pgkiln 0.49.0 → 0.51.0

package/SECURITY.md

@@ -96,6 +96,9 @@ first version (MVP). Every finding below has a regression test in
 | Output | Auto-escaping HTML templates, strict CSP (no inline scripts, no inline styles: the page's one `<style>` carries a per-response nonce), `X-Frame-Options`, `nosniff`, `no-store`. Images may also come from the map tile server (`MAP_TILE_URL`, an http(s) origin only); map data travels as JSON in a `<script type="application/json">` element with `<` escaped. A map area in a report URL (`r<id>_bb`) is parsed into four range-checked numbers before it reaches SQL; anything else is ignored. The browser fetches tiles from that server directly, so it sees users' IP addresses, map areas and the site's origin (sent as `Referer`, which OpenStreetMap requires; never the page's path or query): self-host tiles where that matters. |
 | Files | Uploads are size- and type-checked and stored per session (`meta.temp_files` shows only the session's own files). A posted text value can't point a file item at another file, and a "remove file" value only removes files of the form's own record. Downloads need a checksum bound to user, page, item and record, check page access and read as the app's role (RLS applies). They are sent as attachments with `nosniff` and a sandboxing CSP; only PNG, JPEG, GIF, WebP and PDF are shown inline. |
 | Data loading and PDFs | The `data_load` process loads as the app's role (grants, RLS, triggers apply) and shows only data errors and `RAISE` messages per row. Report PDFs run the report's own query with the same page, region and row checks as the screen. |
+| SQL Worksheet transactions (sprint 107) | A worksheet's open transaction is held in server memory under the caller's builder session id plus the tab key and checked against the workspace: every lookup starts from the caller's own session, so another developer or another sign-in never reaches it. Its connection is a plain client built from the workspace's developer login (or the *Run as* application's), never returned to a pool, and closed at the end, so `SET ROLE` reaches only roles that login has and nothing leaks into the builder's pools; *Run as* can't change while it is open. Rolled back on idle timeout, sign-out, session expiry, workspace switch, tab close and server stop, with `idle_in_transaction_session_timeout` as a backstop; at most `WORKSHEET_TXN_MAX_PER_DEVELOPER` per developer and `WORKSHEET_TXN_MAX` per server, each one database connection outside the pools. CSRF and a developer sign-in on every endpoint. |
+| Release check (sprint 109) | Off by default (`PGKILN_RELEASE_CHECK`, or Instance settings for administrators). When on, the server sends one GET to GitHub's releases API at most once a day per process, with a 5-second timeout and a 1 MB limit, and sends nothing about the installation; only a semver version and an https link are kept from the answer, and they are escaped on the Workspace home. Pages never wait for it. |
+| Data Reporter datasets and reporting applications (sprint 110) | Datasets are managed by the workspace's developers with CSRF on every POST; their schema must be one the workspace's SQL Workshop connection may use (never pgkiln's own or the system's), and tables, columns, joins and filters are checked against the catalog. The runtime builds a dataset's SELECT with quoted identifiers, literal values and whitelisted operators, and runs reports as the application's role. A reporting application's role gets SELECT only on the datasets' tables and views, so RLS applies; viewers never reach the report editor (report parameters in the URL are ignored), and only `admin_authz` users unpublish or delete others' reports. Dataset files are checked like a saved dataset before import. |
 
 ## Findings of the MVP review and their fixes
 

package/db/migrations/119_workspace_home.sql

@@ -0,0 +1,30 @@
+-- ---------------------------------------------------------------------
+-- 119: the Workspace home (sprint 109, WS-1; APEX: the workspace home
+-- page). The builder opens /builder/home after signing in: tool cards, the
+-- workspace's top applications and users by page views over a reporting
+-- timeframe, a summary of counts, the workspace message and a system
+-- message.
+--
+-- meta.developer.home_timeframe: the reporting timeframe each developer
+-- chose for Top applications and Top users (hour, day or week); null is
+-- the default (day). A developer account is installation data: not
+-- exported with an application or a workspace.
+--
+-- meta.workspace.builder_home: what an old /builder link opens in this
+-- workspace (a workspace preference): null or 'apps' = the App Builder (as
+-- before; the App Builder is also at /builder/apps), 'home' = a redirect to
+-- the Workspace home. Travels in a workspace export's settings.
+--
+-- The "new version available" check is an instance setting
+-- (meta.setting 'release_check' = 'on' / 'off'; else the environment
+-- variable PGKILN_RELEASE_CHECK; off by default): no table needed.
+-- ---------------------------------------------------------------------
+alter table meta.developer
+  add column home_timeframe text check (home_timeframe in ('hour', 'day', 'week'));
+comment on column meta.developer.home_timeframe is
+  'The reporting timeframe of the developer''s Workspace home (119): hour, day or week; null = day.';
+
+alter table meta.workspace
+  add column builder_home text check (builder_home in ('apps', 'home'));
+comment on column meta.workspace.builder_home is
+  'What /builder opens in this workspace (119): null or apps = the App Builder, home = the Workspace home.';

