pgkiln 0.48.0 → 0.49.0

package/SECURITY.md

@@ -29,7 +29,7 @@ first version (MVP). Every finding below has a regression test in
 | Passwords | Password policy (length, letters and digits, no username), expiry and change on first use enforced before a session exists; changing a password needs the current one and ends other sessions. |
 | Approvals | Task tables are closed to application roles; `meta.tasks` and the `meta.*_task` functions check, for every call, who may see, claim, decide, delegate or cancel (one rights function for both). Initiators can't decide their own requests unless the definition allows it. The completion SQL runs as the application's role in the same transaction, so RLS applies and an error undoes the decision. |
 | Workflows | Steps run as the application's role (grants and RLS apply), variables are binds (escaped literals), the instance tables are closed to application roles; only initiators and administrators see a workflow, terminate it, and only administrators retry. |
-| REST modules | Bearer tokens only (HS256 with `API_JWT_SECRET`, the app claim must match; no cookies, so no CSRF), the account (active, access) or OAuth client (not revoked) checked on every request, handler roles via `meta.has_role()`, SQL as the application's role (RLS) with every value a bind; `:APP_USER`, `:APP_ID` and the other built-in binds come from the server, never from the request. |
+| REST modules | Bearer tokens only (HS256 with `API_JWT_SECRET`, the app claim must match; no cookies, so no CSRF), the account (active, access) or OAuth client (not revoked) checked on every request, handler roles via `meta.has_role()`, SQL as the application's role (RLS) with every value a bind; `:APP_USER`, `:APP_ID` and the other built-in binds come from the server, never from the request. Handlers (SQL, PL/pgSQL and media) refuse with 403 to run as a superuser, a role with BYPASSRLS or a member of pgkiln's owner, so a missing `db_role` on the owner connection can't turn an endpoint into owner access; the Advisor reports this as an error. PL/pgSQL handlers get request values as transaction-local settings (`meta.rest_param`), never as SQL text, inside a dollar-quote tag the body may not contain. |
 | Progressive Web Apps | Off by default, per app. Kept pages (opt-in) are removed at every sign-in and sign-out; forms kept offline are sent only for the user who filled them in, with a fresh CSRF token, and processed at most once (submission ids); the record a form was opened for is signed with the form. `Permissions-Policy` allows camera and geolocation for the application itself only (`camera=(self), microphone=(), geolocation=(self)`). |
 | Outgoing web requests (REST data sources) | Off until `PGKILN_REST_ALLOWED_HOSTS` lists hosts. Only http/https without user:password; the resolved address is checked at connect time and is the one connected to (no DNS rebinding); private, loopback, link-local (cloud metadata), CGNAT, multicast and documentation ranges are refused, also as IPv4-mapped, NAT64 and 6to4 addresses, unless the host is in `PGKILN_REST_PRIVATE_HOSTS`; at most 3 redirects, each re-checked, credential headers dropped when a redirect leaves the origin; time and size limits (also after decompression). Parameter values are URL-encoded after a fixed host (`.`/`..` refused), header values are one line, and `Authorization`, `Cookie`, `Host` and transport headers can't be set on a source. Response values reach SQL as one escaped literal through `jsonb_to_recordset` with checked column names, as the app's role. |
 | Web credential secrets | Encrypted with AES-256-GCM using `PGKILN_SECRET_KEY`, which lives outside the database (a dump alone reveals nothing); write-only in the builder, never exported, logged or shown in errors; the runtime role's column grant leaves out `secret_enc`. Changing the key means entering the secrets again. |
@@ -212,7 +212,7 @@ A second full review, mainly of what end users and API callers can reach. Regres
 2. `alter role pgkiln_runtime password '...'` and set `RUNTIME_DATABASE_URL`.
 3. Run behind HTTPS with `COOKIE_SECURE=true`, and set `TRUST_PROXY=true` behind one reverse proxy (a number for several, or their addresses; client IPs are needed for throttling).
 4. Keep `debug` off for production apps (see the Settings → Security checklist in the builder).
-5. Give each app its own `db_role` with the minimum grants; add RLS where rows are per user or per team.
+5. Give each app its own `db_role` with the minimum grants; add RLS where rows are per user or per team. REST modules and AutoREST refuse to run without one on a privileged connection (403); run the Advisor after upgrading.
 6. Restrict network access to `/builder` (reverse proxy or firewall) if developers are a small group.
 7. With a REST API: set a long random `API_JWT_SECRET` (the same in PostgREST), change the `pgkiln_authenticator` password, configure `db-pre-request = meta.api_check`, expose only the `api` schema, and run PostgREST behind HTTPS.
 8. With REST data sources: list only the hosts you need in `PGKILN_REST_ALLOWED_HOSTS` (avoid `*`), set a long random `PGKILN_SECRET_KEY` (32+ characters) kept outside the database and its backups, and use `PGKILN_REST_PRIVATE_HOSTS` only for internal services you mean to reach.

