pgkiln 0.46.0 → 0.48.0

package/docs/guide/12-development.md

@@ -66,7 +66,13 @@ src/
   sampledata-words.ts      built-in name, city, company and word lists of Sample Data
   unload.ts                Unload Data: unloadStatement() (one SELECT), openUnload() (cursor, batches, CSV/JSON/XLSX/XML encoders on Postgres text values)
   xml.ts                   safe XML reader (no DTDs or entities, limits) and xmlTable(): rows from a repeating element (unit tested)
-  sqlscript.ts             SQL scripts: splitScript() (statements, line numbers, psql commands), runScript() (stop/continue, transaction, savepoints)
+  sqlscript.ts             SQL scripts: splitScript() (statements, line numbers and offsets, psql commands), runScript() (stop/continue, transaction, savepoints)
+  sqlworksheet.ts          (sprint 91) the worksheet's runs: pickStatements() (at the cursor, a selection, all), runStatements() (a log per
+                           statement, psql command tags, notices, error line and column), explainStatement() (EXPLAIN / rolled-back ANALYZE)
+  datamodel.ts             (sprint 98) Data Modeler diagrams: readModel() (catalog), boxSize(), fkPath() (crow's feet), autoLayout(), diagramSvg()
+  tabledef.ts              (sprint 95) a table as a definition: readTable(), checkTable(), tableSql() (CREATE, or ALTER from the catalog's version)
+  sqlformat.ts             (sprint 93) formatSql(): the worksheet's Format (clauses per line, keyword case; strings and comments kept)
+  sqlplan.ts               (sprint 92) EXPLAIN (FORMAT JSON) as a tree: parsePlan() (self time, slowest step, misestimates), planText()
   quicksql.ts              Quick SQL: shorthand parser and PostgreSQL DDL generator (unit tested)
   xlsx.ts                  Excel writer for report downloads and Unload Data (typed cells, streamed through fflate's Zip)
   automations.ts           cron parser, next run in a time zone, scheduler (also meta.task_expire_tick, 094), running automations (the actions run
@@ -81,6 +87,9 @@ src/
   mvt.ts                   Mapbox Vector Tile encoding for map layers served as tiles
   yamltext.ts              the text style of the directory export: a strict YAML subset, written and read
   webclient.ts             outgoing HTTP to web services: allow-list, address checks at connect time (SSRF), redirects, limits
+  dbroles.ts               (sprint 99, DA-13) Database Users' SQL: roleSql (CREATE/ALTER ROLE, memberships, search path, schema
+                           and default privileges: only what differs from the catalog), dropSql, checkRole/checkPassword,
+                           scramVerifier (SCRAM-SHA-256, SASLprep) and the password slot (maskSql for review and log, withVerifier to run)
   secrets.ts               secrets at rest (web credentials): AES-256-GCM with PGKILN_SECRET_KEY
   websources.ts            web credentials (OAuth2 client credentials/password/refresh token grants, token cache, stored refresh
                            tokens) and REST data sources: requests, JSON paths, typed rows, response cache, write-back operations
@@ -144,6 +153,9 @@ src/
     spatial.ts             spatial filtering on the server: map area and distance parsing, PostGIS detection and SQL (ST_Intersects, ST_DWithin), lat/lng fallback (bounding box, haversine)
     pwa.ts                 Progressive Web App: manifest, service worker route, icons (PNG encoder), offline page
     rest.ts                REST modules: handler checks, matching, bearer tokens, execution (collections stream from a cursor), OpenAPI
+    autorest.ts            (sprint 100, migration 113) AutoREST: /a/:alias/autorest/<object>/ for the tables and views SQL Workshop →
+                           RESTful Services published (meta.rest_object): caller() of rest.ts, SET ROLE to the app role, owner/BYPASSRLS
+                           check, columns from the catalog (column grants), filters/q/order/paging, POST/PUT/DELETE by primary key, OpenAPI
     rest-sources.ts        REST data sources in apps: regions and LOVs as SQL over "rest", the invoke_api process (items; the call is websources.ts invoke()),
                            write-back of forms (fetch, form_dml) and grids (grid_dml) through the source's operations
