pgkiln 0.72.0 → 0.74.0

package/src/restcatalog.ts

@@ -32,7 +32,10 @@ export interface CatalogService {
 export interface Catalog {
   name: string;
   description: string | null;
+  /** (141) may be empty when the catalog is on a remote server */
   base_url: string;
+  /** (141) a remote server of the workspace (static id): data sources made from the catalog use it */
+  server?: string | null;
   source: 'manual' | 'openapi';
   api_version: string | null;
   services: CatalogService[];
@@ -54,10 +57,14 @@ export const trimBase = (url: string) => url.trim().replace(/\/+$/, '');
 export const serviceUrl = (baseUrl: string, path: string) => `${trimBase(baseUrl)}${path}`;
 
 /** Problems with a catalog's own fields (empty: fine). */
-export function catalogProblems(c: { name?: unknown; base_url?: unknown; description?: unknown; api_version?: unknown }): string[] {
+export function catalogProblems(c: { name?: unknown; base_url?: unknown; server?: unknown; description?: unknown; api_version?: unknown }): string[] {
   const out: string[] = [];
   if (typeof c.name !== 'string' || !CATALOG_NAME.test(c.name)) out.push('The name is 1 to 60 characters, without spaces at the start or end.');
-  if (typeof c.base_url !== 'string' || !/^https?:\/\/[^\s<>"{}]+$/i.test(c.base_url) || c.base_url.length > 2000) out.push('The base URL starts with http:// or https://, without spaces or {parameters}, e.g. https://api.example.com/v1.');
+  if (c.server != null && c.server !== '' && (typeof c.server !== 'string' || !SERVICE_NAME.test(c.server))) out.push('The remote server is its static id, e.g. CRM.');
+  // (141) on a remote server the base URL is optional (the document's, kept for reference)
+  if (c.server && (c.base_url == null || c.base_url === '')) {
+    // nothing to check
+  } else if (typeof c.base_url !== 'string' || !/^https?:\/\/[^\s<>"{}]+$/i.test(c.base_url) || c.base_url.length > 2000) out.push('The base URL starts with http:// or https://, without spaces or {parameters}, e.g. https://api.example.com/v1.');
   else if (c.base_url.endsWith('/')) out.push('The base URL ends without a slash: the services\' paths start with one.');
   else {
     try {
@@ -97,7 +104,7 @@ export function wholeCatalogProblems(c: Catalog): string[] {
     if (seen.has(s.name)) out.push(`Service ${s.name} is there twice.`);
     seen.add(s.name);
     // (enough to fix the first ones: a big broken document would list thousands)
-    if (out.length < 50) out.push(...serviceProblems(typeof c.base_url === 'string' ? c.base_url : 'https://x', s));
+    if (out.length < 50) out.push(...serviceProblems(typeof c.base_url === 'string' && c.base_url ? c.base_url : 'https://x', s));
   }
   return out;
 }
@@ -470,6 +477,7 @@ export function catalogDocument(c: Catalog) {
     name: c.name,
     description: c.description,
     base_url: c.base_url,
+    ...(c.server ? { server: c.server } : {}),
     source: c.source,
     api_version: c.api_version,
     services: c.services.map((s) => ({
@@ -487,6 +495,7 @@ export function fromCatalogDocument(doc: Json): Catalog {
     name: String(doc.name ?? ''),
     description: str(doc.description),
     base_url: String(doc.base_url ?? ''),
+    ...(typeof doc.server === 'string' && doc.server ? { server: doc.server } : {}),
     source: doc.source === 'openapi' ? 'openapi' : 'manual',
     api_version: str(doc.api_version),
     services: (Array.isArray(doc.services) ? doc.services : []).map((s: Json) => ({
@@ -554,9 +563,9 @@ export async function loadCatalog(id: number | string, db: Q = owner): Promise<S
 /** Insert a checked catalog into a workspace (inside the caller's transaction); its id. */
 export async function insertCatalog(db: Q, workspaceId: number, c: Catalog, by: string | null): Promise<number> {
   const { id } = (await db.query(
-    `insert into meta.rest_catalog (workspace_id, name, description, base_url, source, api_version, created_by)
-     values ($1, $2, $3, $4, $5, $6, $7) returning id`,
-    [workspaceId, c.name, c.description, c.base_url, c.source, c.api_version, by],
+    `insert into meta.rest_catalog (workspace_id, name, description, base_url, source, api_version, created_by, server)
+     values ($1, $2, $3, $4, $5, $6, $7, $8) returning id`,
+    [workspaceId, c.name, c.description, c.base_url || null, c.source, c.api_version, by, c.server || null],
   )).rows[0];
   await insertServices(db, id, c.services);
   return id;
@@ -565,8 +574,8 @@ export async function insertCatalog(db: Q, workspaceId: number, c: Catalog, by:
 /** Replace a catalog's fields and services (inside the caller's transaction). */
 export async function replaceCatalog(db: Q, id: number, c: Catalog) {
   await db.query(
-    `update meta.rest_catalog set name = $2, description = $3, base_url = $4, source = $5, api_version = $6, updated_at = now() where id = $1`,
-    [id, c.name, c.description, c.base_url, c.source, c.api_version],
+    `update meta.rest_catalog set name = $2, description = $3, base_url = $4, source = $5, api_version = $6, server = $7, updated_at = now() where id = $1`,
+    [id, c.name, c.description, c.base_url || null, c.source, c.api_version, c.server || null],
   );
   await db.query('delete from meta.rest_catalog_service where catalog_id = $1', [id]);
   await insertServices(db, id, c.services);
@@ -587,11 +596,13 @@ async function insertServices(db: Q, catalogId: number, services: CatalogService
  * The values of a REST data source made from a catalog service (meta.rest_source
  * columns): the full URL and a copy of the request and response settings.
  */
-export function sourceFromService(c: { base_url: string; name: string }, s: CatalogService, opts: { name?: string; credential?: string | null } = {}) {
+export function sourceFromService(c: { base_url: string | null; name: string; server?: string | null }, s: CatalogService, opts: { name?: string; credential?: string | null } = {}) {
   return {
     name: (opts.name?.trim() || s.name).toUpperCase(),
     description: s.description ?? `From the REST source catalog ${c.name}.`,
-    url: serviceUrl(c.base_url, s.path),
+    // (141) a catalog on a remote server: the source names the server and the service's path
+    url: c.server ? s.path : serviceUrl(c.base_url ?? '', s.path),
+    server: c.server || null,
     method: s.method,
     credential: opts.credential?.trim() ? opts.credential.trim().toUpperCase() : null,
     params: s.params,

