pgkiln 0.73.0 → 0.74.0

package/src/ai/service.ts

@@ -1,5 +1,6 @@
 import { owner } from '../db.ts';
 import { decryptSecret } from '../secrets.ts';
+import { aiServerUrl } from '../remote-servers.ts';
 import { ClaudeProvider } from './anthropic.ts';
 import { OpenAiProvider } from './openai.ts';
 import { AiError, type AiProvider, type GenerateRequest, type GenerateResult, type ProviderName } from './types.ts';
@@ -27,6 +28,9 @@ export interface AiService {
   base_url: string | null;
   api_key_enc: string | null;
   enabled: boolean;
+  /** (141) a remote server whose base URL (plus server_path) the service calls instead of base_url */
+  server_id?: number | null;
+  server_path?: string | null;
 }
 
 /** The default model of a new Claude service; OpenAI services name theirs. */
@@ -78,7 +82,12 @@ export function serviceKey(s: AiService): string {
 }
 
 export async function loadService(name: string): Promise<AiService | undefined> {
-  return owner.one<AiService>('select * from meta.ai_service where name = $1', [name.toUpperCase()]);
+  const s = await owner.one<AiService>('select * from meta.ai_service where name = $1', [name.toUpperCase()]);
+  if (!s?.server_id) return s;
+  // (141) on a remote server: its URL now (base_url is then what baseUrlFor gives the SDK)
+  const r = await aiServerUrl(s.server_id, s.server_path);
+  if (!r.url) throw new AiError('config', `AI service ${s.name}: ${r.problem}`);
+  return { ...s, base_url: r.url };
 }
 
 /** The provider of a service, with its key (decrypted only here, never stored elsewhere). */

package/src/app.ts

@@ -96,6 +96,7 @@ import { findWorkspaceRoutes } from './builder/find-workspace.ts';
 import { mailQueueRoutes } from './builder/mail-queue.ts';
 import { networkAccessRoutes } from './builder/network-access.ts';
 import { workspaceMailRoutes } from './builder/workspace-mail.ts';
+import { workspaceResourceRoutes } from './builder/workspace-resources.ts';
 import { runtimeScope } from './db.ts';
 // (sprint 139, AP-6) OpenTelemetry: a trace per request, /metrics, the browser relay
 import { startTelemetry } from './telemetry/export.ts';
@@ -281,6 +282,7 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(mailQueueRoutes);
   await app.register(networkAccessRoutes);
   await app.register(workspaceMailRoutes);
+  await app.register(workspaceResourceRoutes);
   // (sprint 138, AP-5) an application's Utilities
   await app.register(utilityRoutes);
   await app.register(dependencyRoutes);

package/src/builder/advisor.ts

@@ -387,6 +387,10 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
   // (104) a document button names a document template or a report query
   const documents = new Set(all.filter((x) => x.kind === 'document_template' || x.kind === 'report_query').map((x) => x.row.name.toUpperCase()));
   const missing = (entry: Entry | null, field: string, message: string, severity: Severity = 'error') => findings.push({ severity, entry, field, message });
+  // (141) remote servers and web credentials of the application's workspace (sources and invoke steps may name them)
+  const wsServers = new Map((await query('select static_id, credential from meta.remote_server where workspace_id = meta.app_workspace($1)', [appId])).rows.map((r) => [r.static_id as string, r.credential as string | null]));
+  const wsCredentials = new Set((await query('select name from meta.workspace_credential where workspace_id = meta.app_workspace($1)', [appId])).rows.map((r) => r.name as string));
+  const appCredentials = new Set(all.filter((x) => x.kind === 'web_credential').map((x) => String(x.row.name).toUpperCase()));
 
   for (const e of entries) {
     for (const f of e.fields) {
@@ -457,6 +461,14 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
     if (kind === 'button' && row.action === 'document' && !documents.has(String(row.document ?? '').toUpperCase()))
       missing(e, 'Document template', row.document ? `Document template or report query ${row.document} doesn't exist.` : 'A document button needs a document template or a report query.');
     if (kind === 'rest_module') for (const problem of handlerProblems(row.handlers)) missing(e, 'Handlers (JSON)', problem);
+    if (kind === 'rest_source') {
+      // (141) an export may name a server or credential this workspace doesn't have (yet): it imports, and says so here
+      if (row.server && !wsServers.has(row.server))
+        missing(e, 'Remote server', `Remote server ${row.server} doesn't exist in this application's workspace: add it under Workspace utilities → Remote servers (calls fail until then).`, 'warning');
+      const credential = row.credential || (row.server ? wsServers.get(row.server) : null);
+      if (credential && !appCredentials.has(credential) && !wsCredentials.has(credential))
+        missing(e, 'Web credential', `Web credential ${credential} is neither the application's nor its workspace's (calls fail until it exists).`, 'warning');
+    }
     if (kind === 'workflow_definition') {
       const tasks = new Set(all.filter((x) => x.kind === 'task_definition').map((x) => x.row.name.toUpperCase()));
       const outcomes = outcomeMap(all.filter((x) => x.kind === 'task_definition').map((x) => x.row));
@@ -465,7 +477,7 @@ export async function advise(appId: number, tx?: pg.ClientBase, opts: { db?: Db
       // invoke_api steps: REST data sources, parameters, web credentials, variables (sprint 32)
       const refs = {
         sources: new Map(all.filter((x) => x.kind === 'rest_source').map((x) => [String(x.row.name).toUpperCase(), x.row])),
-        credentials: new Set(all.filter((x) => x.kind === 'web_credential').map((x) => String(x.row.name).toUpperCase())),
+        credentials: new Set([...appCredentials, ...wsCredentials]),
         startVars: [...String(row.title ?? '').matchAll(/&([A-Za-z][A-Za-z0-9_]*)\./g)].map((m) => m[1]),
       };
       const invokeRefs = invokeStepReferences(row.steps, refs);

package/src/builder/ai.ts

@@ -55,7 +55,7 @@ function serviceForm(s: Partial<AiService>, action: string, csrfField: ReturnTyp
 }
 