     tree.ts                tree region
@@ -215,12 +227,28 @@ src/
                            (sprint 86) GET /builder/apps/:app/pages/:no, /builder/pages/:id redirects browsers there (designerUrl in ui.ts)
     errors.ts              (sprint 86) the builder's HTML 404 and 500 pages for browsers (wantsHtml, a not-found handler and an onSend hook)
     arrange.ts             page designer layout changes: move, column span, create from the gallery, undo / redo
-    sql.ts                 SQL Workshop: the home and SQL commands (templates and drafts to review)
+    sql.ts                 SQL Workshop: the home and the session's schema
+    launchpad.ts           (sprint 96) the SQL Workshop home's Launchpad (pins in meta.builder_pin, 109; tool groups), POST /builder/pins,
+                           GET /builder/palette (the builder's search: JSON for Ctrl+K, a results page without JavaScript)
+    sql-charts.ts          (sprint 97) charts of a query: chartSpec(), drawChart() (runtime/charts.ts, a PageCss in a nonce'd <style>), the
+                           worksheet's Chart tab, SQL Workshop → Charts (meta.sql_chart, 110; read-only runs)
+    sql-tools.ts           (sprint 96) SQL_TOOLS: every SQL Workshop tool with its group, tab and description (home, More menu, search)
+    worksheet.ts           (sprint 91) the SQL Worksheet (Database Actions' SQL; /sql/commands too): navigator (pickSchema, objects with
+                           columns, objectStatements), toolbar, output tabs, history (meta.sql_history, 108), plan trees, Run as an app's role, (sprint 93) Save / Rename / Download as SQL Scripts, bind and substitution values, POST /sql/worksheet/format; GET /sql/worksheet/navigator
     object-browser.ts      (sprint 75) the Object Browser: objects by type, system objects hidden, a table in tabs, column actions as SQL to review
+    table-editor.ts        (sprint 95) Table Properties: GET/POST /sql/objects/table (create, edit ?o=, ?template=), fromForm(), Preview / Apply
+                           (one transaction) / Open in the worksheet
+    object-actions.ts      (sprint 94) an object's ⋯ menu (objectMenu) in the worksheet and the Object Browser: Quick DDL (objectDdl), Drop with
+                           dependents, Add index / trigger / policy as drafts; GET /sql/objects/action, /sql/objects/panel (Open in a panel)
+    data-modeler.ts        (sprint 98) SQL Workshop → Data Modeler: /sql/modeler (diagrams, meta.sql_diagram, 111), /:id (SVG), /:id/objects, /layout,
+                           /rename, /delete, /svg (export), /ddl (diagramDdl), /dictionary (data dictionary, ?download=1)
     scripts.ts             SQL Workshop → SQL Scripts: editor, upload/download, run, results per statement, run history
     quicksql.ts            SQL Workshop → Quick SQL page (preview, save as script, run)
     querybuilder.ts        SQL Workshop → Query Builder: catalog, joins by foreign key or drawn, functions/group by, buildQuery() from the URL; the canvas is in builder.js
     users.ts               user directory and identity providers
+    db-users.ts            (sprint 99, DA-13) Administration → Database Users (/builder/db-users, administrators only): PostgreSQL
+                           roles with highlights, create/edit (review the masked SQL, then Apply in one transaction), drop with
+                           reassigning; pgkiln's own roles read-only, roles of applications and workspaces not dropped
     api.ts                 per-app REST API page (API role, tokens)
     globalization.ts       translations, XLIFF/CSV, text messages
     dataload.ts            SQL Workshop → Load Data (with definitions, save a mapping as one); data load definition spec (Shared Components)
@@ -248,6 +276,9 @@ src/
     form-designer.ts       page designer: Form Designer settings (designers' scheme; sources: key, actions, offered columns, labels, lists of values)
     workingcopies.ts       Working copies: list and create, compare with differences, merge or refresh with conflict choices, delete
     rest.ts                REST module endpoints list and curl example (Shared Components)
+    autorest.ts            (sprint 100) SQL Workshop → RESTful Services (/builder/sql/rest): publish a table or view through an
