ekwo-os 0.4.1

package/dist/assets/migrations/20260911210131_anon_surface.sql

@@ -0,0 +1,85 @@
+-- Ekwo OS — a smaller surface for the anonymous role and for strangers.
+--
+-- Two findings of the security audit of 11 September 2026, both about what
+-- someone who is *not* a member of any company can reach.
+--
+-- 1. Every function in `public` was executable by `anon`, because Postgres
+--    grants EXECUTE to PUBLIC on creation and Supabase exposes `public`
+--    functions as RPC. Row level security made every call return nothing,
+--    but nothing is not the same as no. `anon` keeps EXECUTE on the eight
+--    helpers that row level security policies call — they answer about
+--    `auth.uid()` only, and without them an anonymous SELECT would error
+--    instead of returning an empty set — and loses it on everything else.
+--    The default privileges are changed too, so a function added tomorrow
+--    starts closed.
+--
+-- 2. `instance_admins` was readable by any signed-in user, member or not.
+--    Supabase projects accept self sign-up by default, so "signed in" is a
+--    weaker claim than it sounds. Administrators are now visible to members
+--    of at least one company, to administrators, and to oneself.
+--
+-- Nothing already published is edited: revokes, grants and one policy.
+
+-- 1. Functions ------------------------------------------------------------
+
+revoke execute on all functions in schema public from public, anon;
+grant execute on all functions in schema public to authenticated, service_role;
+
+-- The helpers a policy may evaluate on behalf of an anonymous request.
+grant execute on function company_role(uuid)          to anon;
+grant execute on function is_company_member(uuid)     to anon;
+grant execute on function can_write_company(uuid)     to anon;
+grant execute on function is_company_owner(uuid)      to anon;
+grant execute on function is_instance_admin()         to anon;
+grant execute on function is_any_company_member()     to anon;
+grant execute on function company_has_no_member(uuid) to anon;
+grant execute on function instance_has_no_admin()     to anon;
+
+alter default privileges in schema public revoke execute on functions from public, anon;
+alter default privileges in schema public grant execute on functions to authenticated, service_role;
+
+-- 2. Who may see the administrators ---------------------------------------
+
+drop policy if exists instance_admins_select on instance_admins;
+create policy instance_admins_select on instance_admins
+  for select
+  using (user_id = auth.uid() or is_any_company_member() or is_instance_admin());
+
+comment on policy instance_admins_select on instance_admins is
+  'Members, administrators, and oneself. A signed-in stranger sees no one.';
+
+-- 3. The claim keeps its clear refusal ------------------------------------
+--
+-- `claim_instance_admin` used to learn whether the seat was taken by reading
+-- `instance_admins` as the caller. A stranger can no longer read it, so the
+-- same call would have fallen through to the policy and answered with a bare
+-- row-level-security error. `instance_has_no_admin()` is the definer helper
+-- made for exactly this question, and it answers it for everyone.
+
+create or replace function claim_instance_admin(p_user_id uuid default auth.uid())
+returns instance_admins
+language plpgsql
+as $$
+declare
+  v_row instance_admins%rowtype;
+begin
+  if p_user_id is null then
+    raise exception 'no_user: claim_instance_admin needs a signed-in user or an explicit id';
+  end if;
+
+  if not instance_has_no_admin() and not is_instance_admin() then
+    raise exception 'instance_already_claimed: only an instance administrator can appoint another';
+  end if;
+
+  insert into instance_admins (user_id)
+  values (p_user_id)
+  on conflict (user_id) do nothing
+  returning * into v_row;
+
+  if v_row.user_id is null then
+    select * into v_row from instance_admins where user_id = p_user_id;
+  end if;
+
+  return v_row;
+end;
+$$;

package/dist/assets/migrations/20260912074712_country_packs.sql

@@ -0,0 +1,318 @@
+-- Ekwo OS — a country is a pack, and an installation knows which one it has.
+--
+-- `packs/<cc>/` became the source of a country in the previous change, and
+-- the seeds are now compiled from it. What the schema still could not say is
+-- *which version* of a pack an instance holds and which version a company
+-- copied — so nothing could ever tell an operator that their chart of
+-- accounts is a year behind the pack, and `ekwo pack upgrade` would have had
+-- nothing to compare.
