ekwo-os 0.4.1

package/dist/assets/migrations/20260918161538_a_posted_entry_does_not_move.sql

@@ -0,0 +1,252 @@
+-- Ekwo OS — a posted entry is immutable, in an open period too.
+--
+-- The schema has said so from the first day, in comments, in the description
+-- of the audit trail — "a posted entry is immutable and is corrected by a
+-- reversal, so what is recorded is the act of posting and never the lines" —
+-- and in every design decision that leans on it. What enforced it was
+-- `entries_guard_period`, and that guards a *locked* period. In an open one,
+-- established under row level security as a member holding `entries.write`:
+--
+--   * the lines of a posted entry could be deleted, all of them;
+--   * the entry itself could be deleted;
+--   * its state could be set back to `draft`, after which it is an ordinary
+--     draft and anything goes;
+--   * an amount on its own was refused — by `entries_posted_is_balanced`, a
+--     check that the entry still balances, which two amounts changed together
+--     satisfy.
+--
+-- The audit trail records the posting and deliberately not the lines, on the
+-- ground that they cannot change. So a change to them was not only possible,
+-- it left no trace.
+--
+-- Same shape as `20260918161204` for the document, for the same reason and
+-- with the same absence of an exemption. Once an entry has left `draft`:
+--
+--   * it is not deleted and its state does not change. A posted entry is
+--     undone by a reversal — a second entry naming it in `reversed_entry_id` —
+--     which is what `reopen_fiscal_year()` already does;
+--   * no column of it moves but `updated_at`. `total_debit` and `total_credit`
+--     are derived from lines that no longer move;
+--   * its lines take no insert and no delete, and keep every column but the
+--     two the matching writes — `matching_number` and `matched_amount` — which
+--     is the exception `entry_lines_guard_period` has made for a locked period
+--     since the first migration: matching is not a change to the accounts.
+--
+-- Closed lists again: a column added later is frozen the day it is added.
+--
+-- **Every path of the schema that writes an entry was read before this was
+-- written**, because a guard nobody is exempt from has to be one nobody needs
+-- an exemption from. They all do the same thing: insert a `draft`, insert its
+-- lines, call `post_entry()`.
+--
+--   * `post_document()`, `post_payment()`, `post_module_entry()` — which is how
+--     every module reaches the ledger —, `opening_balance()`,
+--     `settle_cash_basis_tax()`, `settle_filing()`: a draft, its lines,
+--     `post_entry()`. Nothing is touched afterwards.
+--   * `close_fiscal_year()`: the same, twice; its one `delete from entries` is
+--     of the closing entry it has just created as a draft and found nothing to
+--     put in.
+--   * `reconcile()` books an exchange difference as a new entry, and
+--     `unreconcile()` undoes it with a **mirror** naming it in
+--     `reversed_entry_id` — it never deletes or edits the first.
+--     `reopen_fiscal_year()` does the same for the entries of a close.
+--   * `reconciliations_refresh_lines()` writes `matched_amount` and
+--     `matching_number` on posted lines: the closed list below.
+--   * `entries_refresh_totals()` rewrote `total_debit` and `total_credit` on
+--     every write of a line, whatever the state. The lines of a posted entry
+--     no longer move, so it now acts on drafts.
+--
+-- So the reversal is already how this schema undoes an entry, everywhere it
+-- does; what was missing is that nothing made it the *only* way.
+--
+-- **Nobody is born posted**, as for a document and for the same reason: an
+-- entry inserted with a state that is not `draft`, or a line inserted under
+-- one, is `entry_born_posted` for everybody, the installer included. Books
+-- kept elsewhere arrive through `import_company()`, which switches the
+-- triggers of the tables it fills off by name for the time of the load and
+-- needs no exemption here. What it loads is still judged by what no switch
+-- turns off — `entries_posted_is_balanced`, `entries_posted_has_number` — and
+-- is frozen afterwards like everything else. The period guards are triggers
+-- and are off during a load with the rest: an archive brings closed years with
+-- it, and whether a loaded entry may sit in one is the import's question.
