pgkiln 0.73.0 → 0.75.0

package/docs/apex-feature-parity.md

@@ -7,7 +7,7 @@ open item and open an issue or pull request; see [CONTRIBUTING.md](../CONTRIBUTI
 Legend: ✅ available · 🟡 partial (see notes) · ❌ not yet · ➖ not planned (a deliberate choice,
 or better served by the PostgreSQL ecosystem; see the notes and [extensions](guide/15-extensions.md))
 
-Last reviewed: 2026-11-04 against **APEX 26.2** (sprint 140: the items Shuttle (ordered), Select One and Select Many, the regions Classic Report (report templates, pagination types), Breadcrumb and Help Text with a page help text, and a [mapping of every APEX item and region type](#item-and-region-types-one-by-one) (AP-4); sprint 139: OpenTelemetry, traces with a span per SQL statement, web call, AI request and tool call, logs, metrics and `/metrics` for Prometheus, browser spans relayed by pgkiln, per workspace off or its own collector (AP-6); sprint 138: an application's Utilities tab with a dashboard, database object dependencies, change history per component, Upgrade application, UI defaults (APEX's Attribute Dictionary), application and page checksums and an icon browser (AP-5); sprint 137: Create page as a grid of page types with previews, the page types interactive report, smart filters, search page, data loading, tree, timeline, media list, content row, comments, dashboard, wizard, unified task list and workflow console, a Feature tab with nine features that install once, and Create page as copy with shared components mapped or copied (AP-3); sprint 136: vector providers (an AI service with an embedding model or a SQL function), `meta.embed`, *Add vector column* in Table Properties with an HNSW index and a queue that keeps embeddings current, search types vector and hybrid (reciprocal rank fusion with full-text) and a Retrieve (RAG) tool for AI agents, all as the app's role through RLS, on pgvector (AP-1); sprint 135: full-text search configurations, APEX's Oracle Text search type on PostgreSQL full-text search with stemming, ranking, highlights, *Did you mean* and *Add full-text search* in Table Properties (AP-2); sprint 134: the builder also in Italiano, 中文 (简体), 中文 (繁體), 日本語 and 한국어, APEX's ten builder languages plus Nederlands (SEC-5); sprints 121, 123–125: the builder in Deutsch, English, Español, Français, Nederlands and Português, step by step: the frame, sign-in, Workspace home, App Builder, Page Designer menus, the SQL Workshop's home, SQL Worksheet, Object Browser and Table Properties, Shared Components, application settings, users, identity providers, developers and workspaces (WS-7); sprint 122: *Ask in your own words* sets faceted search and smart filter facets, smart filters read a typed phrase (WS-5), and Sample Maps, Sample Approvals, Sample Data Loading and Sample Files in the App Gallery (WS-8); sprint 120: the App Gallery's single-topic sample apps (charts, cards, calendar, interactive grids, dynamic actions, reporting), the UX Pattern Catalog and a Utility Apps tab with Lookup Lists, Release Notes and Announcements (WS-8); sprint 119: data security per table, a roles × columns matrix and masked values per application role in a masking view, the same identity for pages, AI tools, REST, AutoREST and MCP (WS-13); sprint 118: Administration → Mail queue with delivery per hour and per workspace, the slowest provider calls and failures with Retry and Purge, a workspace's own mail service, and workspace network access lists that narrow the installation's allow-list (WS-9); sprint 117: Pillar Light and Pillar Dark navigation appearances with a header strip, clearer navigation tree states, subtle colour utilities, RTL; sprint 116: the comparison moved from 26.1 to 26.2, with a section for the 26.2 workspace items WS-1 … WS-13 and OCI managed identities; the App Builder list with Updated by, working copies and the lock; `pgkiln import --only`, a file-level import; stale rows on facet menus and blueprints fixed; sprint 115: popup LOVs that load on scroll, Wait Popup dynamic actions and dynamic actions on menu entries; sprint 114: Workflow 26.2 with custom task outcomes, task events and notifications, Send E-Mail and draft steps, migrating running instances and the diagram as SVG / PNG; sprint 113: Team Development with issues, labels, milestones, templates, a board and a set-up wizard; sprint 112: AI interactive reports with chips, Undo, computed columns and a phrase parser that needs no AI service; sprint 111: AI Agents with tools as a shared component, a Navigate tool with checksummed URLs, Gemini and OpenAI-compatible services; sprint 110: Data Reporter as a workspace tool with datasets, reporting applications, editors and viewers, published reports with stable URLs and pins; sprint 109: the Workspace home above the App Builder and SQL Workshop, with a summary, top applications, users and developers, and an optional release check; sprint 108: the code editor's syntax colours in the builder's light and dark themes, read-only SQL highlighted, the Data Modeler in dark mode; sprint 107: a transaction mode in the SQL Worksheet with Commit and Rollback; DA-18: JavaScript (MLE) not planned, plv8 where installed; sprint 106: the change log of DDL change sets with Flyway, Liquibase and SQL downloads; sprint 104: RESTful Services modules, templates and handlers with PL/pgSQL and media handlers, privileges, OpenAPI and Try it; sprint 103: Schema Export / Import with pg_dump and pg_restore; sprint 102: the SQL Monitor with live sessions, Top SQL and a statement's plan; sprint 101: Scheduling of pg_cron jobs with a schedule builder, run now and run history; sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
+Last reviewed: 2026-11-04 against **APEX 26.2** (sprint 142: JSON sources with a data profile and updatable views whose arrays are rows, document views of a table with its children (APEX's duality views), JSON path columns in reports (AP-8); sprint 141: static workspace files (`#WORKSPACE_FILES#`), remote servers for REST data sources, catalogs and AI services (an environment variable per environment), and workspace-level web credentials (AP-7); sprint 140: the items Shuttle (ordered), Select One and Select Many, the regions Classic Report (report templates, pagination types), Breadcrumb and Help Text with a page help text, and a [mapping of every APEX item and region type](#item-and-region-types-one-by-one) (AP-4); sprint 139: OpenTelemetry, traces with a span per SQL statement, web call, AI request and tool call, logs, metrics and `/metrics` for Prometheus, browser spans relayed by pgkiln, per workspace off or its own collector (AP-6); sprint 138: an application's Utilities tab with a dashboard, database object dependencies, change history per component, Upgrade application, UI defaults (APEX's Attribute Dictionary), application and page checksums and an icon browser (AP-5); sprint 137: Create page as a grid of page types with previews, the page types interactive report, smart filters, search page, data loading, tree, timeline, media list, content row, comments, dashboard, wizard, unified task list and workflow console, a Feature tab with nine features that install once, and Create page as copy with shared components mapped or copied (AP-3); sprint 136: vector providers (an AI service with an embedding model or a SQL function), `meta.embed`, *Add vector column* in Table Properties with an HNSW index and a queue that keeps embeddings current, search types vector and hybrid (reciprocal rank fusion with full-text) and a Retrieve (RAG) tool for AI agents, all as the app's role through RLS, on pgvector (AP-1); sprint 135: full-text search configurations, APEX's Oracle Text search type on PostgreSQL full-text search with stemming, ranking, highlights, *Did you mean* and *Add full-text search* in Table Properties (AP-2); sprint 134: the builder also in Italiano, 中文 (简体), 中文 (繁體), 日本語 and 한국어, APEX's ten builder languages plus Nederlands (SEC-5); sprints 121, 123–125: the builder in Deutsch, English, Español, Français, Nederlands and Português, step by step: the frame, sign-in, Workspace home, App Builder, Page Designer menus, the SQL Workshop's home, SQL Worksheet, Object Browser and Table Properties, Shared Components, application settings, users, identity providers, developers and workspaces (WS-7); sprint 122: *Ask in your own words* sets faceted search and smart filter facets, smart filters read a typed phrase (WS-5), and Sample Maps, Sample Approvals, Sample Data Loading and Sample Files in the App Gallery (WS-8); sprint 120: the App Gallery's single-topic sample apps (charts, cards, calendar, interactive grids, dynamic actions, reporting), the UX Pattern Catalog and a Utility Apps tab with Lookup Lists, Release Notes and Announcements (WS-8); sprint 119: data security per table, a roles × columns matrix and masked values per application role in a masking view, the same identity for pages, AI tools, REST, AutoREST and MCP (WS-13); sprint 118: Administration → Mail queue with delivery per hour and per workspace, the slowest provider calls and failures with Retry and Purge, a workspace's own mail service, and workspace network access lists that narrow the installation's allow-list (WS-9); sprint 117: Pillar Light and Pillar Dark navigation appearances with a header strip, clearer navigation tree states, subtle colour utilities, RTL; sprint 116: the comparison moved from 26.1 to 26.2, with a section for the 26.2 workspace items WS-1 … WS-13 and OCI managed identities; the App Builder list with Updated by, working copies and the lock; `pgkiln import --only`, a file-level import; stale rows on facet menus and blueprints fixed; sprint 115: popup LOVs that load on scroll, Wait Popup dynamic actions and dynamic actions on menu entries; sprint 114: Workflow 26.2 with custom task outcomes, task events and notifications, Send E-Mail and draft steps, migrating running instances and the diagram as SVG / PNG; sprint 113: Team Development with issues, labels, milestones, templates, a board and a set-up wizard; sprint 112: AI interactive reports with chips, Undo, computed columns and a phrase parser that needs no AI service; sprint 111: AI Agents with tools as a shared component, a Navigate tool with checksummed URLs, Gemini and OpenAI-compatible services; sprint 110: Data Reporter as a workspace tool with datasets, reporting applications, editors and viewers, published reports with stable URLs and pins; sprint 109: the Workspace home above the App Builder and SQL Workshop, with a summary, top applications, users and developers, and an optional release check; sprint 108: the code editor's syntax colours in the builder's light