 /** The form's values, checked; throws with a message. */
-function formValues(b: Record<string, string | undefined>) {
+function formValues(b: Record<string, string | undefined>, hasServer = false) {
   const provider: ProviderName = (['openai', 'gemini', 'openai_compatible'] as const).find((p) => p === b.provider) ?? 'anthropic';
   const model = (b.model ?? '').trim();
   if (!/^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,199}$/.test(model)) throw new Error('The model is a name like claude-opus-5-5 (letters, digits and . _ : / @ -).');
@@ -65,7 +65,7 @@ function formValues(b: Record<string, string | undefined>) {
   if (!Number.isInteger(timeout) || timeout < 5 || timeout > 600) throw new Error('Time limit: 5 to 600 seconds.');
   const baseUrl = (b.base_url ?? '').trim() || null;
   if (baseUrl && (!/^https?:\/\/[^\s]+$/i.test(baseUrl) || baseUrl.length > 500)) throw new Error('The base URL starts with http:// or https://.');
-  if (!baseUrl && provider === 'openai_compatible') throw new Error('An OpenAI-compatible service needs a base URL (e.g. http://localhost:11434/v1 for Ollama).');
+  if (!baseUrl && provider === 'openai_compatible' && !hasServer) throw new Error('An OpenAI-compatible service needs a base URL (e.g. http://localhost:11434/v1 for Ollama).');
   const effort = ['low', 'medium', 'high', 'xhigh', 'max'].includes(b.effort ?? '') ? b.effort! : null;
   return [(b.description ?? '').trim() || null, provider, model, provider === 'anthropic' ? effort : null, b.refusal_fallback === 'true', maxTokens, timeout, baseUrl, b.enabled === 'true'];
 }
@@ -157,12 +157,20 @@ export async function aiRoutes(app: FastifyInstance) {
     delete s.state[TEST_RESULT];
     const recent = (await owner.query(`select u.*, a.alias as app from meta.ai_usage u left join meta.app a on a.id = u.app_id where u.service_id = $1 order by u.id desc limit 50`, [x.id])).rows;
     const view = { ...x, api_key_enc: x.api_key_enc ? 'stored' : null }; // the key itself never reaches the page
+    // (141) the remote servers of every workspace (administrators choose one)
+    const servers = (await owner.query<{ id: number; static_id: string; workspace: string }>(
+      'select r.id, r.static_id, w.name as workspace from meta.remote_server r join meta.workspace w on w.id = r.workspace_id order by lower(w.name), r.static_id')).rows;
     const main = html`
       <div class="title-row"><h1 class="ai-name">${x.name}</h1></div>
       <div class="columns wide-left">
         ${region('Settings', html`${serviceForm(view, `${BASE}/ai/${x.id}`, csrf(s), false)}
           <form method="post" action="${BASE}/ai/${x.id}/delete" class="danger-zone">${csrf(s)}
             <button class="btn btn-danger" data-confirm="Delete AI service ${x.name}? Processes that use it fail until another service gets its name.">Delete service</button></form>`)}
+        ${region('Remote server', html`<form method="post" action="${BASE}/ai/${x.id}/server">${csrf(s)}
+            <p class="muted u-mt0">Instead of the base URL: a remote server's URL (Workspace utilities → Remote servers) plus a path, so moving the endpoint changes one value. The API key is sent there: choose a server whose workspace administrators you trust with it.</p>
+            <div class="form-grid">${select('server_id', 'Remote server', x.server_id ? String(x.server_id) : '', [['', 'none: the base URL above'], ...servers.map((r): [string, string] => [String(r.id), `${r.static_id} (${r.workspace})`])])}
+              ${input('server_path', 'Path', x.server_path ?? '', { placeholder: '/v1', help: 'After the server\'s base URL, e.g. /v1; empty: the base URL itself.' })}</div>
+            <div class="buttons"><button class="btn">Save</button></div></form>`)}
         ${region('Test', html`
           <p class="muted u-mt0">Sends a prompt to the service (counted in the usage log as a builder test).</p>
           <form method="post" action="${BASE}/ai/${x.id}/test">${csrf(s)}
@@ -194,7 +202,7 @@ export async function aiRoutes(app: FastifyInstance) {
         `update meta.ai_service set (${COLUMNS}) = ($2, $3, $4, $5, $6, $7, $8, $9, $10), updated_at = now(),
                 api_key_enc = case when $12 then null when $11::text is null then api_key_enc else $11 end
           where id = $1`,
-        [req.params.id, ...formValues(b), key, b.remove_key === 'true'],
+        [req.params.id, ...formValues(b, !!(await owner.one('select 1 as ok from meta.ai_service where id = $1 and server_id is not null', [req.params.id]))), key, b.remove_key === 'true'],
       );
       flash(s, r.rowCount ? 'AI service saved.' : 'Not found.', r.rowCount ? 'ok' : 'error');
     } catch (e) {
@@ -203,6 +211,24 @@ export async function aiRoutes(app: FastifyInstance) {
     return back(reply, s, `${BASE}/ai/${req.params.id}`);
   });
 