package/db/migrations/120_datasets.sql

@@ -0,0 +1,87 @@
+-- =====================================================================
+-- 120: Data Reporter datasets (APEX 26.1: Data Reporter → Datasets)
+--
+-- A dataset is a reusable, trusted view of a workspace's data for business
+-- users: tables and views of one schema, joined (the joins proposed from
+-- foreign keys), the columns users may see with labels, format masks and
+-- descriptions, and an optional row filter. Developers define datasets in
+-- the builder (Data Reporter); a Data Reporter region offers a dataset as a
+-- source with {"id": "...", "dataset": "<name>"} in config.sources, and
+-- the runtime builds the dataset's SELECT from the definition (identifiers
+-- quoted, values as literals, operators from a whitelist) and runs reports
+-- on it as the application's database role, so grants and row level
+-- security apply.
+--
+--   tables  [{"alias": "t1", "table": "emp"},
+--            {"alias": "t2", "table": "dept",
+--             "join": {"to": "t1", "type": "left", "on": [{"column": "deptno", "ref": "deptno"}]}}]
+--   columns [{"name": "ename", "table": "t1", "column": "ename", "label": "Name",
+--             "format": "FML999G990D00", "description": "..."}]
+--   filters [{"table": "t1", "column": "active", "op": "eq", "value": "true"}]
+--
+-- Per workspace, like the SQL Workshop's saved work. Installation data:
+-- not part of an application's export (the builder's Data Reporter exports
+-- and imports datasets as JSON files). The builder writes it as the owner;
+-- the runtime reads it through its own login, and row level security shows
+-- an isolated workspace's login its own workspace's datasets only.
+-- =====================================================================
+create table meta.dataset (
+  id           bigint generated always as identity primary key,
+  workspace_id int  not null default 1 references meta.workspace on delete cascade,
+  name         text not null check (name ~ '^[a-z][a-z0-9_]{0,39}$'),
+  label        text not null check (length(btrim(label)) between 1 and 80),
+  description  text check (length(description) <= 500),
+  schema_name  text not null check (length(schema_name) between 1 and 63 and schema_name !~* '^(pg_.*|information_schema|meta)$'),
+  tables       jsonb not null check (jsonb_typeof(tables) = 'array' and jsonb_array_length(tables) between 1 and 10),
+  columns      jsonb not null default '[]' check (jsonb_typeof(columns) = 'array' and jsonb_array_length(columns) <= 200),
+  filters      jsonb not null default '[]' check (jsonb_typeof(filters) = 'array' and jsonb_array_length(filters) <= 5),
+  created_by   text not null,
+  created_at   timestamptz not null default now(),
+  updated_by   text,
+  updated_at   timestamptz not null default now(),
+  unique (workspace_id, name)
+);
+revoke all on meta.dataset from public;
+grant select on meta.dataset to pgkiln_runtime;
+comment on table meta.dataset is 'Data Reporter datasets per workspace (120): joined tables and views, offered columns, a row filter; installation data, not exported';
+
+-- May this login see a workspace's datasets? An isolated workspace's login: its own only;
+-- other logins: those of workspaces that are not isolated.
+create function meta.dataset_visible(p_workspace int) returns boolean
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select case when meta.login_workspace() is not null then p_workspace = meta.login_workspace()
+              else not coalesce((select w.isolated from meta.workspace w where w.id = p_workspace), false) end
+$$;
+
+-- The workspace whose datasets an application's Data Reporter offers (refused for an
+-- application the login may not see).
+create function meta.dataset_workspace(p_app_id int) returns int
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select meta.app_workspace(meta.checked_app(p_app_id))
+$$;
+
+revoke all on function meta.dataset_visible(int), meta.dataset_workspace(int) from public;
+grant execute on function meta.dataset_visible(int), meta.dataset_workspace(int) to pgkiln_runtime;
+
+-- (090) an isolated workspace's logins see their own workspace's datasets only
+alter table meta.dataset enable row level security;
+create policy workspace on meta.dataset
+  using ((select meta.isolation_off()) or meta.dataset_visible(workspace_id));
+
+-- ---------------------------------------------------------------------
+-- Reporting applications: an application generated by the builder's Data
+-- Reporter on one or more datasets (a Data Reporter region is its engine;
+-- roles viewer, editor and administrator). The type is part of the
+-- definition and travels with the export.
+-- ---------------------------------------------------------------------
+alter table meta.app drop constraint app_app_type_check;
+alter table meta.app add constraint app_app_type_check
+  check (app_type in ('standard', 'theme', 'library', 'boilerplate', 'reporting'));
+comment on column meta.app.app_type is 'standard, theme, library (components offered to other apps), boilerplate (a starting point for new apps) or reporting (120: generated on Data Reporter datasets)';
+
+-- The number of reporting applications of a workspace (the workspace home's summary).
+create function meta.reporting_app_count(p_workspace int) returns int
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select count(*)::int from meta.app a where a.app_type = 'reporting' and meta.app_workspace(a.id) = p_workspace
+$$;
+revoke all on function meta.reporting_app_count(int) from public;

package/docs/apex-feature-parity.md

@@ -7,7 +7,7 @@ open item and open an issue or pull request; see [CONTRIBUTING.md](../CONTRIBUTI
 Legend: ✅ available · 🟡 partial (see notes) · ❌ not yet · ➖ not planned (a deliberate choice,
 or better served by the PostgreSQL ecosystem; see the notes and [extensions](guide/15-extensions.md))
 
-Last reviewed: 2026-10-16 (sprint 106: the change log of DDL change sets with Flyway, Liquibase and SQL downloads; sprint 104: RESTful Services modules, templates and handlers with PL/pgSQL and media handlers, privileges, OpenAPI and Try it; sprint 103: Schema Export / Import with pg_dump and pg_restore; sprint 102: the SQL Monitor with live sessions, Top SQL and a statement's plan; sprint 101: Scheduling of pg_cron jobs with a schedule builder, run now and run history; sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
+Last reviewed: 2026-10-19 (sprint 110: Data Reporter as a workspace tool with datasets, reporting applications, editors and viewers, published reports with stable URLs and pins; sprint 109: the Workspace home above the App Builder and SQL Workshop, with a summary, top applications, users and developers, and an optional release check; sprint 108: the code editor's syntax colours in the builder's light and dark themes, read-only SQL highlighted, the Data Modeler in dark mode; sprint 107: a transaction mode in the SQL Worksheet with Commit and Rollback; DA-18: JavaScript (MLE) not planned, plv8 where installed; sprint 106: the change log of DDL change sets with Flyway, Liquibase and SQL downloads; sprint 104: RESTful Services modules, templates and handlers with PL/pgSQL and media handlers, privileges, OpenAPI and Try it; sprint 103: Schema Export / Import with pg_dump and pg_restore; sprint 102: the SQL Monitor with live sessions, Top SQL and a statement's plan; sprint 101: Scheduling of pg_cron jobs with a schedule builder, run now and run history; sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
 
 ## At a glance
 
@@ -22,8 +22,8 @@ Last reviewed: 2026-10-16 (sprint 106: the change log of DDL change sets with Fl
 | Globalization | 6 | 0 | 0 | 0 | One translated app like 26.1 with dynamic translations of table values; number format masks and automatic time zone; twenty-two built-in languages |
 | Data and integration | 13 | 0 | 0 | 2 | REST source catalogs from OpenAPI documents; Generate DDL and schema comparison; `meta.data_export` and data export downloads (CSV, JSON, XML, HTML, Excel, PDF); e-mail through SMTP (password or OAuth2), Microsoft Graph, Amazon SES and HTTP APIs; REST APIs via PostgREST, REST data sources that write back and synchronise, web credentials with OAuth2 grants, CSV/XLSX/JSON/XML loading with saved definitions and unloading, SQL scripts and Quick SQL, report PDFs and document templates |
 | Workflow, automation and AI | 6 | 0 | 0 | 0 | Scheduled automations with several actions and runs from SQL, approvals, a task list and workflows with parallel branches, versions and invoke-API steps; AI with Claude or OpenAI: *Generate text with AI*, an assistant region with tools, natural-language report filters and blueprints |
-| Administration | 11 | 0 | 0 | 0 | An APEX-like sign-in with a workspace; a workspace's components exported and imported as one file; workspace message, environment banner and utilization; isolated workspaces with their own database logins and roles, and workspace administrators; application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Top SQL per app; debug messages per request; an install/upgrade log |
-| **Total** | **143** | **0** | **0** | **3** | 146 APEX features compared: 98% available, none partial or missing |
+| Administration | 12 | 0 | 0 | 0 | An APEX-like sign-in with a workspace and a Workspace home; a workspace's components exported and imported as one file; workspace message, environment banner and utilization; isolated workspaces with their own database logins and roles, and workspace administrators; application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Top SQL per app; debug messages per request; an install/upgrade log |
+| **Total** | **144** | **0** | **0** | **3** | 147 APEX features compared: 98% available, none partial or missing |
 
