pgkiln 0.54.0 → 0.55.0

package/SECURITY.md

@@ -109,6 +109,7 @@ first version (MVP). Every finding below has a regression test in
 | Mail queue, workspace mail and network access (sprint 118) | Administration → Mail queue: administrators see every workspace, a workspace's administrators only their current workspace's applications, other developers get 403; Retry and Purge (one mail or all failed) check the mail's workspace again on the server and need the CSRF token; bodies and attachments are never shown. A workspace's own mail service is managed by its administrators only; its secret is encrypted like a web credential's, write-only, never shown or exported (not in the workspace export); it has no API base URL or token URL, and its SMTP host must pass the installation's allow-list and the workspace's network access list and resolve to a public address (unless `PGKILN_REST_PRIVATE_HOSTS` lists it), resolved once and connected to by that address (no DNS rebinding). A workspace's network access list narrows `PGKILN_REST_ALLOWED_HOSTS` on the server for every outgoing web call of its applications (`meta.web_request`, REST data sources incl. write-back and the response cache, invoke API, token endpoints, object storage, the builder's Test, REST source catalogs), on every redirect hop; it can't widen the installation's list or the private-address checks. Refusals go to the debug log and `meta.network_refusal` (7 days). Also fixed: *REST source catalogs → read from a URL* fetched the URL before checking the developer's session (any visitor could make the server call an allowed host); it is now read only after the developer and CSRF checks. |
 | Data security per table (sprint 119) | SQL Workshop → a table → Security writes `GRANT` / `REVOKE` and a masking view, so it needs a signed-in developer and the CSRF token, and works only on tables of the workspace's schemas (never pgkiln's own or the system's: 404). Table, column, view and role names reach SQL quoted; view names and application roles that could break out of their quotes are refused. The masking role is `nologin`, a member of the reader roles, so row level security still applies inside the view, and the generated SQL refuses to run when that role would bypass RLS. MCP `run_query` with an application runs as that application's database role (read-only) and refuses unknown applications. |
 | App Gallery (sprint 120) | Installing a sample app runs shipped SQL as the owner, so only administrators may, with the CSRF token, into their current workspace; a request names only a key of `gallery.json` of its own kind (sample, starter, utility), never a path, and the file names in the catalogue must match fixed patterns. The script and the workspace placement run in one transaction: a failing script leaves nothing behind. Utility apps are blueprints: any developer installs one into their own workspace, only after the review. An installed sample is edited only from its own workspace. The search term is escaped. |
+| Builder language (sprint 121) | Only the codes of the builder's languages are accepted: anything else on a sign-in link is ignored (also a repeated parameter), the status bar's menu refuses it (400) and checks the CSRF token. A sign-in link sets only an HttpOnly, SameSite=Lax cookie that the sign-in page reads; a developer's stored choice changes only through their own signed-in session. Translated texts are escaped like the English ones; placeholders are filled with escaped values unless the code passes markup on purpose (`tx.rich`). |
 
 ## Findings of the MVP review and their fixes
 

package/db/migrations/127_builder_language.sql

@@ -0,0 +1,16 @@
+-- ---------------------------------------------------------------------
+-- 127: the builder in more languages (sprint 121, WS-7; APEX: the
+-- builder's language links on the sign-in page and the workspace home).
+--
+-- meta.developer.language: the builder language each developer chose (the
+-- language menu in the builder's status bar, or a language link on the
+-- builder's sign-in page); null = English. The builder's own texts are
+-- message files in src/builder/i18n/ (en, de, es, fr, nl, pt); the check
+-- keeps the column to codes of that shape, the server accepts only the
+-- languages it has. A developer account is installation data: not
+-- exported with an application or a workspace.
+-- ---------------------------------------------------------------------
+alter table meta.developer
+  add column language text check (language ~ '^[a-z]{2}(-[A-Z]{2})?$');
+comment on column meta.developer.language is
+  'The developer''s builder language (127): en, de, es, fr, nl or pt; null = English.';

package/docs/apex-feature-parity.md

@@ -23,8 +23,8 @@ Last reviewed: 2026-10-20 against **APEX 26.2** (sprint 120: the App Gallery's s
 | Data and integration | 13 | 0 | 0 | 2 | REST source catalogs from OpenAPI documents; Generate DDL and schema comparison; `meta.data_export` and data export downloads (CSV, JSON, XML, HTML, Excel, PDF); e-mail through SMTP (password or OAuth2), Microsoft Graph, Amazon SES and HTTP APIs; REST APIs via PostgREST, REST data sources that write back and synchronise, web credentials with OAuth2 grants, CSV/XLSX/JSON/XML loading with saved definitions and unloading, SQL scripts and Quick SQL, report PDFs and document templates |
 | Workflow, automation and AI | 6 | 0 | 0 | 0 | Scheduled automations with several actions and runs from SQL, approvals, a task list and workflows with parallel branches, versions and invoke-API steps; AI with Claude or OpenAI: *Generate text with AI*, an assistant region with tools, natural-language report filters and blueprints |
 | Administration | 14 | 0 | 0 | 0 | An APEX-like sign-in with a workspace and a Workspace home; a mail queue dashboard, a workspace's own mail service and network access list (26.1 / 26.2); a workspace's components exported and imported as one file; workspace message, environment banner and utilization; isolated workspaces with their own database logins and roles, and workspace administrators; application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Top SQL per app; debug messages per request; an install/upgrade log |
-| APEX 26.2 workspace (WS-1 … WS-13) | 12 | 0 | 1 | 1 | Workspace home, Data Reporter as a workspace tool, Team Development, AI Agents, AI interactive reports, Workflow 26.2, the mail queue, workspace mail and network access, the 26.1 component details, the App Builder list's details, the Pillar navigation appearances and data security per table (rows, columns and masked values), the App Gallery's single-topic sample apps, UX Pattern Catalog and Utility Apps; not yet: the builder in more languages |
-| **Total** | **160** | **0** | **1** | **4** | 165 APEX features compared: 97% available, one missing (the open 26.2 workspace item WS-7) |
+| APEX 26.2 workspace (WS-1 … WS-13) | 13 | 0 | 0 | 1 | Workspace home, Data Reporter as a workspace tool, Team Development, AI Agents, AI interactive reports, Workflow 26.2, the mail queue, workspace mail and network access, the 26.1 component details, the App Builder list's details, the Pillar navigation appearances and data security per table (rows, columns and masked values), the App Gallery's single-topic sample apps, UX Pattern Catalog and Utility Apps; the builder in six languages |
+| **Total** | **161** | **0** | **0** | **4** | 165 APEX features compared: 98% available, none missing, 4 deliberately not planned |
 