+                           application of the workspace (checks: schema the workshop may use, app role not the owner), its page
+                           (grants per method, RLS, security_invoker, endpoints, cURL/fetch, OpenAPI link), settings, disable
     workflows.ts           workflow versions, diagram and instances (Shared Components)
     process-jobs.ts        page designer: the Jobs tab of a background chain process
     template-spec.ts       template component property form (Shared Components)
@@ -279,6 +310,10 @@ public/
   app.css                  theme (light/dark, responsive; --font, --font-size, --radius for style variants; template option classes to-*)
   app.js                   client runtime: dialogs (dialog_closed actions), popup LOVs, dynamic actions (focus, classes, messages), grids (add/duplicate rows, master-detail refresh, move/resize columns, copy/paste of cell ranges), menus, lazy regions, maps (Leaflet layers, marker clusters, heat layer, layer legend, area/distance filter) (no inline JS)
   code-editor.js, .css     builder code editor: enhances <textarea data-code>, highlighting, suggestions (no dependencies)
+  palette.js               (sprint 96) the builder's search dialog (Ctrl+K), recently visited SQL Workshop pages, the Launchpad's tabs
+  data-modeler.js, .css    (sprint 98) the Data Modeler: drag boxes, undo/redo, save, zoom/fit, auto layout, mini-map, SVG/PNG export, print
+  worksheet.js, .css       (sprint 91) the SQL Worksheet: run keys with the cursor, output tabs, navigator swap and search, drag and drop, splitters;
+                           (92) grid sort, value dialog, history filter; (93) worksheet tabs in localStorage, Files, binds dialog, format, find, case
   builder.css              builder only: IDE look (dark chrome, icon rail, panes), builder light/dark tokens
   builder.js               builder only: tabs, component tree, property filter, drag and drop on the layout
   builder-icons.svg        builder only: icons of the rail, toolbar and designer (b-*)
@@ -298,6 +333,13 @@ test/
   unload.test.ts           Unload Data: CSV/JSON/XLSX/XML output, read back with Load Data, read-only and one-statement checks, streaming
   app-from-file.test.ts    Create → From a file: proposed names and types, app + table + rows + pages, row errors, login, validation
   workshop.test.ts         SQL scripts, Quick SQL pages, query builder, data load definitions (Load Data, the process, export)
+  sql-charts.test.ts       (sprint 97) the worksheet's Chart tab, saving a chart, the Charts dashboard, a chart's page, read-only runs
+  launchpad.test.ts        (sprint 96) Launchpad groups, pins (builder pages only, at most 24), the search (JSON and page)
+  tabledef.test.ts         (sprint 95) table definitions round trip: CREATE, read, ALTER, read again; mistakes
+  table-editor.test.ts     (sprint 95) the Table Properties page: preview, apply, a failing apply rolls back, template, worksheet
+  object-actions.test.ts   (sprint 94) object menus: Quick DDL, Drop with dependents, Add index / trigger / policy, the panel, not-found
+  data-modeler.test.ts     (sprint 98) Data Modeler: "hr core" with its FK lines, saved positions, SVG, objects, DDL, dictionary, geometry
+  worksheet.test.ts        (sprint 91) the SQL Worksheet: statement at the cursor, Run Script log, plans, notices, history, navigator, Run as
   quicksql.test.ts         Quick SQL parser and DDL generator
   xml.test.ts              XML reader: rows, attributes, paths, refused DTDs and entities, limits
   printing.test.ts         report PDFs
@@ -343,6 +385,8 @@ test/
   helpers.ts               a cookie-keeping test browser
   e2e/responsive.test.ts   browser tests at phone/tablet/desktop widths (Playwright)
   e2e/code-editor.test.ts  the code editor in a browser: highlighting, keys, suggestions, touch, screen readers
+  e2e/data-modeler.test.ts (sprint 98) the Data Modeler in a browser: drag, save, reload, undo/redo, zoom, mini-map, exports, phone
+  e2e/worksheet.test.ts    (sprint 91) the SQL Worksheet in a browser: run keys, tabs, navigator, drag and drop, splitters, phone, no JavaScript
   e2e/items.test.ts        sprint 26 item types in a browser: editors, tags, stars, dates, reveal; without JavaScript
