET search_path`), a comment, and per schema **Usage** and **Create**,
+**Future tables** (default privileges, *read* or *read and write*, on what pgkiln's owner connection creates there) and
+**Existing tables** (a one-off grant or revoke on the tables there now). pgkiln's own schemas aren't offered.
+
+**Review SQL** shows the statements (only what differs from what the catalog says now), with the password as
+`'********'`; the password itself is typed on that page (twice) and **Apply** runs the statements in one
+transaction: all or none, and the error with the statement that failed. Apply runs only what the review showed:
+when the form or the role changed in between, the review comes again. The masked statements go to the activity log
+(event `db_role`).
+
+**Drop role…** lists what the role owns and warns about objects in other databases; it reassigns them to another role
+(`REASSIGN OWNED`) or, with a tick, drops them (`DROP OWNED`), revokes its privileges in this database and drops the
+role, again after showing the SQL.
+
+pgkiln's **own roles** are marked *pgkiln* and are read only here: the owner and runtime connections (`DATABASE_URL`,
+`RUNTIME_DATABASE_URL`), every `pgkiln…` role (`pgkiln_runtime`, `pgkiln_app_code`, `pgkiln_authenticator`,
+`pgkiln_anon`, isolated workspaces' logins) and the bootstrap superuser. Roles **in use** by an application (parsing
+schema, REST API role) or an isolated workspace can be changed but not dropped. New names can't start with `pg_` or
+`pgkiln`. The owner connection needs `CREATEROLE` (and, on PostgreSQL 16 and later, ADMIN on roles it didn't create)
+for these changes; PostgreSQL's own error says so otherwise.
+
 ## Export and import
 
 **Export** downloads the application as JSON: pages, all components, shared components and

package/docs/guide/08-security.md

@@ -507,10 +507,28 @@ matures. Privileges show up in **SQL Workshop → Object Browser**.
 A `data_load` process loads files as the app role too, also with a data load definition: a
 definition naming a table the role can't write fails like any other insert, and a process only
 finds the definitions of its own application. XML files with a document type declaration are
-refused ([chapter 16](16-files.md#data-loading)). The SQL Workshop (SQL Commands, SQL Scripts,
+refused ([chapter 16](16-files.md#data-loading)). The SQL Workshop (the SQL Worksheet, SQL Scripts,
 Quick SQL, Load Data, Unload Data, Sample Data) runs as the owner instead, so every developer can change any table: keep
 developer accounts to people you trust with the database.
 
+The REST endpoints pgkiln serves (an application's REST modules and the tables and views published with **SQL
+Workshop → RESTful Services**, AutoREST) run as the app role too, never as the owner: these grants, column grants
+and the row level security below decide what an API caller may read and change. AutoREST refuses a role that owns
+the published object or bypasses row level security, and an object answers only to a bearer token of its application
+unless the developer chose *public* for it ([chapter 13](13-rest-api.md#autorest-tables-and-views-from-the-sql-workshop)).
+
+### Database users and their passwords
+
+(sprint 99) Administrators create and change PostgreSQL roles in the builder (**Administration → Database users**,
+[chapter 3](03-builder.md#database-users)). Passwords never reach PostgreSQL or a page in plain text: pgkiln hashes
+a new password itself into a **SCRAM-SHA-256 verifier** (random salt, 4096 iterations, SASLprep, like psql's
+`\password`) and the statement carries only that verifier, as a literal built with pg's `escapeLiteral`. The review
+and the activity log show `PASSWORD '********'`; the password is typed on the review page, posted once with Apply and
+not stored, echoed or logged. A server with `log_statement = ddl` logs the verifier, not the password. Every name is
+quoted with `escapeIdentifier`, every value is checked (dates, numbers, schema names, grantable roles) and quoted.
+The page is for administrators only (others get 403), every change needs the CSRF token, and pgkiln's own roles can't
+be changed, dropped or granted from it, so the page can't take pgkiln's own connections away.
+
 ## Session state protection
 
 - **URL items**: on pages with protection *Arguments must have checksum* (the default), item

package/docs/guide/10-tutorial.md

@@ -20,7 +20,7 @@ Then open http://127.0.0.1:3100/a/tasks and sign in as `ann` / `ann-password` or
 
 ## Step 1: the table and the business logic
 
-Open **SQL Workshop → SQL Commands** and run:
+Open **SQL Workshop → SQL Worksheet**, paste this and press **Run Script** (F5):
 
 ```sql
 create schema tasks;