pgkiln 0.48.0 → 0.50.0

package/public/worksheet.js

@@ -13,6 +13,9 @@
 //   - (sprint 93) worksheets as tabs kept in this browser (unsaved text survives a reload), saved as SQL Scripts
 //     (Ctrl+S), the Files list; bind and substitution values in a dialog; Format (Ctrl+F7), Convert case (Ctrl+B),
 //     find and replace (Ctrl+F, Ctrl+H), go to line (Ctrl+G), comment lines (Ctrl+/), Help (F1)
+//   - (sprint 107) transaction mode per worksheet tab: Autocommit / Transaction, Commit and Rollback, a badge with the
+//     server's real state (fetched again after a reload and a tab switch, and when the idle timeout is due); leaving the
+//     page with an open transaction asks first, closing the tab or switching to Autocommit rolls it back
 // Strict CSP: no inline styles; sizes are set through the CSSOM.
 (() => {
   'use strict';
@@ -266,8 +269,8 @@
       wrap.className = 'ws-wtab';
       const b = document.createElement('button');
       b.type = 'button';
-      b.setAttribute('role', 'tab');
-      b.setAttribute('aria-selected', String(t === cur));
+      // (sprint 108) buttons in a group, the open one aria-current: a tablist may hold only tabs, not the close buttons
+      if (t === cur) b.setAttribute('aria-current', 'true');
       b.dataset.wsWtab = t.key;
       b.textContent = `${t.name}${dirty(t) ? '*' : ''}`;
       b.title = t.scriptId ? `Script “${t.name}”${dirty(t) ? ' (unsaved changes)' : ''}` : 'Not saved as a script';
@@ -288,11 +291,15 @@
     ta.value = t.text;
     ta.dispatchEvent(new Event('input', { bubbles: true }));
     drawTabs();
+    txnTabChanged();
     ta.focus();
   };
   const newTab = () => switchTo(add({ key: newKey(), name: untitled(), scriptId: null, text: '', saved: '' }));
   const closeTab = (t) => {
-    if (dirty(t) && t.text.trim() && !window.confirm(`Close “${t.name}” without saving?`)) return;
+    const txnOpen = t === cur ? txnBox.dataset.state !== 'none' : !!t.txnOpen;
+    if (txnOpen && !window.confirm(`“${t.name}” has an open transaction. Close it and roll the transaction back?`)) return;
+    if (!txnOpen && dirty(t) && t.text.trim() && !window.confirm(`Close “${t.name}” without saving?`)) return;
+    if (t.txn) txnPost(t.key, 'rollback'); // the server knows best whether one is open
     const i = book.tabs.indexOf(t);
     book.tabs.splice(i, 1);
     if (t === cur) {
@@ -340,6 +347,111 @@
   form.querySelector('.ws-nav-switch').addEventListener('click', (e) => { const b = e.target.closest('[data-ws-navtab]'); if (b) navTab(b.dataset.wsNavtab); });
   navTab(location.hash === '#ws-files' ? 'files' : 'objects');
 