+--
+-- **The guards are `security definer`**, for the reason found on the document:
+-- asked under the caller's row level security, "is the company still there?"
+-- is answered *no row* by whoever cannot read `companies`, and that answer let
+-- a delete through. Unlike the guard of a document line they are not named
+-- to fire first: the older guards of these two tables — who may post, what a
+-- module tag may become, which period is locked — refuse more precisely what
+-- they refuse, and keep answering first where they do.
+--
+-- `draft` to `posted` is `post_entry()`'s one statement on a row that is still
+-- a draft, and passes untouched. The cascade of a company being deleted passes
+-- for the reason it does on a document: the company's row is already gone.
+-- The period guards stay exactly as they are and keep their own job — a draft
+-- dated in a locked period is theirs to refuse, not this file's.
+
+create or replace function entries_guard_posted()
+returns trigger
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  v_moved text[];
+begin
+  if tg_op = 'INSERT' then
+    if new.state <> 'draft' then
+      raise exception 'entry_born_posted: an entry is written as a draft and posted by post_entry(). One that is already % arrives with a company being loaded, by import_company(), and in no other way.',
+        new.state
+        using errcode = '55006';
+    end if;
+    return new;
+  end if;
+
+  if old.state = 'draft' then
+    return coalesce(new, old);
+  end if;
+
+  if tg_op = 'DELETE' then
+    if not exists (select 1 from companies c where c.id = old.company_id) then
+      return old;
+    end if;
+    raise exception 'entry_posted: entry % is % and cannot be deleted. A posted entry is undone by a reversal that names it.',
+      coalesce(old.number, old.id::text), old.state
+      using errcode = '55006';
+  end if;
+
+  if new.state is distinct from old.state then
+    raise exception 'entry_posted: entry % is % and stays so. A posted entry is undone by a reversal that names it, never by changing its state to %.',
+      coalesce(old.number, old.id::text), old.state, new.state
+      using errcode = '55006';
+  end if;
+
+  select array_agg(n.key order by n.key)
+    into v_moved
+    from jsonb_each(to_jsonb(new)) n
+    join jsonb_each(to_jsonb(old)) o on o.key = n.key
+   where n.value is distinct from o.value
+     -- `is_balanced` is generated, and not yet computed in a `before` trigger.
+     and n.key not in ('updated_at', 'is_balanced');
+
+  if v_moved is not null then
+    raise exception 'entry_posted: entry % was posted and keeps its % (%). A posted entry is undone by a reversal that names it.',
+      coalesce(old.number, old.id::text),
+      case when array_length(v_moved, 1) = 1 then 'value of' else 'values of' end,
+      array_to_string(v_moved, ', ')
+      using errcode = '55006';
+  end if;
+  return new;
+end;
+$$;
+
+comment on function entries_guard_posted() is
+  'Once an entry has left draft: it is not deleted, its state does not change and no column moves. Refuses entry_posted, by name, to everybody, and entry_born_posted to whoever inserts one that is already posted: that arrives only with a company loaded by import_company(). The period guards keep their own job.';
+
+create trigger entries_guard_posted
+  before insert or update or delete on entries
+  for each row execute function entries_guard_posted();
+
+revoke execute on function entries_guard_posted() from public, anon, authenticated, service_role;
+
+create or replace function entry_lines_guard_posted()
+returns trigger
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  -- What the matching writes, and nothing else. `balance` is generated from
+  -- two columns that are frozen, and is not yet computed when a `before`
+  -- trigger reads the new row.
+  c_still_moves constant text[] := array['matching_number', 'matched_amount', 'balance', 'updated_at'];
+  v_state  entry_state;
+  v_number text;
+  v_moved  text[];
+begin
+  -- The entry the line is leaving, where it is leaving one: a line does not
+  -- walk out of a posted entry into a draft.
