pgkiln 0.47.0 → 0.49.0

package/SECURITY.md

@@ -29,7 +29,7 @@ first version (MVP). Every finding below has a regression test in
 | Passwords | Password policy (length, letters and digits, no username), expiry and change on first use enforced before a session exists; changing a password needs the current one and ends other sessions. |
 | Approvals | Task tables are closed to application roles; `meta.tasks` and the `meta.*_task` functions check, for every call, who may see, claim, decide, delegate or cancel (one rights function for both). Initiators can't decide their own requests unless the definition allows it. The completion SQL runs as the application's role in the same transaction, so RLS applies and an error undoes the decision. |
 | Workflows | Steps run as the application's role (grants and RLS apply), variables are binds (escaped literals), the instance tables are closed to application roles; only initiators and administrators see a workflow, terminate it, and only administrators retry. |
-| REST modules | Bearer tokens only (HS256 with `API_JWT_SECRET`, the app claim must match; no cookies, so no CSRF), the account (active, access) or OAuth client (not revoked) checked on every request, handler roles via `meta.has_role()`, SQL as the application's role (RLS) with every value a bind; `:APP_USER`, `:APP_ID` and the other built-in binds come from the server, never from the request. |
+| REST modules | Bearer tokens only (HS256 with `API_JWT_SECRET`, the app claim must match; no cookies, so no CSRF), the account (active, access) or OAuth client (not revoked) checked on every request, handler roles via `meta.has_role()`, SQL as the application's role (RLS) with every value a bind; `:APP_USER`, `:APP_ID` and the other built-in binds come from the server, never from the request. Handlers (SQL, PL/pgSQL and media) refuse with 403 to run as a superuser, a role with BYPASSRLS or a member of pgkiln's owner, so a missing `db_role` on the owner connection can't turn an endpoint into owner access; the Advisor reports this as an error. PL/pgSQL handlers get request values as transaction-local settings (`meta.rest_param`), never as SQL text, inside a dollar-quote tag the body may not contain. |
 | Progressive Web Apps | Off by default, per app. Kept pages (opt-in) are removed at every sign-in and sign-out; forms kept offline are sent only for the user who filled them in, with a fresh CSRF token, and processed at most once (submission ids); the record a form was opened for is signed with the form. `Permissions-Policy` allows camera and geolocation for the application itself only (`camera=(self), microphone=(), geolocation=(self)`). |
 | Outgoing web requests (REST data sources) | Off until `PGKILN_REST_ALLOWED_HOSTS` lists hosts. Only http/https without user:password; the resolved address is checked at connect time and is the one connected to (no DNS rebinding); private, loopback, link-local (cloud metadata), CGNAT, multicast and documentation ranges are refused, also as IPv4-mapped, NAT64 and 6to4 addresses, unless the host is in `PGKILN_REST_PRIVATE_HOSTS`; at most 3 redirects, each re-checked, credential headers dropped when a redirect leaves the origin; time and size limits (also after decompression). Parameter values are URL-encoded after a fixed host (`.`/`..` refused), header values are one line, and `Authorization`, `Cookie`, `Host` and transport headers can't be set on a source. Response values reach SQL as one escaped literal through `jsonb_to_recordset` with checked column names, as the app's role. |
 | Web credential secrets | Encrypted with AES-256-GCM using `PGKILN_SECRET_KEY`, which lives outside the database (a dump alone reveals nothing); write-only in the builder, never exported, logged or shown in errors; the runtime role's column grant leaves out `secret_enc`. Changing the key means entering the secrets again. |
@@ -212,7 +212,7 @@ A second full review, mainly of what end users and API callers can reach. Regres
 2. `alter role pgkiln_runtime password '...'` and set `RUNTIME_DATABASE_URL`.
 3. Run behind HTTPS with `COOKIE_SECURE=true`, and set `TRUST_PROXY=true` behind one reverse proxy (a number for several, or their addresses; client IPs are needed for throttling).
 4. Keep `debug` off for production apps (see the Settings → Security checklist in the builder).
-5. Give each app its own `db_role` with the minimum grants; add RLS where rows are per user or per team.
+5. Give each app its own `db_role` with the minimum grants; add RLS where rows are per user or per team. REST modules and AutoREST refuse to run without one on a privileged connection (403); run the Advisor after upgrading.
 6. Restrict network access to `/builder` (reverse proxy or firewall) if developers are a small group.
 7. With a REST API: set a long random `API_JWT_SECRET` (the same in PostgREST), change the `pgkiln_authenticator` password, configure `db-pre-request = meta.api_check`, expose only the `api` schema, and run PostgREST behind HTTPS.
 8. With REST data sources: list only the hosts you need in `PGKILN_REST_ALLOWED_HOSTS` (avoid `*`), set a long random `PGKILN_SECRET_KEY` (32+ characters) kept outside the database and its backups, and use `PGKILN_REST_PRIVATE_HOSTS` only for internal services you mean to reach.