+  // ------------------------------------------------------------ (sprint 107) transaction mode
+  function txnTabChanged() {
+    modeSel.value = cur.txn ? 'on' : '';
+    txnApply({ state: 'none', statements: 0, startedMs: null, note: null });
+    txnFetch();
+  }
+  const txnBox = form.querySelector('[data-ws-txn]');
+  const modeSel = txnBox.querySelector('[data-ws-txn-mode]');
+  const badge = txnBox.querySelector('[data-ws-txn-badge]');
+  const commitBtn = txnBox.querySelector('[data-ws-txn-commit]');
+  const rollbackBtn = txnBox.querySelector('[data-ws-txn-rollback]');
+  const commitNote = form.querySelector('[data-ws-commit-note]');
+  const idleSeconds = Number(txnBox.dataset.idle) || 300;
+  const idleWords = idleSeconds % 60 ? `${idleSeconds} seconds` : `${idleSeconds / 60} minute${idleSeconds === 60 ? '' : 's'}`;
+  let txnInfo = { state: txnBox.dataset.state, statements: Number(txnBox.dataset.statements) || 0, startedMs: Number(txnBox.dataset.started) || null,
+    lastMs: Number(txnBox.dataset.last) || null, note: txnBox.dataset.note || null };
+  let clockSkew = Date.now() - (Number(txnBox.dataset.now) || Date.now());
+  let txnTimer = 0;
+  const badgeText = (i) => {
+    if (i.state === 'none') return i.note || 'No open transaction';
+    const min = i.startedMs ? Math.floor((Date.now() - clockSkew - i.startedMs) / 60000) : 0;
+    return `${i.state === 'aborted' ? 'Transaction failed' : 'Transaction open'} · ${i.statements} statement${i.statements === 1 ? '' : 's'} · ${min < 1 ? 'under a minute' : `${min} min`}`;
+  };
+  const txnApply = (i) => {
+    txnInfo = i;
+    const on = modeSel.value === 'on';
+    txnBox.dataset.state = i.state;
+    badge.dataset.state = i.state;
+    badge.textContent = badgeText(i);
+    badge.hidden = !on && i.state === 'none' && !i.note;
+    commitBtn.hidden = rollbackBtn.hidden = !on && i.state === 'none';
+    commitBtn.disabled = i.state !== 'open';
+    rollbackBtn.disabled = i.state === 'none';
+    commitNote.textContent = on
+      ? `The statements stay in one transaction until Commit or Rollback; it is rolled back after ${idleWords} without a run.`
+      : 'Each statement commits on its own.';
+    cur.txn = on;
+    cur.txnOpen = i.state !== 'none';
+    persist();
+    clearTimeout(txnTimer);
+    if (i.state !== 'none') {
+      // the age once a minute; the server again when the idle timeout is due
+      const due = i.lastMs ? i.lastMs + idleSeconds * 1000 + 2000 - (Date.now() - clockSkew) : 60000;
+      txnTimer = setTimeout(() => (due <= 60000 ? txnFetch() : txnApply(txnInfo)), Math.max(1000, Math.min(due, 60000)));
+    }
+  };
+  const fromServer = (j) => {
+    clockSkew = Date.now() - j.now;
+    txnApply({ state: j.state, statements: j.statements, startedMs: j.startedMs, lastMs: j.lastMs, note: j.note });
+  };
+  async function txnFetch() {
+    const key = cur.key;
+    try {
+      const res = await fetch(`/builder/sql/worksheet/txn?tab=${encodeURIComponent(key)}`, { credentials: 'same-origin', headers: { accept: 'application/json' } });
+      if (!res.ok) throw new Error(String(res.status));
+      const j = await res.json();
+      if (key !== cur.key) return; // switched meanwhile
+      if (j.state !== 'none') modeSel.value = 'on';
+      fromServer(j);
+    } catch {
+      badge.textContent = 'Transaction state unknown';
+    }
+  }
+  async function txnPost(key, action) {
+    try {
+      const res = await fetch('/builder/sql/worksheet/txn', { method: 'POST', credentials: 'same-origin', headers: { accept: 'application/json' },
+        body: new URLSearchParams({ __csrf: form.elements.__csrf.value, tab: key, action }) });
+      const j = await res.json();
+      if (key === cur.key) {
+        fromServer(j);
+        if (j.message) announce(j.message);
+      }
+      return j;
+    } catch {
+      announce('The transaction could not be ended: reload the page.');
+      return null;
+    }
+  }
+  modeSel.addEventListener('change', async () => {
+    if (modeSel.value !== 'on' && txnInfo.state !== 'none') {
+      if (!window.confirm('Switching to Autocommit rolls back the open transaction. Roll it back?')) { modeSel.value = 'on'; return; }
+      await txnPost(cur.key, 'rollback');
+      modeSel.value = '';
+    }
+    txnApply(txnInfo);
+  });
+  // a page post (a run, Commit, Rollback) is not leaving: the transaction stays
+  let submitting = false;
+  form.addEventListener('submit', () => {
+    submitting = true;
+    setTimeout(() => { submitting = false; }, 3000); // a download doesn't leave the page
+  });
+  window.addEventListener('pageshow', () => { submitting = false; });
+  window.addEventListener('beforeunload', (e) => {
+    if (submitting || txnInfo.state === 'none') return;
+    e.preventDefault();
+    e.returnValue = ''; // the browser asks "Leave site?"; an idle transaction is rolled back after the timeout
+  });
+  if (!form.dataset.tab || form.dataset.tab !== cur.key) txnTabChanged();
+  else {
+    if (txnInfo.state !== 'none') modeSel.value = 'on';
+    else if (!form.querySelector('[data-ws-txn-mode] option[selected]')) modeSel.value = cur.txn ? 'on' : '';
+    txnApply(txnInfo);
+  }
+
   // ------------------------------------------------------------ (sprint 97) a chart's settings draw it again
   form.querySelector('.ch-controls')?.addEventListener('change', () => run('chart'));
 