package/db/migrations/116_dump_jobs.sql

@@ -0,0 +1,41 @@
+-- ---------------------------------------------------------------------
+-- 116: Schema Export / Import jobs (sprint 103, Database Actions DA-16:
+-- Data Pump). Administration › Schema Export / Import runs pg_dump for a
+-- schema and pg_restore into a new or existing schema as background jobs
+-- (src/datapump.ts). A job's file lives in the dump directory
+-- (PGKILN_DUMP_DIR) until it expires (PGKILN_DUMP_KEEP_DAYS); the row
+-- keeps the job's options, size, timing and log.
+--
+-- The builder reads and writes it as the owner, for administrators only;
+-- nobody else has grants. Installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.dump_job (
+  id             bigint generated always as identity primary key,
+  kind           text not null check (kind in ('export', 'import')),
+  -- uploaded: a file waiting for its import options
+  status         text not null check (status in ('uploaded', 'running', 'succeeded', 'failed', 'cancelled')),
+  username       text not null,
+  -- export: the schema dumped; import: the schema in the dump
+  schema_name    text check (length(schema_name) between 1 and 63),
+  -- import: the schema the objects went to
+  target_schema  text check (length(target_schema) between 1 and 63),
+  options        jsonb not null default '{}',
+  -- the file in the dump directory (a plain name, no path); null once removed
+  file_name      text check (file_name ~ '^[A-Za-z0-9_.-]{1,120}$'),
+  -- an upload's own file name, as shown
+  original_name  text check (length(original_name) <= 255),
+  -- an import of an export's file
+  source_job     bigint references meta.dump_job on delete set null,
+  bytes          bigint,
+  log            text not null default '',
+  error          text,
+  created_at     timestamptz not null default now(),
+  started_at     timestamptz,
+  finished_at    timestamptz,
+  -- a running job's server writes it every few seconds; a job without it for minutes was interrupted
+  heartbeat_at   timestamptz,
+  expires_at     timestamptz
+);
+create index dump_job_created on meta.dump_job (created_at desc);
+revoke all on meta.dump_job from public;
+comment on table meta.dump_job is 'Schema Export / Import jobs (116): pg_dump and pg_restore runs with their options, files, sizes and logs; installation data, not exported';

package/db/migrations/117_rest_handlers.sql

@@ -0,0 +1,63 @@
+-- ---------------------------------------------------------------------
+-- 117: RESTful Services modules, templates and handlers (sprint 104,
+-- Database Actions DA-11 part 2; ORDS: REST › Modules). SQL Workshop ›
+-- RESTful Services edits an application's REST modules (024) as ORDS does:
+-- a module (its base path), its templates (URIs with :parameters) and their
+-- handlers (method and source type: collection query, single row, SQL,
+-- PL/pgSQL, media).
+--
+-- The handlers stay in meta.rest_module.handlers (jsonb), so modules travel
+-- with the application's export as before (export_app takes the whole row:
+-- the new columns go along without redefining it). New here:
+--
+--   roles      the module's privilege: a caller needs one of these
+--              application roles (meta.has_role) for every handler of the
+--              module, on top of a handler's own roles
+--   templates  [{"uri": "emp/:id", "description": "…"}]: a template can
+--              exist before its first handler, and its description goes
+--              into the OpenAPI document
+--
+-- PL/pgSQL handlers run their block as an anonymous DO block as the
+-- application's database role. A DO block takes no parameters, so the
+-- request's binds are set as transaction-local settings (query parameters:
+-- never part of the SQL text) and :NAME in the block reads them through
+-- meta.rest_param('NAME'); meta.rest_reply(body, status) sets the response.
+-- ---------------------------------------------------------------------
+alter table meta.rest_module
+  add column roles text[] not null default '{}',
+  add column templates jsonb not null default '[]' check (jsonb_typeof(templates) = 'array');
+
+-- an export from before 117 has no "roles" or "templates": jsonb_populate_record gives NULL, the default applies
+create function meta.rest_module_defaults() returns trigger
+language plpgsql set search_path = pg_catalog as $$
+begin
+  new.roles := coalesce(new.roles, '{}');
+  new.templates := coalesce(new.templates, '[]');
+  return new;
+end $$;
+create trigger rest_module_defaults before insert or update on meta.rest_module
+  for each row execute function meta.rest_module_defaults();
+
+-- A bind of the REST request a PL/pgSQL handler runs for (NULL when the request has none).
+create function meta.rest_param(p_name text) returns text
+language sql stable set search_path = pg_catalog as $$
+  select nullif(current_setting('pgkiln_bind.' || lower(p_name), true), '')
+$$;
+comment on function meta.rest_param(text) is 'REST handlers (117): a bind of the request (path, query or body parameter; BODY is the JSON body); :NAME in a PL/pgSQL handler reads it';
+
+-- The response of a PL/pgSQL REST handler: a JSON body and an optional HTTP status (200-599).
+create function meta.rest_reply(p_body jsonb, p_status int default null) returns void
+language plpgsql set search_path = pg_catalog as $$
+begin
+  if p_status is not null and (p_status < 200 or p_status > 599) then
+    raise exception 'meta.rest_reply: the status is 200 to 599, not %', p_status;
+  end if;
+  perform set_config('pgkiln_rest.body', coalesce(p_body::text, ''), true);
+  perform set_config('pgkiln_rest.status', coalesce(p_status::text, ''), true);
+end $$;
+comment on function meta.rest_reply(jsonb, int) is 'REST handlers (117): the JSON response of a PL/pgSQL handler and its status';
+
+grant execute on function meta.rest_param(text), meta.rest_reply(jsonb, int) to public;
+
+comment on column meta.rest_module.roles is 'The module''s privilege (117): the caller needs one of these application roles for every handler';
+comment on column meta.rest_module.templates is 'Templates (117): [{"uri": "emp/:id", "description": "…"}]; handlers name their template in "path"';