 (Counts are of the rows in the tables below. A review on 2026-10-06 added 18 rows for APEX features that were
 not compared before, one on 2026-10-12 added two more (property help, application availability), and one on
@@ -194,7 +194,7 @@ two, REST source catalogs and the workspace export, with their features.)
 | Printing, document generator (PDF) | ✅ | **Document templates**: a query (with JSON columns for lines) fills an HTML template with Mustache-style tags, drawn as PDF with a report layout; buttons and links download them. (sprint 82) **Report queries**: a named query as PDF, Excel, CSV, JSON, XML or HTML. Report PDF with **report layouts** and a print stylesheet on every page. No Word/Excel templates or DOCX/XLSX output |
 | `APEX_DATA_EXPORT` (a query to CSV, XLSX, PDF, HTML or JSON from PL/SQL) | ✅ | (sprint 53) `meta.data_export(query, format, options)` returns CSV, JSON, XML or HTML as `bytea` with the caller's privileges; the download process's `{"export": …}` sends a query's rows as CSV, JSON, XML, HTML, Excel or PDF |
 | SQL Workshop utilities: schema comparison, generate DDL | ✅ | (sprint 56) SQL Workshop → **DDL**: a schema's objects (types, sequences, tables, functions, views, constraints, indexes, triggers, RLS and policies, comments, grants) from the catalog, in an order that runs, unqualified so it also creates them in another schema. **Compare**: two schemas by their DDL (only in one, different, with a diff) and a change script that makes the target like the source (tables column by column; drops commented out for review). Also `pgkiln ddl`, `pgkiln compare` and the MCP tools `generate_ddl`, `compare_schemas` ([chapter 3](guide/03-builder.md#sql-workshop)). Two schemas of the same database only (APEX: also within one workspace) |
-| Data Reporter: self-service reports for business users (26.1) | ✅ | A **Data Reporter** region ([chapter 4](guide/04-pages-and-regions.md#data_reporter-data-reporter)): the developer offers tables and views with chosen columns, labels and format masks; signed-in users pick columns, filter, group with totals (count, sum, average, minimum, maximum), sort and chart, and save reports privately or shared with the app's users. Runs as the app's role (grants and RLS apply); works without JavaScript and fits phones. (sprint 68) A **welcome page** like 26.1's: a greeting (the developer's own, or pgkiln's), the sources as cards that start a report, the user's reports latest first, shared ones, and a search. One source per report (offer a view to combine tables); no downloads from a reporter yet |
+| Data Reporter: self-service reports for business users (26.1) | ✅ | A **Data Reporter** region ([chapter 4](guide/04-pages-and-regions.md#data_reporter-data-reporter)): the developer offers tables and views with chosen columns, labels and format masks; signed-in users pick columns, filter, group with totals (count, sum, average, minimum, maximum), sort and chart, and save reports privately or shared with the app's users. Runs as the app's role (grants and RLS apply); works without JavaScript and fits phones. (sprint 68) A **welcome page** like 26.1's: a greeting (the developer's own, or pgkiln's), the sources as cards that start a report, the user's reports latest first, shared ones, and a search. One source per report (offer a view to combine tables); no downloads from a reporter yet (sprint 110) **A workspace tool too**: App Builder → **Data Reporter** ([chapter 3](guide/03-builder.md#data-reporter-datasets-and-reporting-applications)) keeps **datasets** (tables and views of one schema with joins proposed from foreign keys, offered columns with labels, masks and descriptions, a row filter; files and the workspace export) and makes a **reporting application** on them in two clicks: viewers open published reports by a stable URL and pin them, editors build and publish, administrators moderate; every report runs as the application's SELECT-only role through RLS. |
 | REST Source Catalogs (Workspace Utilities) | ✅ | (sprint 67) Workspace utilities → **REST Source Catalogs**: a workspace's web services with a base URL and services, from an **OpenAPI 3 / Swagger 2.0** document (file, pasted or read from a URL on the allow-list), a catalog file or by hand: parameters (under the service's own names), row selector, typed columns and write-back operations from the response schemas and collection/item paths, with notes on what can't be used. An application's *REST data sources → From a REST source catalog* makes a data source from a service, with its own web credential ([chapter 19](guide/19-rest-data-sources.md#rest-source-catalogs)). **Missing:** YAML documents (convert to JSON), APEX's built-in catalogs (e.g. Oracle Fusion) |
 | JSON sources, duality views (24.2) | ➖ | PostgreSQL `jsonb` works in any SQL region, form or grid source |
 | Remote servers / database links | ➖ | `postgres_fdw` or `dblink` |
@@ -216,6 +216,7 @@ two, REST source catalogs and the workspace export, with their features.)
 | APEX | pgkiln | Notes |
 |---|---|---|
 | Developer accounts, workspace sign-in | ✅ | (sprint 61) The builder's sign-in page like APEX's: workspace (optional; it becomes the current one, a wrong one answers like a wrong password), username, password with a Show button, *Remember workspace and username*, a link to Administration. (sprint 68) **Find my workspace**: developers' e-mail addresses, and a mail with their workspaces through the builder's mail service (the same answer for every address, limited per address and IP). **Missing:** the sign-in page's language links (the builder is in English only) |
+| Workspace home (tool cards, top apps and users, summary, workspace and system message) | ✅ | (sprint 109) `/builder/home` opens after sign-in ([chapter 3](guide/03-builder.md#workspace-home)): App Builder, SQL Workshop, Data Reporter and App Gallery cards; the workspace message edited in place; a Summary of applications, tables, developers and reporting applications; top applications, users and developers over an hour, a day or a week; a system message with the server's version and, with the optional release check (`PGKILN_RELEASE_CHECK`, off by default), *pgkiln X is available*. The App Builder moved to `/builder/apps`; `/builder` opens either, per workspace. |