+--
+-- Two tables answer that, and nothing else changes hands:
+--
+--   `country_packs`  one row per pack loaded here, written by the generated
+--                    seed: version, checksum, and the certification status
+--                    that `ekwo init` prints, so an operator knows whether a
+--                    professional has ever read the pack they installed.
+--   `company_packs`  what each company copied, and when. A company can hold
+--                    two packs — a foreign VAT registration is exactly that —
+--                    which is why the key is (company, country).
+--
+-- The rest is the translated labels the pack format already carries.
+-- `account_templates.name_i18n` holds every language of the pack;
+-- `install_country_template` copies the one the company asked for into
+-- `name` and keeps the whole object beside it, so renaming a chart into
+-- another language is a data change and never an import. Translations live in
+-- `jsonb` rather than in a table, which is where Odoo landed in v16 for the
+-- same reason: a table would cost a join per label on six tables.
+--
+-- Additive throughout: new tables, `add column if not exists`, and one
+-- function replaced. `install_country_template` gains a third argument, so
+-- the two-argument version is dropped first — an overload with a default
+-- would make a two-argument `install_country_template` call ambiguous, and
+-- Postgres would refuse the call that works today.
+
+-- ---------------------------------------------------------------------------
+-- country_packs — what this instance holds
+-- ---------------------------------------------------------------------------
+
+do $$
+begin
+  if not exists (select 1 from pg_type where typname = 'pack_certification') then
+    create type pack_certification as enum ('community', 'reviewed', 'ekwo');
+  end if;
+end;
+$$;
+
+comment on type pack_certification is
+  'How much a pack has been read: contributed, read by a named professional, or maintained by Ekwo.';
+
+create table if not exists country_packs (
+  country               char(2) primary key,
+  name                  text not null,
+  version               text not null,
+  released_at           date,
+  schema_min            text,
+  certification_status  pack_certification not null default 'community',
+  certified_by          text,
+  certified_at          date,
+  checksum              text,
+  installed_at          timestamptz not null default now(),
+  constraint country_packs_country_format check (country ~ '^[A-Z]{2}$'),
+  constraint country_packs_version_semver check (version ~ '^[0-9]+\.[0-9]+\.[0-9]+$')
+);
+
+comment on table country_packs is 'Country packs loaded in this installation, with their version and certification.';
+comment on column country_packs.checksum is 'sha256 of the pack files, so a changed pack is visible without a diff.';
+comment on column country_packs.certification_status is 'Printed by `ekwo init`: a community pack has not been read by an accountant.';
+
+-- ---------------------------------------------------------------------------
+-- company_packs — what each company copied
+-- ---------------------------------------------------------------------------
+
+create table if not exists company_packs (
+  company_id   uuid not null references companies(id) on delete cascade,
+  country      char(2) not null,
+  version      text not null,
+  installed_at timestamptz not null default now(),
+  upgraded_at  timestamptz,
+  primary key (company_id, country),
+  constraint company_packs_country_format check (country ~ '^[A-Z]{2}$'),
+  constraint company_packs_version_semver check (version ~ '^[0-9]+\.[0-9]+\.[0-9]+$')
+);
+
+comment on table company_packs is 'Which version of which country pack a company copied. A company may hold two: a foreign VAT registration is one.';
+comment on column company_packs.upgraded_at is 'Last time `install_country_template` or `ekwo pack upgrade` moved this company to another version.';
+
+create index if not exists company_packs_country_idx on company_packs (country);
+
+-- ---------------------------------------------------------------------------
+-- Translated labels, and the line an account reports on
+-- ---------------------------------------------------------------------------
+
+alter table account_templates
+  add column if not exists name_i18n      jsonb not null default '{}'::jsonb,
+  add column if not exists statement_hint text;
+
+alter table accounts
+  add column if not exists name_i18n      jsonb not null default '{}'::jsonb,
+  add column if not exists statement_hint text;
+
+comment on column account_templates.name_i18n is 'Label by language, from packs/<cc>/i18n/. The pack''s own language stays in `name`.';
+comment on column accounts.name_i18n is 'Label by language, copied from the template at install. `name` holds the language the company chose.';
+comment on column account_templates.statement_hint is 'Statement line this account falls under when no rule catches it. Read by financial_statement() (P0-4).';
+comment on column accounts.statement_hint is 'Statement line this account falls under when no rule catches it. Read by financial_statement() (P0-4).';
+
+alter table companies
+  add column if not exists language char(2) not null default 'fr';
+
+comment on column companies.language is
+  'Language this company keeps its books in. Chosen at install; decides which label of name_i18n lands in accounts.name.';
+
+alter table country_defaults
+  add column if not exists language_default char(2);
+
+comment on column country_defaults.language_default is
+  'Language `ekwo init` offers for a company of this country, before the company row exists — like currency_code, and for the same reason.';
+
+-- No backfill here. A pack fills this column, and the compiled seed of every
+-- country upserts `country_defaults`, so re-applying the seeds is what gives
+-- an existing installation the value. Naming a language for a country in a
+-- migration would put a country back into the core.