package/db/migrations/118_change_log.sql

@@ -0,0 +1,54 @@
+-- ---------------------------------------------------------------------
+-- 118: the change log (sprint 106, Database Actions DA-17; Liquibase /
+-- Flyway). The DDL a developer runs from the SQL Worksheet, Table
+-- Properties and Schema Comparison is recorded as a change set: who, when,
+-- the SQL, the schema it changes, where it came from, and a number per
+-- workspace and schema (seq) that stays when other change sets are deleted,
+-- so exported Flyway versions (V0001__add_bonus.sql) never change
+-- (meta.change_set_counter).
+-- SQL Workshop › Change Log lists them per schema and writes them as
+-- migration files; exported_at says when a change set was last written.
+--
+-- The builder reads and writes it as the owner; nobody else has grants.
+-- Installation data like the worksheet's history: not exported with an
+-- application (the schema's DDL is not part of an application).
+-- ---------------------------------------------------------------------
+create table meta.change_set (
+  id            bigint generated always as identity primary key,
+  workspace_id  int  not null default 1 references meta.workspace on delete cascade,
+  schema_name   text not null check (length(schema_name) between 1 and 63),
+  seq           int  not null,
+  -- the description in file names: V0001__<name>.sql
+  name          text not null check (name ~ '^[a-z0-9][a-z0-9_]{0,59}$'),
+  author        text not null,
+  source        text not null check (source in ('worksheet', 'table', 'compare')),
+  sql           text not null check (length(sql) between 1 and 1000000),
+  object_name   text check (length(object_name) <= 63),
+  created_at    timestamptz not null default now(),
+  exported_at   timestamptz,
+  unique (workspace_id, schema_name, seq)
+);
+create index change_set_schema_idx on meta.change_set (workspace_id, schema_name, seq);
+revoke all on meta.change_set from public;
+comment on table meta.change_set is 'The change log (118): DDL run from the SQL Workshop as change sets per workspace and schema; installation data, not exported';
+
+-- the last number given per workspace and schema: a deleted change set's number is never given again
+create table meta.change_set_counter (
+  workspace_id  int  not null references meta.workspace on delete cascade,
+  schema_name   text not null,
+  last_seq      int  not null,
+  primary key (workspace_id, schema_name)
+);
+revoke all on meta.change_set_counter from public;
+comment on table meta.change_set_counter is 'The change log (118): the last change set number per workspace and schema; installation data';
+
+create function meta.change_set_seq() returns trigger
+language plpgsql set search_path = pg_catalog as $$
+begin
+  insert into meta.change_set_counter as c (workspace_id, schema_name, last_seq) values (new.workspace_id, new.schema_name, 1)
+    on conflict (workspace_id, schema_name) do update set last_seq = c.last_seq + 1
+    returning last_seq into new.seq;
+  return new;
+end $$;
+create trigger change_set_seq before insert on meta.change_set
+  for each row execute function meta.change_set_seq();

package/docs/apex-feature-parity.md

@@ -7,7 +7,7 @@ open item and open an issue or pull request; see [CONTRIBUTING.md](../CONTRIBUTI
 Legend: ✅ available · 🟡 partial (see notes) · ❌ not yet · ➖ not planned (a deliberate choice,
 or better served by the PostgreSQL ecosystem; see the notes and [extensions](guide/15-extensions.md))
 
-Last reviewed: 2026-10-16 (sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
+Last reviewed: 2026-10-16 (sprint 106: the change log of DDL change sets with Flyway, Liquibase and SQL downloads; sprint 104: RESTful Services modules, templates and handlers with PL/pgSQL and media handlers, privileges, OpenAPI and Try it; sprint 103: Schema Export / Import with pg_dump and pg_restore; sprint 102: the SQL Monitor with live sessions, Top SQL and a statement's plan; sprint 101: Scheduling of pg_cron jobs with a schedule builder, run now and run history; sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
 
 ## At a glance
 
@@ -184,7 +184,7 @@ two, REST source catalogs and the workspace export, with their features.)
 