package/src/restsync.ts

@@ -74,7 +74,7 @@ async function loadSyncSource(id: number) {
   return owner.one<SyncSource>(
     `select s.id, s.app_id, s.name, s.url, s.method, s.credential, s.headers, s.params, s.body, s.row_selector, s.columns, s.cache_seconds,
             s.timeout_s, s.max_rows, s.key_columns, s.operations, s.sync_table, s.sync_mode, s.sync_delete, s.sync_schedule, s.sync_time_zone,
-            s.sync_enabled, a.db_role
+            s.sync_enabled, s.server, a.db_role
        from meta.rest_source s join meta.app a on a.id = s.app_id where s.id = $1`,
     [id],
   );

package/src/runtime/context.ts

@@ -120,6 +120,8 @@ export function bindValues(ctx: PageContext): BindValues {
 /** Replace &NAME. substitution strings (APEX syntax); `encode` escapes each value. */
 export function substitute(text: string, ctx: PageContext, encode: (v: string) => string) {
   const values = bindValues(ctx);
+  // (141) #APP_FILES# and #WORKSPACE_FILES#: where the application's and its workspace's static files are served
+  if (text.includes('_FILES#')) text = text.replace(/#(APP|WORKSPACE)_FILES#/g, (_, kind: string) => `${ctx.base}/${kind === 'APP' ? 'static' : 'workspace-files'}/`);
   return text.replace(/&([A-Za-z][A-Za-z0-9_]*(?:\$[A-Za-z0-9_.-]+?)?)\./g, (m, name: string) => {
     const upper = name.toUpperCase();
     if (upper.startsWith('APP_TEXT$')) {

package/src/runtime/items.ts

@@ -159,7 +159,7 @@ export async function lovContains(ctx: PageContext, lov: string | null, values:
 }
 
 /** Item types whose posted value must come from their list of values (a combobox takes free text by design). */
-export const LOV_CHECKED = new Set(['select', 'radio', 'checkbox_group', 'multiselect', 'popup_lov']);
+export const LOV_CHECKED = new Set(['select', 'radio', 'checkbox_group', 'multiselect', 'popup_lov', 'shuttle', 'select_one', 'select_many']);
 