   e2e/designer.test.ts     page designer: panes per width, drag and drop, keyboard, Arrange buttons, builder theme
   e2e/calendar.test.ts     calendar drag and drop and create on click, view switching, chart drill-down

package/docs/guide/13-rest-api.md

@@ -1,17 +1,17 @@
 # 13. REST APIs
 
-pgkiln offers two ways to expose data securely over REST (mobile apps, integrations, scripts),
+pgkiln offers three ways to expose data securely over REST (mobile apps, integrations, scripts),
 which can be combined:
 
-| | [REST modules](#rest-modules-in-the-builder) | [PostgREST](#how-it-works) |
-|---|---|---|
-| What | Endpoints you define in the builder: a method, a path and the SQL | A separate service that turns a schema of views and functions into an API |
-| Served by | pgkiln itself, under `/a/<alias>/rest/<module>/` | PostgREST, next to pgkiln |
-| Runs as | the application's database role (like its pages) | a dedicated API role |
-| Good for | a handful of tailored endpoints, field apps, integrations | broad data access with filtering, sorting and embedding |
+| | [REST modules](#rest-modules-in-the-builder) | [AutoREST](#autorest-tables-and-views-from-the-sql-workshop) | [PostgREST](#how-it-works) |
+|---|---|---|---|
+| What | Endpoints you define in the builder: a method, a path and the SQL | A table or view published as it is: rows, one row, insert, update, delete | A separate service that turns a schema of views and functions into an API |
+| Served by | pgkiln itself, under `/a/<alias>/rest/<module>/` | pgkiln itself, under `/a/<alias>/autorest/<object>/` | PostgREST, next to pgkiln |
+| Runs as | the application's database role (like its pages) | the application's database role | a dedicated API role |
+| Good for | a handful of tailored endpoints, field apps, integrations | quick CRUD access to a table, prototypes, simple integrations | broad data access with filtering, sorting and embedding |
 
-Both use the same tokens (App → REST API: tokens and OAuth clients), the same accounts and the
-same row level security, and both publish an OpenAPI description.
+All three use the same tokens (App → REST API: tokens and OAuth clients), the same accounts and the
+same row level security, and all publish an OpenAPI description.
 
 ## REST modules in the builder
 
@@ -63,6 +63,71 @@ curl -X POST http://127.0.0.1:3100/a/hr/rest/v1/leave -H "Authorization: Bearer
      -H "Content-Type: application/json" -d '{"start_date": "2027-05-03", "end_date": "2027-05-04", "reason": "dentist"}'
 ```
 
+## AutoREST: tables and views from the SQL Workshop
+
+**SQL Workshop → RESTful Services** (`/builder/sql/rest`; Database Actions: a table's *REST › Enable*, ORDS
+AutoREST), or **REST › Enable / Disable** in a table's or view's ⋯ menu (SQL Worksheet navigator, Object Browser).
+Choose:
+
+| Setting | Meaning |
+|---|---|
+| Table or view | Any table, partitioned table, view, materialized view or foreign table of a schema the SQL Workshop may use (not `meta`) |
+| Application | An application of the current workspace with a database role. It decides how requests run (below) and gives the URL |
+| URL name | The segment in `/a/<alias>/autorest/<name>/`: lower case letters, digits, `_` and `-`; the object's name by default |
+| Methods | `GET` (rows and one row), `POST` (insert), `PUT` (update), `DELETE`. `PUT` and `DELETE` need a primary key; a materialized view answers `GET` only |
+| Who may call it | **A bearer token of the application** (the default), or **public**: anyone, without a token. Public is never implied: it is a choice on the form |
+| Roles | Optional application roles; the caller needs one of them (`meta.has_role()`), else 403 |
+| Page size | Rows per page without `?limit=` (1–500, default 25) |
+
+The object's page shows the checks (the role is not the owner and doesn't bypass row level security; its grants per
+method; row level security on or off; for a view whether it is `security_invoker`; the primary key; columns the role
+may not read), the endpoints with their URLs, cURL and `fetch` examples, and the OpenAPI link. Its settings can be
+changed, the object disabled (404) or removed (*Disable REST*). The table itself is never changed.