 | APEX | pgkiln | Notes |
 |---|---|---|
-| SQL Workshop: SQL commands, object browser | ✅ | (sprint 61) A **home page** like APEX's: tiles, recently created tables, your recent SQL commands and the workspace's recent scripts, and the session's **default schema** (first in the search path of the SQL Worksheet and Scripts). (sprint 91) **SQL Commands is the SQL Worksheet** like Database Actions' SQL: a navigator, the statement at the cursor or a script with a log per statement, Explain Plan and Autotrace, notices and history (see the Database Actions section below). (sprint 75) The **Object Browser** like APEX's: a schema in the header, a tree by object type (tables, views, materialized views, indexes, sequences, types, functions, procedures, triggers) with a filter and a Create menu, system and extension objects hidden unless asked, and a table in tabs (columns with Add/Rename/Drop column writing the ALTER TABLE to review, data in pages, indexes, constraints, triggers, grants, row level security, dependencies, statistics, DDL); the tools as main tabs and a More menu. (sprint 62) **Utilities** like APEX's: the tools on one page, **Object Reports** (tables without a primary key, unindexed foreign keys, row-level security without policies or not enabled, PUBLIC grants, unused indexes, largest tables, missing comments), **About Database** and a **Database Monitor** of sessions and blocked queries for administrators. **Missing:** a recycle bin (PostgreSQL has none), user interface defaults (pgkiln's wizards read the catalog and comments) |
+| SQL Workshop: SQL commands, object browser | ✅ | (sprint 61) A **home page** like APEX's: tiles, recently created tables, your recent SQL commands and the workspace's recent scripts, and the session's **default schema** (first in the search path of the SQL Worksheet and Scripts). (sprint 91) **SQL Commands is the SQL Worksheet** like Database Actions' SQL: a navigator, the statement at the cursor or a script with a log per statement, Explain Plan and Autotrace, notices and history (see the Database Actions section below). (sprint 75) The **Object Browser** like APEX's: a schema in the header, a tree by object type (tables, views, materialized views, indexes, sequences, types, functions, procedures, triggers) with a filter and a Create menu, system and extension objects hidden unless asked, and a table in tabs (columns with Add/Rename/Drop column writing the ALTER TABLE to review, data in pages, indexes, constraints, triggers, grants, row level security, dependencies, statistics, DDL); the tools as main tabs and a More menu. (sprint 62) **Utilities** like APEX's: the tools on one page, **Object Reports** (tables without a primary key, unindexed foreign keys, row-level security without policies or not enabled, PUBLIC grants, unused indexes, largest tables, missing comments), **About Database** and (sprint 102) the **SQL Monitor** of sessions, blocked queries and Top SQL for administrators. **Missing:** a recycle bin (PostgreSQL has none), user interface defaults (pgkiln's wizards read the catalog and comments) |
 | RESTful services (ORDS) | ✅ | [PostgREST](https://postgrest.org) next to pgkiln: `api` schema, the same RLS as the UI, per-app API role, tokens in the builder, a pre-request check, and **OAuth clients** (client credentials, like ORDS `oauth.create_client`) so tokens renew themselves |
 | REST handler editor, REST-enabled SQL | ✅ | **REST modules** in the builder: handlers (method, path with parameters, SQL as collection, item or statements, roles, public) served by pgkiln with bearer tokens and an OpenAPI description; plus PostgREST for schema-wide APIs. **Missing:** REST-enabled SQL (rarely desirable) |
 | SQL scripts, query builder, Quick SQL | ✅ | **SQL Scripts**: saved, upload/download, a result per statement, stop or continue on errors, optionally one transaction, run history. **Quick SQL** (a subset: tables, child tables, types, the main column directives, `/auditcols`, settings, views). A graphical **query builder**: tables as boxes on a canvas (dragged, placed where left), joins along foreign keys or drawn from column to column (inner or left), column functions with automatic `group by`, conditions, sort, open in SQL Commands; without JavaScript the same as forms ([chapter 3](guide/03-builder.md#sql-workshop)) |
@@ -352,11 +352,11 @@ AI and row level security badges.
 | Object context menu, table properties dialog, Quick DDL | An object's menu (sprint 94): Open in a panel, Quick DDL to the worksheet or a file, Load data, Add index / trigger / policy, Drop with its dependents; **Table Properties** (sprint 95): columns, keys, foreign keys, checks, indexes, comment, RLS, partitioning, DDL preview, Apply in one transaction, use as template | ✅ |
 | Format, Convert Case, Find and replace, bind variables | Format (Ctrl+F7), Convert case, find and replace, Go to line, comment lines, `:NAME` and `&NAME.` asked for before a run (sprint 93); no guided tour | ✅ |
 | Data Modeler (relational diagrams) | SQL Workshop → Data Modeler (sprint 98): diagrams per schema, boxes with columns and keys, foreign key lines with crow's feet, positions saved, zoom, fit, auto layout, mini-map, SVG / PNG export, DDL of the shown objects, a data dictionary | ✅ |
-| REST (modules, AutoREST) | SQL Workshop → RESTful Services (sprint 100): a table or view published through an application with GET (paging, filters, search, order), item GET, POST, PUT, DELETE as the app role with its tokens and RLS, OpenAPI; custom modules, templates and handlers are application REST modules (Shared Components), not yet managed from the SQL Workshop | 🟡 |
-| Scheduling | pgkiln's own jobs and automations | ❌ |
+| REST (modules, AutoREST) | SQL Workshop → RESTful Services (sprint 100): a table or view published through an application with GET (paging, filters, search, order), item GET, POST, PUT, DELETE as the app role with its tokens and RLS, OpenAPI. (sprint 104) *Modules*: module (base path) › templates (URIs with `:parameters`) › handlers (GET/POST/PUT/PATCH/DELETE; collection query, single row, SQL, PL/pgSQL with `meta.rest_reply`, media), module privilege and handler roles mapped to application roles, documented parameters, OpenAPI per module, a Try it panel; modules export with the application. **Missing:** ORDS's own OAuth client and role administration per module (pgkiln uses the application's OAuth clients and roles), header and OUT parameters, ETags | ✅ |
+| Scheduling | SQL Workshop → Scheduling (sprint 101): pg_cron's jobs with the schedule in words and next runs, create / edit with a cron builder and the next five runs, SQL reviewed then applied in one transaction, disable, run now (pgkiln runs the command as the job's role; not in pg_cron's history), unschedule, run history with filters and purge; without pg_cron an install note and pgkiln's own automations and process jobs. No chains (pg_cron has none) | ✅ |
 | Database Users | Administration → Database users (sprint 99): roles with sign-in, attributes, expiry, memberships and owned objects; create and edit with the SQL reviewed (password masked, a SCRAM verifier) and applied in one transaction; drop with reassign or drop owned; pgkiln's roles protected. PostgreSQL has no created date or quota | ✅ |
-| Real Time SQL Monitor | Database Monitor (sessions) and Top SQL per application role | 🟡 |
+| Real Time SQL Monitor | SQL Workshop → SQL Monitor (sprint 102): live sessions (state, wait event, blockers, running time) refreshed every 5 / 15 / 60 s with Pause, Cancel / Terminate with confirmation, wait events, progress of VACUUM / ANALYZE / CREATE INDEX / CLUSTER / COPY; Top SQL from `pg_stat_statements` with bars, sort by any column, reset; a statement's totals per role, Explain Plan (EXPLAIN only, generic plan for parameters) and Open in worksheet; administrators only. No historical (past) monitoring beyond the statistics | ✅ |
 | Launchpad, Search Database (Ctrl+K) | The SQL Workshop home as a Launchpad (sprint 96): pinned and recently visited, Development / Administration / Monitoring tabs; Search (Ctrl+K) for tools, applications, pages and database objects; no guided walk-through | ✅ |
-| Data Pump | Application backups and Unload Data | 🟡 |
-| Liquibase | Schema Comparison | 🟡 |
+| Data Pump | Schema Export / Import (sprint 103): `pg_dump` of a schema (custom or plain format, definitions and / or data, include / exclude tables) and `pg_restore` of a one-schema archive into a new or existing schema (create schema as: renamed in one transaction), background jobs with status, size, duration and log, files kept N days; plus application backups and Unload Data. Plain dumps can't be imported here; one schema per job | ✅ |
+| Liquibase | Schema Comparison; (sprint 106) SQL Workshop → **Change Log**: DDL run from the SQL Worksheet, Table Properties and Schema Comparison (*Apply and record*) is recorded as change sets per schema (author, time, SQL, source, a stable number), downloaded as Flyway files (`V0001__add_bonus.sql`), a Liquibase formatted SQL changelog or a plain script, and marked against the latest export of an application. **Missing:** rollback blocks, preconditions and contexts; DDL run outside the SQL Workshop (psql, migrations) is not recorded | ✅ |
 | JavaScript (MLE) | ➖ Not planned: PostgreSQL has plv8 as an extension | ➖ |