package/db/migrations/109_builder_pins.sql

@@ -0,0 +1,19 @@
+-- ---------------------------------------------------------------------
+-- 109: pins on the SQL Workshop's Launchpad (sprint 96, Database Actions
+-- DA-15: Pinned & Recently Visited). A developer pins a tool, a database
+-- object or a saved worksheet; the home page lists them first. Per
+-- developer and workspace, at most 24 (the builder refuses more). Only
+-- builder paths (/builder/…) are kept. The builder reads and writes it as
+-- the owner; installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.builder_pin (
+  id            bigint generated always as identity primary key,
+  username      text not null,
+  workspace_id  int not null default 1 references meta.workspace on delete cascade,
+  href          text not null check (href ~ '^/builder/' and length(href) <= 400),
+  label         text not null check (length(label) between 1 and 120),
+  icon          text not null default 'bookmark' check (icon ~ '^[a-z0-9-]{1,40}$'),
+  at            timestamptz not null default now(),
+  unique (username, workspace_id, href)
+);
+comment on table meta.builder_pin is 'The SQL Workshop Launchpad''s pins per developer and workspace (109); installation data, not exported';

package/db/migrations/110_sql_charts.sql

@@ -0,0 +1,23 @@
+-- ---------------------------------------------------------------------
+-- 110: SQL Workshop charts (sprint 97, Database Actions DA-6: Charts).
+-- A chart is a SELECT with how to draw it: the chart type, the label
+-- column and the value columns. The worksheet's Chart tab saves one; SQL
+-- Workshop → Charts lists them and shows the ones on the dashboard. Shared
+-- by the workspace's developers, like SQL Scripts. The builder runs the
+-- SELECT read-only with the workshop's connection when it draws a chart.
+-- Installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.sql_chart (
+  id            int generated always as identity primary key,
+  workspace_id  int not null default 1 references meta.workspace on delete cascade,
+  name          text not null check (length(name) between 1 and 120),
+  sql           text not null check (length(sql) between 1 and 20000),
+  kind          text not null default 'bar' check (kind in ('bar', 'column', 'line', 'area', 'donut', 'pie', 'scatter', 'stacked')),
+  label_col     text not null default '',
+  value_cols    text[] not null default '{}',
+  on_dashboard  boolean not null default true,
+  created_by    text,
+  updated_at    timestamptz not null default now(),
+  unique (workspace_id, name)
+);
+comment on table meta.sql_chart is 'SQL Workshop charts: a SELECT drawn as a chart (110); installation data, not exported';

package/db/migrations/111_sql_diagram.sql

@@ -0,0 +1,24 @@
+-- ---------------------------------------------------------------------
+-- 111: the SQL Workshop's Data Modeler (sprint 98, Database Actions
+-- DA-10: relational diagrams). A diagram is a named picture of some
+-- tables and views of one schema: which objects it shows and where each
+-- box stands. objects is a jsonb array of {"name", "x", "y"} (the
+-- object's name in the schema, the box's position). The objects are only
+-- names: the columns, keys and foreign keys are read from the catalog
+-- whenever the diagram is shown, so a diagram never goes stale. Per
+-- workspace, shared by its developers. The builder reads and writes it
+-- as the owner; installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.sql_diagram (
+  id            bigint generated always as identity primary key,
+  workspace_id  int not null default 1 references meta.workspace on delete cascade,
+  name          text not null check (length(name) between 1 and 120),
+  schema_name   text not null check (length(schema_name) between 1 and 63),
+  objects       jsonb not null default '[]' check (jsonb_typeof(objects) = 'array' and jsonb_array_length(objects) <= 500),
+  created_by    text not null,
+  created_at    timestamptz not null default now(),
+  updated_by    text,
+  updated_at    timestamptz not null default now(),
+  unique (workspace_id, name)
+);
+comment on table meta.sql_diagram is 'The SQL Workshop Data Modeler''s diagrams per workspace (111); installation data, not exported';