and dark themes, read-only SQL highlighted, the Data Modeler in dark mode; sprint 107: a transaction mode in the SQL Worksheet with Commit and Rollback; DA-18: JavaScript (MLE) not planned, plv8 where installed; sprint 106: the change log of DDL change sets with Flyway, Liquibase and SQL downloads; sprint 104: RESTful Services modules, templates and handlers with PL/pgSQL and media handlers, privileges, OpenAPI and Try it; sprint 103: Schema Export / Import with pg_dump and pg_restore; sprint 102: the SQL Monitor with live sessions, Top SQL and a statement's plan; sprint 101: Scheduling of pg_cron jobs with a schedule builder, run now and run history; sprint 100: RESTful Services, tables and views published as REST endpoints with paging, filters, keys and OpenAPI; sprint 99: Administration → Database Users for PostgreSQL roles; sprint 98: the Data Modeler with relational diagrams, DDL and a data dictionary; sprint 97: charts of a query in the worksheet, saved charts and their dashboard; sprint 96: the SQL Workshop's Launchpad with pins and tool groups, the builder's search with Ctrl+K; sprint 95: Table Properties: create, edit or copy a table in a form with a DDL preview and Apply in one transaction; sprint 94: an object's menu with Open in a panel, Quick DDL, Add index / trigger / policy and Drop with dependents; sprint 93: worksheets saved as SQL Scripts with tabs and a Files list, Format, Convert case, find and replace, bind and substitution variables; sprint 92: the worksheet's Query Result with sort, value dialog, copy and downloads, plans as a tree with the slowest step and misestimates, SQL History with status, search and run again; sprint 91: the SQL Worksheet like Database Actions' SQL: navigator, Run Statement at the cursor and Run Script with a log per statement, Explain Plan, Autotrace, notices, history, Run as an application role; sprint 90: Comment Out in the page designer, gallery labels in title case; sprint 89: the Object Browser's schema, one row of tabs, blank NULLs, Modify column; sprint 88: home cards with colour bands and round icons, the hero on the page background, a page footer with the version and Back to top; sprint 87: the Create Application wizard reloads the page list for a schema, RLS badges, the alias from the name; sprint 86: the page designer by page number, HTML error pages in the builder; sprint 85: the Form Designer, beyond APEX; sprint 84: the date picker, facet menus; sprint 83: Component Settings and Component Groups; sprint 82: Report Queries; sprint 81: Application Computations and Shortcuts in Shared Components; sprint 80: the master grid's first row selected when the page opens and after a search; grid cells as text with their format mask until edited, with cell navigation by arrow keys, Enter, F2 and Escape; sprint 79: generated dashboards with sums, donuts and lines, leaving out charts that say nothing; applications open in their own light or dark mode until the user chooses, per application; a user menu with Appearance and Sign in when signed out; the developer toolbar's App and Page texts and debug state; the report search's column scope in the magnifier; sprint 78: generated faceted search reports with one column per foreign key, the faceted search's total row count, Show all and Yes/No values, one search field, friendly headings and number formats in generated grids and master-detail pages, friendly names in the Create Application wizard's page list; sprint 77: the Page Designer's layout and tree by display position, button positions, the tree's context menu with Duplicate and Copy to other page, Show Common / Show All, Go to group and the Template Options dialog; display positions, button positions and side-column page templates at runtime; sprint 76: the interactive report's menus and pagination, date items in the date format; sprint 75: the SQL Workshop's Object Browser and tabs; sprint 74: the builder's information architecture: Shared Components grid, Settings tabs, application home search and tasks; sprint 73: the Create Application wizard on one page with page types and features; sprint 72: the runtime chrome compared with APEX 26.2's: the developer toolbar, the Iris look, the navigation bar's Help menu and Install button; sprint 71: generated applications compared with APEX 26.2's: labels, foreign key names in reports, file columns, format masks, the Home page and the dashboard; sprint 70: treemap, sunburst and timeline charts; sprint 69: dragging tasks on a Gantt chart; sprint 68: the Data Reporter's welcome page, Find my workspace; sprint 67: REST source catalogs from OpenAPI documents, a workspace's export and import (two rows added); sprint 66: a blueprint from an existing application; sprint 65: facet charts; sprint 64: approval vacation rules and expiration policies; sprint 63: range, box plot and stock charts; sprint 62: workspace preferences (SQL Workshop and RESTful services per workspace), extension links, Manage backups across applications, SQL Workshop utilities with object reports, About Database and a database monitor; sprint 61: the builder's screens compared with APEX 26.1: the workspace sign-in page, the Administration menu with workspace message, environment banner and utilization, the SQL Workshop home, the App Gallery, application groups and cross application reports (four rows added); sprint 60: isolated workspaces with their own database logins, row-level security on pgkiln's tables and workspace database roles, workspace administrators; sprint 59: the Page Designer's help pane, Quick edit from the developer toolbar; sprint 58: page groups; sprint 57: region templates hero, title bar, buttons container, inline dialog and drawer, wizard with wizard progress, the carousel; sprint 56: Generate DDL and Schema Comparison in the SQL Workshop, `pgkiln ddl` and `pgkiln compare`; sprint 55: an editable login page with a Login region and the Minimal page template, Forgot password through the application's mail service; sprint 54: interactive grid views, the single row view, group by and chart; sprint 53: application settings, user preferences and items kept per user, dynamic translations, `meta.data_export` and data export downloads, display image and geocoded address items; sprint 52: every dynamic action event and action, Ajax callbacks, an error handling function, the session timeout warning; sprint 51: checked imports, application backups, availability and Run only, feedback, type-specific attribute help; sprint 50: lost update detection, warn on unsaved changes, the URL and search regions with search configurations, the developer toolbar with a session state viewer, and e-mail through SMTP with OAuth2, Microsoft Graph, Amazon SES and HTTP APIs; import checks, application availability, property help and e-mail compared again; 2026-10-06: pgkiln 0.31.0, in progress: static application files and the Execute JavaScript dynamic action; region, item, dynamic action and process plug-ins; conditional and dynamic theme styles; XML and Excel in `meta.parse_data`, zips in SQL, `meta.v_boolean`; file items in S3-compatible object storage; map layers by the visible area and as vector tiles; a graphical query builder; tenants for workflows and tasks; application files as YAML and region static IDs; Lucide icons and icon modifiers; PWA push notifications; 0.30.0: 136 icons and an icon picker; an axe-core accessibility audit; cropping pictures; session sharing between applications; twenty-two built-in languages; 0.29.0: workspaces; the Iris base style; drawers; built-in template components including the metric card; Theme Roller dark-mode colours, live preview and template options on items and report columns; report selection across pages; instance settings; fourteen built-in languages; 0.28.0: AI with Claude and OpenAI; 0.27.0: Data Reporter; sample data generator; create application from several sheets, pasted data or existing tables; 0.26.0: working copies with a three-way merge; theme, library and boilerplate applications with subscriptions; 0.25.0: Gantt, pyramid and polar charts; map layers, clustering and server-side spatial filters; REST data sources that write back from forms and grids and synchronise into tables, OAuth2 password and refresh-token grants; debug messages per request and an install/upgrade log; `meta.web_request()` and `meta.parse_data()`; Theme Roller style variants and template options; 0.24.0: automations with several actions, error handling per row and runs from SQL; invoke-API workflow steps; Unload Data in the Data Workshop; create page wizards for cards, calendar, chart, map, faceted search, form and master-detail; create an application from a file; 0.23.0: interactive grid aggregates, frozen/moved/resized columns, layouts and saved grid reports, master-detail, row actions and copy/paste; download processes, execution chains in the background, workflow processes, branches to a function's URL or another app, the Dialog Closed event; number format masks, automatic time zone, runtime messages in German, French and Spanish; SQL scripts, Quick SQL, a query builder, XML loading and data load definitions; custom authentication, lists, page and application locks with developer comments, supporting objects; 0.22.0: keyset paging, report PDFs and REST collections streamed from a cursor, database-account authentication; 0.21.0: HTTP-header authentication behind a reverse proxy; 0.20.0: a popup list of values with server-side search; 0.19.0: row-range pagination, maximum row counts and row limits, lazy loading and caching of regions, streamed CSV/Excel downloads; 0.18.0: calendar week/day/list views with drag and drop, bubble/gauge/funnel/radar charts and drill-down, smart filters, a region display selector and more facet types, computations, conditional branches, build options, menu buttons, REST data sources and web credentials, rich text/Markdown, rating, combobox, date range and QR code items; 0.17.0: an App Builder home, workspace dashboard and utilities like APEX's; 0.16.0: a Page Designer with drag-and-drop layout, a code editor with autocomplete, template components and plug-ins, parallel branches and versions of workflows, the `pgkiln` command line with one file per component; 0.15.0: drop and paste files, heat maps, filtering a report by the map area; 0.14.0: stacked, combo, scatter and pie charts, several files per upload item; 0.13.0: map and tree regions; 0.12.0: REST modules in the builder; 0.11.0: workflows and Progressive Web Apps; 0.10.0: LDAP, SAML, "Keep me signed in", document templates, JSON loading, approvals and the task list; pgkiln installs no application, HR is an example).
 
