pgkiln 0.74.0 → 0.76.0

package/docs/guide/04-pages-and-regions.md

@@ -234,12 +234,32 @@ Features for end users:
   search and filters; at most 200), with a box to narrow them; choosing a value filters the report on it. The sort
   arrow of the sorted column sorts at once. Without JavaScript a heading sorts (again for descending).
 - **Hidden columns**: hidden from the heading menu or *Actions → Columns*, shown as chips to bring them back.
+- **Column order** (sprint 143; APEX 26.2: drag-and-drop columns): *Actions → Columns* lists the columns in their
+  order with a checkbox to hide each; drag one to another place, or move it with its ↑ / ↓ buttons (each move is
+  announced to screen readers; without JavaScript the buttons submit the dialog). *Own column order* is a chip that
+  puts the report's order back. The order is kept in saved reports (`r12_o=sal&r12_o=ename`, the columns it names
+  first, the rest after them in the report's order), and the CSV, Excel and PDF downloads follow it and leave out
+  the columns the user hid.
 - **Pagination**: *1–15 of 107*, first, previous, next and last page, and the **rows per page** list.
 - **Actions menu** (sprint 76: a short menu like APEX's; each entry opens a dialog, or unfolds in place without
   JavaScript): *Columns*, *Filter*, *Data* (sort, aggregate, compute, control break), *Format* (highlight, rows per
   page), *Chart*, *Group by*, *Pivot*, *Report* (saved reports, reset) and *Download* (CSV, Excel, PDF, print):
   - **column filters** (`=`, `≠`, contains, does not contain, `>`, `≥`, `<`, `≤`, is empty, is
-    not empty) and **sort**;
+    not empty, and since sprint 143 the 26.2 operators below) and **sort**:
+    - **is one of** / **is not one of** (APEX 26.2: multi-select filters): tick values in the column's list (with
+      their counts and a search box, as in the heading menu), or type them separated by commas. *Is not one of*
+      keeps the rows without a value. In the URL the values are a JSON array: `r12_f=job|in|["CLERK","ANALYST"]`
+      (`job|in|CLERK, ANALYST` works too), at most 100 values;
+    - **is between** (date-range filters): two values, both included, either may stay empty (*Salary ≥ 1000*). On a
+      date or timestamp column the fields get the date picker and take dates in the application's date format, and
+      the last day counts as a whole (`hiredate|between|["1981-01-01","1981-12-31"]`);
+    - **is in** a period, on a date column: today, yesterday, the last 7 days, the last 30 days, the next 7 days,
+      this month, last month, this year or last year (`hiredate|period|last_30_days`). A period is computed
+      from today when the report runs, so a saved report stays current.
+
+    The dialog shows only the fields the chosen operator needs (without JavaScript it shows all of them); a filter
+    is a chip in words (*Job is one of CLERK, ANALYST*), also in the PDF's filter list. *Ask in your own words* and
+    an AI service may use the same operators; a highlight takes the one-value operators;
   - **control break**: group the rows by a column, with a heading row per group;
   - **aggregates**: sum, average, count, minimum or maximum of a column, over all filtered rows
     (not just the page). A *Total* row closes the table, and with a control break every group
@@ -267,7 +287,8 @@ Features for end users:
 
 The report's state lives in the URL (`?r12_q=…&r12_s=3&r12_d=desc&r12_b=job&r12_a=sum|sal&r12_h=sal|gt|green|3000`),
 so it can be bookmarked and shared. Everything the user enters is applied safely: search, filter
-and highlight values become literals, columns must exist in the result, operators, aggregate
+and highlight values become literals (each value of a list and each bound of a range on its own; a period is one
+of a fixed list of expressions), columns must exist in the result, operators, aggregate
 functions, chart types and colors come from fixed lists, sort positions are integers, and computed
 column expressions are parsed (below), never pasted into SQL.
 
@@ -414,6 +435,7 @@ Attributes (most of them are also in the page designer's **Report settings** for
 | `sortable` | `true` | Allow sorting (`false` keeps the query's order, e.g. for trees) |
 | `mobile` | `"reflow"` | `"scroll"` keeps a horizontally scrolling table on phones |
 | `hidden` | `[]` | Column names to leave out of the display (they can still be used in links). Users can't search, filter, sort, compute or aggregate on them either, also not by editing the URL |
+| `json_columns` | none | (sprint 142) Columns read from a json or jsonb column of the source: `[{"name": "title", "column": "profile", "path": "title", "type": "text"}]`. A path is keys separated by dots, a number picks an array element (`skills.0.name`); `type` is `text` (default), `integer`, `bigint`, `numeric`, `boolean`, `date`, `timestamp`, `timestamptz` or `jsonb`, and a value that doesn't read as it is NULL. They are columns like the others (search, filters, sorting, downloads). In the report settings: *JSON path columns*, `name=column:path[:type]; …` ([chapter 19](19-rest-data-sources.md#json-path-columns-in-reports)) |
 | `headings` | `{}` | Column headings, e.g. `{"sal": "Salary"}`; by default `hire_date` becomes "Hire Date" |
 | `formats` | `{}` | Format masks per column, e.g. `{"sal": "FML999G990D00", "hiredate": "DD-MON-YYYY"}` (see [number formats](14-globalization.md#number-formats)) |
 | `link` | none | Makes one column a link: `{"column": "empno", "page": 3, "items": {"P3_EMPNO": "#empno#"}}`. `#col#` is replaced by the row's value; the link carries a checksum and is hidden when the user may not open that page |