 | Workspace message, environment banner, workspace utilization, preferences and extension links (Manage Service) | ✅ | (sprint 61) An **Administration** menu in the icon rail; administrators and workspace administrators set a **workspace message** (on the App Builder home) and an **environment banner** (a coloured label on every builder page of the workspace), and see **workspace utilization** (applications, pages, page views, users, static files, schema storage) ([chapter 3](guide/03-builder.md#workspace-message-and-environment-banner)). (sprint 62) **Workspace preferences**: the SQL Workshop and the applications' RESTful services (REST modules) on or off per workspace; **extension links** in an Extensions menu of the rail ([chapter 3](guide/03-builder.md#workspace-preferences)). **Missing:** the account login controls of APEX's preferences (pgkiln's password policy and sign-in throttling are installation-wide) |
 | Instance administration, install/upgrade logs (26.1) | ✅ | Versioned migrations (`npm run db:migrate`), every run logged; Workspace utilities → **Installation** (administrators): server version, install and upgrade runs with errors, applied migrations, and warnings for migrations the database misses or the server doesn't know ([chapter 3](guide/03-builder.md)). Workspace utilities → **Instance settings**: session length and sign-in throttling (stored in the database, over the environment variables) and an overview of the server's configuration without secrets; a server whose database lacks migrations says so (503) or applies them (`MIGRATE_ON_START`). Other settings stay environment variables |
 | Debug messages | ✅ | Debug levels 1–9 per app; `meta.debug(level, text)` and `meta.debug_enabled(level)` from application SQL (APEX_DEBUG); timed entries per request (page steps, regions, processes, branches, errors, SQL notices); Activity → **Debug messages** viewer per page view with filters and the slowest step highlighted; retention 1–90 days; password item values are never recorded ([chapter 6](guide/06-processing.md)). (sprint 50) Debug for **one session** from the developer toolbar, the application staying out of debug. **Missing:** debug entries for background jobs and REST requests |
@@ -343,7 +344,7 @@ AI and row level security badges.
 | Database Actions | pgkiln | |
 |---|---|---|
 | SQL worksheet: navigator, editor, output tabs, status bar | SQL Workshop → SQL Worksheet (sprint 91): navigator by schema and object type with columns, drag and drop and SELECT / INSERT / UPDATE / DELETE; Query Result, Script Output, Notices (DBMS Output), Explain Plan, Autotrace, SQL History; resizable panes, fullscreen | ✅ |
-| Run Statement (Ctrl+Enter), Run Script (F5) | The statement at the cursor or the selection; a script with a log per statement (psql command tags, error line and column), stop or continue on error; Run as an application's role | ✅ |
+| Run Statement (Ctrl+Enter), Run Script (F5) | The statement at the cursor or the selection; a script with a log per statement (psql command tags, error line and column), stop or continue on error; Run as an application's role. (sprint 107) Beyond Database Actions, which commits every statement: a worksheet tab in **Transaction** mode keeps its statements in one transaction until Commit or Rollback, with a badge for the open transaction; rolled back after an idle timeout, on sign-out, when the tab closes or the server stops | ✅ |
 | Explain Plan (F10), Autotrace (F6) | A tree of steps (sprint 92): cost, rows, conditions; with Autotrace (`EXPLAIN ANALYZE, BUFFERS`, rolled back) actual time, rows, loops, buffers, each step's own time, the slowest step and 10× misestimates; the text plan too | ✅ |
 | Query Result grid (paging, download, sharing) | 500 rows (All rows: 10,000) with row numbers, numbers right-aligned, sort, a value dialog, copy, Download as CSV, JSON, XML, Excel or SQL inserts (sprint 92); no sharing links | ✅ |
 | SQL History, DBMS Output | SQL History per developer with status, rows, time, search and run again; Notices with their time (sprint 92) | ✅ |
@@ -359,4 +360,4 @@ AI and row level security badges.
 | Launchpad, Search Database (Ctrl+K) | The SQL Workshop home as a Launchpad (sprint 96): pinned and recently visited, Development / Administration / Monitoring tabs; Search (Ctrl+K) for tools, applications, pages and database objects; no guided walk-through | ✅ |
 | Data Pump | Schema Export / Import (sprint 103): `pg_dump` of a schema (custom or plain format, definitions and / or data, include / exclude tables) and `pg_restore` of a one-schema archive into a new or existing schema (create schema as: renamed in one transaction), background jobs with status, size, duration and log, files kept N days; plus application backups and Unload Data. Plain dumps can't be imported here; one schema per job | ✅ |
 | Liquibase | Schema Comparison; (sprint 106) SQL Workshop → **Change Log**: DDL run from the SQL Worksheet, Table Properties and Schema Comparison (*Apply and record*) is recorded as change sets per schema (author, time, SQL, source, a stable number), downloaded as Flyway files (`V0001__add_bonus.sql`), a Liquibase formatted SQL changelog or a plain script, and marked against the latest export of an application. **Missing:** rollback blocks, preconditions and contexts; DDL run outside the SQL Workshop (psql, migrations) is not recorded | ✅ |
-| JavaScript (MLE) | ➖ Not planned: PostgreSQL has plv8 as an extension | ➖ |
+| JavaScript (MLE) | ➖ Not planned: PostgreSQL has plv8 as an extension; where it is installed, plv8 functions are written in the SQL Worksheet like any other ([chapter 3](guide/03-builder.md#sql-workshop)) | ➖ |