+
+-- ---------------------------------------------------------------------------
+-- install_country_template, in a language, recording what it copied
+-- ---------------------------------------------------------------------------
+
+drop function if exists install_country_template(uuid, char);
+
+create or replace function install_country_template(
+  p_company_id uuid,
+  p_country    char(2),
+  p_language   char(2) default null
+)
+returns void
+language plpgsql
+as $$
+declare
+  v_defaults country_defaults%rowtype;
+  r          record;
+  v_tax_id   uuid;
+  v_language char(2);
+  v_version  text;
+begin
+  if not exists (select 1 from companies where id = p_company_id) then
+    raise exception 'unknown_company: %', p_company_id;
+  end if;
+  if not exists (select 1 from account_templates where country = p_country) then
+    raise exception 'unknown_country_template: no chart of accounts seeded for %', p_country;
+  end if;
+
+  -- The language of the copy: what the caller asked for, else what the
+  -- company keeps its books in. `companies.language` is never null, so there
+  -- is always an answer, and a label missing from a pack falls back to the
+  -- pack's own language rather than to nothing.
+  select coalesce(p_language, c.language) into v_language
+    from companies c where c.id = p_company_id;
+
+  -- 1. Accounts, without the hierarchy.
+  insert into accounts (company_id, code, name, name_i18n, statement_hint,
+                        account_type, reconcilable)
+  select p_company_id, t.code,
+         coalesce(nullif(t.name_i18n ->> v_language, ''), t.name),
+         t.name_i18n, t.statement_hint, t.account_type, t.reconcilable
+    from account_templates t
+   where t.country = p_country
+  on conflict (company_id, code) do nothing;
+
+  -- 2. Hierarchy, now that every code exists.
+  update accounts a
+     set parent_id = p.id
+    from account_templates t
+    join accounts p on p.company_id = p_company_id and p.code = t.parent_code
+   where a.company_id = p_company_id
+     and a.code = t.code
+     and t.country = p_country
+     and t.parent_code is not null
+     and a.parent_id is null;
+
+  -- 3. Journals.
+  insert into journals (company_id, code, name, journal_type)
+  select p_company_id, t.code, t.name, t.journal_type
+    from journal_templates t
+   where t.country = p_country
+  on conflict (company_id, code) do nothing;
+
+  -- 4. Taxes and their postings.
+  for r in
+    select * from tax_templates where country = p_country order by sequence, code
+  loop
+    v_tax_id := null;
+    insert into taxes (company_id, code, name, description, amount_type, amount,
+                       applies_to, treatment, country, valid_from, valid_to,
+                       legal_reference, vat_category, exemption_code, sequence)
+    values (p_company_id, r.code, r.name, r.description, r.amount_type, r.amount,
+            r.applies_to, r.treatment, p_country, r.valid_from, r.valid_to,
+            r.legal_reference, r.vat_category, r.exemption_code, r.sequence)
+    on conflict (company_id, code) do nothing
+    returning id into v_tax_id;
+
+    if v_tax_id is null then
+      continue;
+    end if;
+
+    insert into tax_postings (tax_id, company_id, document_kind, posting_type,
+                              factor_percent, account_id, declaration_box,
+                              box_factor_percent, sequence)
+    select v_tax_id, p_company_id, tp.document_kind, tp.posting_type,
+           tp.factor_percent, account_id_by_code(p_company_id, tp.account_code),
+           tp.declaration_box, tp.box_factor_percent, tp.sequence
+      from tax_posting_templates tp
+     where tp.tax_template_id = r.id
+     order by tp.sequence;
+  end loop;
+
+  -- 5. Roles.