package/docs/guide/12-development.md

@@ -139,6 +139,10 @@ src/
                            wins over base_url), joinUrl, resolveSource (a REST source on a server: full URL + the server's default
                            credential; used by loadSource/fetchSource/callOperation), catalog and AI service URLs (owner pool,
                            the application's own workspace only)
+  json-sources.ts          (sprint 142, AP-8) JSON sources (meta.app.json_sources): jsonSourceProblems, proposeProfile (types and
+                           arrays from sample documents), jsonSourceDdl (security_invoker views with the meta.json_source_write /
+                           json_array_write triggers, the table's grants), documentViewDdl (duality-view analogue, meta.json_document_write),
+                           withJsonColumns / parseJsonColumns (a report's json_columns), catalog helpers (primaryKey, tableGrants, childTables)
   datapump.ts              (sprint 103, DA-16) Schema Export / Import jobs (meta.dump_job): findTools (pg_dump/pg_restore ≥ the
                            server's major), startExport (pg_dump, argument array, PGPASSWORD), readToc/parseToc (pg_restore --list),
                            startImport (pg_restore -f - run in one transaction between schema renames; data-only in FK order),
@@ -419,6 +423,11 @@ src/
     vector-providers.ts    (sprint 136, AP-1) Shared Components → Vector providers (/apps/:id/vector-providers: list, provider form,
                            test, delete) and Workspace utilities → Vector providers (/vector-providers: pgvector status, Create
                            extension for administrators, the workspace's providers and vector columns); pgvectorNote()
+    json-sources.ts        (sprint 142, AP-8) Shared Components → JSON sources (/apps/:id/json-sources: list, source form with
+                           Propose from the data, views: Create views / worksheet (Change Log), page: createSourcePage() = a form
+                           on the view and a detail grid per array, delete)
+    document-view.ts       (sprint 142, AP-8) Table Properties › Document view: GET/POST /sql/objects/document?o= (child tables
+                           by foreign key), Preview / Apply (Change Log) / worksheet
     telemetry.ts           (sprint 139, AP-6) Workspace utilities → OpenTelemetry (/telemetry: the collector, signals, values, user,
                            browser spans, /metrics and its token, status per collector, Send a test span; administrators) and a
                            workspace's own (/workspaces/:id/telemetry: as the instance / off / own collector; its administrators)
@@ -643,6 +652,8 @@ test/
   workspace-transfer.test.ts  a workspace's export, import into another workspace (added, kept, replaced, all or nothing), groups, access
   workspace-resources.test.ts  (sprint 141) remote servers (checks, env var, HR's CRM moves its sources, credentials, renames, catalogs,
                            AI services, the Advisor), static workspace files styling two applications, workspace credentials, the export
+  json-sources.test.ts     (sprint 142) data profiles, the views' DDL, writing through them (unknown keys stay, arrays by row_key,
+                           a table of documents, document views), HR page 51 (JSON path columns, form and skills grid), the builder, export
   tree-charts.test.ts      treemap and sunburst (the hierarchy, cycles, squarify), timeline (lanes, rows, points and periods)
   gantt-move.test.ts       an editable Gantt's markup, the move route, dates, who may drag, the builder's settings
   find-workspace.test.ts   developers' addresses, builder mail, the workspaces mail, the same answer, limits

package/docs/guide/19-rest-data-sources.md

@@ -15,7 +15,8 @@ Web Credentials and the Invoke API process):
   puts values of the response into items; the **`invoke_api` workflow step** does the same on the
   server, with workflow variables ([chapter 6](06-processing.md#invoke-api-steps)).
 
-Both are **Shared Components**. The server only calls hosts its administrator allows
+Both are **Shared Components**, as are **JSON sources** ([below](#json-sources-and-document-views)): forms,
+reports and grids over the documents in a `jsonb` column of your own tables. The server only calls hosts its administrator allows
 ([below](#server-configuration-and-the-allow-list)): out of the box, no outgoing request is made.
 
 Try it with the HR example: page 23 "Web services" reads the HR example's own REST module
@@ -355,6 +356,110 @@ A workflow calls a web service with an **`invoke_api` step** instead: the same k
 `variables`, `status_variable` and `response_variable` for the items, `&VAR.` for workflow
 variables and an optional `timeout` ([chapter 6](06-processing.md#invoke-api-steps)).
 