package/docs/guide/01-installation.md

@@ -158,6 +158,10 @@ which is read at startup; real environment variables take precedence.
 | `DB_ACQUIRE_TIMEOUT_MS` | `30000` | How long a request waits for a free connection before it fails with an error |
 | `DB_IDLE_IN_TRANSACTION_MS` | `300000` | The database ends a transaction left idle this long (milliseconds), so a hung request frees its connection |
 | `MAX_UPLOAD_MB` | `10` | Largest file a file item accepts (an item's `max_mb` can only lower it) |
+| `PGKILN_PG_BIN` | (searched) | (sprint 103) The directory of pg_dump and pg_restore for Schema Export / Import (the server's major version or newer) |
+| `PGKILN_DUMP_DIR` | `<temp>/pgkiln-dumps` | Where Schema Export / Import keeps its files (the Docker image: `/app/dumps`, a volume) |
+| `PGKILN_DUMP_KEEP_DAYS` | `7` | Days an export or upload is kept |
+| `PGKILN_DUMP_MAX_MB` | `2048` | Largest dump an administrator uploads |
 | `DATA_LOAD_MAX_MB` | `50` | Largest file for SQL Workshop → Load Data and Create → From a file |
 | `DATA_LOAD_MAX_ROWS` | `100000` | Most rows loaded from one file |
 | `PDF_MAX_ROWS` | `5000` | Most rows in a report PDF (1 to 100,000; read with a cursor in batches) |

package/docs/guide/03-builder.md

@@ -102,7 +102,41 @@ Links), added on the workspace's page by administrators and the workspace's admi
 `https://` URL, an optional description and an order. While the workspace is current an **Extensions** icon in the
 rail opens them, each in a new tab (`rel="noopener noreferrer"`).
 
-### Export and import
+#### Scheduling with pg_cron
+
+(sprint 101; Database Actions: Scheduling) **SQL Workshop → Scheduling** (administrators only) manages the jobs of
+[pg_cron](https://github.com/citusdata/pg_cron), the PostgreSQL extension that runs SQL on a schedule inside the
+database server. pgkiln needs pg_cron 1.4 or later, created in pgkiln's database; the page says what is missing when
+it isn't (the package, `shared_preload_libraries = 'pg_cron'`, `cron.database_name`, `create extension pg_cron`).
+Without pg_cron it lists **pgkiln's own scheduled work** read-only: every application's automations (Shared Components
+→ Automations, [chapter 6](06-processing.md)) with their schedule, next and last run, and the latest background process
+jobs. With pg_cron that list is behind a toggle under the jobs.
+
+- **Jobs** (`cron.job`): name, the command, the schedule with its meaning in words (*At 02:00, every day*), the **next
+  run**, the last run's status and time (and how many of the last ten failed), database and the role it runs as;
+  a search field. Times are in pg_cron's time zone (`cron.timezone`, GMT unless set). pg_cron shows each role only its
+  own jobs: when pgkiln's owner connection is neither a superuser nor `BYPASSRLS`, the page says so.
+- **Create job** / **Edit**: name (unique per role), database, *Run as* (a role that can sign in; only a superuser
+  schedules for another role), *Active*, the command (SQL, run outside a transaction block as pg_cron runs it, so
+  `vacuum` works) and the **schedule**: five cron fields, `n seconds` (1 to 59) or `@hourly` … `@yearly`, `@reboot`.
+  A **schedule builder** (one field each for minute, hour, day of month, month and day of week, `$` for the last day
+  of the month) and **common schedules** fill it in; the **preview** shows it in words with the **next five runs**,
+  as you type (without JavaScript: the *Use* and *Preview* buttons). pgkiln explains schedules as pg_cron reads them:
+  lists, ranges, steps, month and day names, 7 for Sunday, and a day matching either the day of month or the day of
+  week when both are restricted.
+- **Review SQL** shows the statements (`cron.schedule_in_database`, `cron.alter_job` with only what changed, an
+  `update cron.job` for a new name; the command dollar-quoted); **Apply** runs them in one transaction and only if they
+  are still what was reviewed. **Disable / Enable** (`cron.alter_job(…, active := …)`) applies at once and shows the
+  statement; **Unschedule…** (`cron.unschedule`) after a review. Every change goes to the activity log (event `cron_job`).
+- **Run now**: pg_cron has no run-now, so pgkiln runs the job's stored command once itself: a new connection to the
+  job's database with the owner connection's login, `SET ROLE` to the job's role (the owner must be allowed to), no
+  transaction block around it, a 10-minute statement timeout. The page shows the result, the duration and notices.
+  The run is not in pg_cron's history; the activity log has it (event `cron_run_now`).
+- **Run history** (`cron.job_run_details`, newest first, 200 at most): status, start, duration and message, filtered
+  by job, status or a text in the message or command. **Purge…** deletes runs older than 7, 30 or 90 days, or all
+  (of every job or one), after showing the `delete` and how many runs it removes: pg_cron keeps every run until then.
+
+## Export and import
 
 Workspace utilities → **Export and import** (`/builder/workspace-export`; APEX: Workspace Utilities → Export), for
 administrators and the workspace's administrators: the current workspace's components as one JSON file (format
@@ -199,6 +233,13 @@ Every builder page has the same frame, modelled on an IDE:
 
 On phones the rail gets narrower and the breadcrumb shows only the current page.
 