+  select e.state, e.number into v_state, v_number
+    from entries e where e.id = coalesce(old.entry_id, new.entry_id);
+  if found and v_state = 'draft' and tg_op = 'UPDATE' and new.entry_id is distinct from old.entry_id then
+    select e.state, e.number into v_state, v_number from entries e where e.id = new.entry_id;
+  end if;
+
+  if not found or v_state = 'draft' then
+    return coalesce(new, old);
+  end if;
+
+  if tg_op = 'DELETE' then
+    if not exists (select 1 from companies c where c.id = old.company_id) then
+      return old;
+    end if;
+    raise exception 'entry_posted: line % of entry % was posted and cannot be deleted. A posted entry is undone by a reversal that names it.',
+      old.sequence, coalesce(v_number, old.entry_id::text)
+      using errcode = '55006';
+  end if;
+
+  if tg_op = 'INSERT' then
+    raise exception 'entry_posted: entry % was posted with the lines it has, and takes no other. A posted entry is undone by a reversal that names it.',
+      coalesce(v_number, new.entry_id::text)
+      using errcode = '55006';
+  end if;
+
+  select array_agg(n.key order by n.key)
+    into v_moved
+    from jsonb_each(to_jsonb(new)) n
+    join jsonb_each(to_jsonb(old)) o on o.key = n.key
+   where n.value is distinct from o.value
+     and n.key <> all (c_still_moves);
+
+  if v_moved is not null then
+    raise exception 'entry_posted: line % of entry % was posted and keeps its % (%). A posted entry is undone by a reversal that names it.',
+      old.sequence, coalesce(v_number, old.entry_id::text),
+      case when array_length(v_moved, 1) = 1 then 'value of' else 'values of' end,
+      array_to_string(v_moved, ', ')
+      using errcode = '55006';
+  end if;
+  return new;
+end;
+$$;
+
+comment on function entry_lines_guard_posted() is
+  'Once an entry has left draft, its lines are the lines that were posted: no insert, no delete, and no column changed but the two the matching writes, matching_number and matched_amount. Refuses entry_posted, by name, to everybody.';
+
+create trigger entry_lines_guard_posted
+  before insert or update or delete on entry_lines
+  for each row execute function entry_lines_guard_posted();
+
+revoke execute on function entry_lines_guard_posted() from public, anon, authenticated, service_role;
+
+-- ---------------------------------------------------------------------------
+-- The totals of a posted entry are not recomputed
+--
+-- `20260911120400` as it was, acting on drafts only. The lines of a posted
+-- entry do not move, so there is nothing to recompute; and a trigger that
+-- restates the totals of a posted entry from its lines is the mechanism by
+-- which a changed line used to become a changed entry.
+-- ---------------------------------------------------------------------------
+
+create or replace function entries_refresh_totals()
+returns trigger
+language plpgsql
+as $$
+declare
+  v_entry_id uuid := coalesce(new.entry_id, old.entry_id);
+begin
+  update entries e
+     set total_debit  = coalesce(s.debit, 0),
+         total_credit = coalesce(s.credit, 0)
+    from (
+      select sum(l.debit) as debit, sum(l.credit) as credit
+        from entry_lines l
+       where l.entry_id = v_entry_id
+    ) s
+   where e.id = v_entry_id
+     and e.state = 'draft';
+  return null;
+end;
+$$;
+
+comment on function entries_refresh_totals() is
+  'Keeps the totals of a draft entry in step with its lines. A posted entry keeps the totals it was posted, or loaded, with.';

package/dist/assets/migrations/20260918171946_an_entry_is_posted_by_post_entry.sql

@@ -0,0 +1,289 @@
+-- Ekwo OS — an entry is posted by post_entry(), a document by post_document().