+  // (141) the service's remote server and path
+  app.post(`${BASE}/ai/:id(^\\d+$)/server`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await adminOnly(s, reply, 'AI services'))) return;
+    const b = req.body ?? {};
+    try {
+      const serverId = /^\d{1,9}$/.test(String(b.server_id ?? '')) ? Number(b.server_id) : null;
+      const path = String(b.server_path ?? '').trim() || null;
+      if (path && (!/^\/[^\s]*$/.test(path) || path.length > 500)) throw new Error('The path starts with /, without spaces, e.g. /v1.');
+      if (serverId && !(await owner.one('select 1 as ok from meta.remote_server where id = $1', [serverId]))) throw new Error('No such remote server.');
+      const r = await owner.query('update meta.ai_service set server_id = $2, server_path = $3, updated_at = now() where id = $1', [req.params.id, serverId, serverId ? path : null]);
+      flash(s, r.rowCount ? (serverId ? 'The service now calls its remote server: test it.' : 'The service calls its base URL again.') : 'Not found.', r.rowCount ? 'ok' : 'error');
+    } catch (e) {
+      flash(s, (e as Error).message.includes('ai_service_compatible_url') ? 'An OpenAI-compatible service needs a base URL or a remote server.' : (e as Error).message, 'error');
+    }
+    return back(reply, s, `${BASE}/ai/${req.params.id}`);
+  });
+
   app.post(`${BASE}/ai/:id(^\\d+$)/apps`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s || !(await adminOnly(s, reply, 'AI services'))) return;

package/src/builder/designer.ts

@@ -391,7 +391,7 @@ export async function designerRoutes(app: FastifyInstance) {
             ${select('page_template', 'Page template', p.page_template ?? 'standard', [['standard', 'Standard'], ['left_side_column', 'Left side column'], ['right_side_column', 'Right side column'], ['minimal', 'Minimal (no navigation)']], 'Side column: regions with position left (or right) show in a column beside the body (under it on narrow screens). Minimal: no header and navigation menu, e.g. for a login page (Application settings → Login page).')}
             ${select('dialog_position', 'Dialog position', p.dialog_position ?? 'center', [['center', 'Centred dialog'], ['right', 'Drawer from the right'], ['left', 'Drawer from the left'], ['top', 'Drawer from the top'], ['bottom', 'Drawer from the bottom']], 'Modal pages only. On phones dialogs and side drawers fill the screen.')}
             ${select('dialog_size', 'Dialog size', p.dialog_size ?? 'medium', [['small', 'Small'], ['medium', 'Medium'], ['large', 'Large']], 'The width (the height of top and bottom drawers).')}
-            ${input('static_includes', 'JavaScript and CSS files', (p.static_includes ?? []).join(', '), { placeholder: 'e.g. page-3.js, page-3.css', help: 'Static application files (.js, .css) this page loads after the application\'s own, in this order.' })}
+            ${input('static_includes', 'JavaScript and CSS files', (p.static_includes ?? []).join(', '), { placeholder: 'e.g. page-3.js, page-3.css', help: 'Static application files (.js, .css) this page loads after the application\'s own, in this order; #WORKSPACE_FILES#name for a static workspace file.' })}
             <div class="field"><span class="label" aria-hidden="true"></span><label class="check"><input type="checkbox" name="warn_unsaved" value="true"${p.warn_unsaved ? raw(' checked') : ''}> Warn on unsaved changes</label>
               <small class="help">Ask before the user leaves the page (a link, a redirect button, closing the tab) while an item has a changed value. Submitting doesn't ask. Leave an item out with {"warn_unsaved": false} in its attributes.</small></div>
             ${select('parent_page', 'Breadcrumb parent', p.parent_page ?? '', [['', '- none -'], ...lk.pages.filter((x) => x.page_no !== p.page_no).map((x): [string, string] => [String(x.page_no), `${x.page_no}. ${x.name}`])])}

package/src/builder/home.ts

@@ -286,6 +286,9 @@ export async function homeRoutes(app: FastifyInstance) {
         ${card(`${BASE}/developers`, icon('users'), 'Developers', 'Who may use this builder.')}
         ${s.workspace?.sql_workshop === false ? '' : card(`${BASE}/sql`, icon('database'), 'SQL Workshop', 'Run SQL, browse objects and load data.')}
         ${card(`${BASE}/backups`, icon('archive'), 'Manage backups', 'The backups of every application of this workspace; back them all up at once.')}
+        ${card(`${BASE}/workspace-files`, icon('file'), 'Static workspace files', 'CSS, JavaScript, images and fonts every application of this workspace can load (#WORKSPACE_FILES#).')}
+        ${card(`${BASE}/remote-servers`, icon('server'), 'Remote servers', 'Named base URLs for REST data sources, catalogs and AI services: change one value to move them all.')}
+        ${card(`${BASE}/workspace-credentials`, icon('key'), 'Web credentials', 'Keys and OAuth2 clients the applications of this workspace use by name (secrets encrypted, write-only).')}
         ${card(`${BASE}/rest-catalogs`, icon('globe'), 'REST Source Catalogs', 'Web services described once for the workspace (e.g. from an OpenAPI document); applications make REST data sources from them.')}
         ${s.workspace?.admin ? card(`${BASE}/workspace-export`, icon('download'), 'Export and import', 'This workspace\'s components as one file: settings, developers, groups, links, catalogs, scripts, blueprints (workspace administrators).') : ''}
         ${card(`${BASE}/dashboard`, icon('activity'), 'Dashboard', 'Usage and problems across the workspace.')}