@@ -513,6 +625,7 @@
   const size = (key, px) => {
     const v = key === 'nav' ? Math.max(160, Math.min(px, window.innerWidth * 0.5)) : Math.max(80, Math.min(px, window.innerHeight * 0.75));
     form.style.setProperty(key === 'nav' ? '--ws-nav' : '--ws-out', `${Math.round(v)}px`);
+    form.querySelector(`[data-ws-split="${key}"]`)?.setAttribute('aria-valuenow', String(Math.round(v)));
     store.set(key, String(Math.round(v)));
     return v;
   };
@@ -520,6 +633,9 @@
   for (const sp of form.querySelectorAll('[data-ws-split]')) {
     const key = sp.dataset.wsSplit;
     const current = () => (key === 'nav' ? form.querySelector('.ws-nav').getBoundingClientRect().width : out.getBoundingClientRect().height);
+    // (sprint 108) a focusable separator states its position (in pixels)
+    sp.setAttribute('aria-valuemin', '0');
+    if (!sp.hasAttribute('aria-valuenow')) sp.setAttribute('aria-valuenow', String(Math.round(current())));
     sp.addEventListener('pointerdown', (e) => {
       e.preventDefault();
       sp.setPointerCapture(e.pointerId);

package/src/app.ts

@@ -38,6 +38,9 @@ import { layoutRoutes } from './builder/layouts.ts';
 import { dataLoadRoutes } from './builder/dataload.ts';
 import { builderRoutes } from './builder/routes.ts';
 import { dbUserRoutes } from './builder/db-users.ts';
+import { dataPumpRoutes } from './builder/datapump.ts';
+import { schedulingRoutes } from './builder/scheduling.ts';
+import { sqlMonitorRoutes } from './builder/sql-monitor.ts';
 import { usersRoutes } from './builder/users.ts';
 import { codeEditorRoutes } from './builder/code-editor.ts';
 import { sampleDataRoutes } from './builder/sampledata.ts';
@@ -203,6 +206,9 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(sqlRoutes);
   await app.register(usersRoutes);
   await app.register(dbUserRoutes);
+  await app.register(dataPumpRoutes);
+  await app.register(schedulingRoutes);
+  await app.register(sqlMonitorRoutes); // (sprint 102) SQL Workshop › SQL Monitor
   await app.register(dataLoadRoutes);
   await app.register(layoutRoutes);
   await app.register(automationRoutes);

package/src/automations.ts

@@ -330,6 +330,12 @@ export function startScheduler() {
     } catch (e) {
       console.error('AI requests:', (e as Error).message);
     }
+    try {
+      // (116) schema export / import: interrupted jobs, files past PGKILN_DUMP_KEEP_DAYS (src/datapump.ts)
+      await (await import('./datapump.ts')).dumpTick();
+    } catch (e) {
+      console.error('schema export / import:', (e as Error).message);
+    }
     try {
       // debug messages past their retention (at most once an hour; src/debug.ts)
       await (await import('./debug.ts')).purgeDebug();

package/src/binds.ts

@@ -128,7 +128,8 @@ export function splitStatements(sql: string): string[] {
   return out.map((x) => x.replace(/^(\s*(--[^\n]*(\n|$)|\/\*[\s\S]*?\*\/))*\s*/, '').trim()).filter(Boolean);
 }
 
-function substitute(sql: string, replace: (name: string) => string): string {
+/** Replace every :NAME bind (outside strings, comments and casts) with replace(NAME). */
+export function substitute(sql: string, replace: (name: string) => string): string {
   let out = '';
   let i = 0;
   const n = sql.length;

package/src/builder/advisor.ts

@@ -1,13 +1,14 @@
 import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { applyBinds, splitStatements } from '../binds.ts';
-import { owner, type Db } from '../db.ts';
+import { owner, runtime, type Db } from '../db.ts';
 import { devDbForApp } from '../workspace-db.ts';
 import { html, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { templateProblem } from '../runtime/document.ts';
 import { invokeStepReferences, stepProblems, stepWarnings } from '../workflow.ts';
 import { handlerProblems } from '../runtime/rest.ts';
+import { plpgsqlBlock } from '../runtime/rest-handlers.ts';
 import { processProblems } from '../runtime/processes.ts';
 import { urlConfigProblem, urlTarget } from '../runtime/url-region.ts';
 import { configColumns, searchConfigProblems } from '../runtime/search.ts';
@@ -249,7 +250,15 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
       for (const h of Array.isArray(row.handlers) ? row.handlers : []) {
         if (typeof h?.source !== 'string' || !h.source.trim()) continue;
         checked++;
-        const problem = await checkSql(c, h.source, h.type === 'sql' ? 'statements' : 'select');
+        // (117) a PL/pgSQL handler is compiled as the DO block it runs as
+        let block: string | null = null;
+        if (h.type === 'plpgsql') try {
+          block = plpgsqlBlock(h.source);
+        } catch (e) {
+          findings.push({ severity: 'error', message: (e as Error).message, entry, field: `${h.method} ${h.path}` });
+          continue;
+        }
+        const problem = await checkSql(c, block ?? h.source, h.type === 'sql' || block ? 'statements' : 'select');
         if (problem) findings.push({ ...problem, entry, field: `${h.method} ${h.path}` });
       }
     }
@@ -388,6 +397,19 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
     }
   }
 