+  select * into v_defaults from country_defaults where country = p_country;
+  if found then
+    update companies c
+       set receivable_account_id       = coalesce(c.receivable_account_id, account_id_by_code(p_company_id, v_defaults.receivable_code)),
+           payable_account_id          = coalesce(c.payable_account_id, account_id_by_code(p_company_id, v_defaults.payable_code)),
+           suspense_account_id         = coalesce(c.suspense_account_id, account_id_by_code(p_company_id, v_defaults.suspense_code)),
+           rounding_account_id         = coalesce(c.rounding_account_id, account_id_by_code(p_company_id, v_defaults.rounding_code)),
+           retained_earnings_account_id = coalesce(c.retained_earnings_account_id, account_id_by_code(p_company_id, v_defaults.retained_earnings_code)),
+           default_sales_account_id    = coalesce(c.default_sales_account_id, account_id_by_code(p_company_id, v_defaults.sales_account_code)),
+           default_purchase_account_id = coalesce(c.default_purchase_account_id, account_id_by_code(p_company_id, v_defaults.purchase_account_code)),
+           sales_journal_id            = coalesce(c.sales_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.sales_journal_code)),
+           purchase_journal_id         = coalesce(c.purchase_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.purchase_journal_code)),
+           miscellaneous_journal_id    = coalesce(c.miscellaneous_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.misc_journal_code))
+     where c.id = p_company_id;
+
+    -- 6. The financial journals point at their account.
+    update journals j
+       set default_account_id = account_id_by_code(p_company_id, v_defaults.bank_account_code)
+     where j.company_id = p_company_id
+       and j.journal_type = 'bank'
+       and j.default_account_id is null
+       and v_defaults.bank_account_code is not null;
+
+    update journals j
+       set default_account_id = account_id_by_code(p_company_id, v_defaults.cash_account_code)
+     where j.company_id = p_company_id
+       and j.journal_type = 'cash'
+       and j.default_account_id is null
+       and v_defaults.cash_account_code is not null;
+  end if;
+
+  -- 7. What was copied, and from which version. A pack that has not declared
+  --    itself — an instance seeded before this migration — counts as 1.0.0,
+  --    which is what every pack of this release is.
+  v_version := coalesce((select version from country_packs where country = p_country), '1.0.0');
+
+  insert into company_packs (company_id, country, version)
+  values (p_company_id, p_country, v_version)
+  on conflict (company_id, country) do update
+     set version = excluded.version,
+         upgraded_at = now()
+   where company_packs.version is distinct from excluded.version;
+end;
+$$;
+
+comment on function install_country_template(uuid, char, char) is
+  'Copies a country pack into a company in one language, wires the default roles and the financial journals, and records the pack version in company_packs.';
+
+-- A function created today is *not* closed, and migration `20260911210131`
+-- promised it would be. `alter default privileges ... revoke execute on
+-- functions from public` does not delete the built-in world default on
+-- PostgreSQL 15: `get_user_default_acl` merges the stored default with it, so
+-- a function created afterwards still comes out with `=X` — EXECUTE for
+-- PUBLIC, which on Supabase means an anonymous RPC endpoint. This migration
+-- is the first to create a function since that one, and
+-- `install_country_template` came out open; row level security would have
+-- refused every write it attempts, but the surface should be closed and not
+-- merely empty.
+--
+-- So the revoke is repeated here, and from PUBLIC only: `anon` holds explicit
+-- grants on the eight policy helpers, and revoking from `anon` would take
+-- those away and break every anonymous SELECT the policies evaluate. Any
+-- migration that adds a function has to end with this line — the rule is in
+-- `supabase/migrations/README.md`.
+
+revoke execute on all functions in schema public from public;
+
+-- ---------------------------------------------------------------------------
+-- Companies installed before this migration
+--
+-- They hold a chart, so they hold a pack; only its version was never written
+-- down. Every pack of this release is 1.0.0, so that is what they copied.
+-- ---------------------------------------------------------------------------
+
+insert into company_packs (company_id, country, version, installed_at)
+select c.id, c.country, '1.0.0', c.created_at
+  from companies c
+ where exists (select 1 from accounts a where a.company_id = c.id)
+on conflict (company_id, country) do nothing;
+
+-- ---------------------------------------------------------------------------
+-- Row level security
+--
+-- `country_packs` is reference data about the installation, not about a
+-- company: a member of any company may read it, an administrator may read it
+-- before any company exists. `company_packs` follows its company, and the
+-- right to write it is the right that installs a chart of accounts in the
+-- first place. Neither table has a policy that lets a signed-in stranger see
+-- anything.