+The builder's look comes from design tokens at the top of `public/builder.css` (sprint 105): CSS custom properties
+for colours (a warm neutral palette with the kiln's ember for primary buttons, links, focus rings and selections),
+surfaces and their shadows, corner radii, the type scale and transitions, in a light and a dark set. The rail, the
+toolbar and the status bar stay dark in both themes. Transitions are switched off when the operating system asks
+for reduced motion. The builder uses the system's fonts (Inter when it is installed); it loads nothing from
+other sites.
+
 (sprint 86) An address under `/builder` that leads nowhere (a deleted application or page, a typo, an
 application of a workspace you are not a member of) shows a **Page not found** page in the builder's
 theme with a link to the App Builder home; a server error shows **Something went wrong** (the error
@@ -1454,7 +1495,8 @@ the SQL Workshop's connection may use. Without JavaScript the header's field ope
   replaces views and functions, drops and creates constraints, indexes, triggers, policies and
   grants that differ, and lists for review what it doesn't change: drops of what only the target
   has (commented out), columns whose identity or generation differs, and types, domains and
-  sequences that differ. The same from the command line (`pgkiln ddl`, `pgkiln compare`,
+  sequences that differ. (sprint 106) *Apply and record* runs the script on the target in one transaction and records
+  it in the Change Log (below). The same from the command line (`pgkiln ddl`, `pgkiln compare`,
   [chapter 18](18-cli.md)) and for AI agents (`generate_ddl`, `compare_schemas`).
 - **RESTful Services** (`/builder/sql/rest`, sprint 100; Database Actions: REST › AutoREST): publish a table or
   view as REST endpoints. Choose the object (of a schema the SQL Workshop may use), the **application** it is
@@ -1465,6 +1507,25 @@ the SQL Workshop's connection may use. Without JavaScript the header's field ope
   accounts' roles. The object's page checks the role's grants per method, row level security and (for a view)
   `security_invoker`, lists the endpoints with their URLs, and shows cURL and `fetch` examples and the OpenAPI link.
   Details in [chapter 13](13-rest-api.md#autorest-tables-and-views-from-the-sql-workshop).
+  (sprint 104; Database Actions: REST › Modules) The **Modules** tab edits the REST modules of the workspace's
+  applications as a tree: a module (its base path and its privilege: roles every handler needs), its templates (URIs
+  with `:parameters`) and their handlers (method, source type: collection query, single row, SQL, PL/pgSQL or media,
+  who may call it, roles, documented parameters). Each handler has a **Try it** panel: the request goes to the real
+  endpoint without a token or as an account of the application, and the response is shown in the page. Details in
+  [chapter 13](13-rest-api.md#modules-templates-and-handlers-in-the-sql-workshop).
+- **Change Log** (`/builder/sql/changes`, sprint 106; Database Actions: Liquibase): DDL that succeeds in the **SQL
+  Worksheet**, **Table Properties** (*Apply*) and **Schema Comparison** (*Apply and record*: the change script run on
+  the target in one transaction) is recorded as a *change set*: the schema it changes, its SQL, who ran it, when,
+  where from and a number per schema that is never given again (deleting a change set keeps the others' numbers).
+  Statements without a schema-qualified name count for the worksheet's schema. Only schema DDL is kept (CREATE,
+  ALTER, DROP, COMMENT, GRANT and REVOKE on objects): no queries or data changes, and nothing about roles, databases
+  or servers, so passwords never end up in the log. The page lists a schema's change sets with their SQL; rename one
+  (its file name) or delete it from the log (the database is not changed). It marks which change sets were made
+  before the latest **Export** of an application of the workspace (*in it*) and which after (*still to ship*).
+  *Download migration* writes all of them, those not yet written to a file, or those after the latest export, as
+  **Flyway** versioned migrations (`V0001__add_bonus.sql`; several in a zip), a **Liquibase** formatted SQL changelog
+  (`--liquibase formatted sql`, `--changeset author:0001-add_bonus`) or one plain SQL script; each change set also
+  has its own Flyway file. Change sets belong to the workspace and are not part of an application export.
 - **Utilities** (`/builder/sql/utilities`; APEX: SQL Workshop → Utilities): tiles for Load and Unload Data, Sample
   Data, the Query Builder, DDL and Compare, and three pages of their own. Each runs in a read-only transaction with a
   15-second statement timeout, on the SQL Workshop's connection (an isolated workspace's developers see only the
@@ -1475,14 +1536,51 @@ the SQL Workshop's connection may use. Without JavaScript the header's field ope
     to the Object Browser. pgkiln's own `meta` schema and the system's are left out.
   - **About Database**: the PostgreSQL version, database size, uptime, a few settings (encoding, time zone,
     connections, memory, row security), the installed extensions and the schemas with their size.
-  - **Database Monitor** (administrators only): the client sessions of this database from `pg_stat_activity`, active
-    first, with their state, wait event, running time, the sessions that block them and the query (as far as the
-    owner may read other roles' statistics). Read only: it cancels nothing.
+  - **SQL Monitor** (administrators only): see [SQL Monitor](#sql-monitor) below (it replaced the Database Monitor;
+    the old address `/builder/sql/utilities/monitor` redirects).
   - **Database Users** (administrators only; Administration menu → *Database users*, `/builder/db-users`; sprint 99,
     Database Actions: Database Users): see [Database users](#database-users).
+  - **Schema Export / Import** (administrators only; `/builder/sql/data-pump`; sprint 103, Database Actions: Data
+    Pump): see [Schema export and import](#schema-export-and-import).
+  - **Scheduling** (administrators only; `/builder/sql/scheduling`, on the Launchpad under *Administration*, the
+    Utilities page and the search; sprint 101, Database Actions: Scheduling): [pg_cron](#scheduling-with-pg_cron) jobs.
 