 ## At a glance
 
@@ -20,11 +20,11 @@ Last reviewed: 2026-11-04 against **APEX 26.2** (sprint 140: the items Shuttle (
 | Security | 22 | 0 | 0 | 0 | An editable login page and Forgot password; a session timeout warning; On par or stricter (CSP without `unsafe-inline`); OIDC, SAML and LDAP; header authentication behind a proxy; database accounts; custom authentication |
 | User interface | 12 | 0 | 0 | 0 | Region templates incl. hero, inline dialog and drawer, wizard and carousel; Universal Theme-like and responsive; a Theme Roller with style variants and conditional, dynamic styles; about 1,700 icons with Font APEX-like modifiers |
 | Globalization | 6 | 0 | 0 | 0 | One translated app like 26.1 with dynamic translations of table values; number format masks and automatic time zone; twenty-two built-in languages |
-| Data and integration | 13 | 0 | 0 | 2 | REST source catalogs from OpenAPI documents; Generate DDL and schema comparison; `meta.data_export` and data export downloads (CSV, JSON, XML, HTML, Excel, PDF); e-mail through SMTP (password or OAuth2), Microsoft Graph, Amazon SES and HTTP APIs; REST APIs via PostgREST, REST data sources that write back and synchronise, web credentials with OAuth2 grants, CSV/XLSX/JSON/XML loading with saved definitions and unloading, SQL scripts and Quick SQL, report PDFs and document templates |
+| Data and integration | 16 | 0 | 0 | 1 | Remote servers, static workspace files and workspace web credentials; REST source catalogs from OpenAPI documents; Generate DDL and schema comparison; `meta.data_export` and data export downloads (CSV, JSON, XML, HTML, Excel, PDF); e-mail through SMTP (password or OAuth2), Microsoft Graph, Amazon SES and HTTP APIs; REST APIs via PostgREST, REST data sources that write back and synchronise, web credentials with OAuth2 grants, CSV/XLSX/JSON/XML loading with saved definitions and unloading, SQL scripts and Quick SQL, report PDFs and document templates |
 | Workflow, automation and AI | 6 | 0 | 0 | 0 | Scheduled automations with several actions and runs from SQL, approvals, a task list and workflows with parallel branches, versions and invoke-API steps; AI with Claude or OpenAI: *Generate text with AI*, an assistant region with tools, natural-language report filters and blueprints |
 | Administration | 15 | 0 | 0 | 0 | OpenTelemetry traces, logs and metrics to the team's own monitoring and `/metrics` for Prometheus (24.2); An APEX-like sign-in with a workspace and a Workspace home; a mail queue dashboard, a workspace's own mail service and network access list (26.1 / 26.2); a workspace's components exported and imported as one file; workspace message, environment banner and utilization; isolated workspaces with their own database logins and roles, and workspace administrators; application availability and Run only, automatic backups, user feedback; a developer toolbar with a session state viewer and debug per session; Top SQL per app; debug messages per request; an install/upgrade log |
 | APEX 26.2 workspace (WS-1 … WS-13) | 13 | 0 | 0 | 1 | Workspace home, Data Reporter as a workspace tool, Team Development, AI Agents, AI interactive reports, Workflow 26.2, the mail queue, workspace mail and network access, the 26.1 component details, the App Builder list's details, the Pillar navigation appearances and data security per table (rows, columns and masked values), the App Gallery's single-topic sample apps, UX Pattern Catalog and Utility Apps; the builder in eleven languages (APEX's ten and Nederlands) |
-| **Total** | **166** | **0** | **0** | **4** | 170 APEX features compared: 98% available, none missing, 4 deliberately not planned |
+| **Total** | **169** | **0** | **0** | **3** | 172 APEX features compared: 98% available, none missing, 3 deliberately not planned |
 