package/docs/guide/01-installation.md

@@ -169,6 +169,9 @@ which is read at startup; real environment variables take precedence.
 | `SAMPLE_DATA_STATEMENT_TIMEOUT` | `5min` | Statement timeout of SQL Workshop → Sample Data (each insert of a preview or a run) |
 | `SAMPLE_DATA_MAX_ROWS` | `100000` | Most rows one Sample Data run generates (all tables together) |
 | `UNLOAD_STATEMENT_TIMEOUT` | `5min` | Statement timeout of SQL Workshop → Unload Data (each statement: the cursor and every batch of rows) |
+| `WORKSHEET_TXN_IDLE_SECONDS` | `300` | SQL Worksheet transaction mode: seconds without a run before an open transaction is rolled back (10 to 86400) |
+| `WORKSHEET_TXN_MAX_PER_DEVELOPER` | `3` | Open worksheet transactions per developer (each holds a database connection) |
+| `WORKSHEET_TXN_MAX` | `20` | Open worksheet transactions on the server |
 | `REGION_CACHE_MAX_ENTRIES` | `1000` | Most regions in the [region cache](04-pages-and-regions.md#large-tables) of one server process (`0` turns caching off) |
 | `REGION_CACHE_MAX_MB` | `64` | Memory for the region cache of one server process |
 | `AUTOMATIONS` | on | `off` stops this server from running [automations](06-processing.md#automations) |
@@ -188,6 +191,8 @@ which is read at startup; real environment variables take precedence.
 | `PGKILN_REST_MAX_BYTES` | `5000000` | Largest web service response read (also after decompression) |
 | `MIGRATE_ON_START` | `false` | `true` applies missing migrations when the server starts. Without it, a server whose database lacks migrations answers every request with 503 and names the missing files until they are applied (`npm run db:migrate` or `pgkiln migrate`; no restart needed) |
 | `LOG_LEVEL` | `info` | `fatal`, `error`, `warn`, `info`, `debug`, `trace` |
+| `PGKILN_RELEASE_CHECK` | `off` | `on`: the server asks GitHub once a day for a newer pgkiln release and the [Workspace home](03-builder.md#the-release-check) announces it. Administrators can also set it in the builder (Instance settings → *New versions*), which wins over the variable. Keep it off where the server may not reach the internet |
+| `PGKILN_RELEASE_URL` | GitHub's releases API | For tests and mirrors only: the address of a JSON document like GitHub's `releases/latest` |
 
 ## npm scripts
 

package/docs/guide/03-builder.md

@@ -6,7 +6,7 @@ The builder lives at `/builder`. Everything it does is also possible in SQL (see
 ## Signing in and developer accounts
 
 Sign in with a developer account. The first one is `admin` / `admin`, and a red banner reminds you
-to change it.
+to change it. After signing in the builder opens the [Workspace home](#workspace-home) (`/builder/home`).
 
 The sign-in page (`/builder/login`) is laid out like APEX's: **Workspace** (optional), **Username** and
 **Password** (with a *Show* button). A workspace you name must be one of yours (administrators: any); it becomes the
@@ -75,7 +75,8 @@ its developers must not reach other teams' applications or data.
 
 Administrators and the workspace's administrators set them on the workspace's page (*Manage service*, or the
 Administration menu → *Workspace message and environment banner*; APEX: Define Workspace Message, Define Environment
-Banner): a **message** (plain text, up to 2000 characters) shown to the workspace's developers on the App Builder home,
+Banner): a **message** (plain text, up to 2000 characters) shown to the workspace's developers on the
+[Workspace home](#workspace-home) (where they can also edit it in place) and the App Builder home,
 and an **environment banner**: a label of up to 40 characters in one of eight colours, shown at the top of every
 builder page while the workspace is current.
 
@@ -95,6 +96,11 @@ Administrators and the workspace's administrators set them on the workspace's pa
 
 Both are on by default (migration 093) and are not exported.
 
+- **Builder links open** (sprint 109, migration 119): what an address of just `/builder` (a bookmark from before the
+  Workspace home) opens in this workspace: the **App Builder** (the default: it is also at `/builder/apps`) or the
+  **Workspace home** (a redirect). Signing in always opens the Workspace home. It travels in a
+  [workspace export](#export-and-import)'s settings.
+
 ### Extension links
 
 Links to the other tools a workspace's developers use (monitoring, a wiki, a ticket system; APEX: Manage Extension
@@ -151,6 +157,7 @@ applications' files. Choose what goes in:
 | Extension links | Label, URL, description, order |
 | REST source catalogs | Every [catalog](19-rest-data-sources.md#rest-source-catalogs) with its services |
 | SQL scripts, blueprints, data generators | The SQL Workshop's saved work |
+| Data Reporter datasets | Every [dataset](#data-reporter-datasets-and-reporting-applications) (sprint 110) |
 
 Never in the file: the workspace's name, its [isolation](#isolated-workspaces) and database roles, passwords and
 secrets, script runs and other history. **Applications are exported on their own** (an application's *Export*).
@@ -213,7 +220,8 @@ longer sign in. Delete a workspace only when it is shared and empty; its logins
 
 Every builder page has the same frame, modelled on an IDE:
 
-- **The icon rail** on the left: App Builder, SQL Workshop, [App Gallery](#app-gallery), **Search** (on the
+- **The icon rail** on the left: Home (the [Workspace home](#workspace-home); the logo leads there too), App Builder,
+  SQL Workshop, [App Gallery](#app-gallery), [Data Reporter](#data-reporter-datasets-and-reporting-applications), **Search** (on the
   pages of an application); at the bottom the **Administration** menu (Workspace utilities; for administrators of the
   current workspace *Manage service*: [workspace message and environment banner](#workspace-message-and-environment-banner),
   [workspace utilization](#workspace-utilization) and the workspace's page; Manage users and groups, Developers,
@@ -235,7 +243,9 @@ On phones the rail gets narrower and the breadcrumb shows only the current page.
 
 The builder's look comes from design tokens at the top of `public/builder.css` (sprint 105): CSS custom properties
 for colours (a warm neutral palette with the kiln's ember for primary buttons, links, focus rings and selections),
-surfaces and their shadows, corner radii, the type scale and transitions, in a light and a dark set. The rail, the
+surfaces and their shadows, corner radii, the type scale and transitions, in a light and a dark set; the code editor's syntax colours (`--ce-*`: keywords, strings, numbers, comments, binds,
+quoted names, operators, the matching bracket, the current line, the selection and the line numbers) are tokens there
+too (sprint 108). The rail, the
 toolbar and the status bar stay dark in both themes. Transitions are switched off when the operating system asks
 for reduced motion. The builder uses the system's fonts (Inter when it is installed); it loads nothing from
 other sites.
@@ -245,9 +255,43 @@ application of a workspace you are not a member of) shows a **Page not found** p
 theme with a link to the App Builder home; a server error shows **Something went wrong** (the error
 is in the server log, not on the page). Scripts get the plain answers they always got.
 