+  // ---- (117) REST modules refuse (403) to run as a superuser, a role that bypasses RLS or a member of pgkiln's
+  // owner: say so here before the endpoints fail. Without a db_role the runtime connection's own user is the role.
+  if (all.some((x) => x.kind === 'rest_module')) {
+    const role = await (app.db_role ? owner : runtime).one(
+      `select r.rolname, r.rolsuper or r.rolbypassrls or pg_has_role(r.oid, n.nspowner, 'MEMBER') as bad
+         from pg_roles r, pg_namespace n where r.rolname = coalesce($1, current_user) and n.nspname = 'meta'`,
+      [app.db_role ?? null],
+    );
+    if (!role || role.bad)
+      findings.push({ severity: 'error', entry: null, field: 'REST modules',
+        message: `The handlers would run as ${role?.rolname ?? app.db_role}, a role that bypasses row level security or owns pgkiln, so every REST module endpoint answers 403. Give the application its own database role (Settings → Security), or set RUNTIME_DATABASE_URL to the least-privilege runtime role.` });
+  }
+
   // ---- PL/pgSQL functions of the app's schemas, with plpgsql_check when installed
   const plpgsqlCheck = !!(await one(`select 1 as ok from pg_extension where extname = 'plpgsql_check'`));
   if (plpgsqlCheck && app.db_role) {

package/src/builder/autorest.ts

@@ -9,6 +9,7 @@ import { publicUrl } from '../sso.ts';
 import { SYSTEM_SCHEMAS } from './object-browser.ts';
 import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Req } from './ui.ts';
 import { splitRoles } from './users.ts';
+import { restNav } from './rest-modules.ts';
 import { currentWorkspace, usableSchemas, workshopDb } from './workspaces.ts';
 
 // (sprint 100, Database Actions DA-11 part 1) SQL Workshop › RESTful Services: AutoREST. A developer publishes a
@@ -166,8 +167,8 @@ async function listPage(s: Session, q: Record<string, unknown>, problems: string
       <div class="buttons"><button class="btn btn-hot"${usable.length ? '' : raw(' disabled')}>${icon('bolt')} Enable</button></div>
       ${usable.length ? '' : html`<p class="muted">No application of this workspace has a database role to run as.</p>`}
     </form>`;
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('rest')}
-    <p class="muted">RESTful Services: publish a table or view as REST endpoints (AutoREST). Rows come paged as JSON, with filters; a primary key gives single-row GET, PUT and DELETE. Requests run as the publishing application's database role with the caller as <code>meta.app_user()</code>, so its grants and row level security apply. For tailored endpoints with your own SQL, use an application's REST modules (Shared Components).</p>
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('rest')}${restNav('autorest')}
+    <p class="muted">RESTful Services: publish a table or view as REST endpoints (AutoREST). Rows come paged as JSON, with filters; a primary key gives single-row GET, PUT and DELETE. Requests run as the publishing application's database role with the caller as <code>meta.app_user()</code>, so its grants and row level security apply. For tailored endpoints with your own SQL or PL/pgSQL, create a <a href="${BASE}/sql/rest/modules">module</a>.</p>
     ${region('Published objects', table)}
     ${region('Enable a table or view', form)}`;
   return shell(s, 'RESTful Services', [['SQL Workshop', `${BASE}/sql`], ['RESTful Services']], main, 'sql');