 (Counts are of the rows in the tables below. A review on 2026-10-06 added 18 rows for APEX features that were
 not compared before, one on 2026-10-12 added two more (property help, application availability), and one on
@@ -34,7 +34,8 @@ two, REST source catalogs and the workspace export, with their features. Sprint
 the section [APEX 26.2 workspace](#apex-262-workspace-ws-1--ws-13): fourteen rows, the 26.2 workspace items WS-1 … WS-13
 and OCI managed identities. Some of them repeat a row above from the workspace's side; they are counted on purpose, as
 the 26.2 comparison. Sprint 139 added OpenTelemetry (24.2), found missing by the 27 Oct pass (AP-6). Sprint 140 split the shuttle off the
-multi-select row and added Select One / Select Many (24.2) and the Help Text region (AP-4).)
+multi-select row and added Select One / Select Many (24.2) and the Help Text region (AP-4). Sprint 141 split remote servers off the
+database links row and added static workspace files with workspace web credentials (AP-7).)
 
 ## App Builder and development
 
@@ -279,8 +280,10 @@ review is a diff. Not counted in [At a glance](#at-a-glance): the rows above com
 | SQL Workshop utilities: schema comparison, generate DDL | ✅ | (sprint 56) SQL Workshop → **DDL**: a schema's objects (types, sequences, tables, functions, views, constraints, indexes, triggers, RLS and policies, comments, grants) from the catalog, in an order that runs, unqualified so it also creates them in another schema. **Compare**: two schemas by their DDL (only in one, different, with a diff) and a change script that makes the target like the source (tables column by column; drops commented out for review). Also `pgkiln ddl`, `pgkiln compare` and the MCP tools `generate_ddl`, `compare_schemas` ([chapter 3](guide/03-builder.md#sql-workshop)). Two schemas of the same database only (APEX: also within one workspace) |
 | Data Reporter: self-service reports for business users (26.1) | ✅ | A **Data Reporter** region ([chapter 4](guide/04-pages-and-regions.md#data_reporter-data-reporter)): the developer offers tables and views with chosen columns, labels and format masks; signed-in users pick columns, filter, group with totals (count, sum, average, minimum, maximum), sort and chart, and save reports privately or shared with the app's users. Runs as the app's role (grants and RLS apply); works without JavaScript and fits phones. (sprint 68) A **welcome page** like 26.1's: a greeting (the developer's own, or pgkiln's), the sources as cards that start a report, the user's reports latest first, shared ones, and a search. One source per report (offer a view to combine tables); no downloads from a reporter yet (sprint 110) **A workspace tool too**: App Builder → **Data Reporter** ([chapter 3](guide/03-builder.md#data-reporter-datasets-and-reporting-applications)) keeps **datasets** (tables and views of one schema with joins proposed from foreign keys, offered columns with labels, masks and descriptions, a row filter; files and the workspace export) and makes a **reporting application** on them in two clicks: viewers open published reports by a stable URL and pin them, editors build and publish, administrators moderate; every report runs as the application's SELECT-only role through RLS. |
 | REST Source Catalogs (Workspace Utilities) | ✅ | (sprint 67) Workspace utilities → **REST Source Catalogs**: a workspace's web services with a base URL and services, from an **OpenAPI 3 / Swagger 2.0** document (file, pasted or read from a URL on the allow-list), a catalog file or by hand: parameters (under the service's own names), row selector, typed columns and write-back operations from the response schemas and collection/item paths, with notes on what can't be used. An application's *REST data sources → From a REST source catalog* makes a data source from a service, with its own web credential ([chapter 19](guide/19-rest-data-sources.md#rest-source-catalogs)). **Missing:** YAML documents (convert to JSON), APEX's built-in catalogs (e.g. Oracle Fusion) |
-| JSON sources, duality views (24.2) | ➖ | PostgreSQL `jsonb` works in any SQL region, form or grid source |
-| Remote servers / database links | ➖ | `postgres_fdw` or `dblink` |
+| JSON sources, duality views (24.2) | ✅ | (sprint 142, AP-8) Shared Components → **JSON Sources** ([chapter 19](guide/19-rest-data-sources.md#json-sources-and-document-views)): a `jsonb` column with a data profile proposed from the documents; `security_invoker` views with a typed column per path and a view per array (stable row keys), whose triggers write only the changed paths, so unknown keys stay; forms, reports, grids, master-detail, AutoREST and MCP use them like tables; Create page makes a form with detail grids. Table Properties → **Document view**: a row and its child rows as one `jsonb` document, written back in one statement (the duality view). JSON path columns in reports |
+| Remote Servers (Workspace Utilities): a named base URL per environment for REST data sources, catalogs and AI services | ✅ | (sprint 141, AP-7) Workspace utilities → **Remote servers** ([chapter 19](guide/19-rest-data-sources.md#remote-servers)): a static id, this installation's base URL and/or an environment variable `PGKILN_SERVER_<NAME>` that wins when set, and a default web credential. REST data sources (a server and a path), REST source catalogs and AI services name a server, so changing it moves every source at once; the resolved URL passes the allow-list, the workspace's network access list (which shows each server's host) and the address checks. In the workspace export (an existing server keeps its local URL) |
+| Static Workspace Files (`#WORKSPACE_FILES#`), workspace-level Web Credentials | ✅ | (sprint 141, AP-7) Workspace utilities → **Static workspace files**: CSS, JavaScript, images and fonts with the static application files' types (no HTML), size limit and headers, served to each application of the workspace at `/a/<alias>/workspace-files/<name>`, loaded with `#WORKSPACE_FILES#name` and written as `#WORKSPACE_FILES#` / `#APP_FILES#` in HTML and templates ([chapter 16](guide/16-files.md#static-workspace-files)). **Web credentials** of the workspace, used by name by its applications (an application's own of the same name wins); secrets encrypted, write-only, never exported. Both in the workspace export |
+| Remote database regions (REST Enabled SQL), database links | ➖ | Not built: regions on another database were left out of sprint 141. `postgres_fdw` or `dblink` bring another PostgreSQL database's tables into the application's own |
 | E-mail: `APEX_MAIL`, the Send E-Mail process, e-mail templates | ✅ | (sprint 50) `meta.send_mail`, `meta.send_mail_template`, `meta.add_mail_attachment` and `meta.mail_status`, queued in the caller's transaction and sent by the server after the commit with retries; the **send_email** process; Shared Components → **E-mail templates** (`#NAME#` escaped in HTML, `#NAME!RAW#`; exported). Further than APEX (SMTP with a password only, through `UTL_SMTP`): **mail services** for SMTP with a password or **OAuth2** (XOAUTH2, e.g. Exchange Online after the end of basic authentication), **Microsoft 365 through Graph**, **Amazon SES**, **Resend, Postmark, SendGrid and Mailgun**, or log only; encrypted write-only secrets, allowed senders, a service, From address and daily limit per application, a mail log with retry and cancel ([chapter 6](guide/06-processing.md#sending-e-mail)). No bounce or delivery webhooks, no mail in workflows other than from SQL steps |
 