+## Workspace home
+
+(sprint 109; APEX: the workspace home page) The page the builder opens after signing in, `/builder/home`, above the
+App Builder and the SQL Workshop. Everything on it is of the current [workspace](#workspaces), and it works without
+JavaScript. The [default-password banner](#signing-in-and-developer-accounts) stays on top until the password is changed.
+
+- **Tool cards**: App Builder (`/builder/apps`), SQL Workshop (not when the workspace's preferences turn it off),
+  **Data Reporter** (when the server has the Data Reporter tool at `/builder/reporter`) and the [App Gallery](#app-gallery).
+- **Workspace message**: the [workspace message](#workspace-message-and-environment-banner), plain text. The
+  workspace's administrators (and the installation's) edit it in place with **Edit message**; empty removes it.
+- **Summary**: the number of applications (opens the App Builder), tables in the schemas the workspace's database
+  roles may use (opens the Object Browser), developers (opens Developers) and reporting applications (applications
+  made by [Data Reporter](#data-reporter-datasets-and-reporting-applications) → *Create reporting application*; opens
+  the Data Reporter).
+- **Activity**: **Top applications** (page views and users), **Top users** and **Top developers** (page views by the
+  workspace's developers and the installation's administrators in its applications) over **1 hour**, **1 day** (the
+  default) or **1 week**. The timeframe is remembered for each developer (`meta.developer.home_timeframe`).
+- **System message**: the pgkiln version the server runs and, when the [release check](#the-release-check) is on and
+  a newer release is out, **pgkiln X is available** with a link to its release notes and how to upgrade (back up,
+  install the new version, `pgkiln migrate`, restart).
+- **A side column**: About, **Learn more** (this guide, the [tutorial](10-tutorial.md),
+  [Coming from APEX](11-from-apex.md), the changelog and the discussions on GitHub) and Resources.
+
+### The release check
+
+Off by default. When it is on, the server asks GitHub's releases API (`api.github.com`) for the latest pgkiln release,
+at most once a day per server process (an hour after a failure), with a 5-second timeout and a 1 MB limit; nothing
+about the installation is sent. Pages never wait for it: they show what was fetched last and refresh it in the
+background. Administrators turn it on or off on the Workspace home (**Check for new versions**, **Check now**,
+**Turn off**) or on Workspace utilities → **Instance settings** → *New versions* (*On*, *Off*, or *As the environment
+says*: the variable `PGKILN_RELEASE_CHECK`, [chapter 1](01-installation.md#configuration-reference)). Leave it off on a server
+that may not reach the internet. Under the test runner the server never asks GitHub.
+
 ## App Builder home
 
-The home page is laid out like APEX's App Builder:
+The App Builder's home page, `/builder/apps` (`/builder` shows it too, unless the workspace's
+[preferences](#workspace-preferences) send `/builder` to the Workspace home), is laid out like APEX's App Builder:
 
 - **Four tiles**: **Create** and **Import** (each on its own page), the workspace **Dashboard**
   (applications, pages, active accounts; page views, users, failed sign-ins and errors of the last
@@ -290,6 +334,49 @@ The **App Gallery** (the cube in the icon rail, `/builder/gallery`; APEX: App Ga
 
 The list is `examples/gallery/gallery.json`; add your own starters there as blueprint files.
 
+## Data Reporter: datasets and reporting applications
+
+**Data Reporter** in the icon rail (`/builder/reporter`, sprint 110; APEX 26.1: Data Reporter as a workspace tool)
+gives business users reports on the workspace's data without a developer writing a page per question. Every
+developer of the workspace manages it; the page lists the workspace's **datasets** and its **reporting
+applications** (with their users and published reports).
+
+A **dataset** (`meta.dataset`, per workspace) is a trusted view of the data: tables and views of one schema, joined,
+the columns users may see, and a row filter.
+
+- **New dataset**: choose a schema (those your [SQL Workshop](#sql-workshop) connection may use; never pgkiln's own
+  or the system's), tick tables and views (the first is the main one) and give it a name (lower case, it can't
+  change) and a label. **Joins are proposed from foreign keys** in either direction (a left join on the key's
+  columns); every column is offered, labelled from its name, numbers with a number mask.
+- **The dataset's page**: its label and description; the tables with their joins (to an earlier table, left or
+  inner, *on* `column = its column`; add a table, remove one); the **columns** (offer or not, a name reports use, a
+  label, a [format mask](14-globalization.md) and a description users see in the report editor); up to five
+  **row filter** conditions (column, operator, value) that every report on it gets; the **query** it builds, and a
+  **preview** of ten rows (read only, through your SQL Workshop connection). The dataset is checked against the
+  database when it is saved: tables, views and columns must exist; the page says what doesn't match (any more).
+- **Download** one dataset or **Export all** as a file (`*.dataset.json`, format `pgkiln-dataset/1`); **Import**
+  reads such a file (or pasted text) in one transaction: each dataset is checked against this installation's
+  database, and one with the same name is kept unless you choose *Replace*. Datasets also travel in the
+  [workspace export](#export-and-import); they are not part of an application's export.
+
+**Create reporting application** (on a dataset's row or page: the form is filled in, so *Create* is the second
+click) makes an application of type *Reporting* on one or more datasets: page 1 is a
+[Data Reporter](04-pages-and-regions.md#data_reporter-data-reporter) region offering the datasets, users sign in with
+their accounts of the [user directory](#users-the-user-directory), and the first administrator is the account you
+name (yours by default). Its database role `app_<alias>` may only **read** (SELECT) the datasets' tables and views,
+so every report runs through those grants and [row level security](08-security.md) (a view with
+`security_invoker` needs grants on its own tables too: grant them to the role yourself). Give accounts access and
+roles under the application's *Users and roles*:
+
+| Role | May |
+|---|---|
+| viewer (or no role) | Open published reports (by their stable URL too), pin them |
+| editor | Also build reports, save them, publish and unpublish their own |
+| administrator | Also unpublish and delete anyone's reports |
+
+The application is an ordinary pgkiln application otherwise: change its pages, theme or sign-in in the builder as
+you like. `meta.reporting_app_count(workspace_id)` counts a workspace's reporting applications.
+
 ### Creating an application
 