+-- ---------------------------------------------------------------------------
+
+alter table country_packs enable row level security;
+alter table company_packs enable row level security;
+
+create policy country_packs_select on country_packs
+  for select using (is_any_company_member() or is_instance_admin());
+
+create policy company_packs_select on company_packs
+  for select using (is_company_member(company_id));
+create policy company_packs_write on company_packs
+  for all using (can_write_company(company_id)) with check (can_write_company(company_id));
+
+comment on policy country_packs_select on country_packs is
+  'Members of any company and instance administrators. Written by the generated seed, which runs as the owner.';

package/dist/assets/migrations/20260912080311_report_code_and_region.sql

@@ -0,0 +1,198 @@
+-- Ekwo OS — which declaration a box belongs to, and which province a party is in.
+--
+-- Two columns the Canadian pack will need and that cost nothing to add now.
+-- Both are phase-0 additions on purpose: adding them with the pack would mean
+-- migrating `tax_postings` and `entry_lines` twice, and the second time they
+-- would already hold years of postings.
+--
+-- **`report_code`.** `declaration_box` is a box number, and a box number is
+-- only unique inside one form. Belgium and France each file one periodic
+-- return, so '59' has never been ambiguous. A Canadian company files two at
+-- once — the GST/HST return to the CRA and, in Québec, the combined return to
+-- Revenu Québec — and line '101' of one is not line '101' of the other.
+-- `report_code` says which form. Null keeps today's meaning: the periodic
+-- return of the company's `fiscal_country`.
+--
+-- **`region`.** Canadian tax follows the *buyer's* province, not the seller's
+-- (place of supply). The core deliberately chooses no tax for anyone; it can
+-- only ever suggest one, and to suggest it has to know where the parties are.
+-- ISO 3166-2 without the country prefix — `QC`, `BC`, `ON` — because the
+-- country is already on the row next to it. The declarative rules that turn a
+-- region into a suggested tax (`tax_rule_templates`, `suggest_tax()`) are
+-- phase 1, with the pack that needs them; nothing reads `region` yet, and
+-- that is the one deviation from "no column without a reader" this schema
+-- makes, taken knowingly and written down here.
+--
+-- Additive: four `add column if not exists`, a backfill of the rows that
+-- exist, and `install_country_template` replaced so it carries the new column
+-- into a company.
+
+-- ---------------------------------------------------------------------------
+-- report_code
+-- ---------------------------------------------------------------------------
+
+alter table tax_posting_templates add column if not exists report_code text;
+alter table tax_postings          add column if not exists report_code text;
+
+comment on column tax_posting_templates.report_code is
+  'Declaration form the box belongs to (BE-VAT-PERIODIC, FR-CA3, CA-GST34…). Null means the periodic return of the country.';
+comment on column tax_postings.report_code is
+  'Declaration form the box belongs to. Copied from the template; read by vat_return(company, from, to, report_code) from P0-3.';
+
+-- Nothing is backfilled here, and that is the whole point of the column being
+-- nullable. On the template side the packs carry the code and the compiled
+-- seeds upsert it, so re-applying the seeds names every template posting. On
+-- the company side a null keeps its documented meaning — the periodic return
+-- of the company's country — and `vat_return()` reads it exactly that way, so
+-- a posting an older installation holds lands on the right form without
+-- anything being rewritten. A backfill would have had to name a country and
+-- the code of its form, which is the thing this schema refuses to do.