 ## Workflow, automation and AI
@@ -455,9 +458,9 @@ Sources: [APEX 26.2 new features](https://docs.oracle.com/en/database/oracle/ape
 | Plug-ins, Component Settings | The same names (User Interface; component settings sprint 83): rows per page of reports, grids and popup lists of values, list of values rows, star rating stars |
 | Component Groups | The same name (Other Components, sprint 83): a library application's lists of values, authorization schemes, build options, template components and lists, subscribed to at once; Page Groups for pages |
 | Progressive Web App | Settings → Progressive Web App |
-| Static Application Files, Static Workspace Files | Static Application Files; workspace files ➖ not planned |
+| Static Application Files, Static Workspace Files | Static Application Files; Static workspace files in Workspace utilities (sprint 141) |
 | Report Layouts, Report Queries | The same names (Files and Reports, sprint 82): a report query is one query printed as PDF with a report layout, Excel, CSV, JSON, XML or HTML (`?doc=NAME`, document buttons); APEX's several queries for one layout: a document template's JSON columns |
-| REST Data Sources, Web Credentials, REST Enabled SQL, Data Load Definitions | The same names (Data Sources); REST Enabled SQL ➖ not planned (one database) |
+| REST Data Sources, Web Credentials, REST Enabled SQL, Data Load Definitions, JSON Sources | The same names (Data Sources; JSON Sources since sprint 142); web credentials of the workspace and Remote Servers in Workspace utilities (sprint 141); REST Enabled SQL ➖ not planned (one database) |
 | Workflows, Task Definitions, Automations | The same names |
 | Text Messages, Translate, Dynamic Translations, Globalization Attributes | Translations and Text Messages, Dynamic Translations, Settings → Globalization |
 | Map Backgrounds | ➖ Not planned per application: the installation's map tile server (`MAP_TILE_URL`) is every map's background |

package/docs/guide/01-installation.md

@@ -189,6 +189,7 @@ which is read at startup; real environment variables take precedence.
 | `PGKILN_OLD_SECRET_KEY` | *(none)* | (0.67) Only for `pgkiln admin rotate-key`: the key the secrets are stored with now |
 | `PGKILN_REST_ALLOWED_HOSTS` | *(none: no outgoing calls)* | Hosts REST data sources and `invoke_api` may call: `api.example.com`, `*.example.com`, `host:8443`, `*` (any public host) ([chapter 19](19-rest-data-sources.md#server-configuration-and-the-allow-list)); a workspace's [network access list](03-builder.md#network-access) can narrow it, and the SMTP server of a workspace's own mail service must be on it |
 | `PGKILN_REST_PRIVATE_HOSTS` | *(none)* | Hosts that may resolve to private, loopback or link-local addresses (also allows them) |
+| `PGKILN_SERVER_<NAME>` | *(none)* | (sprint 141) The base URL of a [remote server](03-builder.md#static-workspace-files-remote-servers-and-web-credentials) that names this variable, e.g. `PGKILN_SERVER_CRM=https://crm.example.com`: it wins over the URL stored with the server, so each environment (development, test, production) sets its own. Only names starting `PGKILN_SERVER_` can be used |
 | `PGKILN_PUSH_HOSTS` | the browsers' push services | The hosts push notifications may be posted to: `fcm.googleapis.com,updates.push.services.mozilla.com,web.push.apple.com,*.notify.windows.com` when unset ([chapter 17](17-mobile.md#push-notifications)) |
 | `PGKILN_PUSH_SUBJECT` | `PUBLIC_URL` when it is https | The contact the push services see (`mailto:ops@example.com` or an https URL); Apple refuses notifications without one |
 | `PGKILN_PUSH_PRIVATE_HOSTS` | *(none)* | For tests only: a push service on a private or loopback address, also over plain http |

package/docs/guide/03-builder.md

@@ -226,7 +226,7 @@ department. Every installation has the **Default** workspace, which holds the ap
   current workspace; a working copy stays in its main application's workspace. Imports made with the command line
   (`pgkiln import`) go into Default. Exports don't carry the workspace.
 - **Workspace utilities**: tiles for users and sign-in, application groups, the App Gallery, developers, the SQL
-  Workshop and the dashboard (and, for administrators, instance settings, workspaces, AI and mail services and the
+  Workshop, the dashboard, [static workspace files, remote servers and web credentials](#static-workspace-files-remote-servers-and-web-credentials) (and, for administrators, instance settings, workspaces, AI and mail services and the
   installation), with **Cross Application Reports** in the side column (APEX: Cross Application Reports), each over
   every application of the current workspace: *Application attributes* (type, sign-in, availability, build status,
   debug level, language, database role), *Build options*, *Developer comments*, *Authentication* (sign-in methods,
@@ -332,6 +332,9 @@ applications' files. Choose what goes in:
 | SQL scripts, blueprints, data generators | The SQL Workshop's saved work |
 | Data Reporter datasets | Every [dataset](#data-reporter-datasets-and-reporting-applications) (sprint 110) |
 | Team Development | [Label groups, labels, milestones, templates and issues](#team-development) with their comments and history; an issue's application by alias (sprint 113) |
+| Static workspace files | Every [file](#static-workspace-files-remote-servers-and-web-credentials), its content in base64 (sprint 141) |
+| Remote servers | Static id, name, base URL, environment variable, default credential; on import an **existing server keeps its own base URL** (it is per installation), a new one takes the file's (sprint 141) |
+| Web credentials | The workspace's web credentials **without their secrets**: a new one gets its secret entered after the import, an existing one keeps its own (sprint 141) |
 
 Never in the file: the workspace's name, its [isolation](#isolated-workspaces) and database roles, its
 [mail service](#a-workspaces-own-mail-service) and [network access list](#network-access) (installation-specific, like
@@ -351,6 +354,37 @@ Utilization), for administrators and the workspace's administrators: the number
 page views of the last 30 days and SQL scripts; per application its pages, regions, items, page views, users and the
 size of its static files; and the schemas the workspace's database roles use with their tables and storage.
 