package/db/migrations/113_rest_objects.sql

@@ -0,0 +1,49 @@
+-- ---------------------------------------------------------------------
+-- 113: AutoREST (sprint 100, Database Actions DA-11 part 1; ORDS: REST ›
+-- Enable on a table or view). SQL Workshop › RESTful Services publishes a
+-- table or view through an application of the workspace:
+--
+--   /a/<alias>/autorest/<object>/            GET (paged, filters), POST
+--   /a/<alias>/autorest/<object>/<key>       GET, PUT, DELETE (tables with a primary key)
+--   /a/<alias>/autorest/openapi.json         the OpenAPI description of them all
+--
+-- The application decides how a request runs: its database role (never the
+-- object's owner, a superuser or a role that bypasses row level security,
+-- checked when the object is enabled and at every request), its tokens and
+-- OAuth clients (App › REST API), its accounts' roles (meta.has_role) and
+-- its availability. Without a bearer token an object answers 401 unless the
+-- developer chose "public" for it explicitly.
+--
+-- The builder writes the rows as the owner; the runtime reads them.
+-- Installation data like the application's OAuth clients: not exported (an
+-- in-place import keeps them); the application's own REST modules are what
+-- travels with an export.
+-- ---------------------------------------------------------------------
+create table meta.rest_object (
+  id           int generated always as identity primary key,
+  app_id       int  not null references meta.app on delete cascade,
+  schema_name  text not null check (length(schema_name) between 1 and 63),
+  object_name  text not null check (length(object_name) between 1 and 63),
+  -- the URL segment: /a/<alias>/autorest/<alias>/
+  alias        text not null check (alias ~ '^[a-z][a-z0-9_-]{0,62}$' and alias <> 'openapi.json'),
+  methods      text[] not null default '{GET}' check (methods <@ '{GET,POST,PUT,DELETE}'::text[] and cardinality(methods) > 0),
+  -- token: a bearer token of the application (default); public: no token needed, meta.app_user() = nobody
+  auth         text not null default 'token' check (auth in ('token', 'public')),
+  -- the caller needs one of these application roles (meta.has_role); empty: any caller the auth allows
+  roles        text[] not null default '{}',
+  page_size    int  not null default 25 check (page_size between 1 and 500),
+  enabled      boolean not null default true,
+  created_by   text,
+  created_at   timestamptz not null default now(),
+  updated_at   timestamptz not null default now(),
+  unique (app_id, alias),
+  unique (app_id, schema_name, object_name)
+);
+revoke all on meta.rest_object from public;
+grant select on meta.rest_object to pgkiln_runtime;
+-- isolated workspaces (090): a workspace's logins see the rows of their own applications only
+alter table meta.rest_object enable row level security;
+create policy workspace on meta.rest_object
+  using ((select meta.isolation_off()) or app_id in (select meta.visible_apps()))
+  with check ((select meta.isolation_off()) or app_id in (select meta.visible_apps()));
+comment on table meta.rest_object is 'AutoREST (113): tables and views published through an application at /a/<alias>/autorest/<alias>/; installation data, not exported';