+
+-- ---------------------------------------------------------------------------
+-- region
+-- ---------------------------------------------------------------------------
+
+alter table companies add column if not exists region text;
+alter table contacts  add column if not exists region text;
+
+comment on column companies.region is
+  'Province or state, ISO 3166-2 without the country prefix: QC, BC, CA. Null in a country that taxes uniformly.';
+comment on column contacts.region is
+  'Province or state of the party, ISO 3166-2 without the country prefix. Canadian tax follows the buyer''s province, not the seller''s.';
+
+-- ---------------------------------------------------------------------------
+-- install_country_template carries report_code into the company
+-- ---------------------------------------------------------------------------
+
+create or replace function install_country_template(
+  p_company_id uuid,
+  p_country    char(2),
+  p_language   char(2) default null
+)
+returns void
+language plpgsql
+as $$
+declare
+  v_defaults country_defaults%rowtype;
+  r          record;
+  v_tax_id   uuid;
+  v_language char(2);
+  v_version  text;
+begin
+  if not exists (select 1 from companies where id = p_company_id) then
+    raise exception 'unknown_company: %', p_company_id;
+  end if;
+  if not exists (select 1 from account_templates where country = p_country) then
+    raise exception 'unknown_country_template: no chart of accounts seeded for %', p_country;
+  end if;
+
+  select coalesce(p_language, c.language) into v_language
+    from companies c where c.id = p_company_id;
+
+  -- 1. Accounts, without the hierarchy.
+  insert into accounts (company_id, code, name, name_i18n, statement_hint,
+                        account_type, reconcilable)
+  select p_company_id, t.code,
+         coalesce(nullif(t.name_i18n ->> v_language, ''), t.name),
+         t.name_i18n, t.statement_hint, t.account_type, t.reconcilable
+    from account_templates t
+   where t.country = p_country
+  on conflict (company_id, code) do nothing;
+
+  -- 2. Hierarchy, now that every code exists.
+  update accounts a
+     set parent_id = p.id
+    from account_templates t
+    join accounts p on p.company_id = p_company_id and p.code = t.parent_code
+   where a.company_id = p_company_id
+     and a.code = t.code
+     and t.country = p_country
+     and t.parent_code is not null
+     and a.parent_id is null;
+
+  -- 3. Journals.
+  insert into journals (company_id, code, name, journal_type)
+  select p_company_id, t.code, t.name, t.journal_type
+    from journal_templates t
+   where t.country = p_country
+  on conflict (company_id, code) do nothing;
+
+  -- 4. Taxes and their postings, each posting keeping the form its box is on.
+  for r in
+    select * from tax_templates where country = p_country order by sequence, code
+  loop
+    v_tax_id := null;
+    insert into taxes (company_id, code, name, description, amount_type, amount,
+                       applies_to, treatment, country, valid_from, valid_to,
+                       legal_reference, vat_category, exemption_code, sequence)
+    values (p_company_id, r.code, r.name, r.description, r.amount_type, r.amount,
+            r.applies_to, r.treatment, p_country, r.valid_from, r.valid_to,
+            r.legal_reference, r.vat_category, r.exemption_code, r.sequence)
+    on conflict (company_id, code) do nothing
+    returning id into v_tax_id;
+
+    if v_tax_id is null then
+      continue;
+    end if;
+
+    insert into tax_postings (tax_id, company_id, document_kind, posting_type,
+                              factor_percent, account_id, declaration_box,
+                              box_factor_percent, report_code, sequence)
+    select v_tax_id, p_company_id, tp.document_kind, tp.posting_type,
+           tp.factor_percent, account_id_by_code(p_company_id, tp.account_code),
+           tp.declaration_box, tp.box_factor_percent, tp.report_code, tp.sequence
+      from tax_posting_templates tp
+     where tp.tax_template_id = r.id
+     order by tp.sequence;
+  end loop;
+
+  -- 5. Roles.
+  select * into v_defaults from country_defaults where country = p_country;
+  if found then
+    update companies c
+       set receivable_account_id       = coalesce(c.receivable_account_id, account_id_by_code(p_company_id, v_defaults.receivable_code)),
+           payable_account_id          = coalesce(c.payable_account_id, account_id_by_code(p_company_id, v_defaults.payable_code)),
+           suspense_account_id         = coalesce(c.suspense_account_id, account_id_by_code(p_company_id, v_defaults.suspense_code)),
+           rounding_account_id         = coalesce(c.rounding_account_id, account_id_by_code(p_company_id, v_defaults.rounding_code)),
+           retained_earnings_account_id = coalesce(c.retained_earnings_account_id, account_id_by_code(p_company_id, v_defaults.retained_earnings_code)),
+           default_sales_account_id    = coalesce(c.default_sales_account_id, account_id_by_code(p_company_id, v_defaults.sales_account_code)),
+           default_purchase_account_id = coalesce(c.default_purchase_account_id, account_id_by_code(p_company_id, v_defaults.purchase_account_code)),
+           sales_journal_id            = coalesce(c.sales_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.sales_journal_code)),
+           purchase_journal_id         = coalesce(c.purchase_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.purchase_journal_code)),
+           miscellaneous_journal_id    = coalesce(c.miscellaneous_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.misc_journal_code))
+     where c.id = p_company_id;
+
+    update journals j
+       set default_account_id = account_id_by_code(p_company_id, v_defaults.bank_account_code)
+     where j.company_id = p_company_id
+       and j.journal_type = 'bank'
+       and j.default_account_id is null
+       and v_defaults.bank_account_code is not null;
+
+    update journals j
+       set default_account_id = account_id_by_code(p_company_id, v_defaults.cash_account_code)
+     where j.company_id = p_company_id
+       and j.journal_type = 'cash'
+       and j.default_account_id is null
+       and v_defaults.cash_account_code is not null;
+  end if;
+
+  -- 6. What was copied, and from which version.