+### Static workspace files, remote servers and web credentials
+
+What every application of a workspace shares (sprint 141; APEX: *Static Workspace Files*, *Remote Servers* and
+workspace-level *Web Credentials*). Three tiles of Workspace utilities, for the **current workspace**: its developers
+see them, its administrators (and the installation's) add, change and delete. Nothing here reaches another workspace:
+another workspace's file is never served to an application, its servers and credentials are never found.
+
+- **Static workspace files** (`/builder/workspace-files`): CSS, JavaScript, JSON, images and fonts, with the same
+  names, types (no HTML), 5 MB limit and headers as [static application files](#static-application-files). Each
+  application serves them from its own address, `/a/<alias>/workspace-files/<name>`, so the Content-Security-Policy
+  stays `script-src 'self'`. An application loads one on every page with `#WORKSPACE_FILES#brand.css` in *Every page
+  loads* (Shared Components → Static application files; a page: Page → Appearance → JavaScript and CSS files), next to
+  its own files; HTML, templates, list entries and links write `#WORKSPACE_FILES#logo.png` and
+  `#APP_FILES#guide.pdf`, which become those addresses. The *Loaded by* column says which applications (and pages)
+  load a file. The builder's preview of a file is sandboxed.
+- **Remote servers** (`/builder/remote-servers`): a **static id** (`CRM`), a name, this installation's **base URL**
+  (`https://crm.example.com/api`, no trailing slash) and/or an **environment variable** `PGKILN_SERVER_<NAME>` that
+  holds it (it wins when the server's environment sets it: one value per environment; only names starting
+  `PGKILN_SERVER_`, so no other variable becomes a URL), and an optional **default web credential**. A
+  [REST data source](19-rest-data-sources.md#remote-servers), a [REST source catalog](19-rest-data-sources.md#rest-source-catalogs)
+  and an [AI service](#ai-services) name a server and a path instead of a full URL: changing the server moves all of
+  them at once. The list shows the URL now (and where it comes from), whether the [network access](#network-access)
+  lists let it through, and what uses each server. Renaming a static id moves this workspace's sources and catalogs
+  along. The URL still passes every check a full URL does.
+- **Web credentials** (`/builder/workspace-credentials`): the [web credentials](19-rest-data-sources.md#web-credentials)
+  of the workspace (basic, header, bearer, OAuth2, object storage), which its applications use **by name** wherever a
+  credential is named: REST data sources, the Invoke API process and workflow step, `meta.web_request`, remote servers,
+  object storage. An application's own credential with the same name wins (the page lists which applications override
+  one). Secrets are encrypted with `PGKILN_SECRET_KEY`, write-only, never exported and never readable by the runtime
+  role; `pgkiln admin rotate-key` and the lockout checks include them.
+
 ### Isolated workspaces
 
 On a workspace's page an administrator chooses **Isolate this workspace** (Workspace utilities → Workspaces → the
@@ -1464,7 +1498,7 @@ APEX's *Static Application Files*: JavaScript, CSS, JSON, images and fonts that
 application. **Shared Components → Static application files** uploads them (several at once; a
 file with the same name is replaced), writes and edits text files in the browser, renames and
 deletes them. They are served from the application's own address,
-`/a/<alias>/static/<name>`, to anyone (like APEX's `#APP_FILES#`), so don't put secrets in them,
+`/a/<alias>/static/<name>`, to anyone (`#APP_FILES#` in HTML and templates, as in APEX; sprint 141), so don't put secrets in them,
 and they are part of the export (section `static_files`, base64; in a directory export the files
 themselves under `static/`).
 
@@ -1476,7 +1510,8 @@ themselves under `static/`).
   application includes, in order; a page adds its own under **Page → Appearance → JavaScript and
   CSS files** (APEX's *JavaScript File URLs* and *CSS File URLs*). Scripts load with
   `<script src defer>` after pgkiln's own, stylesheets with `<link>`; a name that is not uploaded
-  yet is left out until it is. Renaming a file updates both lists.
+  yet is left out until it is. Renaming a file updates both lists. `#WORKSPACE_FILES#name` in either list loads a
+  [static workspace file](#static-workspace-files-remote-servers-and-web-credentials) (sprint 141).
 - **Caching**: pages link to `…/static/<name>?v=<version>`, which browsers keep for a year; a
   change gives a new version. A link without `?v=` is checked again every time (with an ETag).
 - **The Content-Security-Policy stays strict** (`script-src 'self'`): code runs only from these
@@ -1753,6 +1788,11 @@ fails with *The host … is not on the network access list of workspace …*, is
 (level 2, warning, for `meta.web_request` in a page process; level 1 for regions and processes) and appears under
 **Refused calls** (kept 7 days). **Check a URL** says whether a URL may be called, without calling it.
 
+**Remote servers** (sprint 141): the page lists the host each of the workspace's
+[remote servers](#static-workspace-files-remote-servers-and-web-credentials) stands for now, where its URL comes from
+(base URL or environment variable) and whether a call to it would pass; under the workspace's own list it names the
+servers on each entry.
+
 Not covered by a workspace's list: the installation's own services, which only administrators configure (installation
 mail services, AI services, the geocoder, sign-in providers) and push notification services (their own list,
 `PGKILN_PUSH_HOSTS`).
@@ -1778,7 +1818,10 @@ large language model services of this installation. A service has:
 - the **maximum output tokens** per request (1–128,000) and a **time limit** (5–600 seconds; pages
   wait for the answer);
 - an optional **base URL** for a gateway or proxy that speaks the provider's API (calls to the AI
-  service don't go through `PGKILN_REST_ALLOWED_HOSTS`: only administrators set this URL);
+  service don't go through `PGKILN_REST_ALLOWED_HOSTS`: only administrators set this URL), or
+  (sprint 141) a **remote server** of any workspace plus a path (the service's page, *Remote server*):
+  the service then calls the server's URL of the moment, so moving the endpoint changes one value. The
+  API key is sent to that URL: choose a server whose workspace administrators you trust with it;
 - the **API key**: stored encrypted with `PGKILN_SECRET_KEY`, write-only (never shown again, never
   exported or logged, not readable by applications, never sent to the browser). Without one the
   server's `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY` or `OPENAI_COMPATIBLE_API_KEY`
@@ -1856,6 +1899,17 @@ earns most?* and it calls the SQL tool `top_earners` as the signed-in user's rol
 *Open BLAKE's record*, a link to the employee form (page 3) with a valid checksum, only to users who
 may open that page.
 