+## JSON sources and document views
+
+(Sprint 142; APEX: Shared Components → Data Sources → **JSON Sources**, and JSON Relational **Duality Views**.)
+A `jsonb` column is a single text item to a form, and one cell to a report. A **JSON source** describes the
+documents in such a column with a **data profile**, and pgkiln makes updatable views from it, so forms, reports,
+interactive grids, master-detail pages, REST (AutoREST) and MCP read and write the documents' values like columns
+of a table.
+
+### A JSON source
+
+Shared Components → Data Sources → **JSON Sources** → *Add JSON source*:
+
+- **Table and jsonb column**: a column of an ordinary table (`hr.emp.profile`), or the one document column of a
+  *table of documents* (`id`, `doc`). The table needs a primary key: the views find their row by it. The list
+  shows the json and jsonb columns of the tables your SQL Workshop connection may use (an isolated workspace: its
+  own schemas).
+- **View**: the name of the view, made in the table's schema.
+- **The view also adds and deletes rows of the table**: for a table of documents. Off (the default), the view
+  only changes the documents of existing rows; an insert or delete through it is refused.
+- **Propose from the data** reads up to 200 documents and proposes the profile: a **column** per path to a value
+  (nested objects become `office_city` for `office.city`), typed from the values it found (`integer`, `numeric`,
+  `boolean`, `date`, `timestamptz` for ISO date-times, `text`, `jsonb` for mixed or nested values), and an **array**
+  per list in the documents: a list of objects gets a column per key, a list of values (`["en", "nl"]`) one column
+  for the value itself (an empty path). Names, paths and types stay editable; columns you already named are kept.
+  A column can be **read only**.
+
+**Create views** (the source's page) makes them in one transaction with your SQL Workshop connection and records
+the statements in the [Change Log](03-builder.md#change-log); *Open in the SQL Worksheet* shows them first. After
+changing the profile, *Make the views again* drops and makes them (a view other objects depend on can't be
+dropped: the error says which). The views are ordinary database objects of your application, like the table:
+put the statements in your own migration scripts for the other environments (the source itself travels with the
+application's export as `json_sources`).
+
+For `hr.emp.profile` with `{"title": "Analyst", "since": "1987-04-19", "office": {"city": "Dallas"},
+"skills": [{"name": "SQL", "level": 5}], "badge": {"color": "blue"}}` the HR example's source EMP_PROFILE makes:
+
+| View | Columns | One row per |
+| --- | --- | --- |
+| `hr.emp_profile` | `empno`, `title`, `since` (date), `office_city`, `office_floor` (integer), `remote` (boolean) | employee |
+| `hr.emp_profile_skills` | `empno`, `row_key`, `position`, `skill`, `level` (integer) | element of `skills` |
+| `hr.emp_profile_languages` | `empno`, `row_key`, `position`, `language` | element of `languages` |
+
+- A value that doesn't read as its column's type (`"floor": "ground"`) shows **NULL** in that column instead of
+  failing the whole query (`meta.input_ok`, PostgreSQL's `pg_input_is_valid`).
+- **Writing keeps what the profile doesn't know.** An `UPDATE` of the view writes only the paths whose values
+  changed, into the row's document, in one `UPDATE` of the table (`meta.jsonb_patch`): `badge` above, or any key a
+  newer version of another program added, stays. Setting a column to NULL removes its key; a path to a nested
+  object makes the objects on the way. The key columns are never changed through the view.
+- **Arrays as rows.** An array view has the table's key, `row_key` and `position` (1, 2 …) and the element's
+  columns. `row_key` is the element's contents (an md5) and its occurrence among equal elements: it stays the same
+  when other elements are added, changed or removed, so deleting two rows of a grid in one save removes the right
+  two. An `INSERT` appends an element (the table's key column says to which row), an `UPDATE` patches one
+  (unknown keys of the element stay), a `DELETE` removes it. An element that someone changed meanwhile is no
+  longer found and the statement fails (*Reload and try again*): nothing is overwritten.
+- **Security.** The views are `security_invoker` and get the table's grants (SELECT, INSERT, UPDATE, DELETE of each
+  role that has them on the table). Their INSTEAD OF triggers (`meta.json_source_write`, `meta.json_array_write`)
+  are SECURITY INVOKER too: they write the table as the role that writes the view, so its grants and the table's
+  row level security apply, exactly as for a direct `UPDATE`.
+
+### Pages on a JSON source
+
+The views work everywhere a table does: Create Page, a form's or report's source, the interactive grid, AutoREST
+and MCP. **Create page** on the source's page makes a form on the view with a **detail grid per array** (the
+grid's master is the form's key item, `position` read only, `row_key` hidden) and their save processes; open it
+with the key in the URL, for example from a report's link. HR page 51 *Employee profiles* (Administration) is
+such a page with a report on top:
+
+```sql
+-- the report's source: hr.emp with its jsonb column
+select empno, ename, job, profile from hr.emp order by profile is null, ename
+```
+
+### JSON path columns in reports
+
+A report region's **JSON path columns** (Page Designer → the report's settings) add columns read from a json or
+jsonb column of its query, without writing the SQL: `name=column:path[:type]`, separated by `;`:
+
+```
+title=profile:title; first_skill=profile:skills.0.name; since=profile:since:date
+```
+
+A path is keys separated by dots; a number picks an element of an array (`skills.0.name`). They are columns like
+the others: search, filters, sorting, control breaks, aggregates, headings, format masks and downloads. In the
+region's JSON: `"json_columns": [{"name": "title", "column": "profile", "path": "title", "type": "text"}]`.
+
+### Document views (duality views)
+
+SQL Workshop › Table Properties → **Document view…** (or a table's ⋯ menu) makes a view with the table's key and a
+`jsonb` document per row: the row's columns and, per **child table** you tick (tables whose foreign keys reference
+it), a list of its rows without the foreign key columns:
+
+```json
+{"deptno": 10, "dname": "ACCOUNTING", "loc": "NEW YORK",
+ "emp": [{"empno": 7782, "ename": "CLARK", "job": "MANAGER", "sal": 2450}, …]}
+```
+
+Writing the document back (`update hr.dept_doc set doc = $1 where deptno = 10`, or a PUT through AutoREST on the
+view) updates the row's columns the document names, **upserts** the children it lists (by their key; one without
+a key is inserted) and **deletes** the children it leaves out. A document without the list leaves the children
+alone. An `INSERT` of a document inserts the row and its children, a `DELETE` removes the children and the row.
+Full-text and vector columns are left out of the documents. Like APEX's duality views this gives REST clients and
+MCP tools one document per business object; the trigger (`meta.json_document_write`) is SECURITY INVOKER, so the
+tables' grants and row level security apply to every row it touches.
+
 ## Export, import and application files
 