+--
+-- The two guards published this morning freeze what is posted. They looked at
+-- the way *out* of `posted` and let the way *in* alone, on the ground that the
+-- transition is one statement of `post_entry()`. It is — and it is also one
+-- statement of anybody's. Established as the `accountant` preset, which holds
+-- `entries.post`, under row level security, on a balanced draft:
+--
+--     update entries set state = 'posted', number = 'HAND/1' where id = …
+--
+-- went through. What stood in the way was two check constraints (a posted
+-- entry has a number and balances), the capability, and the lock of the
+-- period as `entries_guard_period` reads it. What did not: the number was
+-- chosen by hand, in a country whose law forbids a hole in the sequence and
+-- where `post_entry()` refuses exactly that by name (`numbering_gapless`);
+-- `posted_at` and `fiscal_year_id` stayed null; an entry with no line at all
+-- balances at zero and was accepted; the period was not asked the stricter
+-- question `post_entry()` asks. And the guard of this morning then froze the
+-- result for good.
+--
+-- The same on a document: `update documents set state = 'posted', entry_id = …`
+-- pointing at an entry that is legitimately posted and is *not* the one the
+-- document produced — an entry keyed by hand, say — went through, because
+-- `document_posted_without_entry` only asked that the entry be posted.
+--
+-- **Judged on facts, not on a flag.** The obvious fix is a transaction-local
+-- setting that `post_entry()` raises and the guard reads. It does not hold: a
+-- custom setting is writable by any session that can run `set_config`, so the
+-- flag would say "post_entry is running" for whoever said so first — and
+-- `post_entry()` runs as its caller, so there is no privilege behind which to
+-- hide it. What `post_entry()` *produces*, on the other hand, is all on the
+-- row and in the counter, and can be checked there whoever wrote it:
+--
+--   * `posted_at` is set, and `fiscal_year_id`, where there is one, is the year
+--     the date falls in;
+--   * the entry has at least one line (`entry_empty`);
+--   * the period is open, asked the way `post_entry()` asks it;
+--   * **the number was drawn, not chosen**, wherever the rule applies: in a
+--     country that numbers without a hole, for a caller who does not hold
+--     `entries.import`, the number has to be the last one the counter of its
+--     journal delivered. `next_entry_number()` advances that counter in the
+--     same statement and holds its row until the transaction ends, and a number
+--     already used is refused by `entries_company_number_idx` — so "equal to
+--     the last delivered, and unique" *is* "just drawn". Elsewhere a number
+--     chosen by hand is what `post_entry()` allows too, and the guard then
+--     brings the counter up to it, as the function does.
+--
+-- A row that satisfies all of that is, fact for fact, the row `post_entry()`
+-- writes, and is let through whoever wrote it: a rule about facts cannot refuse
+-- the facts, and nothing is lost by it. `post_entry()` is unchanged, and so are
+-- the seven functions that call it; `import_company()` switches the guard off
+-- for a load, as before.
+--
+-- The cost is said plainly: the conditions of `post_entry()` are now read in
+-- two places, the function and the guard. `tests/posted_by_hand.test.ts` walks
+-- every refusal of the function beside the same attempt by hand, so that a
+-- condition added to one and not to the other fails a test.
+--
+-- For a document the facts are on two rows: the entry names this document
+-- (`entries.document_id`, written by `post_document()` when it builds it, and
+-- frozen with the entry), the document is booked on its entry's day, and it
+-- carries the number it had, or its entry's. `document_posted_by_hand`
+-- otherwise.
+
+-- ---------------------------------------------------------------------------
+-- 1. The guard of an entry, asking at the transition what post_entry() leaves
+--
+-- `20260918161538` as it was, with the transition judged. It is written in the
+-- trigger and not in a function beside it: a function nobody may call is a
+-- function the grants have no honest line for.