package/db/migrations/116_dump_jobs.sql

@@ -0,0 +1,41 @@
+-- ---------------------------------------------------------------------
+-- 116: Schema Export / Import jobs (sprint 103, Database Actions DA-16:
+-- Data Pump). Administration › Schema Export / Import runs pg_dump for a
+-- schema and pg_restore into a new or existing schema as background jobs
+-- (src/datapump.ts). A job's file lives in the dump directory
+-- (PGKILN_DUMP_DIR) until it expires (PGKILN_DUMP_KEEP_DAYS); the row
+-- keeps the job's options, size, timing and log.
+--
+-- The builder reads and writes it as the owner, for administrators only;
+-- nobody else has grants. Installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.dump_job (
+  id             bigint generated always as identity primary key,
+  kind           text not null check (kind in ('export', 'import')),
+  -- uploaded: a file waiting for its import options
+  status         text not null check (status in ('uploaded', 'running', 'succeeded', 'failed', 'cancelled')),
+  username       text not null,
+  -- export: the schema dumped; import: the schema in the dump
+  schema_name    text check (length(schema_name) between 1 and 63),
+  -- import: the schema the objects went to
+  target_schema  text check (length(target_schema) between 1 and 63),
+  options        jsonb not null default '{}',
+  -- the file in the dump directory (a plain name, no path); null once removed
+  file_name      text check (file_name ~ '^[A-Za-z0-9_.-]{1,120}$'),
+  -- an upload's own file name, as shown
+  original_name  text check (length(original_name) <= 255),
+  -- an import of an export's file
+  source_job     bigint references meta.dump_job on delete set null,
+  bytes          bigint,
+  log            text not null default '',
+  error          text,
+  created_at     timestamptz not null default now(),
+  started_at     timestamptz,
+  finished_at    timestamptz,
+  -- a running job's server writes it every few seconds; a job without it for minutes was interrupted
+  heartbeat_at   timestamptz,
+  expires_at     timestamptz
+);
+create index dump_job_created on meta.dump_job (created_at desc);
+revoke all on meta.dump_job from public;
+comment on table meta.dump_job is 'Schema Export / Import jobs (116): pg_dump and pg_restore runs with their options, files, sizes and logs; installation data, not exported';

package/db/migrations/117_rest_handlers.sql

@@ -0,0 +1,63 @@
+-- ---------------------------------------------------------------------
+-- 117: RESTful Services modules, templates and handlers (sprint 104,
+-- Database Actions DA-11 part 2; ORDS: REST › Modules). SQL Workshop ›
+-- RESTful Services edits an application's REST modules (024) as ORDS does:
+-- a module (its base path), its templates (URIs with :parameters) and their
+-- handlers (method and source type: collection query, single row, SQL,
+-- PL/pgSQL, media).
+--
+-- The handlers stay in meta.rest_module.handlers (jsonb), so modules travel
+-- with the application's export as before (export_app takes the whole row:
+-- the new columns go along without redefining it). New here:
+--
+--   roles      the module's privilege: a caller needs one of these
+--              application roles (meta.has_role) for every handler of the
+--              module, on top of a handler's own roles
+--   templates  [{"uri": "emp/:id", "description": "…"}]: a template can
+--              exist before its first handler, and its description goes
+--              into the OpenAPI document
+--
+-- PL/pgSQL handlers run their block as an anonymous DO block as the
+-- application's database role. A DO block takes no parameters, so the
+-- request's binds are set as transaction-local settings (query parameters:
+-- never part of the SQL text) and :NAME in the block reads them through
+-- meta.rest_param('NAME'); meta.rest_reply(body, status) sets the response.
+-- ---------------------------------------------------------------------
+alter table meta.rest_module
+  add column roles text[] not null default '{}',
+  add column templates jsonb not null default '[]' check (jsonb_typeof(templates) = 'array');
+
+-- an export from before 117 has no "roles" or "templates": jsonb_populate_record gives NULL, the default applies
+create function meta.rest_module_defaults() returns trigger
+language plpgsql set search_path = pg_catalog as $$
+begin
+  new.roles := coalesce(new.roles, '{}');
+  new.templates := coalesce(new.templates, '[]');
+  return new;
+end $$;
+create trigger rest_module_defaults before insert or update on meta.rest_module
+  for each row execute function meta.rest_module_defaults();
+
+-- A bind of the REST request a PL/pgSQL handler runs for (NULL when the request has none).
+create function meta.rest_param(p_name text) returns text
+language sql stable set search_path = pg_catalog as $$
+  select nullif(current_setting('pgkiln_bind.' || lower(p_name), true), '')
+$$;
+comment on function meta.rest_param(text) is 'REST handlers (117): a bind of the request (path, query or body parameter; BODY is the JSON body); :NAME in a PL/pgSQL handler reads it';
+
+-- The response of a PL/pgSQL REST handler: a JSON body and an optional HTTP status (200-599).
+create function meta.rest_reply(p_body jsonb, p_status int default null) returns void
+language plpgsql set search_path = pg_catalog as $$
+begin
+  if p_status is not null and (p_status < 200 or p_status > 599) then
+    raise exception 'meta.rest_reply: the status is 200 to 599, not %', p_status;
+  end if;
+  perform set_config('pgkiln_rest.body', coalesce(p_body::text, ''), true);
+  perform set_config('pgkiln_rest.status', coalesce(p_status::text, ''), true);
+end $$;
+comment on function meta.rest_reply(jsonb, int) is 'REST handlers (117): the JSON response of a PL/pgSQL handler and its status';
+
+grant execute on function meta.rest_param(text), meta.rest_reply(jsonb, int) to public;
+
+comment on column meta.rest_module.roles is 'The module''s privilege (117): the caller needs one of these application roles for every handler';
+comment on column meta.rest_module.templates is 'Templates (117): [{"uri": "emp/:id", "description": "…"}]; handlers name their template in "path"';