 Because the SQL Workshop runs as the owner, restrict who gets a developer account.
 
+### SQL Monitor
+
+(sprint 102; Database Actions: Real Time SQL Monitor and Performance Hub) **SQL Workshop → SQL Monitor**
+(`/builder/sql/monitor`, administrators only; on the Launchpad under *Monitoring*, in the Utilities and in the search,
+Ctrl+K) shows what the database is doing, from PostgreSQL's statistics views:
+
+- **Sessions**: tiles with the sessions (of `max_connections`), the active ones, those idle in a transaction, the
+  blocked ones and the longest running statement; then the client sessions of this database (`pg_stat_activity`;
+  idle sessions on request, *Show idle sessions*) with user, application and client address, state (idle in a
+  transaction with its time), wait event, running time, the sessions that **block** it (the row is highlighted) and
+  the query. A query with a `query_id` links to its statement page. **Cancel** (`pg_cancel_backend`: stop the running
+  statement) and **Terminate** (`pg_terminate_backend`: roll back and disconnect) ask for a confirmation first; only
+  client sessions of this database can be signalled, and the owner role needs the right to (a superuser, the
+  session's own role, or `pg_signal_backend` for non-superusers' sessions).
+- **Wait events**: what the active sessions of the server wait for now, counted per type and event (*CPU: running*
+  when they don't wait).
+- **In progress** (only when something runs): VACUUM, ANALYZE, CREATE INDEX, CLUSTER and COPY from the
+  `pg_stat_progress_*` views, with the phase and a progress bar.
+- The tiles and tables **refresh in place** every 5, 15 or 60 seconds, with a **Pause** button; the choice is
+  remembered in the browser. Without JavaScript, *Refresh* reloads the page.
+- **Top SQL**: the statements of this database from `pg_stat_statements`, every role: calls, total and mean time
+  (with bars), rows, shared blocks hit and read; sort by any column (click the heading again to reverse), search the
+  text, **Reset statistics** (the whole server, after a confirmation). Literals show as `$1`, `$2`….
+- **A statement**: its text, its totals (calls, total and mean time, rows, blocks, temporary blocks) and a row per
+  role with standard deviation, minimum and maximum; **Explain** shows its plan as a tree like the worksheet's. It is
+  `EXPLAIN` only, never `EXPLAIN ANALYZE` (the statement is someone else's): a text with parameters gets a generic
+  plan (`EXPLAIN (GENERIC_PLAN)`, PostgreSQL 16 or later), in a read-only transaction that is rolled back, with
+  a 5-second timeout and one statement only. Choose the schema its unqualified names live in. **Open in worksheet**
+  puts the text in the SQL Worksheet.
+
+Top SQL needs the `pg_stat_statements` extension, which the server must load (`shared_preload_libraries`); pgkiln
+creates the extension when it can (migration 016). Without it the page says how to turn it on. The per-application
+**Top SQL** on an application's Activity page shows the same statistics for its database role only.
+
 ### Database users
 
 (sprint 99; Database Actions: Database Users) **Administration → Database users** (administrators only; also on the
@@ -1518,6 +1616,82 @@ schema, REST API role) or an isolated workspace can be changed but not dropped.
 `pgkiln`. The owner connection needs `CREATEROLE` (and, on PostgreSQL 16 and later, ADMIN on roles it didn't create)
 for these changes; PostgreSQL's own error says so otherwise.
 