package/src/builder/changelog.ts

@@ -0,0 +1,240 @@
+import type { FastifyInstance, FastifyReply } from 'fastify';
+import pg from 'pg';
+import { filesToZip } from '../appfiles.ts';
+import { flywayFile, flywayName, liquibaseChangelog, plainScript, recordChanges, type ChangeSet } from '../changelog.ts';
+import { owner } from '../db.ts';
+import { changeScript, readSchema, userSchemas } from '../ddl.ts';
+import { html, raw } from '../html.ts';
+import { icon } from '../icons.ts';
+import { splitStatements } from '../binds.ts';
+import { clientIp, logActivity, type Session } from '../session.ts';
+import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Req } from './ui.ts';
+import { currentWorkspace, workshopDb } from './workspaces.ts';
+
+// (sprint 106, Database Actions DA-17; migration 118) SQL Workshop › Change Log: the change sets recorded from the
+// worksheet, Table Properties and Schema Comparison (src/changelog.ts), per schema of the developer's workspace:
+// number, name, author, time, where from, the SQL; whether each is in the latest export of an application of the
+// workspace (made before it) and whether it was written to a migration file. Downloads (POST, they mark the change
+// sets exported): plain SQL, a Liquibase formatted SQL changelog, Flyway files (V0001__add_bonus.sql; several in a
+// zip). Schema Comparison's "Apply and record" runs its change script here, in one transaction, and records it.
+
+export const CHANGES = `${BASE}/sql/changes`;
+const NAME = /^[a-z0-9][a-z0-9_]{0,59}$/;
+const FORMATS = ['sql', 'liquibase', 'flyway'] as const;
+type Format = (typeof FORMATS)[number];
+
+const asFormat = (v: unknown): Format => (FORMATS.includes(v as Format) ? (v as Format) : 'sql');
+
+/** The workspace's change sets of a schema (or one by id). */
+async function changeSets(s: Session, where: { schema?: string; id?: number }): Promise<ChangeSet[]> {
+  const params: unknown[] = [currentWorkspace(s)];
+  let cond = '';
+  if (where.schema !== undefined) cond += ` and schema_name = $${params.push(where.schema)}`;
+  if (where.id !== undefined) cond += ` and id = $${params.push(where.id)}`;
+  return (await owner.query<ChangeSet>(
+    `select id::int, workspace_id, schema_name, seq, name, author, source, sql, object_name, created_at::text, exported_at::text
+       from meta.change_set where workspace_id = $1${cond} order by schema_name, seq`, params)).rows;
+}
+
+/** Schemas with change sets in the workspace, with their counts. */
+async function schemasWithChanges(s: Session) {
+  return (await owner.query<{ schema_name: string; n: number; last: string }>(
+    `select schema_name, count(*)::int as n, max(created_at)::text as last from meta.change_set where workspace_id = $1 group by 1 order by 1`,
+    [currentWorkspace(s)])).rows;
+}
+
+/** The latest builder export of each application of the workspace (activity log 'app_export'). */
+async function latestExports(s: Session) {
+  return (await owner.query<{ id: number; name: string; alias: string; at: string }>(
+    `select a.id, a.name, a.alias, max(l.at)::text as at from meta.app a join meta.activity_log l on l.app_id = a.id and l.event = 'app_export'
+      where meta.app_workspace(a.id) = $1 group by a.id order by max(l.at) desc`, [currentWorkspace(s)])).rows;
+}
+
+const when = (t: string | null) => (t ? t.slice(0, 16).replace('T', ' ') : '');
+const SOURCE_LABELS: Record<string, string> = { worksheet: 'SQL Worksheet', table: 'Table Properties', compare: 'Schema Comparison' };
+
+async function listPage(s: Session, q: Record<string, unknown>) {
+  const schemas = await schemasWithChanges(s);
+  const schema = schemas.some((x) => x.schema_name === q.schema) ? String(q.schema) : (schemas[0]?.schema_name ?? '');
+  const exportsList = await latestExports(s);
+  const exp = exportsList.find((e) => String(e.id) === String(q.app ?? '')) ?? exportsList[0];
+  const list = schema ? await changeSets(s, { schema }) : [];
+  const inExport = (c: ChangeSet) => !!exp && c.created_at <= exp.at;
+  const pending = list.filter((c) => !c.exported_at).length;
+  const nav = schemas.length
+    ? html`<nav class="settings-tabs" aria-label="Schemas">${schemas.map((x) => html`<a href="${CHANGES}?${new URLSearchParams({ schema: x.schema_name, ...(exp ? { app: String(exp.id) } : {}) })}"${x.schema_name === schema ? raw(' aria-current="page"') : ''}>${x.schema_name} <span class="muted small">${x.n}</span></a>`)}</nav>`
+    : '';
+  const table = list.length
+    ? html`<div class="table-wrap"><table class="report report-reflow"><thead><tr><th>#</th><th>Change set</th><th>Author</th><th>Recorded</th><th>From</th><th>Latest app export</th><th>Migration file</th></tr></thead><tbody>
+      ${list.map((c) => html`<tr>
+        <td data-label="#">${c.seq}</td>
+        <td data-label="Change set" class="wrap-anywhere"><details><summary><code>${flywayName(c)}</code>${c.object_name ? html` <span class="muted small">${c.object_name}</span>` : ''}</summary>
+          <pre class="source wrap-pre" data-code-view="sql" tabindex="0" aria-label="SQL">${c.sql}</pre>
+          <form method="post" action="${CHANGES}/${c.id}" class="search u-mwnone">${csrf(s)}
+            <div class="field"><label class="label" for="f_name_${c.id}">Name</label><input id="f_name_${c.id}" name="name" value="${c.name}" pattern="[a-z0-9][a-z0-9_]{0,59}" required></div>