+## JSON sources
+
+(sprint 142; APEX: JSON Sources) Shared Components → Data Sources → **JSON Sources**: a `jsonb` column of one of the
+application's tables described by a data profile (columns at paths, arrays of objects or values), kept in
+`meta.app.json_sources` and exported with the application. *Propose from the data* reads up to 200 documents;
+**Create views** makes a `security_invoker` view with a typed column per path and a view per array (one row per
+element), with INSTEAD OF triggers that write only the changed paths, so keys the profile doesn't know stay in the
+documents; **Create page** makes a form on the view with a detail grid per array. The list shows which views are
+not made yet. Everything about the views, their keys and their security is in
+[chapter 19](19-rest-data-sources.md#json-sources-and-document-views).
+
 ## Vector providers
 
 (sprint 136; APEX: Vector Providers) A **vector provider** turns a text into an **embedding**: a list of numbers
@@ -2041,6 +2095,10 @@ the SQL Workshop's connection may use. Without JavaScript the header's field ope
     [vector provider](#vector-providers), an HNSW index for the distance and a trigger that re-embeds a row when its
     source columns change (at once with a function provider, else through the server's queue); the page shows each
     vector column's progress and **Backfill**. Without pgvector it says what is missing.
+    (sprint 142) **Document view…** (Table Properties, or the ⋯ menu): a `security_invoker` view with the table's key
+    and a `jsonb` document per row with lists of the child tables you tick (by foreign key); writing a document
+    updates the row, upserts the children it lists and deletes the ones it leaves out, like an APEX duality view
+    ([chapter 19](19-rest-data-sources.md#document-views-duality-views)). Preview, Apply (Change Log) or Open in the worksheet.
   - (sprint 119) **Security** (the Object Browser's *Security* button on a table, *Security…* in its ⋯ menu): the
     table's row level security policies, a matrix of database roles × columns with *read* and *update*, and masked
     columns per application role in a masking view; Preview SQL, Apply (one transaction, recorded in the Change Log)

package/docs/guide/04-pages-and-regions.md

@@ -414,6 +414,7 @@ Attributes (most of them are also in the page designer's **Report settings** for
 | `sortable` | `true` | Allow sorting (`false` keeps the query's order, e.g. for trees) |
 | `mobile` | `"reflow"` | `"scroll"` keeps a horizontally scrolling table on phones |
 | `hidden` | `[]` | Column names to leave out of the display (they can still be used in links). Users can't search, filter, sort, compute or aggregate on them either, also not by editing the URL |
+| `json_columns` | none | (sprint 142) Columns read from a json or jsonb column of the source: `[{"name": "title", "column": "profile", "path": "title", "type": "text"}]`. A path is keys separated by dots, a number picks an array element (`skills.0.name`); `type` is `text` (default), `integer`, `bigint`, `numeric`, `boolean`, `date`, `timestamp`, `timestamptz` or `jsonb`, and a value that doesn't read as it is NULL. They are columns like the others (search, filters, sorting, downloads). In the report settings: *JSON path columns*, `name=column:path[:type]; …` ([chapter 19](19-rest-data-sources.md#json-path-columns-in-reports)) |
 | `headings` | `{}` | Column headings, e.g. `{"sal": "Salary"}`; by default `hire_date` becomes "Hire Date" |
 | `formats` | `{}` | Format masks per column, e.g. `{"sal": "FML999G990D00", "hiredate": "DD-MON-YYYY"}` (see [number formats](14-globalization.md#number-formats)) |
 | `link` | none | Makes one column a link: `{"column": "empno", "page": 3, "items": {"P3_EMPNO": "#empno#"}}`. `#col#` is replaced by the row's value; the link carries a checksum and is hidden when the user may not open that page |