 **Create** (a tile, or `/builder/create`) is one page, like APEX's Create Application wizard. Links at the top
@@ -704,7 +791,13 @@ handlers, the SQL Workshop and the import box) opens in a small code editor:
   binds, `&ITEM.` substitutions, `$$` bodies), JSON and HTML (tags, attributes, `&ITEM.` and
   `{{tags}}`). The language follows the component type: a `static` region's source is HTML, a
   `regex` validation is plain text, an `execute_sql` dynamic action is PL/pgSQL.
-- **Line numbers**, the line and column of the cursor, and the **matching bracket** marked.
+- **Line numbers**, the line and column of the cursor, the **current line** (a band and its number in bold
+  while the field has the focus) and the **matching bracket** marked.
+- **Colours from the builder's theme** (sprint 108): keywords take the kiln's ember, types, functions, strings,
+  numbers, binds and quoted names cool hues, comments a muted grey, each at least 4.5:1 (WCAG AA) on the editor's
+  background in the light and the dark theme. Read-only SQL (the Object Browser's DDL and source tabs, the Data
+  Modeler's DDL, generated SQL in Quick SQL, Query Builder, Scheduling, Database Users and the table editor, the SQL
+  Monitor's text, a saved chart's query, the Change Log, a script's results) is highlighted the same way.
 - **Tab / Shift+Tab** indent and outdent (the selected lines, too); **Enter** keeps the
   indentation and indents after `(`, `begin`, `loop`, `then`; brackets and quotes are closed for
   you and typing the closer steps over it. Press **Escape, then Tab** to move on to the next field.
@@ -748,7 +841,7 @@ out, other keys are kept, columns the query no longer returns stay listed so you
 | `display_selector` | Tabs or a select list, "Show all", remember the choice; per other region of the page: in a tab and the tab name (saved in that region's settings) |
 | `ai_assistant` | The AI service (those the application may use), system prompt, welcome text, placeholder, error message, tool rounds per question, questions per conversation, public or not, and the context queries and tools as JSON (checked when saving: query shapes, parameter types, REST data sources and authorization schemes that exist) ([AI assistant](04-pages-and-regions.md#ai_assistant-ai-assistant)) |
 | `report` (also) | *Ask in your own words (AI)*: the AI service and placeholder of the [natural-language filters](04-pages-and-regions.md#natural-language-filters-ask-in-your-own-words) |
-| `data_reporter` | Data sources (a table or view each: static id, label, description, offered columns with labels and format masks), who may share reports, rows per page ([Data Reporter](04-pages-and-regions.md#data_reporter-data-reporter)) |
+| `data_reporter` | Data sources (a table or view each: static id, label, description, offered columns with labels and format masks; or (sprint 110) a dataset of the workspace), who may share, build and moderate reports, publishing, rows per page ([Data Reporter](04-pages-and-regions.md#data_reporter-data-reporter)) |
 | `form_designer` | Who may design forms (an authorization scheme), data sources (a table or view each: static id, label, description, key column, may add / change / delete rows, offered columns with labels and lists of values), rows per page ([Form Designer](04-pages-and-regions.md#form_designer-form-designer)) |
 
 Links, lists of values and the facets' report are checked when saving: a form can only point to
@@ -955,6 +1048,7 @@ application has a **type** (Settings → Application type):
 | Theme application | Offers its theme (colours, navigation, light/dark settings and the Theme Roller's styles) and its template components to other applications |
 | Library application | Offers its lists of values, authorization schemes, build options, template components and lists (with their entries) to other applications |
 | Boilerplate application | A starting point: **Create** offers it under *Start from* |
+| Reporting application | (sprint 110) Made by [App Builder → Data Reporter](#data-reporter-datasets-and-reporting-applications) on datasets: its users build, publish and share reports |
 
 **Shared Components → Subscriptions** subscribes the application to one of those components: it is
 copied now (replacing a component with the same name) and remembered as a subscription. The page
@@ -1381,11 +1475,41 @@ the SQL Workshop's connection may use. Without JavaScript the header's field ope
     (**Ctrl + F**, **Ctrl + H**) with a regular expression or exact case, **Go to line** (**Ctrl + G**), and
     **Ctrl + /** comments the selected lines out or in. The **?** menu lists every key; **F1** opens this help. The
     upload button opens Load Data for the navigator's schema.
-  - Each statement commits on its own. Statements run as the **owner connection** (an isolated workspace's
+  - Each statement commits on its own (**Autocommit**, like Database Actions). Statements run as the **owner connection** (an isolated workspace's
     developer login for its developers), on a connection of their own that is closed afterwards, so `SET ROLE` or
     `SET search_path` doesn't leak. **Run as** picks an application of your workspace instead: the statements then
     run as its database role, with `pgkiln.app_id` set, so its grants and row level security policies apply. Use
-    it to test policies; it is no security boundary, since the SQL could `RESET ROLE`.
+    it to test policies; it is no security boundary, since the SQL could `RESET ROLE`. A `BEGIN` typed in
+    Autocommit lasts for the run only: `begin; …; commit;` in one Run Script works, but a transaction still open at
+    the end of the run is rolled back, with a warning under *Notices*.
+  - (sprint 107) **Transaction mode** (more than Database Actions, which always autocommits): the toolbar's
+    **Commit** menu switches a worksheet tab between *Autocommit* and *Transaction*. In Transaction mode the tab's
+    statements (Run Statement and Run Script) stay in one transaction on a connection of its own until you press
+    **Commit** or **Rollback**: a SELECT in the same tab sees the changes, other sessions (and your other tabs) don't
+    until you commit. A badge shows *Transaction open*, the number of statements and its age; after a reload it shows
+    the server's real state, and leaving the page with an open transaction asks first.
+    - `COMMIT` or `ROLLBACK` typed in the editor end the transaction too (the next run starts a new one); a `BEGIN`
+      typed inside it only warns. Statements PostgreSQL refuses inside a transaction (`VACUUM`, `CREATE INDEX
+      CONCURRENTLY`, `ALTER SYSTEM`, `CREATE DATABASE`, …) are refused before they run, so they can't abort it.
+    - A statement that fails leaves the transaction **aborted** (*Transaction failed*): every later statement fails
+      until **Rollback**; Commit then rolls back as well, and says so.
+    - **Explain Plan** and **Autotrace** run inside the open transaction behind a savepoint: the plan sees its changes,
+      Autotrace's own changes are undone and the transaction stays as it was.
+    - **Run as**: the transaction keeps the role it started with. Changing *Run as* while it is open is refused:
+      commit or roll back first. `SET ROLE` typed in the editor reaches only the roles of the connection's login, as
+      in Autocommit.
+    - DDL reaches the **Change Log** when the transaction commits, never when it is rolled back. SQL History records
+      each statement as it runs.
+    - The transaction is **rolled back** when it is left without a run for `WORKSHEET_TXN_IDLE_SECONDS` (default
+      300, five minutes; the badge and the next run say so), when you close its worksheet tab or switch it to
+      Autocommit (after asking), sign out, switch workspaces, and when the server stops. The database ends the
+      connection itself a minute later (`idle_in_transaction_session_timeout`) should the server not.
+    - Each open transaction holds a database connection outside the pools: a developer has at most
+      `WORKSHEET_TXN_MAX_PER_DEVELOPER` (default 3) and the server `WORKSHEET_TXN_MAX` (default 20); past that a run in
+      Transaction mode is refused. A transaction belongs to the builder session, workspace and worksheet tab that
+      started it: another developer, or another sign-in of yours, never reaches it. It lives in the server's memory,
+      so with several pgkiln servers behind a load balancer the browser must stay on one (sticky sessions).
+    - Without JavaScript the worksheet runs in Autocommit only.
   - With script, the panes fill the window. Drag the splitters (or focus one and use the arrow keys) to resize
     them, hide the navigator, or use **Fullscreen** to see only the editor (**Escape** leaves). Sizes are
     remembered in the browser. Without script, the buttons post the form and the panes stack; Run Statement then
@@ -1453,8 +1577,9 @@ the SQL Workshop's connection may use. Without JavaScript the header's field ope
   when the foreign key may be empty. A box's name opens **Table Properties** (a view: the Object
   Browser). The toolbar: **Save** (Ctrl+S), **Undo** / **Redo** (Ctrl+Z, Ctrl+Y), **Zoom out** / **Zoom
   in** (or Ctrl+wheel), **Fit**, **Auto layout** (referenced tables to the left of the tables that
-  reference them; undoable), a **Mini-map** (click or drag in it to move around), **SVG** and **PNG**
-  exports of the diagram as shown, **Print**, **Generate DDL** (the CREATE statements of the shown
+  reference them; undoable), a **Mini-map** (click or drag in it to move around; the button shows when it is on),
+  **SVG** and **PNG** exports of the diagram as shown (in light colours, whichever theme the builder uses; on screen the
+  boxes, lines and mini-map follow the light or dark theme), **Print**, **Generate DDL** (the CREATE statements of the shown
   objects with their keys, indexes, triggers, row level security, policies, comments and grants: to
   download or open in the SQL Worksheet) and **Data dictionary** (each object's columns with type,
   nullability, default, keys and comments, its constraints and what references it; to print, save as
@@ -1526,6 +1651,10 @@ the SQL Workshop's connection may use. Without JavaScript the header's field ope
   **Flyway** versioned migrations (`V0001__add_bonus.sql`; several in a zip), a **Liquibase** formatted SQL changelog
   (`--liquibase formatted sql`, `--changeset author:0001-add_bonus`) or one plain SQL script; each change set also
   has its own Flyway file. Change sets belong to the workspace and are not part of an application export.
+- **JavaScript (MLE)**: not planned. Database Actions has a JavaScript tool for Oracle's Multilingual Engine;
+  PostgreSQL runs JavaScript in the database only through the [plv8](15-extensions.md) extension. Where plv8 is
+  installed, write `create function … language plv8` in the SQL Worksheet like any other function: the navigator,
+  the Object Browser and Quick DDL show it. pgkiln adds no JavaScript editor of its own.
 - **Utilities** (`/builder/sql/utilities`; APEX: SQL Workshop → Utilities): tiles for Load and Unload Data, Sample
   Data, the Query Builder, DDL and Compare, and three pages of their own. Each runs in a read-only transaction with a
   15-second statement timeout, on the SQL Workshop's connection (an isolated workspace's developers see only the