 (Counts are of the rows in the tables below. A review on 2026-10-06 added 18 rows for APEX features that were
 not compared before, one on 2026-10-12 added two more (property help, application availability), and one on
@@ -221,7 +221,7 @@ the 26.2 comparison.)
 
 | APEX | pgkiln | Notes |
 |---|---|---|
-| Developer accounts, workspace sign-in | ✅ | (sprint 61) The builder's sign-in page like APEX's: workspace (optional; it becomes the current one, a wrong one answers like a wrong password), username, password with a Show button, *Remember workspace and username*, a link to Administration. (sprint 68) **Find my workspace**: developers' e-mail addresses, and a mail with their workspaces through the builder's mail service (the same answer for every address, limited per address and IP). **Missing:** the sign-in page's language links (the builder is in English only) |
+| Developer accounts, workspace sign-in | ✅ | (sprint 61) The builder's sign-in page like APEX's: workspace (optional; it becomes the current one, a wrong one answers like a wrong password), username, password with a Show button, *Remember workspace and username*, a link to Administration. (sprint 68) **Find my workspace**: developers' e-mail addresses, and a mail with their workspaces through the builder's mail service (the same answer for every address, limited per address and IP). (sprint 121) The sign-in page's language links: Deutsch, English, Español, Français, Nederlands, Português (WS-7) |
 | Workspace home (tool cards, top apps and users, summary, workspace and system message) | ✅ | (sprint 109) `/builder/home` opens after sign-in ([chapter 3](guide/03-builder.md#workspace-home)): App Builder, SQL Workshop, Data Reporter and App Gallery cards; the workspace message edited in place; a Summary of applications, tables, developers and reporting applications; top applications, users and developers over an hour, a day or a week; a system message with the server's version and, with the optional release check (`PGKILN_RELEASE_CHECK`, off by default), *pgkiln X is available*. The App Builder moved to `/builder/apps`; `/builder` opens either, per workspace. |
 | Workspace message, environment banner, workspace utilization, preferences and extension links (Manage Service) | ✅ | (sprint 61) An **Administration** menu in the icon rail; administrators and workspace administrators set a **workspace message** (on the App Builder home) and an **environment banner** (a coloured label on every builder page of the workspace), and see **workspace utilization** (applications, pages, page views, users, static files, schema storage) ([chapter 3](guide/03-builder.md#workspace-message-and-environment-banner)). (sprint 62) **Workspace preferences**: the SQL Workshop and the applications' RESTful services (REST modules) on or off per workspace; **extension links** in an Extensions menu of the rail ([chapter 3](guide/03-builder.md#workspace-preferences)). **Missing:** the account login controls of APEX's preferences (pgkiln's password policy and sign-in throttling are installation-wide) |
 | Instance administration, install/upgrade logs (26.1) | ✅ | Versioned migrations (`npm run db:migrate`), every run logged; Workspace utilities → **Installation** (administrators): server version, install and upgrade runs with errors, applied migrations, and warnings for migrations the database misses or the server doesn't know ([chapter 3](guide/03-builder.md)). Workspace utilities → **Instance settings**: session length and sign-in throttling (stored in the database, over the environment variables) and an overview of the server's configuration without secrets; a server whose database lacks migrations says so (503) or applies them (`MIGRATE_ON_START`). Other settings stay environment variables |
@@ -249,7 +249,7 @@ row above where there is one.
 | WS-4 AI Agents with tools | ✅ | (sprint 111) AI Agents and AI Tools as shared components, a Navigate tool, Gemini and OpenAI-compatible services ([Workflow, automation and AI](#workflow-automation-and-ai)) |
 | WS-5 AI interactive reports: chips, computed columns | ✅ | (sprint 112) *Ask in your own words* with chips, Undo and computed columns; a phrase parser that needs no AI service. Not yet: phrases mapped to facets and smart filters |
 | WS-6 Workflow 26.2: outcomes, migrating running instances, drafts, diagram export | ✅ | (sprint 114) Custom task outcomes, task events, Send E-Mail and draft steps, migrating running instances, the diagram as SVG / PNG ([Workflow, automation and AI](#workflow-automation-and-ai)) |
-| WS-7 The builder in more languages | ❌ | Applications have twenty-two built-in languages; the builder and its sign-in page are English only |
+| WS-7 The builder in more languages | ✅ | (sprint 121) The builder in Deutsch, English, Español, Français, Nederlands and Português: links on the sign-in page, a language menu in the status bar, the choice stored per developer (migration 127). Translated: the builder's frame, sign-in page, Workspace home, App Builder home, an application's home and tabs, the Page Designer's toolbar, menus, tree and gallery, the SQL Workshop's home and tabs; other screens move over incrementally (English until then). Builder texts are keyed message files with a coverage check in CI |
 | WS-8 App Gallery: more sample apps, Utility Apps | ✅ | (sprint 120) Four tabs with counts and a search that also works without JavaScript ([chapter 3](guide/03-builder.md#app-gallery)). *Sample Apps*: HR Demo, Tasks, six single-topic apps (Sample Charts, Sample Cards, Sample Calendar, Sample Interactive Grids, Sample Dynamic Actions, Sample Reporting) and the **UX Pattern Catalog**, each with its own schema, data, demo account and explanatory texts, installed by administrators from one SQL file in one transaction; *Utility Apps*: Lookup Lists, Release Notes and Announcements as blueprints any developer installs into the workspace. APEX's 27 sample apps include topics pgkiln shows in HR Demo instead (maps, approvals, workflows, REST); no remote catalogue |
 | WS-9 Mail queue reporting, workspace SMTP, workspace network ACLs | ✅ | (sprint 118) Administration → Mail queue (per hour and per workspace / application, the slowest provider calls, failures with the provider's answer, Retry and Purge), a workspace's own mail service, and a workspace's network access list that narrows the installation's allow-list for every outgoing call ([Administration](#administration)) |
 | WS-10 Universal Theme 26.2: Pillar appearances, navigation polish | ✅ | (sprint 117) Theme Roller → Navigation appearance Pillar Light / Pillar Dark per application or style, with a header strip colour for light and dark mode; the current page filled, its parents bold with an accent guide line; `u-color-*-subtle` utilities; a lighter processing indicator; RTL mirrored |

package/docs/guide/03-builder.md

@@ -237,7 +237,7 @@ Every builder page has the same frame, modelled on an IDE:
   API, Settings, Search and Advisor, with Export and Run on the right.
 
 - **The status bar** at the bottom: who is signed in, the current [workspace](#workspaces), the database, the
-  builder's language and the pgkiln version.
+  [builder language](#choosing-the-builder-language) (a menu) and the pgkiln version.
 - **An environment banner** (when the current workspace has one) across the top: a coloured band with a label such as
   DEVELOPMENT or TEST, so nobody mistakes one environment for another.
 
@@ -257,6 +257,27 @@ application of a workspace you are not a member of) shows a **Page not found** p
 theme with a link to the App Builder home; a server error shows **Something went wrong** (the error
 is in the server log, not on the page). Scripts get the plain answers they always got.
 
+### Choosing the builder language
+
+(sprint 121, APEX: the builder's language links) The builder speaks **Deutsch, English, Español, Français, Nederlands
+and Português** (Brazilian). English is the default.
+
+- **On the sign-in page** the languages are links under the form: choosing one shows the sign-in page in that
+  language and, when you then sign in, stores it as your builder language. The choice is remembered on this device
+  (a cookie), so the sign-in page keeps it after you sign out.
+- **When signed in**, the language in the status bar at the bottom is a menu: pick another language and the page
+  you are on comes back in it.
+
+The language is stored **per developer** (in your developer account), so it follows you to every session and every
+device; other developers keep their own. It only changes the builder: your applications have their own languages
+(chapter 7).
+
+What is translated: the builder's frame (the rail, the top bar and its search, your account menu, the status bar,
+standard messages and error pages), the sign-in page, the Workspace home, the App Builder home, an application's
+home page and its tabs, the Page Designer's toolbar, menus, component tree, panes and gallery, and the SQL Workshop's
+home page and tabs. Other builder pages are still in English (they move over screen by screen); so are the
+Page Designer's property names and their help, the links to this guide, and any SQL the builder generates.
+
 ## Workspace home
 
 (sprint 109; APEX: the workspace home page) The page the builder opens after signing in, `/builder/home`, above the

package/docs/guide/12-development.md

@@ -263,6 +263,11 @@ src/
   builder/
     components.ts          property spec of every component (drives the property editor)
     ui.ts                  IDE shell (icon rail, toolbar, breadcrumb, status bar), builder theme, form helpers, CSRF check, app tabs
+    i18n.ts                (sprint 121) the builder's own texts: BUILDER_LANGUAGES, tr(s) / translatorFor(lang) → tx(key, params),
+                           tx.rich (markup in a sentence), tx.dyn (keys made at run time), tx.label (known breadcrumb labels)
+    i18n/                  en.ts defines the builder's keys; de, es, fr, nl, pt are Records of the same keys
+    language.ts            (migration 127) the status bar's language menu (POST /builder/language), the sign-in page's
+                           language links (?lang=, a cookie), meta.developer.language
     routes.ts              sign-in, app home, settings, activity, developers, create (POST, via newapp.ts)/import (POST)
     wizards.ts             create page wizards: step 2 forms per page type (defaults from meta.wizard_defaults), POST → meta.generate_page
                            (the generators are PL/pgSQL in migration 047: catalog, defaults, form/cards/calendar/chart/map/facets/master-detail)
@@ -484,6 +489,8 @@ test/
   logic.test.ts            computations, branches, menu buttons and badges, new dynamic actions, build options, export
   page-logic.test.ts       download, chain (background jobs) and workflow processes, function/app branches, dialog_closed (HR page 28)
   code-editor.test.ts      code editor: completions scoped to the app's role, the check, marked fields
+  builder-i18n.test.ts     (sprint 121) builder languages: the coverage check of src/builder against i18n/en.ts, the message
+                           files, Deutsch on the sign-in page, the status bar menu, the choice per developer, English fallback
   builder-home.test.ts     App Builder home: search, sort, views, Recent, Create/Import pages, dashboard, utilities
   app-list.test.ts         (116) the App Builder list's Updated by, working copies and lock; what counts as a change
   import-only.test.ts      (116) pgkiln import --replace --only: a page or component file, refusals
@@ -531,6 +538,7 @@ test/
   ai-mock.ts               a local mock of the Claude Messages API (SSE stream) and OpenAI Chat Completions
   helpers.ts               a cookie-keeping test browser
   e2e/responsive.test.ts   browser tests at phone/tablet/desktop widths (Playwright)
+  e2e/builder-i18n.test.ts (sprint 121) Deutsch on the sign-in page, the status bar's language menu, German screens at 390 px, CSP
   e2e/gallery.test.ts      (sprint 120) the gallery's sample apps: every page at 4 widths, CSP, axe; dynamic actions; the four tabs at 390 px
   e2e/admin-mail-network.test.ts (sprint 118) Mail queue, Network access and a workspace's mail service at 390 px without JavaScript
   e2e/pillar.test.ts       (sprint 117) Pillar appearances: axe in light and dark, subtle colours, current vs parent entry, Arabic RTL, 390 px, preview
@@ -551,6 +559,39 @@ test/
   e2e/ai.test.ts           Generate text with AI on HR page 37 in a browser (mock Claude): dynamic actions without a submit, errors, no JavaScript
 ```
 
+## Builder texts in more languages
+
+(sprint 121) The builder's own texts are keyed messages, like the runtime's: `src/builder/i18n/en.ts` defines every
+key (`<screen>.<what>`, e.g. `rail.app_builder`, `pd.menu.create`, `ab.count` with `{n}`), and `de.ts`, `es.ts`,
+`fr.ts`, `nl.ts` and `pt.ts` are `Record<BuilderKey, string>` of the same keys. A page takes its translator from the
+session and uses it for every text it shows:
+
+```ts
+const tx = tr(s);                                  // the developer's language (meta.developer.language, in the session)
+html`<h2>${tx('wh.summary')}</h2><p>${tx('ab.count', { n: 3 })}</p>`;   // plain text: html`` escapes it
+tx.rich('ab.none_yet', { create: html`<a href="…">${tx('ab.create_one')}</a>` });   // markup inside a sentence
+tx.dyn(`gallery.region.${type}`, REGION_LABELS[type][0]);              // a key made at run time, with a fallback
+```
+
+A missing text falls back to English, never to the raw key. Shared helpers that render chrome take the session as
+an optional last argument (`appHeader(a, 'pages', s)`, `workshopTabs('sql', s)`); `shell()` translates known English
+breadcrumb labels (`tx.label`) so pages that aren't moved yet still get a translated trail.
+
+**Moving a screen over**: replace its literal texts with `tx('key')`, add each key with its English text to `en.ts`
+(keep the English exactly as it was: tests and e2e tests assert it), then add the key to the five other files
+(TypeScript refuses a file with a missing or an unknown key). A sentence with a link is one key with a `{link}`
+placeholder and `tx.rich`, not pieces glued together; a count has a `_one` and a plural key; never lower-case a
+translated label (German nouns). Flash messages are translated where they are set.
+
+**The coverage check** (`test/builder-i18n.test.ts`, part of `npm test` and CI) scans `src/builder/**/*.ts` for
+`tx('…')`, `tx.rich('…')` and `tr(s)('…')` and fails when a key has no English text (templated keys such as
+`` `ago.${unit}` `` must match at least one English key); checks that every region type, item type, button action,
+display position, button position, component kind and SQL Workshop tool has its run-time key; and that every
+language file has exactly the English keys, the same `{placeholders}`, no empty texts and is mostly translated.
+
+Stays English by design: the property editor's field names and help, links to the guide, generated SQL, and pages
+not moved yet. The builder's language is separate from an application's languages (`src/i18n.ts`).
+
 ## Principles
 
 - **User-facing texts go through the translator**: `ctx.locale.t('key')` for pgkiln's own texts (add the key to `en` and `nl` in `src/i18n.ts` and to `src/i18n/de.ts`, `fr.ts`, `es.ts`; TypeScript checks that every language has every key), `ctx.locale.tr(text)` for texts derived from application metadata.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/builder.css

@@ -1545,3 +1545,21 @@ pre.wrap-pre { white-space: pre-wrap; overflow-wrap: anywhere; }
   .gal-tabs a:nth-child(3) { border-left: 1px solid var(--border); border-top: 0; border-radius: 0 0 0 var(--radius); }
   .gal-tabs a:last-child { border-top: 0; border-radius: 0 0 var(--radius) 0; }
 }
+
+/* ---------------------------------------------------------------- (sprint 121) builder language: status bar menu, sign-in links */
+.ide-status .ide-lang { flex: none; }
+.ide-status .ide-lang > summary { display: inline-flex; align-items: center; gap: 6px; cursor: pointer; color: inherit; padding: 2px 4px; border-radius: 4px; }
+.ide-status .ide-lang > summary:hover, .ide-status .ide-lang[open] > summary { color: var(--chrome-text); background: rgb(255 255 255 / 8%); }
+.ide-status .ide-lang > summary:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
+/* the status bar clips (overflow: hidden): the menu opens fixed, above it */
+.ide-status .ide-lang .menu-panel { position: fixed; top: auto; bottom: 34px; left: auto; right: auto; min-width: 200px; font-size: 13px; white-space: normal; }
+.ide-lang-form button { width: 100%; }
+.ide-lang-form button[aria-current="true"] { font-weight: 600; }
+.ide-lang-form .icon, .ide-lang-pad { width: 1em; height: 1em; flex: none; display: inline-block; }
+.signin-langs ul { display: flex; flex-wrap: wrap; justify-content: center; gap: 0.25rem 1rem; margin: 0; padding: 0.75rem 0 0; list-style: none; font-size: 0.85rem; }
+.signin-langs a { color: var(--muted); text-decoration: none; }
+.signin-langs a:hover { color: var(--accent); text-decoration: underline; }
+.signin-langs a[aria-current="true"] { color: var(--text); font-weight: 600; }
+@media (max-width: 640px) { .ide-status .ide-lang .menu-panel { left: 0.5rem; right: 0.5rem; min-width: 0; } }
+/* long compound words of other languages (Workspace-Dienstprogramme) wrap instead of widening a phone's page */
+.ab-tile > *, .stat span { min-width: 0; overflow-wrap: anywhere; hyphens: auto; }

package/public/worksheet.css

@@ -263,8 +263,9 @@ details.menu.obj-menu > summary::before, details.menu.obj-menu > summary::after
 .lp-chips li { display: flex; align-items: center; border: 1px solid var(--border); border-radius: 999px; background: var(--surface); padding-left: 10px; }
 .lp-chips a { display: inline-flex; align-items: center; gap: 6px; text-decoration: none; color: var(--text); padding: 4px 0; font-size: 13px; }
 .lp-recent li { padding-right: 10px; border-style: dashed; }
-.lp-tabs { display: flex; gap: 0; border-bottom: 1px solid var(--border); margin-bottom: 10px; }
-.lp-tabs [role=tab] { border: 0; background: none; color: var(--muted); padding: 7px 12px; font: inherit; cursor: pointer; }
+.lp-tabs { display: flex; gap: 0; border-bottom: 1px solid var(--border); margin-bottom: 10px; overflow-x: auto; scrollbar-width: none; }
+.lp-tabs [role=tab] { border: 0; background: none; color: var(--muted); padding: 7px 12px; font: inherit; cursor: pointer; white-space: nowrap; }
+@media (max-width: 480px) { .lp-tabs [role=tab] { padding: 7px 8px; } }
 .lp-tabs [role=tab][aria-selected=true] { color: var(--text); box-shadow: inset 0 -2px 0 var(--hot); }
 .js .lp-group > h2 { position: absolute; width: 1px; height: 1px; overflow: hidden; clip-path: inset(50%); }
 .lp-list { list-style: none; margin: 0 0 16px; padding: 0; display: grid; grid-template-columns: repeat(auto-fill, minmax(min(100%, 260px), 1fr)); gap: 8px; }

package/src/builder/advisor.ts

@@ -453,7 +453,7 @@ export async function advisorRoutes(app: FastifyInstance) {
           <span class="hit-snippet">${f.entry ? html`<b>${f.field}:</b> ` : ''}${f.message}</span>
         </li>`)}</ul>`
       : html`<div class="alert alert-success" role="status">No problems found.</div>`;
-    const main = html`${appHeader(a, 'advisor')}
+    const main = html`${appHeader(a, 'advisor', s)}
       ${region('Advisor', html`<p class="muted u-mt0">Checked ${checked} pieces of SQL as the role <code>${a.db_role ?? '(owner)'}</code> (planned with EXPLAIN and rolled back, nothing is run), and every reference to pages, items, lists of values, authorization schemes and report layouts.
           ${plpgsqlCheck ? 'PL/pgSQL functions were checked with plpgsql_check.' : html`Install the <code>plpgsql_check</code> extension to check PL/pgSQL functions too.`}</p>
         <p><span class="tag tag-error">${count('error')} errors</span> <span class="tag tag-warning">${count('warning')} warnings</span> <span class="tag tag-info">${count('info')} notes</span>

package/src/builder/ai-agents.ts

@@ -223,7 +223,7 @@ export async function aiAgentRoutes(app: FastifyInstance) {
     const agents = (a.ai_agents ?? []) as AiAgent[];
     const tools = (a.ai_tools ?? []) as AiTool[];
     const problems = definitionProblems(agents, tools);
-    const main = html`${appHeader(a, 'shared')}
+    const main = html`${appHeader(a, 'shared', s)}
       <div class="title-row"><h1>AI Agents</h1></div>
       <p class="muted u-mt0">An agent answers in an AI assistant region and acts only through the tools you give it: SQL queries (read-only, as the application's database role, so row level security applies), PL/pgSQL functions, REST data sources, JavaScript actions in the browser, and links to pages (pgkiln builds the URL and its checksum, only for pages the user may open). What users type and the tools' results go to the agent's AI service. <a href="${BASE}/apps/${a.id}/ai">AI usage</a> lists every tool call.</p>
       ${problems.length ? html`<div class="alert alert-error" role="alert">${problems.join(' ')}</div>` : ''}
@@ -250,7 +250,7 @@ export async function aiAgentRoutes(app: FastifyInstance) {
     const x = name ? ((a.ai_agents ?? []) as AiAgent[]).find((g) => g.name === name) : {};