+### Schema export and import
+
+(sprint 103; Database Actions: Data Pump) **SQL Workshop → Schema Export / Import** (administrators only; on the
+Launchpad under *Administration* and on the Utilities page) dumps a schema to a file with **pg_dump** and loads a
+file into a schema with **pg_restore**, as background jobs. The list shows every job: export or import, the schema,
+its status (*running*, *succeeded*, *failed*, *cancelled*, or *uploaded* for a file waiting for its options), the
+file's size, when it started, how long it took and who ran it. A job's page has its options, pg_dump's or the
+import's **log**, and **Download**, **Import…**, **Cancel** (while it runs) and **Delete** (the job and its file).
+
+**Export a schema**: pick a schema (not pgkiln's own `meta`, PostgreSQL's or an extension's), then
+
+- the **format**: *custom* (compressed, `pg_dump -Fc`; what Import reads) or *plain SQL* (for `psql`; not imported
+  here; owners are left out);
+- the **content**: definitions and data, definitions only (`--schema-only`) or data only (`--data-only`), with or
+  without **grants**;
+- the **tables, views and sequences**: the whole schema, only the checked ones (`--table`: the file then has no
+  CREATE SCHEMA and no functions or types), or all but the checked ones (`--exclude-table`).
+
+pg_dump runs with an argument list (no shell) on the owner connection (`DATABASE_URL`); the password goes in
+`PGPASSWORD`, never on the command line. The file is kept in the dump directory for `PGKILN_DUMP_KEEP_DAYS` days
+(default 7); then the scheduler removes it and the job stays in the list.
+
+**Import**: upload a custom or tar archive of **one schema** (`pg_dump -Fc -n <schema>`, up to `PGKILN_DUMP_MAX_MB`,
+default 2048 MB; the file is streamed to the dump directory), or pick a kept export. The next page shows what the
+archive holds (`pg_restore --list`): the schema, the tables, the object types and how many of each, the server and
+pg_dump versions. Then choose
+
+- the **schema** to import into: the dump's own name or another one, **new or existing**. Another name renames the
+  dump's schema in the same transaction (*create schema as*);
+- the **content** (definitions and data, definitions only, data only: data goes into the tables that are there, in
+  foreign key order, parents first);
+- **Drop the dump's objects in the schema first** (`pg_restore --clean --if-exists`, to replace what an earlier import
+  made) and **Grants**.
+
+pg_restore writes the script (`pg_restore -f -`, without a connection of its own) and pgkiln runs it on one
+connection in **one transaction**, so an error rolls everything back:
+
+```sql
+begin;
+alter schema hr rename to pgkiln_dump_42;   -- importing hr as hr_copy while hr exists: the original steps aside
+alter schema hr_copy rename to hr;          -- only when hr_copy exists: the dump's names now mean it
+-- the dump's statements and COPY data (CREATE SCHEMA left out when the schema exists)
+alter schema hr rename to hr_copy;
+alter schema pgkiln_dump_42 rename to hr;
+commit;
+```
+
+Other sessions keep seeing the original schema until the commit. Views, column defaults, triggers, policies and
+SQL-standard function bodies refer to objects, so they follow the rename; **names inside PL/pgSQL bodies** and other
+text (dynamic SQL, a function's `SET search_path`) still say the dump's schema after a rename. Objects are owned by
+pgkiln's owner role (`--no-owner`); security labels, tablespaces, publications and subscriptions are left out.
+
+Every statement is checked before it runs: the settings pg_dump writes, CREATE / ALTER / COMMENT / GRANT / DROP of
+objects **in the dump's schema**, `COPY … FROM stdin` into its tables and `setval` of its sequences. Anything else is
+refused and rolls the import back: objects in other schemas (`meta` among them), roles and role memberships, `SET
+ROLE`, `OWNER TO`, `SET SCHEMA`, `DO`, `COPY` from or to files and programs, extensions, and psql meta-commands (other
+than pg_dump's `\restrict`). An archive with several schemas, extensions or large objects is refused at the preview.
+A dump is still code: its functions and triggers run as pgkiln's owner role. **Import only dumps you trust.**
+
+**The client programs.** pg_dump can't dump a server newer than itself, so pgkiln looks for pg_dump and pg_restore of
+the server's major version or newer, the newest it finds: `PGKILN_PG_BIN` (a directory), else
+`/usr/lib/postgresql/<n>/bin` (Debian, Ubuntu), `/usr/pgsql-<n>/bin` (RHEL), Homebrew's `postgresql@<n>`, else `PATH`.
+Without them the page says what to install (`postgresql-client-17` for a PostgreSQL 17 server). The Docker image
+includes PostgreSQL 17's client programs and keeps the files in `/app/dumps` (a volume in `deploy/compose.yaml`).
+
+| Variable | Default | |
+|---|---|---|
+| `PGKILN_PG_BIN` | (searched) | the directory of pg_dump and pg_restore |
+| `PGKILN_DUMP_DIR` | `<temp>/pgkiln-dumps` | where the files are kept; one server's directory: with several pgkiln servers, a job's file is on the server that ran it |
+| `PGKILN_DUMP_KEEP_DAYS` | 7 | days a file is kept |
+| `PGKILN_DUMP_MAX_MB` | 2048 | the largest upload |
+
+A job runs in the server that started it: when that server stops, the scheduler marks its running jobs *failed
+(interrupted)* within two minutes. Exports, uploads, imports and downloads go to the activity log (`schema_export`,
+`schema_upload`, `schema_import`, `schema_download`).
+
 ## Export and import
 
 **Export** downloads the application as JSON: pages, all components, shared components and

package/docs/guide/08-security.md

@@ -516,6 +516,17 @@ Workshop → RESTful Services**, AutoREST) run as the app role too, never as the
 and the row level security below decide what an API caller may read and change. AutoREST refuses a role that owns
 the published object or bypasses row level security, and an object answers only to a bearer token of its application
 unless the developer chose *public* for it ([chapter 13](13-rest-api.md#autorest-tables-and-views-from-the-sql-workshop)).
+(sprint 104) REST module handlers refuse to run as a superuser, a role that bypasses row level security or a member
+of pgkiln's owner (403). Their parameters are bound: SQL handlers get escaped literals, PL/pgSQL handlers read
+transaction-local settings through `meta.rest_param()`; a request can't set the server's binds (`APP_USER`, …) or
+real settings. Media handlers are served with a sandboxing Content-Security-Policy and `nosniff`. *Try it* in the
+SQL Workshop calls an endpoint as an account of the application, as a developer issuing a token could
+([chapter 13](13-rest-api.md#modules-templates-and-handlers-in-the-sql-workshop)).
+
+(sprint 106) The SQL Workshop's **Change Log** keeps the schema DDL developers run from the worksheet, Table
+Properties and Schema Comparison, per workspace (only the workspace's developers see it). Statements about roles,
+databases, servers, user mappings and subscriptions are never recorded, so passwords and connection strings stay
+out of it; it holds what the DDL says otherwise (defaults, comments, function bodies).
 
 ### Database users and their passwords