 /** Rows a list of values reads when its item sets no config.max_rows (1 to 50,000). */
 export const LOV_MAX_ROWS = 5000;
@@ -168,9 +168,10 @@ export const lovMax = (item: Item, settings?: ComponentSettings) => {
   return Number.isFinite(n) && n >= 1 ? Math.min(n, 50_000) : settings ? componentSetting(settings, 'lov_max_rows') : LOV_MAX_ROWS;
 };
 
-const LOV_TYPES = new Set(['select', 'radio', 'checkbox_group', 'multiselect', 'popup_lov', 'combobox']);
+/** Item types that show a list of values (the Page Designer's "List of values"). */
+export const LOV_TYPES = new Set(['select', 'radio', 'checkbox_group', 'multiselect', 'popup_lov', 'combobox', 'shuttle', 'select_one', 'select_many']);
 const hasLov = (item: Item) => LOV_TYPES.has(item.type) || (item.type === 'display' && !!item.lov);
-export const MULTI_VALUE = new Set(['checkbox_group', 'multiselect']);
+export const MULTI_VALUE = new Set(['checkbox_group', 'multiselect', 'shuttle', 'select_many']);
 /** Multi-value items store their values colon-separated, as in APEX. */
 export const splitValues = (v: string) => (v ? v.split(':') : []);
 
@@ -324,6 +325,34 @@ export async function renderItem(ctx: PageContext, item: Item, hiddenByDa = fals
         </select>`;
         break;
       }
+      case 'shuttle': {
+        // (140; APEX: Shuttle) a <select multiple> that works without JavaScript; app.js turns it into two lists
+        // (available, chosen) with move and order buttons. The chosen values keep their order: they come first.
+        const chosen = splitValues(value);
+        const set = new Set(chosen);
+        const indexed = options.map((o, i) => ({ ...o, i }));
+        const ordered = [...chosen.flatMap((v) => indexed.filter((o) => o.value === v).slice(0, 1)), ...indexed.filter((o) => !set.has(o.value))];
+        const t = ctx.locale.t;
+        control = html`<div class="shuttle" data-shuttle="${id}" data-filter-label="${t('shuttle.filter')}" data-available-label="${t('shuttle.available')}" data-chosen-label="${t('shuttle.chosen')}" data-move-label="${t('shuttle.move')}" data-move-all-label="${t('shuttle.move_all')}" data-remove-label="${t('shuttle.remove')}" data-remove-all-label="${t('shuttle.remove_all')}" data-up-label="${t('shuttle.up')}" data-down-label="${t('shuttle.down')}" data-top-label="${t('shuttle.top')}" data-bottom-label="${t('shuttle.bottom')}">
+          <select id="${id}" name="${id}" multiple size="${Math.min(Math.max(options.length, 4), 10)}"${aria}>
+          ${ordered.map((o) => html`<option value="${o.value}" data-i="${o.i}"${set.has(o.value) ? raw(' selected') : ''}>${o.display}</option>`)}
+          </select></div>`;
+        break;
+      }
+      case 'select_one':
+      case 'select_many': {
+        // (140; APEX 24.2: Select One, Select Many) a <select> (or <select multiple>) that works without JavaScript;
+        // app.js adds a search field with a list box that filters the options as one types, and chips for the chosen values
+        const many = item.type === 'select_many';
+        const chosen = new Set(many ? splitValues(value) : value ? [value] : []);
+        const t = ctx.locale.t;
+        control = html`<div class="select-pick" data-select-pick="${many ? 'many' : 'one'}" data-search-label="${t('lov.search')}" data-none-label="${t('lov.no_rows')}" data-remove-label="${t('item.tag_remove')}">
+          <select id="${id}" name="${id}"${many ? html` multiple size="${Math.min(Math.max(options.length, 3), 8)}"` : ''}${aria}>
+          ${many || item.config?.null_label === false ? '' : html`<option value="">${item.config?.null_label ?? t('lov.none')}</option>`}
+          ${options.map((o) => html`<option value="${o.value}"${chosen.has(o.value) ? raw(' selected') : ''}>${o.display}</option>`)}
+          </select></div>`;
+        break;
+      }
       case 'popup_lov': {
         // a select list (the LOV's first max_rows rows) that works without JavaScript; app.js
         // turns it into a field with a button that searches the whole LOV on the server