+            <button class="btn btn-sm u-selfend">Rename</button></form>
+          <div class="buttons">
+            <form method="post" action="${CHANGES}/${c.id}/download" class="u-inline">${csrf(s)}<button class="btn btn-sm">${icon('download')} ${flywayName(c)}</button></form>
+            <form method="post" action="${CHANGES}/${c.id}/delete" class="u-inline">${csrf(s)}<button class="btn btn-sm btn-danger" data-confirm="Delete change set ${c.seq} from the log? The database is not changed, and its number is not given again.">${icon('trash')} Delete</button></form>
+          </div></details></td>
+        <td data-label="Author">${c.author}</td>
+        <td data-label="Recorded">${when(c.created_at)}</td>
+        <td data-label="From">${SOURCE_LABELS[c.source] ?? c.source}</td>
+        <td data-label="Latest app export">${exp ? (inExport(c) ? html`<span class="tag">✓ in it</span>` : html`<span class="tag tag-warn">after it</span>`) : html`<span class="muted">—</span>`}</td>
+        <td data-label="Migration file">${c.exported_at ? `written ${when(c.exported_at)}` : html`<span class="muted">not yet</span>`}</td></tr>`)}
+      </tbody></table></div>`
+    : html`<p class="muted">No change sets yet. DDL you run in the SQL Worksheet, apply in Table Properties or apply from Schema Comparison is recorded here.</p>`;
+  const exportPick = exportsList.length
+    ? html`<form method="get" action="${CHANGES}" class="search u-mwnone u-mb1"><input type="hidden" name="schema" value="${schema}">
+        <div class="field"><label class="label" for="f_app">Compare with the latest export of</label><select id="f_app" name="app">${exportsList.map((e) =>
+          html`<option value="${e.id}"${e === exp ? raw(' selected') : ''}>${e.name} (${when(e.at)})</option>`)}</select></div>
+        <button class="btn u-selfend">Show</button></form>
+        <p class="muted small u-mt0">✓ in it: recorded before the application was last exported, so a deployment of that export expects the change. <em>After it</em>: still to be shipped with the next export.</p>`
+    : html`<p class="muted small">No application of this workspace was exported from the builder yet (Application › Export): the change sets can't be compared with an export.</p>`;
+  const downloads = list.length
+    ? html`<form method="post" action="${CHANGES}/download" class="u-mt1">${csrf(s)}<input type="hidden" name="schema" value="${schema}">
+        <div class="form-grid">
+          <div class="field"><label class="label" for="f_format">Format</label><select id="f_format" name="format">
+            <option value="flyway">Flyway: V0001__name.sql files (a zip for several)</option>
+            <option value="liquibase">Liquibase: formatted SQL changelog</option>
+            <option value="sql">Plain SQL script</option></select></div>
+          <div class="field"><label class="label" for="f_which">Change sets</label><select id="f_which" name="which">
+            <option value="pending">Not yet written to a file (${pending})</option>
+            <option value="all">All of ${schema} (${list.length})</option>
+            ${exp ? html`<option value="after_export">After the latest export of ${exp.name} (${list.filter((c) => !inExport(c)).length})</option>` : ''}</select></div>
+        </div>
+        ${exp ? html`<input type="hidden" name="app" value="${exp.id}">` : ''}
+        <div class="buttons"><button class="btn btn-hot">${icon('download')} Download migration</button></div></form>`
+    : '';
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('changes')}
+    <p class="muted">The change log (Liquibase, Flyway): DDL run from the SQL Worksheet, Table Properties and Schema Comparison is kept as change sets per schema, with who ran it and when. Download them as a migration for another database: Flyway versioned files, a Liquibase formatted SQL changelog or a plain script. Only statements that succeeded are kept; data changes (INSERT, UPDATE, DELETE) are not.</p>
+    ${nav}
+    ${schema ? region(`Change sets of ${schema}`, html`${exportPick}${table}${downloads}`) : region('Change sets', table)}`;
+  return shell(s, 'Change Log', [['SQL Workshop', `${BASE}/sql`], ['Change Log']], main, 'sql');
+}
+
+async function oneOr404(req: Req, reply: FastifyReply, s: Session) {
+  const id = Number(req.params.id);
+  const c = Number.isInteger(id) && id > 0 && id < 2 ** 53 ? (await changeSets(s, { id }))[0] : undefined;
+  if (!c) reply.code(404).send('Not found');
+  return c;
+}
+
+const markExported = (ids: number[]) => owner.query('update meta.change_set set exported_at = now() where id = any($1::bigint[])', [ids]);
+
+/** The download of change sets in a format: one file, or a zip of Flyway files. */
+function fileOf(list: ChangeSet[], format: Format, schema: string): { name: string; type: string; body: string | Buffer } {
+  if (format === 'flyway') {
+    if (list.length === 1) return { name: flywayName(list[0]), type: 'application/sql; charset=utf-8', body: flywayFile(list[0]) };
+    return { name: `${schema}-migrations.zip`, type: 'application/zip', body: Buffer.from(filesToZip(new Map(list.map((c) => [flywayName(c), Buffer.from(flywayFile(c))])), `${schema}-migrations`)) };
+  }
+  if (format === 'liquibase') return { name: `${schema}.changelog.sql`, type: 'application/sql; charset=utf-8', body: liquibaseChangelog(list) };
+  return { name: `${schema}-changes.sql`, type: 'application/sql; charset=utf-8', body: plainScript(list) };