package/db/migrations/118_change_log.sql

@@ -0,0 +1,54 @@
+-- ---------------------------------------------------------------------
+-- 118: the change log (sprint 106, Database Actions DA-17; Liquibase /
+-- Flyway). The DDL a developer runs from the SQL Worksheet, Table
+-- Properties and Schema Comparison is recorded as a change set: who, when,
+-- the SQL, the schema it changes, where it came from, and a number per
+-- workspace and schema (seq) that stays when other change sets are deleted,
+-- so exported Flyway versions (V0001__add_bonus.sql) never change
+-- (meta.change_set_counter).
+-- SQL Workshop › Change Log lists them per schema and writes them as
+-- migration files; exported_at says when a change set was last written.
+--
+-- The builder reads and writes it as the owner; nobody else has grants.
+-- Installation data like the worksheet's history: not exported with an
+-- application (the schema's DDL is not part of an application).
+-- ---------------------------------------------------------------------
+create table meta.change_set (
+  id            bigint generated always as identity primary key,
+  workspace_id  int  not null default 1 references meta.workspace on delete cascade,
+  schema_name   text not null check (length(schema_name) between 1 and 63),
+  seq           int  not null,
+  -- the description in file names: V0001__<name>.sql
+  name          text not null check (name ~ '^[a-z0-9][a-z0-9_]{0,59}$'),
+  author        text not null,
+  source        text not null check (source in ('worksheet', 'table', 'compare')),
+  sql           text not null check (length(sql) between 1 and 1000000),
+  object_name   text check (length(object_name) <= 63),
+  created_at    timestamptz not null default now(),
+  exported_at   timestamptz,
+  unique (workspace_id, schema_name, seq)
+);
+create index change_set_schema_idx on meta.change_set (workspace_id, schema_name, seq);
+revoke all on meta.change_set from public;
+comment on table meta.change_set is 'The change log (118): DDL run from the SQL Workshop as change sets per workspace and schema; installation data, not exported';
+
+-- the last number given per workspace and schema: a deleted change set's number is never given again
+create table meta.change_set_counter (
+  workspace_id  int  not null references meta.workspace on delete cascade,
+  schema_name   text not null,
+  last_seq      int  not null,
+  primary key (workspace_id, schema_name)
+);
+revoke all on meta.change_set_counter from public;
+comment on table meta.change_set_counter is 'The change log (118): the last change set number per workspace and schema; installation data';
+
+create function meta.change_set_seq() returns trigger
+language plpgsql set search_path = pg_catalog as $$
+begin
+  insert into meta.change_set_counter as c (workspace_id, schema_name, last_seq) values (new.workspace_id, new.schema_name, 1)
+    on conflict (workspace_id, schema_name) do update set last_seq = c.last_seq + 1
+    returning last_seq into new.seq;
+  return new;
+end $$;
+create trigger change_set_seq before insert on meta.change_set
+  for each row execute function meta.change_set_seq();

package/docs/apex-feature-parity.md

@@ -7,7 +7,7 @@ open item and open an issue or pull request; see [CONTRIBUTING.md](../CONTRIBUTI
 Legend: ✅ available · 🟡 partial (see notes) · ❌ not yet · ➖ not planned (a deliberate choice,
 or better served by the PostgreSQL ecosystem; see the notes and [extensions](guide/15-extensions.md))
 