 The export ([chapter 3](03-builder.md#export-format)) has two new sections: `web_credentials`
@@ -363,6 +468,8 @@ synchronisation settings, without the synchronisation's next and last run; an im
 the schedule off). In the directory format they are
 `shared/web-credentials/` and `shared/rest-sources/` ([chapter 18](18-cli.md)). Regions, lists of
 values, processes and workflow steps refer to sources and credentials by name, so nothing needs remapping.
+JSON sources are part of the application (`json_sources`, in `app.yaml` of the directory format); their
+views are not: they belong to your schema's migration scripts, like the table.
 
 ## Security notes
 

package/examples/hr/hr_77_json_sources.sql

@@ -0,0 +1,174 @@
+-- =====================================================================
+-- HR example, part 77: a JSON source (sprint 142, AP-8; migration 142;
+-- docs/guide/19-rest-data-sources.md "JSON sources")
+--
+-- hr.emp gets a jsonb column "profile": a document per employee with a
+-- job title, a start date, an office, skills (objects) and languages
+-- (values), and keys no form knows about (e.g. "badge"). JSON source
+-- EMP_PROFILE (Shared Components → JSON sources) describes it, and the
+-- three views below are what its "Create views" makes:
+--
+--   hr.emp_profile            empno and a column per path (title, since,
+--                             office_city, office_floor, remote);
+--   hr.emp_profile_skills     a row per skill: empno, row_key, position,
+--                             skill, level;
+--   hr.emp_profile_languages  a row per language.
+--
+-- Saving the form changes only the paths whose values changed, so "badge"
+-- and anything else in the document stay. Page 51 "Employee profiles"
+-- (Administration): a report of the employees with JSON path columns
+-- (title and first skill read from the document), a form on
+-- hr.emp_profile and the skills and languages as detail grids.
+-- =====================================================================
+
+alter table hr.emp add column if not exists profile jsonb
+  check (profile is null or jsonb_typeof(profile) = 'object');
+comment on column hr.emp.profile is 'Profile document (JSON source EMP_PROFILE): title, since, office {city, floor}, remote, skills [{name, level}], languages []';
+
+update hr.emp e set profile = p.doc::jsonb
+  from (values
+  (7839, '{"title": "Chief executive", "since": "1981-11-17", "office": {"city": "New York", "floor": 30}, "remote": false,
+           "skills": [{"name": "Strategy", "level": 5}, {"name": "Negotiation", "level": 4}], "languages": ["en", "fr"],
+           "badge": {"color": "gold", "printed": "2024-01-08"}}'),
+  (7698, '{"title": "Sales manager", "since": "1981-05-01", "office": {"city": "Chicago", "floor": 12}, "remote": false,
+           "skills": [{"name": "Sales", "level": 5}, {"name": "Coaching", "level": 3, "certified": true}], "languages": ["en", "es"]}'),
+  (7782, '{"title": "Accounting manager", "since": "1981-06-09", "office": {"city": "New York", "floor": 28},
+           "skills": [{"name": "Accounting", "level": 5}, {"name": "SQL", "level": 3}], "languages": ["en"]}'),
+  (7566, '{"title": "Research manager", "since": "1981-04-02", "office": {"city": "Dallas", "floor": 4}, "remote": true,
+           "skills": [{"name": "PostgreSQL", "level": 5}, {"name": "Statistics", "level": 4}], "languages": ["en", "de", "nl"],
+           "badge": {"color": "blue"}}'),
+  (7788, '{"title": "Analyst", "since": "1987-04-19", "office": {"city": "Dallas"}, "remote": true,
+           "skills": [{"name": "SQL", "level": 5}, {"name": "TypeScript", "level": 3}], "languages": ["en"]}')
+  ) as p (empno, doc)
+ where e.empno = p.empno and e.profile is null;
+
+-- the JSON source (the builder writes this list; it travels with the application's export)
+update meta.app set json_sources = json_sources || $j$[{"name": "EMP_PROFILE",
+  "description": "The employee profile (hr.emp.profile): job title, office, skills and languages",
+  "schema": "hr", "table": "emp", "key": ["empno"], "column": "profile", "view": "emp_profile",
+  "columns": [{"name": "title", "path": ["title"], "type": "text"}, {"name": "since", "path": ["since"], "type": "date"},
+              {"name": "office_city", "path": ["office", "city"], "type": "text"},
+              {"name": "office_floor", "path": ["office", "floor"], "type": "integer"},
+              {"name": "remote", "path": ["remote"], "type": "boolean"}],
+  "arrays": [{"name": "skills", "path": ["skills"], "view": "emp_profile_skills",
+              "columns": [{"name": "skill", "path": ["name"], "type": "text"}, {"name": "level", "path": ["level"], "type": "integer"}]},
+             {"name": "languages", "path": ["languages"], "view": "emp_profile_languages",
+              "columns": [{"name": "language", "path": [], "type": "text"}]}]}]$j$::jsonb
+ where alias = 'hr' and not json_sources @> '[{"name": "EMP_PROFILE"}]';
+
+-- the views, as Shared Components → JSON sources → Create views makes them
+create view hr.emp_profile with (security_invoker = true) as
+select t.empno,
+       t.profile #>> array['title'] as title,
+       case when meta.input_ok(t.profile #>> array['since'], 'date') then (t.profile #>> array['since'])::date end as since,
+       t.profile #>> array['office', 'city'] as office_city,
+       case when meta.input_ok(t.profile #>> array['office', 'floor'], 'integer') then (t.profile #>> array['office', 'floor'])::integer end as office_floor,
+       case when meta.input_ok(t.profile #>> array['remote'], 'boolean') then (t.profile #>> array['remote'])::boolean end as remote
+  from hr.emp t;
+
+comment on view hr.emp_profile is 'JSON source EMP_PROFILE of application hr: hr.emp.profile (made by pgkiln; Shared Components → JSON sources makes it again)';
+
+create trigger json_source_write
+  instead of insert or update or delete on hr.emp_profile
+  for each row execute function meta.json_source_write('{"name":"EMP_PROFILE","schema":"hr","table":"emp","key":["empno"],"column":"profile","rows":false,"columns":[{"name":"title","path":["title"]},{"name":"since","path":["since"]},{"name":"office_city","path":["office","city"]},{"name":"office_floor","path":["office","floor"]},{"name":"remote","path":["remote"]}]}');
+
+grant delete, insert, select, update on hr.emp_profile to "hr_app";
+