package/src/builder/network-access.ts

@@ -3,6 +3,7 @@ import { owner } from '../db.ts';
 import { html, raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { parseHostList, scopeForWorkspace } from '../network-acl.ts';
+import { serverUrl, type RemoteServer } from '../remote-servers.ts';
 import { clientIp, logActivity, type Session } from '../session.ts';
 import { matches, restHosts, scopeProblem, urlProblem } from '../webclient.ts';
 import { clearResponseCache } from '../websources.ts';
@@ -53,6 +54,29 @@ export async function networkAccessRoutes(app: FastifyInstance) {
         `select r.at, r.what, r.host, r.url, r.list, r.message, a.alias from meta.network_refusal r left join meta.app a on a.id = r.app_id
           where r.workspace_id = $1 order by r.id desc limit 100`, [w.id]).then((r) => r.rows),
     ]);
+    // (141) the hosts the workspace's remote servers stand for now, and whether a call to them would pass
+    const scopeNow = await scopeForWorkspace(w.id, 'check');
+    const servers = (await owner.query<RemoteServer>('select * from meta.remote_server where workspace_id = $1 order by static_id', [w.id])).rows.map((x) => {
+      const u = serverUrl(x);
+      let host = '';
+      let problem: string | null = u.problem;
+      if (u.url)
+        try {
+          const url = new URL(u.url);
+          host = url.host;
+          problem = urlProblem(url) ?? scopeProblem(scopeNow, url);
+        } catch {
+          problem = 'not a valid URL';
+        }
+      return { ...x, url: u.url, from: u.from, host, problem };
+    });
+    const serversOf = (entry: string) => servers.filter((x) => x.host && (() => {
+      try {
+        return matches([entry], new URL(`https://${x.host}`));
+      } catch {
+        return false;
+      }
+    })()).map((x) => x.static_id);
     // entries the installation's list never lets through (they narrow nothing: worth a warning)
     const unreachable = w.network_hosts.filter((h) => {
       const host = h.replace(/^\*\./, 'x.');
@@ -90,11 +114,20 @@ export async function networkAccessRoutes(app: FastifyInstance) {
               <textarea id="f_hosts" name="hosts" rows="6" spellcheck="false">${w.network_hosts.join('\n')}</textarea>
               <small class="help">One per line: <code>api.example.com</code>, <code>*.example.com</code> for its subdomains, <code>api.example.com:8443</code> for one port only. No scheme or path. Restricted with no hosts: no outgoing calls at all.</small></div>
             ${unreachable.length ? html`<div class="alert alert-warning" role="status">Not on the installation's list, so never reachable: ${unreachable.join(', ')}.</div>` : ''}
+            ${w.network_hosts.some((h) => serversOf(h).length) ? html`<p class="muted small">Remote servers on these hosts: ${w.network_hosts.filter((h) => serversOf(h).length).map((h) => `${h} (${serversOf(h).join(', ')})`).join('; ')}.</p>` : ''}
             <div class="buttons"><button class="btn btn-hot">Save</button></div></form>`, '', 'workspace-list')}
         ${region('Installation', html`<p class="muted u-mt0">Set in the server's environment by its administrators (<code>PGKILN_REST_ALLOWED_HOSTS</code>).</p>
             ${inst.allowed.includes('*') ? html`<p>Any public host (<code>*</code>).</p>` : entries(inst.allowed)}
             ${m.admin ? html`<h3 class="u-mt1">Private hosts</h3><p class="muted small">Hosts on private or loopback addresses that may be called (<code>PGKILN_REST_PRIVATE_HOSTS</code>).</p>${entries(inst.private)}` : ''}`)}
       </div>
+      ${region('Remote servers', html`<p class="muted u-mt0">The hosts this workspace's <a href="${BASE}/remote-servers">remote servers</a> stand for now: the REST data sources, catalogs and AI services on a server call this host.</p>
+        <div class="table-wrap"><table class="report report-reflow">
+        <thead><tr><th>Server</th><th>Host</th><th>From</th><th>Would be called</th></tr></thead>
+        <tbody>${servers.length ? servers.map((x) => html`<tr><td data-label="Server">${x.static_id}</td>
+            <td data-label="Host" class="u-break">${x.host ? html`<code>${x.host}</code>` : html`<span class="muted">none</span>`}</td>
+            <td data-label="From">${x.from === 'env' ? x.env_var : x.from === 'stored' ? 'base URL' : ''}</td>
+            <td data-label="Would be called">${x.problem ? html`<span class="tag tag-error">no</span> <span class="muted small">${x.problem}</span>` : html`<span class="tag tag-ok">yes</span>`}</td></tr>`)
+          : html`<tr><td colspan="4" class="empty">No remote servers.</td></tr>`}</tbody></table></div>`, '', 'servers')}
       ${region('Check a URL', html`<form method="get" action="${BASE}/network" class="search u-mwnone">
           <input type="hidden" name="ws" value="${w.id}">
           ${input('url', 'URL', tryUrl, { type: 'url', placeholder: 'https://api.example.com/v1/items' })}