+
+**Endpoints** (`/a/hr/autorest/dept/` for `hr.dept` published through `hr`):
+
+| Request | Answer |
+|---|---|
+| `GET …/dept/` | `{"items": […], "offset": 0, "limit": 25, "has_more": true}`. `?limit=` (1–500) and `?offset=` page; `?<column>=<value>` keeps rows whose column equals the value (several are combined with AND); `?q=<text>` keeps rows where a text column contains the text (case-insensitive; `%` and `_` are literal); `?order=dname,deptno.desc` sorts (default: the primary key). An unknown parameter or column is a 400 |
+| `GET …/dept/10` | The row as an object, or 404. A composite key is comma separated: `…/pair/1,x` (URL-encode a comma inside a value) |
+| `POST …/dept/` | A JSON object of column values → 201 with the new row and a `Location` header. Columns left out get their defaults; an unknown column is a 400 |
+| `PUT …/dept/10` | A JSON object of the columns to change → 200 with the row, or 404 (also when row level security hides it). Columns left out keep their values |
+| `DELETE …/dept/10` | 204, or 404 |
+| `GET /a/hr/autorest/openapi.json` | OpenAPI 3 of the application's published objects: without a token the public ones, with a valid token all of them; column types as JSON Schema |
+
+A method that isn't enabled answers 405 with an `Allow` header. Errors are JSON `{"error": "…"}`, as for REST modules:
+400 for invalid input, a check or unique constraint, or a `raise exception`; 403 for a missing role or grant
+(including column grants and a row level security `with check`).
+
+**How a request runs.** As for [REST modules](#rest-modules-in-the-builder): the token is checked (signature, expiry,
+the application, an active account with access or a client that isn't revoked) at every request; a browser session is
+not accepted. The statement then runs in a transaction **as the application's database role**, with
+`meta.app_user()` = the caller (`nobody` for a public object without a token), `meta.has_role()` reading the caller's
+roles, and a 30-second statement timeout. So the role's grants, column grants and the table's row level security
+apply exactly as on the application's pages. Columns the role may not select are left out of every answer and can't
+be filtered or sorted on. AutoREST refuses, when the object is enabled and again at every request (after `SET ROLE`),
+a role that owns the object or is a member of its owner (row level security doesn't apply to the owner), a superuser
+and a role with `BYPASSRLS`. An application without a database role can't publish objects. Names come from the
+catalog and are quoted; filter values, keys and bodies are query parameters, never SQL text.
+
+The workspace preference *Enable RESTful services* turns AutoREST off with the REST modules (404), and the
+application's availability applies too.
+
+```bash
+TOKEN=…   # App → REST API → Issue a token for king
+curl "http://127.0.0.1:3100/a/hr/autorest/dept/?limit=2" -H "Authorization: Bearer $TOKEN"
+# {"items":[{"deptno":10,"dname":"ACCOUNTING",…},{"deptno":20,…}],"offset":0,"limit":2,"has_more":true}
+curl "http://127.0.0.1:3100/a/hr/autorest/dept/?limit=2"            # 401: no token
+```
+
+**Views.** A view without `security_invoker = true` runs with its owner's rights, so the row level security of the
+tables beneath it does not apply to the caller; the page warns about it. Views have no primary key: they publish the
+collection (`GET`, and `POST` when PostgreSQL can insert into the view).
+
+**Export.** The published objects are installation data, like OAuth clients: they name objects of this database and
+are not part of an application export; an in-place import (`pgkiln import --replace`) keeps them. Tailored endpoints
+that travel with the application are [REST modules](#rest-modules-in-the-builder).