+create view hr.emp_profile_skills with (security_invoker = true) as
+select t.empno,
+       k.key as row_key,
+       k.idx + 1 as position,
+       e.v #>> array['name'] as skill,
+       case when meta.input_ok(e.v #>> array['level'], 'integer') then (e.v #>> array['level'])::integer end as level
+  from hr.emp t
+  cross join lateral meta.jsonb_element_keys(t.profile #> array['skills']) k
+  cross join lateral (select (t.profile #> array['skills']) -> k.idx as v) e;
+
+comment on view hr.emp_profile_skills is 'JSON source EMP_PROFILE of application hr: the array skills of hr.emp.profile, one row per element (made by pgkiln)';
+
+create trigger json_source_write
+  instead of insert or update or delete on hr.emp_profile_skills
+  for each row execute function meta.json_array_write('{"name":"EMP_PROFILE","schema":"hr","table":"emp","key":["empno"],"column":"profile","array":["skills"],"row_key":"row_key","position":"position","columns":[{"name":"skill","path":["name"]},{"name":"level","path":["level"]}]}');
+
+grant delete, insert, select, update on hr.emp_profile_skills to "hr_app";
+
+create view hr.emp_profile_languages with (security_invoker = true) as
+select t.empno,
+       k.key as row_key,
+       k.idx + 1 as position,
+       e.v #>> array[]::text[] as language
+  from hr.emp t
+  cross join lateral meta.jsonb_element_keys(t.profile #> array['languages']) k
+  cross join lateral (select (t.profile #> array['languages']) -> k.idx as v) e;
+
+comment on view hr.emp_profile_languages is 'JSON source EMP_PROFILE of application hr: the array languages of hr.emp.profile, one row per element (made by pgkiln)';
+
+create trigger json_source_write
+  instead of insert or update or delete on hr.emp_profile_languages
+  for each row execute function meta.json_array_write('{"name":"EMP_PROFILE","schema":"hr","table":"emp","key":["empno"],"column":"profile","array":["languages"],"row_key":"row_key","position":"position","columns":[{"name":"language","path":[]}]}');
+
+grant delete, insert, select, update on hr.emp_profile_languages to "hr_app";
+
+-- ---------------------------------------------------------------- page 51
+
+insert into meta.page (app_id, page_no, name, title, parent_page)
+select id, 51, 'Employee profiles', 'Employee profiles', 1 from meta.app where alias = 'hr';
+
+insert into meta.region (page_id, seq, title, type, columns, source, table_name, pk_column, pk_item, condition, config)
+select p.id, r.seq, r.title, r.type, r.cols, r.source, r.table_name, r.pk_column, r.pk_item, r.condition, r.config::jsonb
+  from meta.page p join meta.app a on a.id = p.app_id, (values
+  (10, 'Employees', 'report', 12,
+   'select empno, ename, job, profile from hr.emp order by profile is null, ename', null, null, null, null,
+   '{"hidden": ["profile"], "headings": {"empno": "No.", "ename": "Name", "job": "Job", "title": "Title (profile)", "first_skill": "First skill", "since": "Since"},
+     "json_columns": [{"name": "title", "column": "profile", "path": "title", "type": "text"},
+                      {"name": "first_skill", "column": "profile", "path": "skills.0.name", "type": "text"},
+                      {"name": "since", "column": "profile", "path": "since", "type": "date"}],
+     "link": {"page": 51, "column": "empno", "items": {"P51_EMPNO": "#empno#"}}, "page_size": 5}'),
+  (20, 'Profile', 'form', 12, null, 'hr.emp_profile', 'empno', 'P51_EMPNO', ':P51_EMPNO is not null', '{}'),
+  (30, 'Skills', 'grid', 8,
+   'select empno, row_key, position, skill, level
+  from hr.emp_profile_skills
+ where empno::text = :P51_EMPNO
+ order by position', 'hr.emp_profile_skills', 'row_key', null, ':P51_EMPNO is not null',
+   '{"master": {"item": "P51_EMPNO", "column": "empno"}, "readonly": ["position"], "layout": {"hidden": ["empno", "row_key"]},
+     "headings": {"position": "#", "skill": "Skill", "level": "Level (1-5)"}, "columns": {"skill": {"required": true}}, "row_actions": {"delete": true}}'),
+  (40, 'Languages', 'grid', 4,
+   'select empno, row_key, position, language
+  from hr.emp_profile_languages
+ where empno::text = :P51_EMPNO
+ order by position', 'hr.emp_profile_languages', 'row_key', null, ':P51_EMPNO is not null',
+   '{"master": {"item": "P51_EMPNO", "column": "empno"}, "readonly": ["position"], "layout": {"hidden": ["empno", "row_key"]},
+     "headings": {"position": "#", "language": "Language"}, "row_actions": {"delete": true}}')
+  ) as r (seq, title, type, cols, source, table_name, pk_column, pk_item, condition, config)
+ where a.alias = 'hr' and p.page_no = 51;
+
+insert into meta.item (page_id, region_id, seq, name, label, type, source_column)
+select p.id, r.id, i.seq, i.name, i.label, i.type, i.col
+  from meta.page p join meta.app a on a.id = p.app_id
+  join meta.region r on r.page_id = p.id and r.title = 'Profile', (values
+  (10, 'P51_EMPNO', 'Employee', 'hidden', 'empno'),
+  (20, 'P51_TITLE', 'Title', 'text', 'title'),
+  (30, 'P51_SINCE', 'Since', 'date', 'since'),
+  (40, 'P51_OFFICE_CITY', 'Office city', 'text', 'office_city'),
+  (50, 'P51_OFFICE_FLOOR', 'Office floor', 'number', 'office_floor'),
+  (60, 'P51_REMOTE', 'Works remotely', 'switch', 'remote')
+  ) as i (seq, name, label, type, col)
+ where a.alias = 'hr' and p.page_no = 51;
+
+insert into meta.button (page_id, region_id, seq, name, label, action, hot)
+select p.id, r.id, 10, 'SAVE', 'Apply Changes', 'submit', true
+  from meta.page p join meta.app a on a.id = p.app_id
+  join meta.region r on r.page_id = p.id and r.title = 'Profile'
+ where a.alias = 'hr' and p.page_no = 51;
+
+insert into meta.process (page_id, region_id, seq, name, type, point)
+select p.id, r.id, r.seq, case r.type when 'form' then 'Process form Profile' else 'Save ' || r.title end,
+       case r.type when 'form' then 'form_dml' else 'grid_dml' end, 'submit'
+  from meta.page p join meta.app a on a.id = p.app_id
+  join meta.region r on r.page_id = p.id and r.type in ('form', 'grid')
+ where a.alias = 'hr' and p.page_no = 51;
+
+insert into meta.nav_entry (app_id, parent_id, seq, label, icon, target_page)
+select a.id, n.id, 80, 'Employee profiles', 'id-card', 51
+  from meta.app a join meta.nav_entry n on n.app_id = a.id and n.label = 'Administration' and n.parent_id is null
+ where a.alias = 'hr';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.74.0",
+  "version": "0.76.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/app.css