package/src/builder/rest-catalogs.ts

@@ -144,7 +144,7 @@ export async function restCatalogRoutes(app: FastifyInstance) {
     const s = await developer(req, reply);
     if (!s) return;
     const rows = (await owner.query(
-      `select c.id, c.name, c.description, c.base_url, c.source, c.api_version, c.updated_at,
+      `select c.id, c.name, c.description, c.base_url, c.server, c.source, c.api_version, c.updated_at,
               (select count(*)::int from meta.rest_catalog_service x where x.catalog_id = c.id) as services
          from meta.rest_catalog c where c.workspace_id = $1 order by lower(c.name)`, [currentWorkspace(s)])).rows;
     const main = html`<div class="title-row"><h1>REST Source Catalogs</h1></div>
@@ -154,7 +154,7 @@ export async function restCatalogRoutes(app: FastifyInstance) {
         <thead><tr><th>Catalog</th><th>Base URL</th><th class="num">Services</th><th>From</th><th>Updated (UTC)</th></tr></thead>
         <tbody>${rows.length ? rows.map((c) => html`<tr>
           <td data-label="Catalog"><a href="${root}/${c.id}">${c.name}</a>${c.description ? html`<br><span class="muted small">${String(c.description).slice(0, 160)}</span>` : ''}</td>
-          <td data-label="Base URL"><code class="wrap-anywhere">${c.base_url}</code></td>
+          <td data-label="Base URL">${c.server ? html`<span class="tag">${icon('server')} ${c.server}</span> ` : ''}<code class="wrap-anywhere">${c.base_url ?? ''}</code></td>
           <td class="num" data-label="Services">${c.services}</td>
           <td data-label="From">${c.source === 'openapi' ? html`OpenAPI${c.api_version ? html` <span class="muted">${c.api_version}</span>` : ''}` : 'by hand'}</td>
           <td data-label="Updated">${when(c.updated_at)}</td></tr>`)
@@ -225,7 +225,7 @@ export async function restCatalogRoutes(app: FastifyInstance) {
     const sel = req.query.service ? c.services.find((x) => String(x.id) === req.query.service) : null;
     const main = html`<div class="title-row"><h1>${c.name}</h1>
         <a class="btn" href="${base}/download">${icon('download')} Download</a></div>
-      <p class="muted u-mt0"><code class="wrap-anywhere">${c.base_url}</code>${c.source === 'openapi' ? html` · from an OpenAPI document${c.api_version ? html` (version ${c.api_version})` : ''}` : ''} · updated ${when(c.updated_at)} UTC</p>
+      <p class="muted u-mt0">${c.server ? html`On remote server <a href="${BASE}/remote-servers">${c.server}</a> · ` : ''}<code class="wrap-anywhere">${c.base_url ?? ''}</code>${c.source === 'openapi' ? html` · from an OpenAPI document${c.api_version ? html` (version ${c.api_version})` : ''}` : ''} · updated ${when(c.updated_at)} UTC</p>
       ${notesHtml(s)}
       ${region('Services', html`<div class="table-wrap"><table class="report report-reflow">
         <thead><tr><th>Service</th><th>Method</th><th>Path</th><th class="num">Parameters</th><th class="num">Columns</th><th>Write back</th></tr></thead>
@@ -241,12 +241,13 @@ export async function restCatalogRoutes(app: FastifyInstance) {
       ${req.query.service === 'new'
         ? region('New service', serviceForm(s, `${base}/services`, { method: 'GET', path: '/' }, 'Add'), '', 'service')
         : sel
-          ? region(`Service ${sel.name}`, html`<p class="muted u-mt0">URL: <code class="wrap-anywhere">${serviceUrl(c.base_url, sel.path)}</code></p>
+          ? region(`Service ${sel.name}`, html`<p class="muted u-mt0">URL: <code class="wrap-anywhere">${c.server ? `${c.server} + ${sel.path}` : serviceUrl(c.base_url ?? '', sel.path)}</code></p>
               ${serviceForm(s, `${base}/services/${sel.id}`, sel, 'Save')}
               <form method="post" action="${base}/services/${sel.id}/delete" class="danger-zone">${csrf(s)}<button class="btn btn-danger" data-confirm="Delete the service ${sel.name}?">Delete service</button></form>`, '', 'service')
           : ''}
       ${region('Catalog', html`<form method="post" action="${base}">${csrf(s)}
-        <div class="form-grid">${input('name', 'Name', c.name, { required: true })}${input('base_url', 'Base URL', c.base_url, { required: true, help: 'e.g. a test system\'s URL. Data sources made earlier keep the URL they were made with.' })}
+        <div class="form-grid">${input('name', 'Name', c.name, { required: true })}${input('base_url', 'Base URL', c.base_url ?? '', { help: 'e.g. a test system\'s URL (optional on a remote server). Data sources made earlier keep the URL they were made with.' })}
+          ${input('server', 'Remote server', c.server ?? '', { placeholder: 'e.g. CRM', help: 'The static id of a remote server of this workspace (Workspace utilities → Remote servers): data sources made from the catalog then name the server and the service\'s path, so they move with it.' })}
           ${input('api_version', 'API version', c.api_version ?? '')}
           <div class="field" data-wide><label class="label" for="f_cdescription">Description</label><textarea id="f_cdescription" name="description" rows="2">${c.description ?? ''}</textarea></div></div>
         <div class="buttons"><button class="btn btn-hot">${icon('save')} Save</button></div></form>`)}
@@ -262,14 +263,19 @@ export async function restCatalogRoutes(app: FastifyInstance) {
     if (!c) return reply.code(404).send('Not found');
     const v = {
       name: String(req.body?.name ?? '').trim(), base_url: trimBase(String(req.body?.base_url ?? '')),
+      server: String(req.body?.server ?? '').trim().toUpperCase() || null,
       description: String(req.body?.description ?? '').trim() || null, api_version: String(req.body?.api_version ?? '').trim() || null,
     };
     // the services must still make sense on the new base URL
-    const problems = [...catalogProblems(v), ...c.services.flatMap((x) => serviceProblems(v.base_url, x))];