+
 ## PostgREST
 
 [PostgREST](https://postgrest.org) runs as a separate service **next to** pgkiln and turns

package/docs/guide/16-files.md

@@ -265,7 +265,7 @@ parsing, type inference and limits.)
 3. The result shows the rows inserted, updated and skipped, with a link to the table in the
    Object Browser.
 
-Load Data runs as the builder's owner connection, like SQL Commands.
+Load Data runs as the builder's owner connection, like the SQL Worksheet.
 
 ### SQL Workshop → Unload Data
 
@@ -352,7 +352,7 @@ Rows to develop and test with (APEX 26.1's Data Generator / "sample data for dev
    Definitions are shared by the developers of the installation, like SQL scripts, and not part of
    an application export (they describe tables, not an application).
 
-Sample Data runs as the builder's owner connection (like SQL Commands: triggers run, row level
+Sample Data runs as the builder's owner connection (like the SQL Worksheet: triggers run, row level
 security doesn't apply to the owner), on a connection of its own that is closed afterwards, with a
 statement timeout (`SAMPLE_DATA_STATEMENT_TIMEOUT`, default `5min`) and at most
 `SAMPLE_DATA_MAX_ROWS` rows per run (default 100,000). Table and column names come from the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/builder.css

@@ -1032,3 +1032,25 @@ details.prop-group-more[open] > summary { margin-bottom: 8px; }
 
 /* (sprint 90, PD-4) a commented-out component in the tree (APEX: Comment Out): struck through and muted */
 .pd-node[data-commented] .pd-label { text-decoration: line-through; color: var(--muted); }
+
+/* (sprint 99, DA-13) Administration → Database Users */
+.dbu-stats { grid-template-columns: repeat(auto-fill, minmax(150px, 1fr)); gap: 0.6rem; }
+.dbu-stats a.stat { color: inherit; text-decoration: none; }
+.dbu-stats a.stat:hover, .dbu-stats a.stat:focus-visible { border-color: var(--accent); }
+.dbu-stats a.stat[aria-current="page"] { border-color: var(--accent); background: var(--accent-soft); }
+.dbu-search { display: flex; flex-wrap: wrap; gap: 0.4rem; align-items: center; }
+.dbu-search input { flex: 1 1 12rem; max-width: 24rem; }
+.dbu-members { max-height: 16rem; overflow: auto; }
+.dbu-schemas .te-c { text-align: center; width: 1%; white-space: nowrap; }
+.dbu-sql { white-space: pre-wrap; overflow-wrap: anywhere; }
+.dbu-list td { white-space: normal; overflow: visible; max-width: 24rem; }
+.dbu-list td .tag { margin: 0.1rem 0; }
+.dbu-facts { display: grid; grid-template-columns: max-content 1fr; gap: 0.35rem 1rem; margin: 0; }
+.dbu-facts dt { color: var(--muted); }
+.dbu-facts dd { margin: 0; min-width: 0; }
+@media (max-width: 640px) {
+  .dbu-facts { grid-template-columns: 1fr; } .dbu-facts dd { margin-bottom: 0.4rem; }
+  .dbu-stats { grid-template-columns: repeat(2, minmax(0, 1fr)); } .dbu-stats a.stat { padding: 0.5rem 0.7rem; } .dbu-stats .stat b { font-size: 1.15rem; }
+}
+/* (sprint 100) RESTful Services: examples wrap instead of scrolling sideways */
+pre.wrap-pre { white-space: pre-wrap; overflow-wrap: anywhere; }

package/public/data-modeler.css

@@ -0,0 +1,56 @@
+/* pgkiln builder: the SQL Workshop's Data Modeler (sprint 98, src/builder/data-modeler.ts, public/data-modeler.js).