@@ -2020,6 +2020,24 @@ a.search-hit:hover, a.search-hit:focus-visible { background: var(--accent-soft);
 .ir-dialog-head h2 { margin: 0; font-size: 1.05rem; }
 .ir-dialog .ir-body { padding: 1rem; }
 .ir-dialog .filter-row { min-width: 0; }
+.filter-dialog .date-field { display: flex; min-width: 0; }
+.filter-dialog .date-field input { flex: 1; min-width: 0; }
+.filter-dialog .filter-values, .filter-dialog .help { grid-column: 1 / -1; }
+.filter-values { display: grid; gap: 0.3rem; }
+.filter-values-list { list-style: none; margin: 0; padding: 0.25rem 0.4rem; max-height: 14rem; overflow: auto; border: 1px solid var(--border); border-radius: var(--radius); }
+.filter-values-list .check { display: flex; gap: 0.4rem; align-items: center; padding: 0.15rem 0; }
+.filter-values-list .muted { margin-left: auto; font-variant-numeric: tabular-nums; }
+/* (143) Actions → Columns: a row per column, dragged by its handle or moved with its arrows */
+.ir-col-order { list-style: none; margin: 0; padding: 0; display: grid; gap: 0.15rem; }
+.ir-col-order > li { display: flex; align-items: center; gap: 0.4rem; padding: 0.15rem 0.3rem; border: 1px solid transparent; border-radius: var(--radius); background: var(--surface); }
+.ir-col-order > li:hover { border-color: var(--border); }
+.ir-col-order > li.dragging { opacity: 0.55; border-style: dashed; border-color: var(--accent); }
+.ir-col-order .check { flex: 1; min-width: 0; }
+.ir-col-order .drag-handle { color: var(--muted); cursor: grab; display: inline-flex; }
+.no-js .ir-col-order .drag-handle, html:not(.js) .ir-col-order .drag-handle { display: none; }
+.ir-col-move { display: inline-flex; gap: 0.15rem; }
+.ir-col-move .btn { min-width: 2rem; padding: 0.1rem 0.4rem; line-height: 1.2; }
+.ir-col-move .btn:disabled { opacity: 0.35; }
 /* the search field with its column list (APEX: the magnifier's column menu) */
 .search-field { display: flex; flex: 1; min-width: 0; border: 1px solid var(--border); border-radius: var(--radius); background: var(--surface); }
 .search-field:focus-within { outline: 2px solid var(--accent); outline-offset: 1px; }