+-- ---------------------------------------------------------------------------
+
+create or replace function entries_guard_posted()
+returns trigger
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  v_moved   text[];
+  v_format  text;
+  v_gapless boolean;
+  v_code    text;
+  v_period  smallint;
+  v_last    integer;
+begin
+  if tg_op = 'INSERT' then
+    if new.state <> 'draft' then
+      raise exception 'entry_born_posted: an entry is written as a draft and posted by post_entry(). One that is already % arrives with a company being loaded, by import_company(), and in no other way.',
+        new.state
+        using errcode = '55006';
+    end if;
+    return new;
+  end if;
+
+  if old.state = 'draft' then
+    if tg_op = 'UPDATE' and new.state = 'posted' then
+      if new.posted_at is null then
+        raise exception 'entry_posted_by_hand: entry % would be posted with no instant it was posted at. An entry is posted by post_entry() and by nothing else.',
+          coalesce(new.number, new.id::text)
+          using errcode = '55006';
+      end if;
+      -- Null is what post_entry() itself writes where it finds no year — a company
+      -- that has not opened one, or a caller who cannot read `fiscal_years`, which
+      -- is a machine key today. A year that is *named* has to be the right one.
+      if new.fiscal_year_id is not null
+         and new.fiscal_year_id is distinct from fiscal_year_at(new.company_id, new.entry_date) then
+        raise exception 'entry_posted_by_hand: entry % would be posted outside the financial year its date falls in. An entry is posted by post_entry() and by nothing else.',
+          coalesce(new.number, new.id::text)
+          using errcode = '55006';
+      end if;
+
+      if not exists (select 1 from entry_lines l where l.entry_id = new.id) then
+        raise exception 'entry_empty: entry % has no lines', new.id;
+      end if;
+
+      perform assert_period_open(new.company_id, new.entry_date, true);
+
+      select r.number_format, r.numbering_gapless into v_format, v_gapless
+        from numbering_rules(new.company_id) r;
+      select j.code into v_code from journals j where j.id = new.journal_id;
+      v_period := case when v_format ~ '\{(YYYY|YY)\}'
+                       then extract(year from new.entry_date)::smallint
+                       else 0::smallint end;
+      select s.last_number into v_last
+        from journal_sequences s
+       where s.journal_id = new.journal_id and s.year = v_period;
+
+      if v_last is not null and new.number = format_number(v_format, v_code, new.entry_date, v_last) then
+        return new;  -- drawn from the counter, a moment ago, by this transaction
+      end if;
+
+      -- A number chosen by hand: on the draft beforehand, or in this statement.
+      if v_gapless and not (auth.uid() is not null and has_capability(new.company_id, 'entries.import')) then
+        raise exception 'entry_posted_by_hand: % is not the number the counter of this journal delivered, and this country forbids a hole in the sequence. An entry is posted by post_entry(), which draws it; books that already have numbers are brought in by whoever holds entries.import.',
+          new.number
+          using errcode = '55006';
+      end if;
+      perform catch_up_journal_sequence(new.journal_id, new.entry_date, new.number);
+    end if;
+    return coalesce(new, old);
+  end if;
+
+  if tg_op = 'DELETE' then
+    if not exists (select 1 from companies c where c.id = old.company_id) then
+      return old;
+    end if;
+    raise exception 'entry_posted: entry % is % and cannot be deleted. A posted entry is undone by a reversal that names it.',
+      coalesce(old.number, old.id::text), old.state
+      using errcode = '55006';
+  end if;
+
+  if new.state is distinct from old.state then
+    raise exception 'entry_posted: entry % is % and stays so. A posted entry is undone by a reversal that names it, never by changing its state to %.',
+      coalesce(old.number, old.id::text), old.state, new.state
+      using errcode = '55006';
+  end if;
+
+  select array_agg(n.key order by n.key)
+    into v_moved
+    from jsonb_each(to_jsonb(new)) n
+    join jsonb_each(to_jsonb(old)) o on o.key = n.key
+   where n.value is distinct from o.value
+     -- `is_balanced` is generated, and not yet computed in a `before` trigger.