+   The diagram is an SVG with presentation attributes (light colours: an exported file); here the builder's theme
+   overrides them. The canvas scrolls inside the page, so a wide diagram never widens the page. */
+.dm-head { display: flex; flex-wrap: wrap; align-items: baseline; gap: 4px 12px; margin-bottom: 8px; }
+.dm-name { margin: 0; font-size: 1.25rem; overflow-wrap: anywhere; }
+.dm-toolbar { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; margin-bottom: 8px; }
+.dm-toolbar form { display: contents; }
+.dm-toolbar .btn[disabled] { opacity: 0.5; }
+.dm-status { min-width: 0; }
+.dm-stage { position: relative; }
+.dm-canvas { overflow: auto; max-width: 100%; height: 65vh; min-height: 18rem; border: 1px solid var(--border); border-radius: var(--radius); background: var(--bg); }
+.dm-canvas:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.dm-svg { display: block; }
+.dm-svg .dm-bg { fill: var(--bg); }
+.dm-svg .dm-frame { fill: var(--surface); stroke: var(--border); }
+.dm-svg .dm-view .dm-frame { fill: var(--surface-2); }
+.dm-svg .dm-head { fill: var(--accent-soft); stroke: var(--border); }
+.dm-svg .dm-title { fill: var(--text); }
+.dm-svg .dm-col { fill: var(--text); }
+.dm-svg .dm-type, .dm-svg .dm-kind, .dm-svg .dm-more { fill: var(--muted); }
+.dm-svg .dm-key { fill: var(--gold, #b45309); }
+.dm-svg .dm-line, .dm-svg .dm-end { stroke: var(--muted); }
+.dm-svg .dm-opt { fill: var(--bg); stroke: var(--muted); }
+.dm-svg .dm-fk:hover .dm-line, .dm-svg .dm-fk:hover .dm-end { stroke: var(--accent); stroke-width: 2.5; }
+.dm-svg .dm-link:hover .dm-title, .dm-svg .dm-link:focus .dm-title { fill: var(--accent); text-decoration: underline; }
+.dm-live .dm-box { cursor: grab; touch-action: none; }
+.dm-live .dm-box.dm-dragging { cursor: grabbing; }
+.dm-svg .dm-box:focus { outline: none; }
+.dm-svg .dm-box:focus-visible .dm-frame { stroke: var(--accent); stroke-width: 2.5; }
+.dm-svg .dm-dragging .dm-frame { stroke: var(--accent); }
+.dm-svg text { user-select: none; }
+.dm-minimap { position: absolute; right: 12px; bottom: 12px; width: 200px; height: 140px; border: 1px solid var(--border); border-radius: var(--radius);
+  background: var(--surface); box-shadow: 0 2px 8px rgba(0, 0, 0, 0.2); cursor: pointer; touch-action: none; }
+.dm-minimap-bg { fill: var(--surface); }
+.dm-minimap-view { fill: var(--accent); fill-opacity: 0.15; stroke: var(--accent); stroke-width: 4; vector-effect: non-scaling-stroke; }
+.dm-legend { margin: 6px 0 12px; }
+.dm-search-row { display: flex; gap: 6px; flex-wrap: wrap; }
+.dm-search-row input { flex: 1 1 12rem; min-width: 0; }
+.dm-settings { margin-bottom: 16px; }
+.dm-settings > summary { cursor: pointer; margin-bottom: 8px; }
+.dm-settings form { margin-bottom: 8px; }
+.dm-dict-actions { margin-bottom: 12px; }
+.dm-dict-toc { columns: 3 14rem; }
+.dm-dict-table { margin-top: 1.5rem; }
+.dm-dict-table h2 { border-bottom: 1px solid var(--border); padding-bottom: 4px; overflow-wrap: anywhere; }
+@media (max-width: 640px) {
+  .dm-btn-label { position: absolute; width: 1px; height: 1px; overflow: hidden; clip-path: inset(50%); }
+  .dm-canvas { height: 55vh; }
+  .dm-minimap { width: 130px; height: 90px; }
+}
+@media print {
+  .sw-tabs, .dm-toolbar, .dm-legend, #dm-objects, #dm-add, .dm-settings, .dm-minimap, .dm-dict-actions, .ide-alerts { display: none !important; }
+  .dm-canvas { height: auto; overflow: visible; border: 0; }
+  .dm-svg { max-width: 100%; height: auto; }
+  .dm-dict-table { break-inside: avoid-page; }
+}