package/public/app.js

@@ -4420,6 +4420,147 @@ const reportTexts = (() => {
   window.addEventListener('resize', shut);
 })();
 
+// (143; APEX 26.2: multi-select and date-range filters) Actions → Filter shows the fields its operator needs: one
+// value; "is one of" a list of the column's values with counts and a search (the ticked ones go as r<id>_fl, next to
+// values typed with commas); "is between" two values; "is in" a period, offered on date columns only. On a date
+// column the value fields get the date picker in the application's date format.
+(() => {
+  const t = (k, d) => reportTexts[k] || d;
+  const cache = new Map();
+  function fill(box, column) {
+    const list = box.querySelector('.filter-values');
+    if (!list || list.dataset.column === column) return;
+    list.dataset.column = column;
+    list.replaceChildren();
+    const search = document.createElement('input');
+    search.type = 'search';
+    search.placeholder = t('report.filter_values', 'Filter the values');
+    search.setAttribute('aria-label', search.placeholder);
+    const ul = document.createElement('ul');
+    ul.className = 'filter-values-list';
+    list.append(search, ul);
+    search.addEventListener('input', () => {
+      const q = search.value.trim().toLowerCase();
+      ul.querySelectorAll('li').forEach((li) => { li.hidden = !!q && !li.textContent.toLowerCase().includes(q); });
+    });
+    const url = new URL(box.dataset.values, location.href);
+    new URL(location.href).searchParams.forEach((v, k) => url.searchParams.append(k, v));
+    url.searchParams.set('col', column);
+    const key = url.toString();
+    const got = cache.get(key) ?? fetch(url, { headers: { accept: 'application/json' }, credentials: 'same-origin' }).then((r) => (r.ok ? r.json() : { values: [] })).catch(() => ({ values: [] }));
+    cache.set(key, got);
+    got.then(({ values }) => {
+      if (list.dataset.column !== column) return;
+      const shown = (values || []).filter((x) => x.value !== null);
+      if (!shown.length) {
+        const li = document.createElement('li');
+        li.className = 'muted';
+        li.textContent = t('report.no_values', 'No values');
+        ul.append(li);
+        return;
+      }
+      for (const { value, count } of shown) {
+        const li = document.createElement('li');
+        const label = document.createElement('label');
+        label.className = 'check';
+        const box2 = document.createElement('input');
+        box2.type = 'checkbox';
+        box2.name = box.dataset.list;
+        box2.value = value;
+        box2.setAttribute('form', box.dataset.form);
+        const n = document.createElement('span');
+        n.className = 'muted';
+        n.textContent = ` ${count}`;
+        label.append(box2, ` ${value}`, n);
+        li.append(label);
+        ul.append(li);
+      }
+    });
+  }
+  function sync(box) {
+    const col = box.querySelector('[data-filter-column]');
+    const op = box.querySelector('[data-filter-op]');
+    if (!col || !op) return;
+    const date = col.selectedOptions[0]?.dataset.kind === 'date';
+    op.querySelectorAll('option[data-op-kind="period"]').forEach((o) => { o.hidden = !date; o.disabled = !date; });
+    if (!date && op.selectedOptions[0]?.dataset.opKind === 'period') op.value = 'eq';
+    const kind = op.selectedOptions[0]?.dataset.opKind || 'one';
+    box.querySelectorAll('.filter-field[data-show]').forEach((el) => { el.hidden = !el.dataset.show.split(' ').includes(kind); });
+    for (const input of box.querySelectorAll('input[data-mask-off]')) {
+      const picker = date && kind !== 'list';
+      if (picker) input.dataset.dateMask = input.dataset.maskOff;
+      else delete input.dataset.dateMask;
+      input.placeholder = picker ? input.dataset.maskOff : input.getAttribute('aria-label') || '';
+      const btn = input.parentElement?.querySelector('[data-date-pick]');
+      if (btn) btn.hidden = !picker;
+    }
+    if (kind === 'list') fill(box, col.value);
+  }
+  document.querySelectorAll('[data-filter-dialog]').forEach(sync);
+  document.addEventListener('change', (e) => {
+    const box = e.target.closest?.('[data-filter-dialog]');