package/docs/guide/12-development.md

@@ -37,7 +37,8 @@ src/
   restcatalog.ts           (095) REST source catalogs: checks, fromOpenApi (OpenAPI 3 / Swagger 2 → services: parameters with "key",
                            rows and columns from the response schema, write-back from collection and item paths, notes), catalog
                            files, load/insert/replace, sourceFromService
-  workspace-export.ts      (sprint 67) a workspace's components as a file (pgkiln-workspace/1) and importWorkspace (one transaction)
+  workspace-export.ts      (sprint 67) a workspace's components as a file (pgkiln-workspace/1) and importWorkspace (one transaction);
+                           (sprint 141) workspace_files, remote_servers (an existing server keeps its base URL), web_credentials (no secrets)
   team.ts                  (sprint 113) Team Development's data: workspaceDevelopers (members and administrators: assignees, @mentions),
                            issueHtml (markdownHtml + mentions), recordMentions, logIssue (history), teamSetup, teamCounts, pageIssues,
                            exportTeam / importTeam (the workspace export's "team" part)
@@ -134,6 +135,14 @@ src/
   network-acl.ts           (sprint 118, WS-9) workspace network access lists (meta.workspace.network_*): scopeForApp/scopeForWorkspace
                            (no cache), parseHostList, recordRefusal/purgeRefusals (meta.network_refusal, 7 days), mailHostAddress
                            (a workspace mail service's SMTP host: both lists, resolved once, the checked address connected to)
+  remote-servers.ts        (sprint 141, AP-7) remote servers (meta.remote_server): serverProblems, serverUrl (PGKILN_SERVER_* env var
+                           wins over base_url), joinUrl, resolveSource (a REST source on a server: full URL + the server's default
+                           credential; used by loadSource/fetchSource/callOperation), catalog and AI service URLs (owner pool,
+                           the application's own workspace only)
+  json-sources.ts          (sprint 142, AP-8) JSON sources (meta.app.json_sources): jsonSourceProblems, proposeProfile (types and
+                           arrays from sample documents), jsonSourceDdl (security_invoker views with the meta.json_source_write /
+                           json_array_write triggers, the table's grants), documentViewDdl (duality-view analogue, meta.json_document_write),
+                           withJsonColumns / parseJsonColumns (a report's json_columns), catalog helpers (primaryKey, tableGrants, childTables)
   datapump.ts              (sprint 103, DA-16) Schema Export / Import jobs (meta.dump_job): findTools (pg_dump/pg_restore ≥ the
                            server's major), startExport (pg_dump, argument array, PGPASSWORD), readToc/parseToc (pg_restore --list),
                            startImport (pg_restore -f - run in one transaction between schema renames; data-only in FK order),
@@ -220,6 +229,9 @@ src/
     processes.ts           download (file or zip from a query, safe headers), workflow processes, configuration checks of chains
     logic.ts               computations (the page's and (102) the application's), branches (page, URL, function returning a URL, another application) and their conditions
     shortcuts.ts           (103) "NAME" shortcuts in static content, help texts and confirm messages
+    static-files.ts        (068) static application files (/a/<alias>/static/<name>), the <script>/<link> tags of a page; (141) static
+                           workspace files (/a/<alias>/workspace-files/<name>, the application's own workspace's only, owner pool);
+                           #APP_FILES# / #WORKSPACE_FILES# are substituted in context.ts substitute and template-components.ts
     render.ts              page chrome (nav, breadcrumb), dynamic action JSON, theme (the page's nonce'd <style>, light/dark and style switches)
     page-regions.ts        (sprint 140) breadcrumb and help_text regions: breadcrumbLinks (also the title bar's trail, left out when the
                            page has a breadcrumb region), the page's help text (meta.page.help) as Markdown with escaped &ITEM. values
@@ -380,6 +392,10 @@ src/
                            list (workspaceAdmin), Check a URL (nothing called), the workspaces (administrators), refused calls
     workspace-mail.ts      (sprint 118, WS-9) a workspace's own mail service (/builder/workspaces/:id/mail, WORKSPACE_<id>): its
                            administrators only, write-only secret, checks through mail.ts runCheck with the workspace's guard
+    workspace-resources.ts (sprint 141, AP-7) Workspace utilities → Static workspace files (/builder/workspace-files), Remote servers
+                           (/builder/remote-servers: URL now, network verdict, used by; renaming moves sources/catalogs) and Web
+                           credentials (/builder/workspace-credentials: write-only secrets): the current workspace, its developers see,
+                           its administrators change
     shared.ts              Shared Components and access control
     designer.ts            page designer: component tree (with computations and branches), layout canvas and gallery, property editor, toolbar;
                            (sprint 86) GET /builder/apps/:app/pages/:no, /builder/pages/:id redirects browsers there (designerUrl in ui.ts)
@@ -407,6 +423,11 @@ src/
     vector-providers.ts    (sprint 136, AP-1) Shared Components → Vector providers (/apps/:id/vector-providers: list, provider form,
                            test, delete) and Workspace utilities → Vector providers (/vector-providers: pgvector status, Create
                            extension for administrators, the workspace's providers and vector columns); pgvectorNote()
+    json-sources.ts        (sprint 142, AP-8) Shared Components → JSON sources (/apps/:id/json-sources: list, source form with
+                           Propose from the data, views: Create views / worksheet (Change Log), page: createSourcePage() = a form
+                           on the view and a detail grid per array, delete)
+    document-view.ts       (sprint 142, AP-8) Table Properties › Document view: GET/POST /sql/objects/document?o= (child tables
+                           by foreign key), Preview / Apply (Change Log) / worksheet
     telemetry.ts           (sprint 139, AP-6) Workspace utilities → OpenTelemetry (/telemetry: the collector, signals, values, user,
                            browser spans, /metrics and its token, status per collector, Send a test span; administrators) and a
                            workspace's own (/workspaces/:id/telemetry: as the instance / off / own collector; its administrators)
@@ -629,6 +650,10 @@ test/
   blueprint-from-app.test.ts  a blueprint of HR: checks clean, pages and menu, notes, a working copy with sample rows, workspaces
   rest-catalogs.test.ts    OpenAPI/Swagger reading, parameter keys, catalog files, the builder's pages, a data source from a service
   workspace-transfer.test.ts  a workspace's export, import into another workspace (added, kept, replaced, all or nothing), groups, access
+  workspace-resources.test.ts  (sprint 141) remote servers (checks, env var, HR's CRM moves its sources, credentials, renames, catalogs,
+                           AI services, the Advisor), static workspace files styling two applications, workspace credentials, the export
+  json-sources.test.ts     (sprint 142) data profiles, the views' DDL, writing through them (unknown keys stay, arrays by row_key,
+                           a table of documents, document views), HR page 51 (JSON path columns, form and skills grid), the builder, export
   tree-charts.test.ts      treemap and sunburst (the hierarchy, cycles, squarify), timeline (lanes, rows, points and periods)
   gantt-move.test.ts       an editable Gantt's markup, the move route, dates, who may drag, the builder's settings
   find-workspace.test.ts   developers' addresses, builder mail, the workspaces mail, the same answer, limits

package/docs/guide/16-files.md

@@ -21,6 +21,8 @@ This chapter covers three things that deal with files:
 | Interactive report → Download → CSV / Excel / PDF | Actions → **Download CSV / Excel / PDF** |
 | Shared Components → Report Layouts | Shared Components → **Report layouts** |
 | Print (browser) | Actions → **Print**, and a print stylesheet on every page |
+| Static Application Files (`#APP_FILES#`) | Shared Components → **Static application files** ([chapter 3](03-builder.md#static-application-files)) |
+| Static Workspace Files (`#WORKSPACE_FILES#`) | Workspace utilities → **Static workspace files** ([below](#static-workspace-files)) |
 
 ## File upload items
 
@@ -206,6 +208,33 @@ address or the credential. Downloads are limited to `MAX_UPLOAD_MB`.
 Large files in bytea columns are fine up to tens of megabytes. For bigger files or large numbers
 of them, store them in object storage and keep the key in the table.
 
+## Static workspace files
+
+Files a developer ships with the applications, rather than files users upload: CSS, JavaScript, JSON, images, fonts
+and PDFs. An application has its own (Shared Components → **Static application files**,
+[chapter 3](03-builder.md#static-application-files)); since sprint 141 a **workspace** has them too (Workspace
+utilities → **Static workspace files**; APEX: Static Workspace Files), shared by every application of the workspace,
+for example one stylesheet with the company's colours.
+
+| Write | Means |
+|---|---|
+| `#WORKSPACE_FILES#brand.css` in *Every page loads* (or a page's *JavaScript and CSS files*) | Every page (that page) loads the workspace's `brand.css` with `<link>` (a `.js` file with `<script src defer>`), after pgkiln's own, in list order with the application's own files |
+| `#WORKSPACE_FILES#logo.png` in HTML, a template, a list entry, a link | `/a/<alias>/workspace-files/logo.png` |
+| `#APP_FILES#guide.pdf` | `/a/<alias>/static/guide.pdf`, the application's own file |
+
+Each application serves the workspace's files from its own address, `/a/<alias>/workspace-files/<name>`, to anyone
+(don't put secrets in them): only its own workspace's files, never another workspace's. Pages link to
+`…?v=<version>`, which browsers keep for a year; a change gives a new version.
+
+The rules are those of static application files: names of letters, digits, `_`, `-` and `.` with an extension from a
+fixed list; **no HTML** (the database refuses it too); up to 5 MB a file; `X-Content-Type-Options: nosniff`; an SVG or
+PDF opened on its own is sandboxed, so a script in it never runs. The workspace's administrators upload, write, rename
+and delete them; its developers see the list (with the applications and pages that load each file) and open a file in
+a sandboxed preview. They travel with the [workspace export](03-builder.md#export-and-import), not with an
+application's.
+
+HR example (part 76): `brand.css` is a workspace file; HR loads it as `#WORKSPACE_FILES#brand.css`.
+
 ## Data loading
 
 Both ways of loading accept: