ekwo-os 0.12.0 → 0.12.2

package/README.md

@@ -517,7 +517,7 @@ exactly six fields:
   "organization": "My Organisation",
   "country": "<cc>",
   "edition": "community",
-  "schema_version": "0.12.0",
+  "schema_version": "0.12.2",
   "contact_email": "you@example.com"
 }
 ```

package/dist/assets/expected-objects.json

@@ -1,6 +1,6 @@
 {
-  "schemaVersion": "0.12.0",
-  "migration": "20261010181201",
+  "schemaVersion": "0.12.2",
+  "migration": "20261011163457",
   "socle": {
     "schema": "public",
     "tables": [
@@ -793,6 +793,14 @@
             "name": "id",
             "type": "uuid"
           },
+          {
+            "name": "invoice_accent_color",
+            "type": "text"
+          },
+          {
+            "name": "invoice_logo_position",
+            "type": "text"
+          },
           {
             "name": "language",
             "type": "character(2)"
@@ -2232,6 +2240,10 @@
             "name": "declaration_box",
             "type": "text"
           },
+          {
+            "name": "declaration_boxes",
+            "type": "text[]"
+          },
           {
             "name": "declared_on",
             "type": "date"
@@ -2260,6 +2272,10 @@
             "name": "posting_type",
             "type": "tax_posting_type"
           },
+          {
+            "name": "report_code",
+            "type": "text"
+          },
           {
             "name": "sequence",
             "type": "integer"
@@ -3062,6 +3078,18 @@
             "name": "name_i18n",
             "type": "jsonb"
           },
+          {
+            "name": "result_in_progress",
+            "type": "text"
+          },
+          {
+            "name": "result_in_progress_name",
+            "type": "text"
+          },
+          {
+            "name": "result_in_progress_name_i18n",
+            "type": "jsonb"
+          },
           {
             "name": "source_key",
             "type": "text"
@@ -3905,6 +3933,10 @@
         "name": "assert_writes_into_known_company",
         "arguments": "p_company_id uuid"
       },
+      {
+        "name": "attachment_is_filing_deposit_file",
+        "arguments": "p_attachment_id uuid"
+      },
       {
         "name": "audit_changes",
         "arguments": ""
@@ -3965,6 +3997,10 @@
         "name": "bank_statements_refresh_balance",
         "arguments": ""
       },
+      {
+        "name": "bank_transactions_guard",
+        "arguments": ""
+      },
       {
         "name": "caller_companies",
         "arguments": ""
@@ -4117,6 +4153,10 @@
         "name": "current_api_key",
         "arguments": ""
       },
+      {
+        "name": "declaration_boxes_of",
+        "arguments": "p_tax_id uuid, p_box text, p_tax_line boolean, OUT boxes text[], OUT report_code text"
+      },
       {
         "name": "declaration_period_months",
         "arguments": "p_period declaration_period"
@@ -4245,6 +4285,10 @@
         "name": "entries_refresh_totals",
         "arguments": ""
       },
+      {
+        "name": "entry_lines_box_from_posting",
+        "arguments": ""
+      },
       {
         "name": "entry_lines_guard_period",
         "arguments": ""
@@ -4597,6 +4641,10 @@
         "name": "reconciliations_guard_cancelled",
         "arguments": ""
       },
+      {
+        "name": "reconciliations_guard_reconcile",
+        "arguments": ""
+      },
       {
         "name": "reconciliations_refresh_lines",
         "arguments": ""
@@ -4713,6 +4761,14 @@
         "name": "statement_account_matches",
         "arguments": "p_company_id uuid, p_statement_code text, p_from date, p_to date"
       },
+      {
+        "name": "statement_figures",
+        "arguments": "p_company_id uuid, p_statement_code text, p_from date, p_to date"
+      },
+      {
+        "name": "statement_rule_catches",
+        "arguments": "p_rule statement_line_rules, p_code text, p_account_type account_type, p_balance numeric"
+      },
       {
         "name": "suggest_combination",
         "arguments": "p_transaction_id uuid"
@@ -4832,6 +4888,10 @@
       {
         "name": "version_at_least",
         "arguments": "p_version text, p_floor text"
+      },
+      {
+        "name": "year_result_account",
+        "arguments": "p_company_id uuid, p_balance numeric"
       }
     ],
     "policies": [
@@ -5425,6 +5485,10 @@
         "table": "bank_transactions",
         "name": "bank_transactions_currency_of_bank_account"
       },
+      {
+        "table": "bank_transactions",
+        "name": "bank_transactions_guard"
+      },
       {
         "table": "bank_transactions",
         "name": "bank_transactions_refresh_balance"
@@ -5629,6 +5693,10 @@
         "table": "entries",
         "name": "entries_set_updated_at"
       },
+      {
+        "table": "entry_lines",
+        "name": "entry_lines_box_from_posting"
+      },
       {
         "table": "entry_lines",
         "name": "entry_lines_guard_period"
@@ -5741,6 +5809,10 @@
         "table": "reconciliations",
         "name": "reconciliations_guard_cancelled"
       },
+      {
+        "table": "reconciliations",
+        "name": "reconciliations_guard_reconcile"
+      },
       {
         "table": "reconciliations",
         "name": "reconciliations_refresh_lines"
@@ -7312,6 +7384,17 @@
           "authenticated": [],
           "service_role": []
         },
+        {
+          "name": "attachment_is_filing_deposit_file",
+          "arguments": "p_attachment_id uuid",
+          "anon": [],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "audit_changes",
           "arguments": "",
@@ -7445,6 +7528,14 @@
           "authenticated": [],
           "service_role": []
         },
+        {
+          "name": "bank_transactions_guard",
+          "arguments": "",
+          "trigger": true,
+          "anon": [],
+          "authenticated": [],
+          "service_role": []
+        },
         {
           "name": "caller_companies",
           "arguments": "",
@@ -7828,6 +7919,17 @@
             "execute"
           ]
         },
+        {
+          "name": "declaration_boxes_of",
+          "arguments": "p_tax_id uuid, p_box text, p_tax_line boolean, OUT boxes text[], OUT report_code text",
+          "anon": [],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "declaration_period_months",
           "arguments": "p_period declaration_period",
@@ -8137,6 +8239,14 @@
           "authenticated": [],
           "service_role": []
         },
+        {
+          "name": "entry_lines_box_from_posting",
+          "arguments": "",
+          "trigger": true,
+          "anon": [],
+          "authenticated": [],
+          "service_role": []
+        },
         {
           "name": "entry_lines_guard_period",
           "arguments": "",
@@ -9101,6 +9211,14 @@
           "authenticated": [],
           "service_role": []
         },
+        {
+          "name": "reconciliations_guard_reconcile",
+          "arguments": "",
+          "trigger": true,
+          "anon": [],
+          "authenticated": [],
+          "service_role": []
+        },
         {
           "name": "reconciliations_refresh_lines",
           "arguments": "",
@@ -9412,6 +9530,28 @@
             "execute"
           ]
         },
+        {
+          "name": "statement_figures",
+          "arguments": "p_company_id uuid, p_statement_code text, p_from date, p_to date",
+          "anon": [],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
+        {
+          "name": "statement_rule_catches",
+          "arguments": "p_rule statement_line_rules, p_code text, p_account_type account_type, p_balance numeric",
+          "anon": [],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "suggest_combination",
           "arguments": "p_transaction_id uuid",
@@ -9721,6 +9861,17 @@
           "service_role": [
             "execute"
           ]
+        },
+        {
+          "name": "year_result_account",
+          "arguments": "p_company_id uuid, p_balance numeric",
+          "anon": [],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
         }
       ],
       "defaultPrivileges": []
@@ -11176,7 +11327,7 @@
     },
     {
       "code": "tax",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "schema": "tax",
       "tables": [
         {
@@ -11804,6 +11955,47 @@
             }
           ]
         },
+        {
+          "name": "prepayments",
+          "columns": [
+            {
+              "name": "amount",
+              "type": "numeric"
+            },
+            {
+              "name": "company_id",
+              "type": "uuid"
+            },
+            {
+              "name": "created_at",
+              "type": "timestamp with time zone"
+            },
+            {
+              "name": "entry_id",
+              "type": "uuid"
+            },
+            {
+              "name": "fiscal_year_id",
+              "type": "uuid"
+            },
+            {
+              "name": "id",
+              "type": "uuid"
+            },
+            {
+              "name": "note",
+              "type": "text"
+            },
+            {
+              "name": "paid_on",
+              "type": "date"
+            },
+            {
+              "name": "updated_at",
+              "type": "timestamp with time zone"
+            }
+          ]
+        },
         {
           "name": "rate_templates",
           "columns": [
@@ -11880,6 +12072,10 @@
           "name": "archive_tables",
           "arguments": ""
         },
+        {
+          "name": "book_provision",
+          "arguments": "p_computation_id uuid"
+        },
         {
           "name": "condition_failure",
           "arguments": "p_condition jsonb, p_values jsonb, p_taxable_base numeric"
@@ -11908,6 +12104,10 @@
           "name": "in_force",
           "arguments": "p_valid_from date, p_valid_to date, p_valid_on tax.validity_basis, p_start date, p_end date"
         },
+        {
+          "name": "instalment_date",
+          "arguments": "p_month_basis text, p_month integer, p_day integer, p_start date, p_end date"
+        },
         {
           "name": "line",
           "arguments": "p_kind text, p_code text, p_name text, p_base numeric, p_rate numeric, p_amount numeric, p_legal_reference text, p_source_key text"
@@ -11916,10 +12116,22 @@
           "name": "loss_stock",
           "arguments": "p_company_id uuid, p_before date"
         },
+        {
+          "name": "plan_instalments",
+          "arguments": "p_instalments jsonb"
+        },
+        {
+          "name": "prepayment_plan",
+          "arguments": "p_company_id uuid, p_fiscal_year_id uuid, p_at date, p_tax numeric"
+        },
         {
           "name": "record_computation",
           "arguments": "p_company_id uuid, p_fiscal_year_id uuid, p_at date"
         },
+        {
+          "name": "round_prepayment",
+          "arguments": ""
+        },
         {
           "name": "withdraw_computation",
           "arguments": "p_computation_id uuid"
@@ -12011,6 +12223,16 @@
           "name": "tax_prepayment_templates_select",
           "command": "select"
         },
+        {
+          "table": "prepayments",
+          "name": "tax_prepayments_select",
+          "command": "select"
+        },
+        {
+          "table": "prepayments",
+          "name": "tax_prepayments_write",
+          "command": "all"
+        },
         {
           "table": "rate_templates",
           "name": "tax_rate_templates_select",
@@ -12049,6 +12271,14 @@
         {
           "table": "losses",
           "name": "tax_losses_set_updated_at"
+        },
+        {
+          "table": "prepayments",
+          "name": "tax_prepayments_round"
+        },
+        {
+          "table": "prepayments",
+          "name": "tax_prepayments_set_updated_at"
         }
       ],
       "types": [
@@ -12254,6 +12484,22 @@
               "select"
             ]
           },
+          {
+            "name": "prepayments",
+            "anon": [],
+            "authenticated": [
+              "delete",
+              "insert",
+              "select",
+              "update"
+            ],
+            "service_role": [
+              "delete",
+              "insert",
+              "select",
+              "update"
+            ]
+          },
           {
             "name": "rate_templates",
             "anon": [],
@@ -12301,6 +12547,17 @@
               "execute"
             ]
           },
+          {
+            "name": "book_provision",
+            "arguments": "p_computation_id uuid",
+            "anon": [],
+            "authenticated": [
+              "execute"
+            ],
+            "service_role": [
+              "execute"
+            ]
+          },
           {
             "name": "condition_failure",
             "arguments": "p_condition jsonb, p_values jsonb, p_taxable_base numeric",
@@ -12372,6 +12629,17 @@
               "execute"
             ]
           },
+          {
+            "name": "instalment_date",
+            "arguments": "p_month_basis text, p_month integer, p_day integer, p_start date, p_end date",
+            "anon": [],
+            "authenticated": [
+              "execute"
+            ],
+            "service_role": [
+              "execute"
+            ]
+          },
           {
             "name": "line",
             "arguments": "p_kind text, p_code text, p_name text, p_base numeric, p_rate numeric, p_amount numeric, p_legal_reference text, p_source_key text",
@@ -12394,6 +12662,28 @@
               "execute"
             ]
           },
+          {
+            "name": "plan_instalments",
+            "arguments": "p_instalments jsonb",
+            "anon": [],
+            "authenticated": [
+              "execute"
+            ],
+            "service_role": [
+              "execute"
+            ]
+          },
+          {
+            "name": "prepayment_plan",
+            "arguments": "p_company_id uuid, p_fiscal_year_id uuid, p_at date, p_tax numeric",
+            "anon": [],
+            "authenticated": [
+              "execute"
+            ],
+            "service_role": [
+              "execute"
+            ]
+          },
           {
             "name": "record_computation",
             "arguments": "p_company_id uuid, p_fiscal_year_id uuid, p_at date",
@@ -12405,6 +12695,14 @@
               "execute"
             ]
           },
+          {
+            "name": "round_prepayment",
+            "arguments": "",
+            "trigger": true,
+            "anon": [],
+            "authenticated": [],
+            "service_role": []
+          },
           {
             "name": "withdraw_computation",
             "arguments": "p_computation_id uuid",

package/dist/assets/migrations/20261010160429_an_invoice_wears_the_colour_of_its_company.sql

@@ -0,0 +1,38 @@
+-- Ekwo OS — an invoice wears the colour of the company that sends it.
+--
+-- `@ekwo-ai/invoice-pdf` prints every invoice in one layout and takes a small
+-- theme: an accent colour and the side of the logo. Until now only the caller
+-- could hand it one, so the PDF of `ekwo doc pdf`, of the MCP tool
+-- `render_invoice_pdf` and of any other client came out in the brick's default
+-- whoever had sent it. Which colour a company prints in is a fact about that
+-- company, the same for every surface that renders its invoices; it belongs
+-- beside its logo, on `companies`.
+--
+-- **Two columns, both nullable.** Null is the brick's default, which is the
+-- answer for every company that exists today and needs no backfill. The
+-- typeface of the theme stays out: it is a file, and the core keeps none.
+--
+-- **The same constraints the brick applies.** A colour is `#rrggbb` and a side
+-- is `left` or `right`; anything else would be stored here and refused at the
+-- first rendering, so it is refused at the write instead.
+--
+-- **Who may write it** is who may write the company: `companies_update`
+-- judges the row, `company.write`. No grant changes — the table is already
+-- granted, and a column added to it is covered by that grant.
+
+alter table companies
+  add column if not exists invoice_accent_color  text,
+  add column if not exists invoice_logo_position text;
+
+alter table companies
+  add constraint companies_invoice_accent_color_hex
+  check (invoice_accent_color ~ '^#[0-9A-Fa-f]{6}$');
+
+alter table companies
+  add constraint companies_invoice_logo_position_side
+  check (invoice_logo_position in ('left', 'right'));
+
+comment on column companies.invoice_accent_color is
+  'The accent colour of this company''s invoice PDF, written #rrggbb: the title, the rules and the bands of the layout. Null is the default of @ekwo-ai/invoice-pdf.';
+comment on column companies.invoice_logo_position is
+  'The side of this company''s invoice PDF its logo is printed on: left or right. Null is the default of @ekwo-ai/invoice-pdf (left).';

package/dist/assets/migrations/20261010203452_a_filing_file_is_read_as_a_filing.sql

@@ -0,0 +1,95 @@
+-- Ekwo OS — the file of a declaration is read as a declaration.
+--
+-- `filings.read` was granted apart from `documents.read` on purpose: what a
+-- company declared is not the same secret as what it books
+-- (`20260917150000`), and the deposits that record each send ask it
+-- (`20260918110000`). The two files of a deposit — what was sent, and the
+-- receipt that came back — are rows of `attachments`, and every row of
+-- `attachments` was read through `documents.read` and written through
+-- `documents.write` (`20260913083216`). So a member whose `filings.read` was
+-- withdrawn and who kept `documents.read` saw no deposit, and still read the
+-- declaration that went and the acknowledgement of the administration.
+-- Decision 0039 left it as an open item; this closes it.