+    const problems = [...catalogProblems(v), ...c.services.flatMap((x) => serviceProblems(v.base_url || 'https://x', x))];
     if (problems.length) flash(s, problems.slice(0, 6).join(' '), 'error');
     else
       try {
-        await owner.query('update meta.rest_catalog set name = $2, base_url = $3, description = $4, api_version = $5, updated_at = now() where id = $1', [c.id, v.name, v.base_url, v.description, v.api_version]);
+        await owner.query('update meta.rest_catalog set name = $2, base_url = $3, description = $4, api_version = $5, server = $6, updated_at = now() where id = $1',
+          [c.id, v.name, v.base_url || null, v.description, v.api_version, v.server]);
+        if (v.server && !(await owner.one('select 1 as ok from meta.remote_server where workspace_id = $1 and static_id = $2', [c.workspace_id, v.server])))
+          flash(s, `Catalog saved. This workspace has no remote server ${v.server} yet: add it under Workspace utilities → Remote servers.`, 'error');
+        else
         flash(s, 'Catalog saved.');
       } catch (e) {
         flash(s, uniqueError(e), 'error');
@@ -292,6 +298,8 @@ export async function restCatalogRoutes(app: FastifyInstance) {
       if (doc instanceof Error) throw doc;
       doc = await documentOf(doc, s);
       const { catalog, notes } = readCatalogText(doc.text, { baseUrl: req.body?.base_url, from: doc.from, name: c.name });
+      // (141) the catalog stays on its remote server
+      catalog.server = c.server ?? null;
       const problems = wholeCatalogProblems(catalog);
       if (problems.length) throw new Error(problems.slice(0, 8).join(' '));
       await owner.tx((db) => replaceCatalog(db, c.id, catalog));
@@ -338,7 +346,7 @@ export async function restCatalogRoutes(app: FastifyInstance) {
     const retry = `${root}/${c.id}?service=${sid ?? 'new'}#service`;
     try {
       const v = serviceFromBody(req.body ?? {});
-      const problems = serviceProblems(c.base_url, v);
+      const problems = serviceProblems(c.base_url || 'https://x', v);
       if (problems.length) throw new Error(problems.join(' '));
       const vals = [v.name, v.description, v.path, v.method, JSON.stringify(v.params), JSON.stringify(v.headers), v.body, v.row_selector, JSON.stringify(v.columns), v.key_columns, JSON.stringify(v.operations)];
       let id = sid;
@@ -388,14 +396,14 @@ export async function restCatalogRoutes(app: FastifyInstance) {
       const c = (await loadCatalog(svc.catalog_id))!;
       const v = sourceFromService(c, c.services.find((x) => x.id === svc.id)!, { name: req.body?.name, credential: req.body?.credential });
       if (!/^[A-Z][A-Z0-9_]{0,59}$/.test(v.name)) throw new Error('The name is upper case letters, digits and _, starting with a letter, e.g. COUNTRIES.');
-      if (v.credential && !(await owner.one('select 1 as ok from meta.web_credential where app_id = $1 and name = $2', [appId, v.credential])))
-        throw new Error(`This application has no web credential ${v.credential}.`);
+      if (v.credential && !(await owner.one('select 1 as ok from meta.web_credential where app_id = $1 and name = $2 union all select 1 from meta.workspace_credential where workspace_id = meta.app_workspace($1) and name = $2', [appId, v.credential])))
+        throw new Error(`This application has no web credential ${v.credential} (nor does its workspace).`);
       const problems = sourceProblems(v);
       if (problems.length) throw new Error(problems.join(' '));
       const r = await owner.one<{ id: number }>(
-        `insert into meta.rest_source (app_id, name, description, url, method, credential, params, headers, body, row_selector, columns, key_columns, operations)
-         values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13) returning id`,
-        [appId, v.name, v.description, v.url, v.method, v.credential, JSON.stringify(v.params), JSON.stringify(v.headers), v.body, v.row_selector, JSON.stringify(v.columns), v.key_columns, JSON.stringify(v.operations)]);
+        `insert into meta.rest_source (app_id, name, description, url, method, credential, params, headers, body, row_selector, columns, key_columns, operations, server)
+         values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) returning id`,
+        [appId, v.name, v.description, v.url, v.method, v.credential, JSON.stringify(v.params), JSON.stringify(v.headers), v.body, v.row_selector, JSON.stringify(v.columns), v.key_columns, JSON.stringify(v.operations), v.server]);
       flash(s, `REST data source ${v.name} made from ${c.name}. Test it below${v.credential ? '' : '; add a web credential if the service needs one'}.`);
       return back(reply, s, `${BASE}/apps/${appId}/shared?c=rest_source-${r!.id}`);
     } catch (e) {
@@ -423,7 +431,7 @@ export async function catalogPicker(appId: number, s: Session): Promise<Raw | ''
       where c.workspace_id = meta.app_workspace($1) order by lower(c.name), x.position, x.name`, [appId])).rows;
   if (!services.length)
     return html`<p class="muted u-mt0 u-mb1">${icon('globe')} Services described once for the workspace: <a href="${root}">REST Source Catalogs</a>.</p>`;
-  const credentials = (await owner.query('select name from meta.web_credential where app_id = $1 order by name', [appId])).rows;
+  const credentials = (await owner.query('select name from meta.web_credential where app_id = $1 union select name from meta.workspace_credential where workspace_id = meta.app_workspace($1) order by name', [appId])).rows;
   const groups = new Map<string, typeof services>();
   for (const x of services) groups.set(x.catalog, [...(groups.get(x.catalog) ?? []), x]);
   return region('From a REST source catalog', html`<form method="post" action="${BASE}/apps/${appId}/rest-sources/from-catalog">${csrf(s)}