+    if (box && e.target.matches('[data-filter-column], [data-filter-op]')) sync(box);
+  });
+})();
+
+// (143; APEX 26.2: drag-and-drop column ordering) Actions → Columns: drag a column to another place, or move it with
+// its arrow buttons (Up / Down; without JavaScript they submit the form and the server moves it); the dialog's form
+// sends the columns in the list's order when applied. Each move is announced.
+(() => {
+  const t = (k, d) => reportTexts[k] || d;
+  const fmt = (s, p) => s.replace(/\{(\w+)\}/g, (m, k) => (k in p ? p[k] : m));
+  function refresh(list, moved) {
+    const items = [...list.children];
+    items.forEach((li, i) => {
+      const [up, down] = li.querySelectorAll('.ir-col-move button');
+      if (up) up.disabled = i === 0;
+      if (down) down.disabled = i === items.length - 1;
+    });
+    if (!moved) return;
+    const status = list.closest('.ir-columns')?.parentElement?.querySelector('[data-col-status]');
+    const name = moved.querySelector('label')?.textContent.trim() || moved.dataset.colName;
+    if (status) status.textContent = fmt(t('report.moved', '{column}: position {n} of {total}'), { column: name, n: items.indexOf(moved) + 1, total: items.length });
+  }
+  document.addEventListener('click', (e) => {
+    const btn = e.target.closest?.('[data-col-order] .ir-col-move button');
+    if (!btn) return;
+    e.preventDefault();
+    const li = btn.closest('li');
+    const list = li.parentElement;
+    const up = btn === li.querySelector('.ir-col-move button');
+    const other = up ? li.previousElementSibling : li.nextElementSibling;
+    if (!other) return;
+    if (up) other.before(li);
+    else other.after(li);
+    refresh(list, li);
+    (btn.disabled ? li.querySelector('.ir-col-move button:not(:disabled)') : btn)?.focus();
+  });
+  let dragged = null;
+  document.addEventListener('dragstart', (e) => {
+    const li = e.target.closest?.('[data-col-order] > li');
+    if (!li) return;
+    dragged = li;
+    li.classList.add('dragging');
+    e.dataTransfer.effectAllowed = 'move';
+    e.dataTransfer.setData('text/plain', li.dataset.colName || '');
+  });
+  document.addEventListener('dragover', (e) => {
+    const list = e.target.closest?.('[data-col-order]');
+    if (!dragged || !list || dragged.parentElement !== list) return;
+    e.preventDefault();
+    const after = [...list.children].find((li) => li !== dragged && e.clientY < li.getBoundingClientRect().top + li.offsetHeight / 2);
+    if (after) after.before(dragged);
+    else list.append(dragged);
+  });
+  document.addEventListener('drop', (e) => { if (dragged && e.target.closest?.('[data-col-order]')) e.preventDefault(); });
+  document.addEventListener('dragend', () => {
+    if (!dragged) return;
+    dragged.classList.remove('dragging');
+    refresh(dragged.parentElement, dragged);
+    dragged = null;
+  });
+})();
+
 // (sprint 76) the report pager's rows per page: sent on change
 document.addEventListener('change', (e) => {
   if (e.target.matches?.('select[data-go]')) e.target.form?.submit();

package/src/app.ts

@@ -27,6 +27,8 @@ import { ldapRoutes } from './builder/ldap.ts';
 import { aiRoutes } from './builder/ai.ts';
 import { aiAgentRoutes } from './builder/ai-agents.ts';
 import { vectorProviderRoutes } from './builder/vector-providers.ts';
+import { jsonSourceRoutes } from './builder/json-sources.ts';
+import { documentViewRoutes } from './builder/document-view.ts';
 import { mailRoutes } from './builder/mail.ts';
 import { backupRoutes } from './builder/backups.ts';
 import { availabilityRoutes } from './builder/availability.ts';
@@ -252,6 +254,9 @@ export async function buildApp(opts: { logger?: boolean } = {}) {
   await app.register(aiAgentRoutes);
   // (sprint 136, AP-1) vector providers: Shared Components and Workspace utilities
   await app.register(vectorProviderRoutes);
+  // (sprint 142, AP-8) JSON sources (Shared Components) and document views (Table Properties)
+  await app.register(jsonSourceRoutes);
+  await app.register(documentViewRoutes);
   await app.register(mailRoutes);
   await app.register(backupRoutes);
   await app.register(availabilityRoutes);