package/src/runtime/page-regions.ts

@@ -0,0 +1,50 @@
+// (140) Two region types about the page itself: breadcrumb (APEX: Breadcrumb) shows the page's
+// breadcrumb trail, the pages above it by "Breadcrumb parent" (else Home), and help_text (APEX: Help
+// Text) shows the page's help text. The page's title bar shows the trail too, unless the page has a
+// breadcrumb region of its own.
+
+import { html, raw, type Raw } from '../html.ts';
+import type { Region } from '../metadata.ts';
+import { markdownHtml } from '../richtext.ts';
+import { pageAllowed } from './authz.ts';
+import { substitute, type PageContext } from './context.ts';
+import { expandShortcuts } from './shortcuts.ts';
+
+/** The pages above the current one (at most six), as links the user may follow. */
+export async function breadcrumbLinks(ctx: PageContext): Promise<Raw[]> {
+  const trail: { page_no: number; name: string }[] = [];
+  let p = ctx.app.pages.find((x) => x.page_no === ctx.page.parent_page);
+  for (let guard = 0; p && guard < 6; guard++) {
+    trail.unshift(p);
+    p = ctx.app.pages.find((x) => x.page_no === p!.parent_page);
+  }
+  if (!trail.length && ctx.page.page_no !== ctx.app.home_page) {
+    const home = ctx.app.pages.find((x) => x.page_no === ctx.app.home_page);
+    if (home) trail.push(home);
+  }
+  const links = [];
+  for (const t of trail) if (await pageAllowed(ctx, t.page_no)) links.push(html`<li><a href="${ctx.base}/${t.page_no}">${t.name}</a></li>`);
+  return links;
+}
+
+/** Whether the page shows a breadcrumb region (then its title bar leaves the trail out). */
+export const hasBreadcrumbRegion = (ctx: PageContext) => ctx.page.regions.some((r) => r.type === 'breadcrumb' && ctx.vis?.regions.has(r.id));
+
+/** A breadcrumb region: the trail and ({"current": false} leaves it out) the current page. */
+export async function renderBreadcrumbRegion(ctx: PageContext, r: Region): Promise<Raw> {
+  const links = await breadcrumbLinks(ctx);
+  const title = substitute(ctx.page.title ?? ctx.page.name, ctx, (v) => v);
+  const current = r.config?.current === false ? '' : html`<li><span aria-current="page">${title}</span></li>`;
+  return html`<nav class="region-crumbs" aria-label="${r.title || ctx.locale.t('region.breadcrumb')}"><ol class="crumbs">${links}${current}</ol></nav>`;
+}
+
+/** Markdown's punctuation, escaped in item values put into a help text (they stay text). */
+const mdEscape = (v: string) => v.replace(/[\\`*_{}[\]()#+\-.!~>|]/g, '\\$&');
+
+/** A help text region: the page's help text (Markdown with &ITEM. substitutions), else {"empty": "…"} or "No help…". */
+export async function renderHelpTextRegion(ctx: PageContext, r: Region): Promise<Raw> {
+  const help = ctx.page.help?.trim();
+  if (!help) return html`<p class="muted help-text-none">${typeof r.config?.empty === 'string' ? r.config.empty : ctx.locale.t('region.no_help')}</p>`;
+  const text = substitute(await expandShortcuts(ctx, help, 'text'), ctx, mdEscape);
+  return html`<div class="help-text rich-text">${raw(markdownHtml(text))}</div>`;
+}

package/src/runtime/region-cache.ts

@@ -23,7 +23,7 @@ import { bindValues, type PageContext } from './context.ts';
 // the placeholder is a link that renders the page with the region (r<id>_load=1).
 
 /** Region types that can be cached or loaded lazily (no form state of their own). */
-export const DEFERRABLE = new Set<Region['type']>(['report', 'chart', 'cards', 'dynamic', 'tree', 'template_component']);
+export const DEFERRABLE = new Set<Region['type']>(['report', 'classic_report', 'chart', 'cards', 'dynamic', 'tree', 'template_component']);
 
 export interface CacheSetting {
   scope: 'user' | 'session' | 'all';

package/src/runtime/regions.ts

@@ -37,6 +37,7 @@ import { renderPluginRegion } from './plugins.ts';
 import { renderUrlRegion } from './url-region.ts';
 import { renderSearch } from './search.ts';
 import { renderLoginRegion } from './signin.ts';
+import { renderBreadcrumbRegion, renderHelpTextRegion } from './page-regions.ts';
 
 // ---------------------------------------------------------------- buttons
 
@@ -335,6 +336,16 @@ async function renderBody(ctx: PageContext, r: Region, hidden: Set<string>): Pro
     case 'report':
       body = html`${await renderAiFilter(ctx, r)}${await renderReport(ctx, r, await renderItems(ctx, items, hidden))}`;
       break;
+    case 'classic_report':
+      // (140) the report renderer without the interactive features (report.ts: classic)
+      body = await renderReport(ctx, r, await renderItems(ctx, items, hidden));
+      break;
+    case 'breadcrumb':
+      body = await renderBreadcrumbRegion(ctx, r);
+      break;
+    case 'help_text':
+      body = await renderHelpTextRegion(ctx, r);
+      break;
     case 'form':
       body = html`<div class="form-grid">${await renderItems(ctx, items, hidden)}</div>`;
       break;

package/src/runtime/render.ts

@@ -20,6 +20,7 @@ import { buttonsFor, renderRegion } from './regions.ts';
 import { listTree, navbarMarkup, navMarkup } from './lists.ts';
 import { aiInputs, aiOutputs, aiProcessOf } from './ai.ts';
 import { frameOrigins } from './url-region.ts';
+import { breadcrumbLinks, hasBreadcrumbRegion } from './page-regions.ts';
 import { devbarHtml } from './devbar.ts';
 import { feedbackNode } from './feedback.ts';
 import { sessionLimits } from '../session.ts';
@@ -121,22 +122,6 @@ async function navTree(ctx: PageContext, topNav = false) {
   return render(null);
 }
 
-async function breadcrumb(ctx: PageContext) {
-  const trail: { page_no: number; name: string }[] = [];
-  let p = ctx.app.pages.find((x) => x.page_no === ctx.page.parent_page);
-  for (let guard = 0; p && guard < 6; guard++) {
-    trail.unshift(p);
-    p = ctx.app.pages.find((x) => x.page_no === p!.parent_page);
-  }
-  if (!trail.length && ctx.page.page_no !== ctx.app.home_page) {
-    const home = ctx.app.pages.find((x) => x.page_no === ctx.app.home_page);
-    if (home) trail.push(home);
-  }
-  const links = [];
-  for (const t of trail) if (await pageAllowed(ctx, t.page_no)) links.push(html`<li><a href="${ctx.base}/${t.page_no}">${t.name}</a></li>`);
-  return links;
-}
-
 // ---------------------------------------------------------------- theme
 
 /** Per-app colours (Theme Roller) and the style variant in use. Only checked values reach the CSS (styles.ts). */
@@ -392,7 +377,8 @@ export async function renderPage(ctx: PageContext) {
   // (078) the origins of the page's URL regions (also those a refresh or lazy load shows later)
   for (const o of frameOrigins(ctx.page.regions.filter((r) => ctx.vis!.regions.has(r.id)))) ctx.frameSrc?.add(o);
   const title = substitute(ctx.page.title ?? ctx.page.name, ctx, (v) => v);
-  const crumbs = ctx.dialog ? [] : await breadcrumb(ctx);
+  // (140) a page with a breadcrumb region shows the trail there instead
+  const crumbs = ctx.dialog || hasBreadcrumbRegion(ctx) ? [] : await breadcrumbLinks(ctx);
   const das = dynamicActionsJson(ctx);
 
   const main = html`

package/src/runtime/report.ts

@@ -239,7 +239,10 @@ export function selectionOf(page: { items: { name: string }[] }, r: Region) {
 
 export function reportState(ctx: PageContext, r: Region): ReportState {
   const p = ctx.params;
-  const size = parseInt(p.get(key(r, 'n')) ?? '', 10) || Number(r.config.page_size) || componentSetting(ctx.app.component_settings, 'report_rows');
+  // (140) a classic report: no rows-per-page choice; "pagination": "none" shows its rows on one page
+  const classic = r.type === 'classic_report';
+  const size = classic && r.config.pagination === 'none' ? Math.min(maxRows(r, 500) ?? 500, 500)
+    : (!classic && parseInt(p.get(key(r, 'n')) ?? '', 10)) || Number(r.config.page_size) || componentSetting(ctx.app.component_settings, 'report_rows');
   const st: ReportState = {
     search: (p.get(key(r, 'q')) ?? '').trim(),
     searchCol: (p.get(key(r, 'qc')) ?? '').trim() || null,
@@ -288,6 +291,13 @@ export function reportState(ctx: PageContext, r: Region): ReportState {
     seek: null as Seek | null,
   };
   st.seek = parseSeek(ctx, r, st);
+  // (140) a classic report has none of an interactive report's settings: sorting, paging and (when searchable) the search only
+  if (classic) {
+    Object.assign(st, { searchCol: null, hideCols: [], filters: [], breakCol: null, aggregates: [], highlights: [], computations: [], view: 'report',
+      groupBy: { columns: [], functions: [] }, pivot: null, chart: null, area: null, near: null });
+    if (r.config.searchable !== true) st.search = '';
+    if (r.config.pagination === 'none') st.page = 1;
+  }
   return st;
 }
 
@@ -814,8 +824,10 @@ export async function renderReport(ctx: PageContext, r: Region, filterItems: Raw
   const t = ctx.locale.t;
   const c = ctx.client!;
   const st = reportState(ctx, r);
-  const searchable = r.config.searchable !== false;
-  const interactive = r.config.interactive !== false && searchable;
+  // (140; APEX: Classic Report) no Actions menu, column menus or saved reports; a search field only with {"searchable": true}
+  const classic = r.type === 'classic_report';
+  const searchable = classic ? r.config.searchable === true : r.config.searchable !== false;
+  const interactive = !classic && r.config.interactive !== false && searchable;
   // (sprint 78; APEX: a faceted search's results have no search bar) one search field: the facets'
   const searchBox = !ctx.page.regions.some((x) => x.type === 'facets' && x.config.search === true && Number(x.config.report) === r.id && ctx.vis?.regions.has(x.id) !== false);
 
@@ -1193,6 +1205,17 @@ export async function renderReport(ctx: PageContext, r: Region, filterItems: Raw
     ? html`<p class="sel-count muted" data-sel-count="${r.id}" aria-live="polite">${selected.size ? t('report.selected_count', { n: selected.size }) : ''}</p>
       ${elsewhere.map((v) => html`<input type="hidden" name="${selection!.item}" value="${v}" data-sel-other>`)}`
     : '';
+  if (classic) {
+    const pager = r.config.pagination === 'none'
+      ? (info.more ? html`<p class="region-limit">${t('region.first_rows', { n: st.size })}</p>` : '')
+      : info.more || info.page > 1 || searchable ? pagerNav(ctx, r, info) : '';
+    const shaped = classicTemplate(ctx, r, cols, info.rows, fmtOf, linkIdx >= 0 ? (row) => linkAttrs(ctx, link!.page, rowItems(row)) : null);
+    if (shaped) return html`${toolbar}${shaped}${pager}`;
+    return html`${toolbar}<div class="table-wrap"><table class="report report-classic${r.config.mobile === 'scroll' ? '' : ' report-reflow'}">
+      <thead><tr>${header}</tr></thead>
+      <tbody>${body.length ? body : html`<tr><td colspan="${cols.length + lead || 1}" class="empty">${empty}</td></tr>`}</tbody>
+    </table></div>${pager}`;
+  }
   return html`${toolbar}${switcher}${errors}${selectionNote}
     <div class="table-wrap"><table class="report${r.config.mobile === 'scroll' ? '' : ' report-reflow'}"${selIdx >= 0 ? raw(` data-sel-region="${r.id}"`) : ''}>
       <thead><tr>${header}</tr></thead>
@@ -1201,3 +1224,32 @@ export async function renderReport(ctx: PageContext, r: Region, filterItems: Raw
     </table></div>
     ${info.more || info.page > 1 || searchable ? pagerNav(ctx, r, info) : ''}`;
 }
+
+/** (140) A classic report's templates besides the table ({"report_template": …}). */
+export const CLASSIC_TEMPLATES = ['standard', 'value_pairs', 'badges', 'media_list'] as const;
+
+/**
+ * (140; APEX: the classic report templates Value Attribute Pairs, Badge List and Media List) The rows in another shape
+ * than a table; null for the table ("standard"). value_pairs: each row as headings and values; badges: the first column
+ * as the label and the second as the value; media_list: a title (column title, else the first) and a text (column
+ * description, text or body, else the second), the title a link when the report has one.
+ */
+function classicTemplate(ctx: PageContext, r: Region, cols: { f: pg.FieldDef; i: number }[], rows: unknown[][], fmtOf: (name: string) => Formatter,
+  linkOf: ((row: unknown[]) => Raw) | null): Raw | null {
+  const tpl = r.config.report_template;
+  if (!tpl || tpl === 'standard' || !(CLASSIC_TEMPLATES as readonly string[]).includes(tpl)) return null;
+  const text = (row: unknown[], c: { f: pg.FieldDef; i: number } | undefined) => (c ? cell(row[c.i], c.f.dataTypeID, fmtOf(c.f.name)) : '');
+  if (!rows.length) return html`<p class="empty">${r.config.empty ?? ctx.locale.t('report.no_data')}</p>`;
+  if (tpl === 'value_pairs')
+    return html`<div class="cr-pairs">${rows.map((row) => html`<dl>${cols.map((c) => html`<dt>${headingOf(r, c.f.name, ctx.locale.tr)}</dt><dd>${text(row, c)}</dd>`)}</dl>`)}</div>`;
+  if (tpl === 'badges')
+    return html`<ul class="cr-badges">${rows.map((row) => {
+      const inner = html`<span class="cr-badge-value">${text(row, cols[1] ?? cols[0])}</span><span class="cr-badge-label">${cols[1] ? text(row, cols[0]) : ''}</span>`;
+      return html`<li>${linkOf ? html`<a ${linkOf(row)}>${inner}</a>` : inner}</li>`;
+    })}</ul>`;
+  const named = (...names: string[]) => cols.find((c) => names.includes(c.f.name.toLowerCase()));
+  const titleCol = named('title') ?? cols[0];
+  const textCol = named('description', 'text', 'body') ?? cols.find((c) => c !== titleCol);
+  return html`<ul class="cr-media">${rows.map((row) => html`<li><div class="cr-media-title">${linkOf ? html`<a ${linkOf(row)}>${text(row, titleCol)}</a>` : text(row, titleCol)}</div>${
+    textCol ? html`<p class="cr-media-text">${text(row, textCol)}</p>` : ''}</li>`)}</ul>`;
+}

package/src/runtime/static-files.ts

@@ -6,10 +6,15 @@
 // inline. HTML (and anything else a browser would run as a document) is
 // refused by the database and by the type list below, and SVG is served
 // with a policy of its own so a script in it never runs.
-import type { FastifyInstance } from 'fastify';
+// (sprint 141, AP-7) Static workspace files (meta.workspace_file) are served
+// the same way to every application of their workspace, at
+// /a/<alias>/workspace-files/<name>; lists name them #WORKSPACE_FILES#<name>,
+// templates and settings use #APP_FILES# and #WORKSPACE_FILES# (context.ts
+// substitute, template-components.ts rowLookup).
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
 import { html } from '../html.ts';
-import { runtime } from '../db.ts';
-import { loadApp } from '../metadata.ts';
+import { owner, runtime } from '../db.ts';
+import { loadApp, type StaticInclude } from '../metadata.ts';
 import type { PageContext } from './context.ts';
 import { pluginsOnPage } from './plugins.ts';
 
@@ -43,17 +48,51 @@ export function staticHead(ctx: PageContext) {
   // the plug-ins' files (at their version) after the application's, then the page's
   const version = new Map<string, number>((ctx.app.static_files ?? []).map((f) => [f.name, f.v]));
   const pluginFiles = pluginsOnPage(ctx).flatMap((p) => p.files.filter((n) => version.has(n)).map((name) => ({ name, v: version.get(name)! })));
-  const files = [...(ctx.app.static_includes ?? []), ...pluginFiles, ...(ctx.page.static_includes ?? [])];
+  const files: StaticInclude[] = [...(ctx.app.static_includes ?? []), ...pluginFiles, ...(ctx.page.static_includes ?? [])];
   const seen = new Set<string>();
   return files
-    .filter((f) => includable(f.name) && !seen.has(f.name) && seen.add(f.name))
+    .filter((f) => includable(f.name) && !seen.has(`${f.ws ? 'w' : 'a'}:${f.name}`) && seen.add(`${f.ws ? 'w' : 'a'}:${f.name}`))
     .map((f) => {
-      const src = `${ctx.base}/static/${encodeURIComponent(f.name)}?v=${f.v}`;
+      // (141) a static workspace file: from the workspace of this application, on its own origin
+      const src = `${ctx.base}/${f.ws ? 'workspace-files' : 'static'}/${encodeURIComponent(f.name)}?v=${f.v}`;
       return /\.css$/i.test(f.name) ? html`<link rel="stylesheet" href="${src}">` : html`<script src="${src}" defer></script>`;
     });
 }
 
+/** Send a static file with the headers both kinds share (type, cache, a policy for SVG and PDF). */
+function sendFile(req: FastifyRequest<{ Querystring: { v?: string } }>, reply: FastifyReply, type: string, f: { content: Buffer; v: string }) {
+  const etag = `"${Number(f.v).toString(36)}"`;
+  reply
+    .type(type.startsWith('text/') ? `${type}; charset=utf-8` : type)
+    .header('etag', etag)
+    // never sniffed into something else (the app's pages set it too; a file may be fetched on its own)
+    .header('x-content-type-options', 'nosniff')
+    // a versioned link (?v=…, as pages write them) never changes; a bare one is checked again
+    .header('cache-control', req.query.v ? 'public, max-age=31536000, immutable' : 'no-cache');
+  // opened on its own, an SVG or PDF is a document: no scripts, no requests
+  if (type === 'image/svg+xml' || type === 'application/pdf')
+    reply.header('content-security-policy', `default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'${type === 'image/svg+xml' ? '; sandbox' : ''}`);
+  if (req.headers['if-none-match'] === etag) return reply.code(304).send();
+  return reply.send(f.content);
+}
+
+/** (141) A static workspace file to serve to an application: its own workspace's only (the owner pool). */
+export async function workspaceFileFor(alias: string, name: string) {
+  return owner.one<{ content: Buffer; v: string }>(
+    `select f.content, floor(extract(epoch from f.updated_at) * 1000)::bigint::text as v
+       from meta.app a join meta.workspace_file f on f.workspace_id = meta.app_workspace(a.id) and f.name = $2
+      where a.alias = $1`, [alias, name]);
+}
+
 export async function staticFileRoutes(app: FastifyInstance) {
+  // (141) static workspace files, served to every application of the workspace on its own origin
+  app.get<{ Params: { alias: string; name: string }; Querystring: { v?: string } }>('/a/:alias/workspace-files/:name', async (req, reply) => {
+    const type = staticType(req.params.name);
+    const f = type ? await workspaceFileFor(req.params.alias, req.params.name) : null;
+    if (!f) return reply.code(404).type('text/plain').send('Not found');
+    return sendFile(req, reply, type!, f);
+  });
+
   app.get<{ Params: { alias: string; name: string }; Querystring: { v?: string } }>('/a/:alias/static/:name', async (req, reply) => {
     const type = staticType(req.params.name);
     const a = type ? await loadApp(req.params.alias) : null;
@@ -61,16 +100,6 @@ export async function staticFileRoutes(app: FastifyInstance) {
       ? await runtime.one<{ content: Buffer; v: string }>('select content, floor(extract(epoch from updated_at) * 1000)::bigint::text as v from meta.static_file where app_id = $1 and name = $2', [a.id, req.params.name])
       : null;
     if (!f) return reply.code(404).type('text/plain').send('Not found');
-    const etag = `"${Number(f.v).toString(36)}"`;
-    reply
-      .type(type!.startsWith('text/') ? `${type}; charset=utf-8` : type!)
-      .header('etag', etag)
-      // a versioned link (?v=…, as pages write them) never changes; a bare one is checked again
-      .header('cache-control', req.query.v ? 'public, max-age=31536000, immutable' : 'no-cache');
-    // opened on its own, an SVG or PDF is a document: no scripts, no requests
-    if (type === 'image/svg+xml' || type === 'application/pdf')
-      reply.header('content-security-policy', `default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'${type === 'image/svg+xml' ? '; sandbox' : ''}`);
-    if (req.headers['if-none-match'] === etag) return reply.code(304).send();
-    return reply.send(f.content);
+    return sendFile(req, reply, type!, f);
   });
 }

package/src/runtime/template-components.ts

@@ -573,7 +573,8 @@ export function attributeValues(c: TemplateComponent, use: TcUse) {
  * filled in), then LINK, APEX$ROW_NUM, then the row's columns.
  */
 export function rowLookup(ctx: PageContext | null, attrs: Map<string, string>, columns: Map<string, string>, extra: Record<string, string | undefined> = {}): Lookup {
-  const col: Lookup = (n) => columns.get(n) ?? extra[n];
+  // (141) #APP_FILES# / #WORKSPACE_FILES#: where the application's and its workspace's static files are served
+  const col: Lookup = (n) => columns.get(n) ?? extra[n] ?? (ctx && (n === 'APP_FILES' || n === 'WORKSPACE_FILES') ? `${ctx.base}/${n === 'APP_FILES' ? 'static' : 'workspace-files'}/` : undefined);
   const memo = new Map<string, string>();
   return (name) => {
     if (attrs.has(name)) {