package/src/builder/routes.ts

@@ -603,7 +603,11 @@ export async function builderRoutes(app: FastifyInstance) {
       });
       // supporting objects are never run on import: the developer reviews them and chooses
       const scripts = (await owner.one('select count(*)::int as n from meta.supporting_script where app_id = $1', [r.id])).n;
-      flash(s, `Application imported. Check its database role and users under Settings / Shared Components.${scripts ? ` It has ${scripts} supporting object script(s): they were not run.` : ''}`);
+      // (141) remote servers its REST data sources name that this workspace doesn't have (yet)
+      const servers = (await owner.query<{ server: string }>(
+        `select distinct x.server from meta.rest_source x where x.app_id = $1 and x.server is not null
+            and not exists (select 1 from meta.remote_server r where r.workspace_id = meta.app_workspace($1) and r.static_id = x.server) order by 1`, [r.id])).rows.map((x) => x.server);
+      flash(s, `Application imported. Check its database role and users under Settings / Shared Components.${scripts ? ` It has ${scripts} supporting object script(s): they were not run.` : ''}${servers.length ? ` Its REST data sources use remote server${servers.length > 1 ? 's' : ''} ${servers.join(', ')}, which this workspace doesn't have: add ${servers.length > 1 ? 'them' : 'it'} under Workspace utilities → Remote servers.` : ''}`);
       return back(reply, s, scripts ? `${BASE}/apps/${r.id}/supporting-objects?imported=1` : `${BASE}/apps/${r.id}`);
     } catch (e) {
       flash(s, `Import failed: ${(e as Error).message}`, 'error');

package/src/builder/static-files.ts

@@ -5,6 +5,7 @@ import { icon } from '../icons.ts';
 import { readMultipart } from '../runtime/files.ts';
 import { includable, STATIC_MAX, STATIC_TYPES, staticType } from '../runtime/static-files.ts';
 import type { Session } from '../session.ts';
+import { WORKSPACE_FILES } from '../metadata.ts';
 import { appOr404 } from './forms.ts';
 import { appHeader, back, BASE, csrf, developer, flash, input, region, send, shell, type Body, type Req } from './ui.ts';
 
@@ -17,9 +18,15 @@ import { appHeader, back, BASE, csrf, developer, flash, input, region, send, she
 /** Files a list may name (every page, or one page). */
 const MAX_INCLUDES = 20;
 
-/** "a.js, b.css" → the valid, includable, distinct names, in order. */
+/**
+ * "a.js, b.css" → the valid, includable, distinct names, in order. (141) "#WORKSPACE_FILES#theme.css"
+ * is a static workspace file; "#APP_FILES#a.js" is the same as "a.js".
+ */
 export function parseIncludes(text: string | undefined) {
-  const names = (text ?? '').split(/[\s,]+/).map((n) => n.trim()).filter((n) => n && staticType(n) && includable(n));
+  const names = (text ?? '').split(/[\s,]+/).map((n) => n.trim().replace(/^#APP_FILES#/, '')).filter((n) => {
+    const file = n.startsWith(WORKSPACE_FILES) ? n.slice(WORKSPACE_FILES.length) : n;
+    return file && staticType(file) && includable(file);
+  });
   return [...new Set(names)].slice(0, MAX_INCLUDES);
 }
 
@@ -84,7 +91,7 @@ async function page(s: Session, a: any, query: Record<string, string | undefined
         <small class="help">A file with the same name is replaced.</small>
       </form>`)}
     ${region('Every page loads', html`<form method="post" action="${base}/includes">${csrf(s)}
-        <div class="form-grid">${input('includes', 'Scripts and stylesheets, in order', (a.static_includes ?? []).join(', '), { placeholder: 'e.g. library.js, app.js, app-styles.css', help: `Up to ${MAX_INCLUDES} .js and .css files, loaded in this order after pgkiln's own (scripts deferred). A page adds its own files under Page → Appearance.` })}</div>
+        <div class="form-grid">${input('includes', 'Scripts and stylesheets, in order', (a.static_includes ?? []).join(', '), { placeholder: 'e.g. library.js, app.js, app-styles.css', help: `Up to ${MAX_INCLUDES} .js and .css files, loaded in this order after pgkiln's own (scripts deferred). #WORKSPACE_FILES#name is a static workspace file (Workspace utilities). A page adds its own files under Page → Appearance.` })}</div>
         <div class="buttons"><button class="btn btn-hot">Save</button></div>
       </form>`)}`;
 }
@@ -191,7 +198,10 @@ export async function staticFileBuilderRoutes(app: FastifyInstance) {
     if (!a) return reply.code(404).send('Not found');
     const names = parseIncludes(req.body?.includes);
     await owner.query('update meta.app set static_includes = $2, updated_at = now() where id = $1', [a.id, names]);
-    const missing = (await owner.query<{ n: string }>('select n from unnest($2::text[]) n where not exists (select 1 from meta.static_file f where f.app_id = $1 and f.name = n)', [a.id, names])).rows.map((r) => r.n);
+    const missing = (await owner.query<{ n: string }>(
+      `select n from unnest($2::text[]) n
+        where not exists (select 1 from meta.static_file f where f.app_id = $1 and f.name = n)
+          and not exists (select 1 from meta.workspace_file w where w.workspace_id = meta.app_workspace($1) and $3 || w.name = n)`, [a.id, names, WORKSPACE_FILES])).rows.map((r) => r.n);
     flash(s, missing.length ? `Saved. Not uploaded yet (left out until they are): ${missing.join(', ')}.` : 'Saved.');
     return back(reply, s, `${BASE}/apps/${a.id}/static-files`);
   });

package/src/builder/websources.ts

@@ -9,6 +9,7 @@ import { runSync, syncLog, syncProblems } from '../restsync.ts';
 import { buildRequest, call, clearResponseCache, clearTokens, credentialProblems, guessColumns, loadCredential, parseJson, rowsSql, select, sourceProblems, toRows, withRest, type RestColumn, type RestSource } from '../websources.ts';
 import type { ComponentSpec } from './components.ts';
 import { back, BASE, csrf, developer, flash, type Req } from './ui.ts';
+import { resolveSource } from '../remote-servers.ts';
 