+}
+const safeName = (n: string) => n.replace(/[^A-Za-z0-9._-]/g, '_');
+
+export async function changeLogRoutes(app: FastifyInstance) {
+  app.get(CHANGES, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    return send(reply, s, await listPage(s, req.query ?? {}));
+  });
+
+  app.post(`${CHANGES}/download`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const b = req.body ?? {};
+    const schema = String(b.schema ?? '');
+    let list = await changeSets(s, { schema });
+    if (!list.length) return reply.code(404).send('Not found');
+    if (b.which === 'pending') list = list.filter((c) => !c.exported_at);
+    else if (b.which === 'after_export') {
+      const exp = (await latestExports(s)).find((e) => String(e.id) === String(b.app ?? ''));
+      if (exp) list = list.filter((c) => c.created_at > exp.at);
+    }
+    if (!list.length) {
+      flash(s, 'No change sets to write: every one is in an earlier file. Choose "All".', 'error');
+      return back(reply, s, `${CHANGES}?${new URLSearchParams({ schema })}`);
+    }
+    const format = asFormat(b.format);
+    const f = fileOf(list, format, schema);
+    await markExported(list.map((c) => c.id));
+    await logActivity({ username: s.username, event: 'change_log_export', ip: clientIp(req), detail: `${schema}: ${list.length} change set(s) as ${format}` });
+    return reply.header('content-disposition', `attachment; filename="${safeName(f.name)}"`).type(f.type).send(f.body);
+  });
+
+  app.post(`${CHANGES}/:id/download`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const c = await oneOr404(req, reply, s);
+    if (!c) return;
+    await markExported([c.id]);
+    return reply.header('content-disposition', `attachment; filename="${safeName(flywayName(c))}"`).type('application/sql; charset=utf-8').send(flywayFile(c));
+  });
+
+  app.post(`${CHANGES}/:id`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const c = await oneOr404(req, reply, s);
+    if (!c) return;
+    const name = String(req.body?.name ?? '').trim().toLowerCase();
+    if (!NAME.test(name)) flash(s, 'A name is lower case letters, digits and _ (at most 60), starting with a letter or digit.', 'error');
+    else {
+      await owner.query('update meta.change_set set name = $2 where id = $1', [c.id, name]);
+      flash(s, `Change set ${c.seq} is now ${flywayName({ seq: c.seq, name })}.`);
+    }
+    return back(reply, s, `${CHANGES}?${new URLSearchParams({ schema: c.schema_name })}`);
+  });
+
+  app.post(`${CHANGES}/:id/delete`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const c = await oneOr404(req, reply, s);
+    if (!c) return;
+    await owner.query('delete from meta.change_set where id = $1', [c.id]);
+    await logActivity({ username: s.username, event: 'change_log_delete', ip: clientIp(req), detail: `${c.schema_name} #${c.seq} ${c.name}` });
+    flash(s, `Change set ${c.seq} removed from the log; the database is unchanged.`);
+    return back(reply, s, `${CHANGES}?${new URLSearchParams({ schema: c.schema_name })}`);
+  });
+
+  // Schema Comparison › Apply and record: the change script that makes the target like the source, run in one
+  // transaction on the SQL Workshop's connection, recorded as a change set of the target
+  app.post(`${BASE}/sql/compare/apply`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const db = await workshopDb(s);
+    const schemas = await userSchemas(db, { usable: db !== owner });
+    const source = String(req.body?.source ?? '');
+    const target = String(req.body?.target ?? '');
+    if (!schemas.includes(source) || !schemas.includes(target) || source === target) return reply.code(404).send('Not found');
+    const [a, b] = await Promise.all([readSchema(db.pool, source), readSchema(db.pool, target)]);
+    const script = changeScript(source, target, a, b);
+    const statements = splitStatements(script);
+    const back2 = `${BASE}/sql/compare?${new URLSearchParams({ source, target })}`;
+    if (!statements.length) {
+      flash(s, `${target} is already like ${source}: nothing to apply.`);
+      return back(reply, s, back2);
+    }
+    const c = await db.pool.connect();
+    let failed = '';
+    try {
+      await c.query('begin');
+      await c.query(`select set_config('search_path', $1, true)`, [`${pg.escapeIdentifier(target)}, public`]);
+      for (const x of statements) await c.query(x);
+      await c.query('commit');
+    } catch (e) {
+      failed = (e as Error).message;
+      await c.query('rollback').catch(() => {});
+    } finally {
+      c.release(true);
+    }
+    await logActivity({ username: s.username, event: 'sql_command', ip: clientIp(req), detail: `compare apply ${source} → ${target}: ${failed ? `failed: ${failed}` : `${statements.length} statement(s)`}`.slice(0, 2000) });
+    if (failed) {
+      flash(s, `Nothing was changed: the change script ran in one transaction, which was rolled back. ${failed}`, 'error');
+      return back(reply, s, back2);
+    }
+    await recordChanges({ workspaceId: currentWorkspace(s), author: s.username ?? '?', source: 'compare', statements, defaultSchema: target, name: `like_${source}`.toLowerCase().replace(/[^a-z0-9_]+/g, '_').slice(0, 60) });
+    flash(s, `${target} is now like ${source}: ${statements.length} statement(s), recorded in the change log.`);
+    return back(reply, s, `${CHANGES}?${new URLSearchParams({ schema: target })}`);
+  });
+}

package/src/builder/components.ts

@@ -567,7 +567,7 @@ export const COMPONENTS: Record<string, ComponentSpec> = {
       { name: 'description', label: 'Description', kind: 'text', wide: true, group: 'Identification' },
       { name: 'enabled', label: 'Enabled', kind: 'bool', group: 'Identification' },
       { name: 'handlers', label: 'Handlers (JSON)', kind: 'json', wide: true, group: 'Handlers',
-        help: '[{"method": "GET", "path": "orders", "type": "collection", "source": "select id, customer, total from sales.orders order by id"}, {"method": "GET", "path": "orders/:id", "type": "item", "source": "select * from sales.orders where id = :ID::int"}, {"method": "POST", "path": "orders", "type": "sql", "source": "select sales.create_order(:CUSTOMER, :TOTAL::numeric) as id", "roles": ["sales"]}] · type: collection (paged: ?limit, ?offset), item (404 when no row), sql (the first row of the last statement). Binds: path parameters, query parameters and JSON body fields, upper case; :BODY is the whole body. "auth": "public" for endpoints without a token. The SQL runs as the application\'s role, with meta.app_user() the caller.' },
+        help: '[{"method": "GET", "path": "orders", "type": "collection", "source": "select id, customer, total from sales.orders order by id"}, {"method": "GET", "path": "orders/:id", "type": "item", "source": "select * from sales.orders where id = :ID::int"}, {"method": "POST", "path": "orders", "type": "sql", "source": "select sales.create_order(:CUSTOMER, :TOTAL::numeric) as id", "roles": ["sales"]}] · type: collection (paged: ?limit, ?offset), item (404 when no row), sql (the first row of the last statement), plpgsql (a PL/pgSQL block answering with meta.rest_reply(body, status)), media (a row\'s content_type and content). SQL Workshop › RESTful Services › Modules edits them as templates and handlers. Binds: path parameters, query parameters and JSON body fields, upper case; :BODY is the whole body. "auth": "public" for endpoints without a token. The SQL runs as the application\'s role, with meta.app_user() the caller.' },
     ],
   },
   workflow_definition: {

package/src/builder/data-modeler.ts

@@ -355,7 +355,7 @@ export async function dataModelerRoutes(app: FastifyInstance) {
       return reply.header('content-disposition', `attachment; filename="${fileName(d.name)}.sql"`).type('application/sql; charset=utf-8').send(script);
     const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('modeler')}
       ${region(`DDL of ${d.name}`, html`<p class="muted u-mt0">The CREATE statements of the diagram's ${m.tables.length} objects in schema ${d.schema_name}: tables, their keys, indexes, triggers, row level security, policies, comments and grants, and views. Review before running.</p>
-        <pre class="source" tabindex="0" aria-label="DDL">${script}</pre>
+        <pre class="source" data-code-view="sql" tabindex="0" aria-label="DDL">${script}</pre>
         <form method="post" action="${BASE}/sql">${csrf(s)}<input type="hidden" name="sql" value="${script}">
           <div class="buttons"><a class="btn" href="${M}/${d.id}">${bicon('back')} Back to the diagram</a><a class="btn" href="${M}/${d.id}/ddl?download=1">${icon('download')} Download</a>
             <button class="btn btn-hot">${icon('play')} Open in the SQL Worksheet</button></div></form>`)}`;