     if (!x) return reply.code(404).send('Not found');
     const title = name || 'New agent';
-    const main = html`${appHeader(a, 'shared')}<div class="title-row"><h1 class="ai-name">${title}</h1></div>${region('AI agent', await agentForm(a, s, x, name, []))}`;
+    const main = html`${appHeader(a, 'shared', s)}<div class="title-row"><h1 class="ai-name">${title}</h1></div>${region('AI agent', await agentForm(a, s, x, name, []))}`;
     return send(reply, s, shell(s, title, crumbs(a, title), main));
   });
 
@@ -273,7 +273,7 @@ export async function aiAgentRoutes(app: FastifyInstance) {
       return [];
     });
     if (problems.length) {
-      const main = html`${appHeader(a, 'shared')}<div class="title-row"><h1 class="ai-name">${original || 'New agent'}</h1></div>${region('AI agent', await agentForm(a, s, x, original, problems))}`;
+      const main = html`${appHeader(a, 'shared', s)}<div class="title-row"><h1 class="ai-name">${original || 'New agent'}</h1></div>${region('AI agent', await agentForm(a, s, x, original, problems))}`;
       return send(reply.code(422), s, shell(s, original || 'New agent', crumbs(a, original || 'New agent'), main));
     }
     if (original && original !== x.name)
@@ -305,7 +305,7 @@ export async function aiAgentRoutes(app: FastifyInstance) {
     const x = name ? ((a.ai_tools ?? []) as AiTool[]).find((t) => t.name === name) : {};
     if (!x) return reply.code(404).send('Not found');
     const title = name || 'New tool';
-    const main = html`${appHeader(a, 'shared')}<div class="title-row"><h1 class="ai-name">${title}</h1></div>${region('AI tool', await toolForm(a, s, x, name, []))}`;
+    const main = html`${appHeader(a, 'shared', s)}<div class="title-row"><h1 class="ai-name">${title}</h1></div>${region('AI tool', await toolForm(a, s, x, name, []))}`;
     return send(reply, s, shell(s, title, crumbs(a, title), main));
   });
 
@@ -337,7 +337,7 @@ export async function aiAgentRoutes(app: FastifyInstance) {
       return [];
     });
     if (problems.length) {
-      const main = html`${appHeader(a, 'shared')}<div class="title-row"><h1 class="ai-name">${original || 'New tool'}</h1></div>${region('AI tool', await toolForm(a, s, x, original, problems))}`;
+      const main = html`${appHeader(a, 'shared', s)}<div class="title-row"><h1 class="ai-name">${original || 'New tool'}</h1></div>${region('AI tool', await toolForm(a, s, x, original, problems))}`;
       return send(reply.code(422), s, shell(s, original || 'New tool', crumbs(a, original || 'New tool'), main));
     }
     flash(s, 'AI tool saved.');

package/src/builder/ai-builder.ts

@@ -142,7 +142,7 @@ const SQL_SCHEMA = {
 
 async function workshopPage(s: Session, reply: FastifyReply, out: { question?: string; schema?: string; sql?: string; error?: string; result?: Raw }) {
   const list = await schemas(s);
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ai')}
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ai', s)}
     ${await serviceBox(s)}
     <p><a href="${BASE}/sql/ai/describe">Describe tables for AI ▸</a> <span class="muted">(better answers: say what tables and columns mean)</span></p>
     ${out.result ?? ''}
@@ -178,7 +178,7 @@ async function describePage(s: Session, reply: FastifyReply, schema: string, tab
   const t = table ? tables.find((x) => x.table === table) : undefined;
   const noted = new Set((await owner.query<{ t: string }>(`select distinct table_name as t from meta.ai_table_note where schema_name = $1`, [schema])).rows.map((r) => r.t));
   const value = (col: string, current: string | null) => (draft ? (col === '' ? draft.table : draft.columns?.[col]) ?? current ?? '' : current ?? '');
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ai')}
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ai', s)}
     <p><a href="${BASE}/sql/ai">◂ SQL Workshop AI</a></p>
     ${message ?? ''}
     ${region('Describe tables for AI', html`
@@ -225,7 +225,7 @@ async function pagesPage(s: Session, reply: FastifyReply, a: any, description: s
   const tables = (await wizardTables(a.db_role)).filter((t) => t.access).map((t) => t.t);
   const svc = await builderService();
   const kindOptions = WIZARD_KINDS.map(([k, label]): [string, string] => [k, label]);
-  const main = html`${appHeader(a, 'pages')}
+  const main = html`${appHeader(a, 'pages', s)}
     ${message ?? ''}
     ${region('Create pages with AI', html`
       <p class="muted u-mt0">Describe the pages you want. The App Builder's AI service proposes pages of the create page wizards for tables and views the application's role (${a.db_role ?? 'the owner'}) can read; you check the proposals and create the ones you tick. Table and column names, types and <a href="${BASE}/sql/ai/describe">descriptions</a> are sent to the service, never rows.</p>

package/src/builder/api.ts

@@ -116,7 +116,7 @@ async function apiPage(s: Session, a: any, issued?: { token: string; username: s
   ].join('\n');
 
   const check = (ok: boolean, text: Raw | string) => html`<li>${ok ? '✓' : '✗'} ${text}</li>`;
-  const main = html`${appHeader(a, 'api')}
+  const main = html`${appHeader(a, 'api', s)}
     <div class="columns">
       ${region('Setup', html`
         <p class="muted u-mt0">PostgREST runs next to pgkiln and serves the <code>${API_SCHEMA}</code> schema over HTTP. Requests carry a JWT whose <code>role</code> claim is this application’s API role; row level security uses the same <code>meta.app_user()</code> and <code>meta.has_role()</code> as the web pages.</p>

package/src/builder/autorest.ts

@@ -167,7 +167,7 @@ async function listPage(s: Session, q: Record<string, unknown>, problems: string
       <div class="buttons"><button class="btn btn-hot"${usable.length ? '' : raw(' disabled')}>${icon('bolt')} Enable</button></div>
       ${usable.length ? '' : html`<p class="muted">No application of this workspace has a database role to run as.</p>`}
     </form>`;
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('rest')}${restNav('autorest')}
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('rest', s)}${restNav('autorest')}
     <p class="muted">RESTful Services: publish a table or view as REST endpoints (AutoREST). Rows come paged as JSON, with filters; a primary key gives single-row GET, PUT and DELETE. Requests run as the publishing application's database role with the caller as <code>meta.app_user()</code>, so its grants and row level security apply. For tailored endpoints with your own SQL or PL/pgSQL, create a <a href="${BASE}/sql/rest/modules">module</a>.</p>
     ${region('Published objects', table)}
     ${region('Enable a table or view', form)}`;
@@ -227,7 +227,7 @@ async function detailPage(s: Session, o: Row, problems: string[] = []) {
   ].filter(Boolean).join('\n');
   const fetchEx = `const res = await fetch('${base}?limit=10'${o.auth === 'public' ? '' : `, {\n  headers: { Authorization: \`Bearer \${token}\` },\n}`});\nconst { items, has_more } = await res.json();`;
   const openapi = `${publicUrl()}/a/${o.app_alias}/autorest/openapi.json`;
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('rest')}
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('rest', s)}
     <h2 class="u-mb1 wrap-anywhere">${o.schema_name}.${o.object_name} <span class="muted small">${info ? kindLabel(info.kind) : ''} · ${o.enabled ? 'enabled' : 'disabled'}</span></h2>
     ${errorList(problems)}
     ${!o.enabled ? html`<div class="alert alert-info" role="status">Disabled: the endpoints answer 404.</div>` : ''}

package/src/builder/availability.ts

@@ -40,7 +40,7 @@ export async function availabilityRoutes(app: FastifyInstance) {
           'Run only: the builder refuses changes to the application (pages, shared components, settings, restores) until it is set back here. pgkiln import --replace still deploys it.')}
       </div>
       <div class="buttons"><button class="btn btn-hot">Save</button></div></form>`);
-    const main = html`${appHeader(a, 'settings')}<div class="ide-body">${body}</div>`;
+    const main = html`${appHeader(a, 'settings', s)}<div class="ide-body">${body}</div>`;
     return send(reply, s, shell(s, `${a.name} availability`, [['App Builder', BASE], [a.name, `${BASE}/apps/${a.id}`], ['Availability']], main));
   });
 

package/src/builder/backups.ts

@@ -66,7 +66,7 @@ export async function backupRoutes(app: FastifyInstance) {
           <div class="form-grid">${input('keep', 'Backups to keep', a.backups_keep, { type: 'number', help: '0 to 500; 0 makes no backups at all (also not before an import).' })}</div>
           <div class="buttons"><button class="btn">Save</button></div></form>`)}
       </div>`;
-    const main = html`${appHeader(a, 'pages')}<div class="ide-body">${body}</div>`;
+    const main = html`${appHeader(a, 'pages', s)}<div class="ide-body">${body}</div>`;
     return send(reply, s, shell(s, `${a.name} backups`, [['App Builder', BASE], [a.name, `${BASE}/apps/${a.id}`], ['Backups']], main));
   });
 

package/src/builder/changelog.ts

@@ -106,7 +106,7 @@ async function listPage(s: Session, q: Record<string, unknown>) {
         ${exp ? html`<input type="hidden" name="app" value="${exp.id}">` : ''}
         <div class="buttons"><button class="btn btn-hot">${icon('download')} Download migration</button></div></form>`
     : '';
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('changes')}
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('changes', s)}
     <p class="muted">The change log (Liquibase, Flyway): DDL run from the SQL Worksheet, Table Properties and Schema Comparison is kept as change sets per schema, with who ran it and when. Download them as a migration for another database: Flyway versioned files, a Liquibase formatted SQL changelog or a plain script. Only statements that succeeded are kept; data changes (INSERT, UPDATE, DELETE) are not.</p>
     ${nav}
     ${schema ? region(`Change sets of ${schema}`, html`${exportPick}${table}${downloads}`) : region('Change sets', table)}`;

package/src/builder/data-modeler.ts

@@ -87,7 +87,7 @@ async function listPage(req: Req, reply: FastifyReply) {
         <small class="help">Names separated by commas or spaces; <code>*</code> for all, <code>ord*</code> for those starting with ord. You can add more later.</small></div>
     </div>
     <div class="buttons"><button class="btn btn-hot">${icon('plus')} Create diagram</button></div></form>`;
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('modeler')}
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('modeler', s)}
     <p class="muted u-mt0">Relational diagrams of a schema's tables and views: their columns, keys and the foreign keys between them. From a diagram: its DDL and a data dictionary.</p>
     ${region('Diagrams', list)}<div class="u-spacer"></div>${region('Create diagram', create)}`;
   return send(reply, s, shell(s, 'Data Modeler', [['SQL Workshop', `${BASE}/sql`], ['Data Modeler']], main, 'sql'));
@@ -102,7 +102,7 @@ async function diagramPage(req: Req, reply: FastifyReply) {
   const m = await model(s, d);
   const crumbs: [string, string?][] = [['SQL Workshop', `${BASE}/sql`], ['Data Modeler', M], [d.name]];
   if (!m) {
-    const main = html`<h1 class="u-mb1">${d.name}</h1>${workshopTabs('modeler')}<div class="alert alert-error" role="alert">The schema ${d.schema_name} doesn't exist any more, or this workspace can't use it.</div>
+    const main = html`<h1 class="u-mb1">${d.name}</h1>${workshopTabs('modeler', s)}<div class="alert alert-error" role="alert">The schema ${d.schema_name} doesn't exist any more, or this workspace can't use it.</div>
       <form method="post" action="${M}/${d.id}/delete">${csrf(s)}<button class="btn btn-danger" data-confirm="Delete the diagram ${d.name}?">${icon('trash')} Delete the diagram</button></form>`;
     return send(reply, s, shell(s, d.name, crumbs, main, 'sql'));
   }
@@ -151,7 +151,7 @@ async function diagramPage(req: Req, reply: FastifyReply) {
   const settings = html`<details class="dm-settings"><summary>Rename or delete the diagram</summary>
     <form method="post" action="${M}/${d.id}/rename" class="dm-search-row">${csrf(s)}<label class="sr-only" for="f_rename">Name</label><input id="f_rename" name="name" value="${d.name}" maxlength="120" required><button class="btn">${icon('edit')} Rename</button></form>
     <form method="post" action="${M}/${d.id}/delete">${csrf(s)}<button class="btn btn-danger" data-confirm="Delete the diagram ${d.name}? The tables stay as they are.">${icon('trash')} Delete diagram</button></form></details>`;
-  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('modeler')}
+  const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('modeler', s)}
     <div class="dm-head"><h2 class="dm-name">${d.name}</h2><span class="muted small">Schema ${d.schema_name} · ${tables.length} objects · updated ${when(d.updated_at)} by ${d.updated_by ?? d.created_by}</span></div>
     ${missing.length ? html`<div class="alert alert-error" role="alert">Not in ${d.schema_name} any more: ${missing.join(', ')}. Saving the diagram leaves them out.</div>` : ''}
     ${toolbar}
@@ -353,7 +353,7 @@ export async function dataModelerRoutes(app: FastifyInstance) {
     const script = diagramDdl(d.schema_name, new Set(m.tables.map((t) => t.name)), await readSchema(m.db.pool, d.schema_name));
     if (req.query.download === '1')
       return reply.header('content-disposition', `attachment; filename="${fileName(d.name)}.sql"`).type('application/sql; charset=utf-8').send(script);
-    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('modeler')}
+    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('modeler', s)}
       ${region(`DDL of ${d.name}`, html`<p class="muted u-mt0">The CREATE statements of the diagram's ${m.tables.length} objects in schema ${d.schema_name}: tables, their keys, indexes, triggers, row level security, policies, comments and grants, and views. Review before running.</p>
         <pre class="source" data-code-view="sql" tabindex="0" aria-label="DDL">${script}</pre>
         <form method="post" action="${BASE}/sql">${csrf(s)}<input type="hidden" name="sql" value="${script}">

package/src/builder/data-security.ts

@@ -171,7 +171,7 @@ async function page(req: Req, reply: FastifyReply) {
   }
   const title = `Security of ${cur.schema}.${cur.table}`;
   const objUrl = `${BASE}/sql/objects?${new URLSearchParams({ schema: cur.schema, k: 'table', o: ref })}`;
-  const main = html`<h1 class="u-mb1">${title}</h1>${workshopTabs('objects')}${form(s, cur, def, { ref, sql, warnings, errors, output })}`;
+  const main = html`<h1 class="u-mb1">${title}</h1>${workshopTabs('objects', s)}${form(s, cur, def, { ref, sql, warnings, errors, output })}`;
   return send(reply, s, shell(s, title, [['SQL Workshop', `${BASE}/sql`], ['Object Browser', `${BASE}/sql/objects`], [`${cur.schema}.${cur.table}`, objUrl], ['Security']], main, 'sql'));
 }
 

package/src/builder/dataload.ts

@@ -139,7 +139,7 @@ export function resultHtml(r: LoadResult, failed: boolean) {
 
 export async function dataLoadRoutes(app: FastifyInstance) {
   const page = (s: Session, reply: FastifyReply, main: Raw) =>
-    send(reply, s, shell(s, 'Load Data', [['SQL Workshop', `${BASE}/sql`], ['Load Data']], html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('load')}${main}`, 'sql'));
+    send(reply, s, shell(s, 'Load Data', [['SQL Workshop', `${BASE}/sql`], ['Load Data']], html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('load', s)}${main}`, 'sql'));
 
   // step 1: choose a file
   app.get(`${BASE}/sql/load`, async (req: Req, reply) => {

package/src/builder/datapump.ts

@@ -36,7 +36,7 @@ async function admin(req: Req, reply: FastifyReply) {
 }
 
 const page = (reply: FastifyReply, s: Session, title: string, trail: [string, string?][], body: Raw, code = 200) =>
-  send(reply.code(code), s, shell(s, title, crumbs(...trail), html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('datapump')}${body}`, 'sql'));
+  send(reply.code(code), s, shell(s, title, crumbs(...trail), html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('datapump', s)}${body}`, 'sql'));
 
 export const size = (n: number | null) =>
   n === null ? '' : n < 1024 ? `${n} B` : n < 1024 ** 2 ? `${(n / 1024).toFixed(1)} KB` : n < 1024 ** 3 ? `${(n / 1024 ** 2).toFixed(1)} MB` : `${(n / 1024 ** 3).toFixed(2)} GB`;

package/src/builder/ddl-tools.ts

@@ -65,7 +65,7 @@ export async function ddlToolRoutes(app: FastifyInstance) {
         result = html`<div class="alert alert-error" role="alert">${(e as Error).message}</div>`;
       }
     }
-    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ddl')}
+    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('ddl', s)}
       <p class="muted">The DDL of a schema's objects, from the database catalog, in an order that runs: types, sequences, tables, functions, views, constraints, indexes, triggers, row level security, comments and grants (APEX: Generate DDL). Objects of extensions are left out.</p>
       <form method="get" class="u-mb1">
         <div class="form-grid">${schemaSelect('schema', 'Schema', schemas, schema)}</div>
@@ -114,7 +114,7 @@ export async function ddlToolRoutes(app: FastifyInstance) {
         result = html`<div class="alert alert-error" role="alert">${(e as Error).message}</div>`;
       }
     }
-    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('compare')}
+    const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('compare', s)}
       <p class="muted">Compares the objects of two schemas of this database by their DDL (APEX: Schema Comparison), e.g. a development copy with the schema it came from, and writes a script that makes the target like the source. The order of a table's columns is not compared.</p>
       <form method="get" class="u-mb1">
         <div class="form-grid">${schemaSelect('source', 'Source', schemas, source)}${schemaSelect('target', 'Target (to make like the source)', schemas, target)}</div>