 // Shared Components → Web credentials and REST data sources: their property
 // specs, the secrets' status (never a secret), "Test" for a source (its
@@ -75,7 +76,7 @@ export const REST_SOURCE_SPEC: ComponentSpec = {
     if (v.sync_time_zone === null) v.sync_time_zone = 'UTC';
     if (v.sync_mode === null) v.sync_mode = 'merge';
     const problems = [
-      ...sourceProblems({ url: v.url, params: json(v.params), columns: json(v.columns), headers: json(v.headers), row_selector: v.row_selector, key_columns: v.key_columns, operations: json(v.operations) }),
+      ...sourceProblems({ url: v.url, server: v.server, params: json(v.params), columns: json(v.columns), headers: json(v.headers), row_selector: v.row_selector, key_columns: v.key_columns, operations: json(v.operations) }),
       ...syncProblems(v),
     ];
     return problems.length ? problems.join(' ') : null;
@@ -88,10 +89,12 @@ export const REST_SOURCE_SPEC: ComponentSpec = {
   fields: [
     { name: 'name', label: 'Name', kind: 'upper', group: 'Identification', help: 'Regions and lists of values use it by this name, e.g. COUNTRIES.' },
     { name: 'description', label: 'Description', kind: 'text', wide: true, group: 'Identification' },
+    { name: 'server', label: 'Remote server', kind: 'upper', group: 'Request',
+      help: 'Optional: the static id of a remote server of the workspace (Workspace utilities → Remote servers), e.g. CRM. The URL is then the path after the server\'s base URL, and changing the server moves every source on it.' },
     { name: 'url', label: 'URL', kind: 'text', wide: true, group: 'Request',
-      help: 'e.g. https://api.example.com/v1/cities/{city}/weather — {name} is a path parameter. The host must be on the server\'s allow-list (PGKILN_REST_ALLOWED_HOSTS).' },
+      help: 'e.g. https://api.example.com/v1/cities/{city}/weather — {name} is a path parameter. With a remote server: the path, e.g. /v1/cities/{city}/weather. The host must be on the server\'s allow-list (PGKILN_REST_ALLOWED_HOSTS).' },
     { name: 'method', label: 'Method', kind: 'select', options: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'], group: 'Request' },
-    { name: 'credential', label: 'Web credential', kind: 'upper', group: 'Request', help: 'The name of a web credential, or empty.' },
+    { name: 'credential', label: 'Web credential', kind: 'upper', group: 'Request', help: 'The name of a web credential (the application\'s, else one of the workspace\'s), or empty: on a remote server, the server\'s default credential.' },
     { name: 'params', label: 'Parameters (JSON)', kind: 'json', wide: true, group: 'Request',
       help: '[{"name": "city", "in": "path", "default": "&P1_CITY.", "required": true}, {"name": "units", "in": "query", "default": "metric"}] · in: path, query, header, body. Defaults may use &ITEM. substitutions; regions override them with {"rest_params": {…}}.' },
     { name: 'headers', label: 'Headers (JSON)', kind: 'json', group: 'Request', help: '{"Accept-Language": "en"} — not for secrets: use a web credential.' },
@@ -267,11 +270,14 @@ export async function webSourceRoutes(app: FastifyInstance) {
   app.post(`${BASE}/apps/:id(^\\d+$)/rest-sources/:sid(^\\d+$)/test`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const src = await owner.one<RestSource>('select * from meta.rest_source where id = $1 and app_id = $2', [req.params.sid, req.params.id]);
-    if (!src) return reply.code(404).send('Not found');
-    const result: TestResult = { id: src.id, ok: false, message: '' };
+    const stored = await owner.one<RestSource>('select * from meta.rest_source where id = $1 and app_id = $2', [req.params.sid, req.params.id]);
+    if (!stored) return reply.code(404).send('Not found');
+    const result: TestResult = { id: stored.id, ok: false, message: '' };
     const started = Date.now();
+    let src = stored;
     try {
+      // (141) on a remote server: its URL now
+      src = await resolveSource(stored);
       const values: Record<string, string> = {};
       for (const p of src.params) values[p.name] = String(req.body?.[`p_${p.name}`] ?? '');
       const r = buildRequest(src, values);

package/src/builder/workflows.ts

@@ -73,7 +73,8 @@ export async function workflowExtras(appId: number, row: Definition, s: Session,
   const shown = dev ? (row.dev_steps ?? []) : row.steps;
   const refs = {
     sources: new Map((await owner.query('select name, params, columns from meta.rest_source where app_id = $1', [appId])).rows.map((r) => [r.name as string, r])),
-    credentials: new Set((await owner.query('select name from meta.web_credential where app_id = $1', [appId])).rows.map((r) => r.name as string)),
+    // (141) the application's credentials and its workspace's
+    credentials: new Set((await owner.query('select name from meta.web_credential where app_id = $1 union select name from meta.workspace_credential where workspace_id = meta.app_workspace($1)', [appId])).rows.map((r) => r.name as string)),
     startVars: [...String((row as { title?: string }).title ?? '').matchAll(/&([A-Za-z][A-Za-z0-9_]*)\./g)].map((m) => m[1]),
   };
   const invokeRefs = invokeStepReferences(shown, refs);