+--
+-- **Which files.** Two kinds, and either is enough:
+--
+--   - an attachment **of a declaration** (`entity_type = 'tax_filing'`), which
+--     is where the two files of a deposit are kept, from the moment they are
+--     uploaded and before the deposit names them;
+--   - an attachment **a deposit names**, as `sent_file_id` or
+--     `acknowledgement_id`, wherever it was pinned: the trigger of
+--     `20261007113412` keeps it in the declaration's company and does not
+--     ask its `entity_type`.
+--
+-- Such a file is read with `filings.read` and written — uploaded, changed,
+-- moved, deleted — with `filings.write`, the capability that writes deposits.
+-- Every other attachment keeps `documents.read` and `documents.write`. The
+-- two policies of a client handing a piece over (`attachments_deposit`,
+-- `attachments_select_own_deposit`, `20260918113807`) are untouched: they
+-- only ever reach a piece on the company itself, or one the caller filed.
+--
+-- **Why a definer function asks about the deposit.** A policy reads other
+-- tables under the caller's own policies, and the deposits ask
+-- `filings.read`: an `exists` written in the policy would find no deposit for
+-- precisely the member this is about, and let the file through as an
+-- ordinary one. `attachment_is_filing_deposit_file()` looks past the
+-- policies of `tax_filing_deposits`, answers about one attachment and nothing
+-- else, and is two probes of the indexes `20260918110000` put on the two
+-- columns. On a shared installation it answers only about a company the
+-- caller may know of (`may_know_of_company()`, decision 0065): an id of
+-- another tenant's file gets the answer an id of nobody gets. The capabilities are compared the way `20260918141627` compares
+-- them — a sub-select run once per statement — and `attachments` is a table
+-- read file by file, never walked by a report.
+
+create or replace function attachment_is_filing_deposit_file(p_attachment_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = public, pg_temp
+as $$
+  select exists (select 1 from tax_filing_deposits d join tax_filings f on f.id = d.filing_id
+                  where d.sent_file_id = p_attachment_id and may_know_of_company(f.company_id))
+      or exists (select 1 from tax_filing_deposits d join tax_filings f on f.id = d.filing_id
+                  where d.acknowledgement_id = p_attachment_id and may_know_of_company(f.company_id));
+$$;
+
+comment on function attachment_is_filing_deposit_file(uuid) is
+  'Whether a deposit of a declaration names this attachment as the file that was sent or as the receipt. Definer, because the policy of attachments asks it for callers who may not read the deposits — which is the case it exists for; it answers about one id and nothing else, and about a company the caller may not know of as about nobody (decision 0065).';
+
+revoke execute on function attachment_is_filing_deposit_file(uuid) from public, anon;
+grant execute on function attachment_is_filing_deposit_file(uuid) to authenticated, service_role;
+
+drop policy attachments_select on attachments;
+create policy attachments_select on attachments
+  for select using (
+    case
+      when entity_type = 'tax_filing' or attachment_is_filing_deposit_file(id)
+        then company_id = any ((select companies_with_capability('filings.read'))::uuid[])
+      else company_id = any ((select companies_with_capability('documents.read'))::uuid[])
+    end
+  );
+
+comment on policy attachments_select on attachments is
+  'documents.read, except for the files of a declaration — attached to a tax_filing, or named by a deposit as what was sent or the receipt — which are proof of filing and read with filings.read, like the deposits themselves.';
+
+drop policy attachments_write on attachments;
+create policy attachments_write on attachments
+  for all using (
+    case
+      when entity_type = 'tax_filing' or attachment_is_filing_deposit_file(id)
+        then company_id = any ((select companies_with_capability('filings.write'))::uuid[])
+      else company_id = any ((select companies_with_capability('documents.write'))::uuid[])
+    end
+  )
+  -- A check is asked once per row written, as `20260918141627` leaves it.
+  with check (
+    case
+      when entity_type = 'tax_filing' or attachment_is_filing_deposit_file(id)
+        then has_capability(company_id, 'filings.write')
+      else has_capability(company_id, 'documents.write')
+    end
+  );
+
+comment on policy attachments_write on attachments is
+  'documents.write, except for the files of a declaration — attached to a tax_filing, or named by a deposit — which are written with filings.write, the capability that records a deposit. Moving a file onto a declaration needs both: the old row is asked documents.write, the new one filings.write.';