-Last reviewed: 2026-10-16 (sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
+Last reviewed: 2026-10-16 (sprint 106: the change log of DDL change sets with Flyway, Liquibase and SQL downloads; sprint 104: RESTful Services modules, templates and handlers with PL/pgSQL and media handlers, privileges, OpenAPI and Try it; sprint 103: Schema Export / Import with pg_dump and pg_restore; sprint 102: the SQL Monitor with live sessions, Top SQL and a statement's plan; sprint 101: Scheduling of pg_cron jobs with a schedule builder, run now and run history; sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
 
 ## At a glance
 
@@ -184,7 +184,7 @@ two, REST source catalogs and the workspace export, with their features.)
 
 | APEX | pgkiln | Notes |
 |---|---|---|
-| SQL Workshop: SQL commands, object browser | ✅ | (sprint 61) A **home page** like APEX's: tiles, recently created tables, your recent SQL commands and the workspace's recent scripts, and the session's **default schema** (first in the search path of the SQL Worksheet and Scripts). (sprint 91) **SQL Commands is the SQL Worksheet** like Database Actions' SQL: a navigator, the statement at the cursor or a script with a log per statement, Explain Plan and Autotrace, notices and history (see the Database Actions section below). (sprint 75) The **Object Browser** like APEX's: a schema in the header, a tree by object type (tables, views, materialized views, indexes, sequences, types, functions, procedures, triggers) with a filter and a Create menu, system and extension objects hidden unless asked, and a table in tabs (columns with Add/Rename/Drop column writing the ALTER TABLE to review, data in pages, indexes, constraints, triggers, grants, row level security, dependencies, statistics, DDL); the tools as main tabs and a More menu. (sprint 62) **Utilities** like APEX's: the tools on one page, **Object Reports** (tables without a primary key, unindexed foreign keys, row-level security without policies or not enabled, PUBLIC grants, unused indexes, largest tables, missing comments), **About Database** and a **Database Monitor** of sessions and blocked queries for administrators. **Missing:** a recycle bin (PostgreSQL has none), user interface defaults (pgkiln's wizards read the catalog and comments) |
+| SQL Workshop: SQL commands, object browser | ✅ | (sprint 61) A **home page** like APEX's: tiles, recently created tables, your recent SQL commands and the workspace's recent scripts, and the session's **default schema** (first in the search path of the SQL Worksheet and Scripts). (sprint 91) **SQL Commands is the SQL Worksheet** like Database Actions' SQL: a navigator, the statement at the cursor or a script with a log per statement, Explain Plan and Autotrace, notices and history (see the Database Actions section below). (sprint 75) The **Object Browser** like APEX's: a schema in the header, a tree by object type (tables, views, materialized views, indexes, sequences, types, functions, procedures, triggers) with a filter and a Create menu, system and extension objects hidden unless asked, and a table in tabs (columns with Add/Rename/Drop column writing the ALTER TABLE to review, data in pages, indexes, constraints, triggers, grants, row level security, dependencies, statistics, DDL); the tools as main tabs and a More menu. (sprint 62) **Utilities** like APEX's: the tools on one page, **Object Reports** (tables without a primary key, unindexed foreign keys, row-level security without policies or not enabled, PUBLIC grants, unused indexes, largest tables, missing comments), **About Database** and (sprint 102) the **SQL Monitor** of sessions, blocked queries and Top SQL for administrators. **Missing:** a recycle bin (PostgreSQL has none), user interface defaults (pgkiln's wizards read the catalog and comments) |
 | RESTful services (ORDS) | ✅ | [PostgREST](https://postgrest.org) next to pgkiln: `api` schema, the same RLS as the UI, per-app API role, tokens in the builder, a pre-request check, and **OAuth clients** (client credentials, like ORDS `oauth.create_client`) so tokens renew themselves |
 | REST handler editor, REST-enabled SQL | ✅ | **REST modules** in the builder: handlers (method, path with parameters, SQL as collection, item or statements, roles, public) served by pgkiln with bearer tokens and an OpenAPI description; plus PostgREST for schema-wide APIs. **Missing:** REST-enabled SQL (rarely desirable) |
 | SQL scripts, query builder, Quick SQL | ✅ | **SQL Scripts**: saved, upload/download, a result per statement, stop or continue on errors, optionally one transaction, run history. **Quick SQL** (a subset: tables, child tables, types, the main column directives, `/auditcols`, settings, views). A graphical **query builder**: tables as boxes on a canvas (dragged, placed where left), joins along foreign keys or drawn from column to column (inner or left), column functions with automatic `group by`, conditions, sort, open in SQL Commands; without JavaScript the same as forms ([chapter 3](guide/03-builder.md#sql-workshop)) |
@@ -348,15 +348,15 @@ AI and row level security badges.
 | Query Result grid (paging, download, sharing) | 500 rows (All rows: 10,000) with row numbers, numbers right-aligned, sort, a value dialog, copy, Download as CSV, JSON, XML, Excel or SQL inserts (sprint 92); no sharing links | ✅ |
 | SQL History, DBMS Output | SQL History per developer with status, rows, time, search and run again; Notices with their time (sprint 92) | ✅ |
 | Worksheets saved as files, tabs | Save, Save as, Rename, Download as SQL Scripts, a Files tab, worksheet tabs that survive a reload (sprint 93) | ✅ |
-| Create Chart from a query, Charts | Charts in applications only | ❌ |
+| Create Chart from a query, Charts | The worksheet's Chart tab (Ctrl+F11) and SQL Workshop → Charts with a dashboard (sprint 97); no page made from a chart yet | ✅ |
 | Object context menu, table properties dialog, Quick DDL | An object's menu (sprint 94): Open in a panel, Quick DDL to the worksheet or a file, Load data, Add index / trigger / policy, Drop with its dependents; **Table Properties** (sprint 95): columns, keys, foreign keys, checks, indexes, comment, RLS, partitioning, DDL preview, Apply in one transaction, use as template | ✅ |
 | Format, Convert Case, Find and replace, bind variables | Format (Ctrl+F7), Convert case, find and replace, Go to line, comment lines, `:NAME` and `&NAME.` asked for before a run (sprint 93); no guided tour | ✅ |
-| Data Modeler (relational diagrams) | Query Builder joins only | ❌ |
-| REST (modules, AutoREST) | Consumes REST (catalogs, sources); the application REST API | 🟡 |
-| Scheduling | pgkiln's own jobs and automations | ❌ |
-| Database Users | Application users and developers; roles in SQL | ❌ |
-| Real Time SQL Monitor | Database Monitor (sessions) and Top SQL per application role | 🟡 |
-| Launchpad, Search Database (Ctrl+K) | The SQL Workshop home | 🟡 |
-| Data Pump | Application backups and Unload Data | 🟡 |
-| Liquibase | Schema Comparison | 🟡 |
+| Data Modeler (relational diagrams) | SQL Workshop → Data Modeler (sprint 98): diagrams per schema, boxes with columns and keys, foreign key lines with crow's feet, positions saved, zoom, fit, auto layout, mini-map, SVG / PNG export, DDL of the shown objects, a data dictionary | ✅ |
+| REST (modules, AutoREST) | SQL Workshop → RESTful Services (sprint 100): a table or view published through an application with GET (paging, filters, search, order), item GET, POST, PUT, DELETE as the app role with its tokens and RLS, OpenAPI. (sprint 104) *Modules*: module (base path) › templates (URIs with `:parameters`) › handlers (GET/POST/PUT/PATCH/DELETE; collection query, single row, SQL, PL/pgSQL with `meta.rest_reply`, media), module privilege and handler roles mapped to application roles, documented parameters, OpenAPI per module, a Try it panel; modules export with the application. **Missing:** ORDS's own OAuth client and role administration per module (pgkiln uses the application's OAuth clients and roles), header and OUT parameters, ETags | ✅ |
+| Scheduling | SQL Workshop → Scheduling (sprint 101): pg_cron's jobs with the schedule in words and next runs, create / edit with a cron builder and the next five runs, SQL reviewed then applied in one transaction, disable, run now (pgkiln runs the command as the job's role; not in pg_cron's history), unschedule, run history with filters and purge; without pg_cron an install note and pgkiln's own automations and process jobs. No chains (pg_cron has none) | ✅ |
+| Database Users | Administration → Database users (sprint 99): roles with sign-in, attributes, expiry, memberships and owned objects; create and edit with the SQL reviewed (password masked, a SCRAM verifier) and applied in one transaction; drop with reassign or drop owned; pgkiln's roles protected. PostgreSQL has no created date or quota | ✅ |
+| Real Time SQL Monitor | SQL Workshop → SQL Monitor (sprint 102): live sessions (state, wait event, blockers, running time) refreshed every 5 / 15 / 60 s with Pause, Cancel / Terminate with confirmation, wait events, progress of VACUUM / ANALYZE / CREATE INDEX / CLUSTER / COPY; Top SQL from `pg_stat_statements` with bars, sort by any column, reset; a statement's totals per role, Explain Plan (EXPLAIN only, generic plan for parameters) and Open in worksheet; administrators only. No historical (past) monitoring beyond the statistics | ✅ |
+| Launchpad, Search Database (Ctrl+K) | The SQL Workshop home as a Launchpad (sprint 96): pinned and recently visited, Development / Administration / Monitoring tabs; Search (Ctrl+K) for tools, applications, pages and database objects; no guided walk-through | ✅ |
+| Data Pump | Schema Export / Import (sprint 103): `pg_dump` of a schema (custom or plain format, definitions and / or data, include / exclude tables) and `pg_restore` of a one-schema archive into a new or existing schema (create schema as: renamed in one transaction), background jobs with status, size, duration and log, files kept N days; plus application backups and Unload Data. Plain dumps can't be imported here; one schema per job | ✅ |
+| Liquibase | Schema Comparison; (sprint 106) SQL Workshop → **Change Log**: DDL run from the SQL Worksheet, Table Properties and Schema Comparison (*Apply and record*) is recorded as change sets per schema (author, time, SQL, source, a stable number), downloaded as Flyway files (`V0001__add_bonus.sql`), a Liquibase formatted SQL changelog or a plain script, and marked against the latest export of an application. **Missing:** rollback blocks, preconditions and contexts; DDL run outside the SQL Workshop (psql, migrations) is not recorded | ✅ |
 | JavaScript (MLE) | ➖ Not planned: PostgreSQL has plv8 as an extension | ➖ |

package/docs/guide/01-installation.md

@@ -158,6 +158,10 @@ which is read at startup; real environment variables take precedence.
 | `DB_ACQUIRE_TIMEOUT_MS` | `30000` | How long a request waits for a free connection before it fails with an error |
 | `DB_IDLE_IN_TRANSACTION_MS` | `300000` | The database ends a transaction left idle this long (milliseconds), so a hung request frees its connection |
 | `MAX_UPLOAD_MB` | `10` | Largest file a file item accepts (an item's `max_mb` can only lower it) |
+| `PGKILN_PG_BIN` | (searched) | (sprint 103) The directory of pg_dump and pg_restore for Schema Export / Import (the server's major version or newer) |
+| `PGKILN_DUMP_DIR` | `<temp>/pgkiln-dumps` | Where Schema Export / Import keeps its files (the Docker image: `/app/dumps`, a volume) |
+| `PGKILN_DUMP_KEEP_DAYS` | `7` | Days an export or upload is kept |
+| `PGKILN_DUMP_MAX_MB` | `2048` | Largest dump an administrator uploads |
 | `DATA_LOAD_MAX_MB` | `50` | Largest file for SQL Workshop → Load Data and Create → From a file |
 | `DATA_LOAD_MAX_ROWS` | `100000` | Most rows loaded from one file |
 | `PDF_MAX_ROWS` | `5000` | Most rows in a report PDF (1 to 100,000; read with a cursor in batches) |