+  v_version := coalesce((select version from country_packs where country = p_country), '1.0.0');
+
+  insert into company_packs (company_id, country, version)
+  values (p_company_id, p_country, v_version)
+  on conflict (company_id, country) do update
+     set version = excluded.version,
+         upgraded_at = now()
+   where company_packs.version is distinct from excluded.version;
+end;
+$$;
+
+comment on function install_country_template(uuid, char, char) is
+  'Copies a country pack into a company in one language, wires the default roles and the financial journals, and records the pack version in company_packs.';
+
+-- The rule of `20260911210131`, which its own default privileges cannot keep:
+-- a function created now comes out executable by PUBLIC unless this runs.
+-- From PUBLIC only — `anon` holds explicit grants on the policy helpers.
+revoke execute on all functions in schema public from public;

package/dist/assets/migrations/20260912081014_pack_certification_maintained.sql

@@ -0,0 +1,31 @@
+-- Ekwo OS — Ekwo maintains a pack; only a professional reviews one.
+--
+-- `pack_certification` shipped with three values, and one of them said the
+-- wrong thing. `ekwo` read as "certified by Ekwo", which is a claim nobody
+-- here can make: we write the pack, we test that it is internally coherent,
+-- and none of that is an accountant reading it against the law. The word
+-- *certified* should only ever describe a review by a named professional.
+--
+-- So the scale becomes:
+--
+--   community   contributed, not read by an accountant
+--   maintained  maintained by Ekwo, not yet reviewed by an accountant
+--   reviewed    read by a named professional, with `certified_by`,
+--               `certified_at` and the sources they worked from
+--
+-- `ekwo` stays in the type because a value is never removed from an enum a
+-- published column uses, and it is deprecated: nothing writes it any more,
+-- the JSON schema of a pack refuses it, and the next migration moves the rows
+-- that hold it. A value cannot be added and used in the same transaction,
+-- which is why the update is its own file rather than ten lines below.
+
+alter type pack_certification add value if not exists 'maintained' after 'community';
+
+comment on type pack_certification is
+  'How much a pack has been read: community (contributed, unread), maintained (by Ekwo, not yet reviewed), reviewed (by a named professional). The value `ekwo` is deprecated and nothing writes it.';
+
+comment on column country_packs.certification_status is
+  'How much a pack has been read, printed by `ekwo init`: community (contributed, unread), maintained (by Ekwo, not yet reviewed), reviewed (by the professional named in certified_by).';
+
+comment on column country_packs.certified_by is
+  'The professional who reviewed the pack. Only on a reviewed pack: maintaining is not reviewing.';

package/dist/assets/migrations/20260912081015_pack_certification_backfill.sql

@@ -0,0 +1,16 @@
+-- Ekwo OS — the packs that called themselves certified are maintained.
+--
+-- Its own file because PostgreSQL refuses a new enum value in the transaction
+-- that added it, and the migration runner gives each file one transaction.
+--
+-- `certified_by` is emptied along with it: on a maintained pack it held
+-- "Ekwo AI", which is the claim this pair of migrations exists to stop
+-- making. On a reviewed pack it holds the professional who read it, and this
+-- touches nothing of the sort. The generated seeds carry the same values, so
+-- an installation that re-applies them lands in the same place.
+
+update country_packs
+   set certification_status = 'maintained',
+       certified_by = null,
+       certified_at = null
+ where certification_status = 'ekwo';