package/docs/guide/04-pages-and-regions.md

@@ -1186,9 +1186,12 @@ Attributes (written by the region's **Settings**):
 
 | Key | Default | Meaning |
 |---|---|---|
-| `sources` | | `[{"id": "orders", "label": "Orders", "description": "…", "schema": "sales", "table": "order_v", "columns": [{"name": "total", "label": "Total", "format": "FML999G990D00"}]}]` |
+| `sources` | | `[{"id": "orders", "label": "Orders", "description": "…", "schema": "sales", "table": "order_v", "columns": [{"name": "total", "label": "Total", "format": "FML999G990D00"}]}]`; (sprint 110) or a dataset: `{"id": "sales", "dataset": "sales"}` (label and description optional) |
 | `sharing` | `true` | `false`: reports stay private |
 | `share_authz` | | An authorization scheme: only users that pass it may share reports |
+| `edit_authz` | | (sprint 110) An authorization scheme: only users that pass it build, change, save and delete reports; the others only run shared ones |
+| `admin_authz` | | (sprint 110) An authorization scheme: users that pass it unpublish and delete anyone's reports |
+| `publishing` | `false` | (sprint 110) `true`: shared reports are *published*: a stable URL, Publish / Unpublish buttons, pins |
 | `page_size` | `25` | Rows per page of a detail report (5 to 200) |
 | `welcome` | `true` | `false`: the compact start (a list of sources and *Start*) instead of the welcome page |
 | `welcome_title`, `welcome_text` | | The welcome page's greeting instead of pgkiln's (translated like other application texts) |
@@ -1200,6 +1203,27 @@ region when an application is replaced. The HR example's page 36 (*My reports*)
 (a view without the user name and photo columns) and leave requests (row level security: an
 employee sees only their own), with King's shared report *Salary by department*.
 
+#### Datasets and reporting applications
+
+(sprint 110) A source may be a **dataset** of the workspace ([App Builder → Data
+Reporter](03-builder.md#data-reporter-datasets-and-reporting-applications)): tables and views of one schema with
+their joins, the offered columns with labels, format masks and descriptions (shown under the column in the editor),
+and a row filter. The region's Settings add one under *Add a data source → Or a dataset of the workspace*. The
+runtime reads the dataset when the page is drawn and builds its SELECT from the definition (identifiers quoted,
+values escaped literals, operators from the whitelist), and the report runs on it as a subquery, as the
+application's database role. A dataset that was deleted disappears from the region; a column that no longer exists
+makes the report show an error.
+
+With **`publishing`**, shared reports are *published*: an editor saves a report privately and **Publishes** it
+(or ticks *Publish for all users* when saving), and **Unpublishes** it again. A published report has a **stable
+URL**, `/a/<alias>/reports/<id>`, shown on the report: it opens the report on its page (signing in first), so it
+can be bookmarked or sent. Every signed-in user may **Pin** a published report: pinned reports come first on the
+welcome page (a [preference](06-processing.md) of the user, `reporter.pins.<region>`). Users that don't pass
+`edit_authz` see only the published reports: no *New report* cards, no editor (report parameters in the URL are
+ignored), no saving. Users that pass `admin_authz` unpublish and delete anyone's reports. The HR example's dataset
+`hr` (`examples/hr/hr_63_datasets.sql`: employees with their department, active ones only) is the one a reporting
+application is made from in the guide's chapter 3.
+
 ### `form_designer` (Form Designer)
 
 A **Form Designer** region (sprint 85; pgkiln's own, APEX has no counterpart) lets the application's