+     and n.key not in ('updated_at', 'is_balanced');
+
+  if v_moved is not null then
+    raise exception 'entry_posted: entry % was posted and keeps its % (%). A posted entry is undone by a reversal that names it.',
+      coalesce(old.number, old.id::text),
+      case when array_length(v_moved, 1) = 1 then 'value of' else 'values of' end,
+      array_to_string(v_moved, ', ')
+      using errcode = '55006';
+  end if;
+  return new;
+end;
+$$;
+
+-- ---------------------------------------------------------------------------
+-- 2. The guard of a document, asking whose entry it is
+--
+-- `20260918161204` as it was; the transition reads the entry instead of only
+-- finding it.
+-- ---------------------------------------------------------------------------
+
+create or replace function documents_guard_posted()
+returns trigger
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  -- What may still move once the state has left `draft`. A closed list: a
+  -- column that is not named here is frozen, including one that does not
+  -- exist yet.
+  c_still_moves constant text[] := array[
+    'amount_paid', 'amount_residual', 'payment_state',
+    'sent_at', 'peppol_status', 'peppol_message_id',
+    'updated_at'
+  ];
+  v_moved text[];
+  v_entry entries%rowtype;
+begin
+  if tg_op = 'INSERT' then
+    if new.state <> 'draft' then
+      raise exception 'document_born_posted: a document is written as a draft and posted by post_document(). One that is already % arrives with a company being loaded, by import_company(), and in no other way.',
+        new.state
+        using errcode = '55006';
+    end if;
+    return new;
+  end if;
+
+  if tg_op = 'DELETE' then
+    if old.state = 'draft'
+       or not exists (select 1 from companies c where c.id = old.company_id) then
+      return old;
+    end if;
+    raise exception 'document_posted: % % was issued and cannot be deleted. It is undone by a credit note that names it.',
+      old.doc_type, coalesce(old.number, old.id::text)
+      using errcode = '55006';
+  end if;
+
+  if old.state = 'draft' then
+    -- The one transition that produces an entry has to have produced one.
+    if new.state = 'posted' then
+      select e.* into v_entry from entries e where e.id = new.entry_id and e.state = 'posted';
+      if not found then
+        raise exception 'document_posted_without_entry: % has no posted entry. A document is posted by post_document(), which builds its entry and posts it first.',
+          coalesce(new.number, new.id::text)
+          using errcode = '55006';
+      end if;
+      -- What post_document() leaves behind, read on the two rows: the entry
+      -- was built for this document and for no other, the document is booked
+      -- on the day its entry is, and it is numbered as it was — or, where it
+      -- had no number, as its entry.
+      if v_entry.document_id is distinct from new.id
+         or new.accounting_date is distinct from v_entry.entry_date
+         or new.number is distinct from coalesce(old.number, v_entry.number) then
+        raise exception 'document_posted_by_hand: % is not what post_document() writes — its entry % was not built for it, or is not booked on its day, or did not give it its number. A document is posted by post_document() and by nothing else.',
+          coalesce(new.number, new.id::text), coalesce(v_entry.number, v_entry.id::text)
+          using errcode = '55006';
+      end if;
+    end if;
+    return new;
+  end if;
+
+  if new.state is distinct from old.state then
+    raise exception 'document_posted: % % is % and stays so. It is undone by a credit note that names it, never by changing its state to %.',
+      old.doc_type, coalesce(old.number, old.id::text), old.state, new.state
+      using errcode = '55006';
+  end if;
+
+  select array_agg(n.key order by n.key)
+    into v_moved
+    from jsonb_each(to_jsonb(new)) n
+    join jsonb_each(to_jsonb(old)) o on o.key = n.key
+   where n.value is distinct from o.value
+     and n.key <> all (c_still_moves);
+
+  if v_moved is not null then
+    raise exception 'document_posted: % % was issued and keeps its % (%). What produced an entry does not change after it; credit it and issue another.',
+      old.doc_type, coalesce(old.number, old.id::text),
+      case when array_length(v_moved, 1) = 1 then 'value of' else 'values of' end,
+      array_to_string(v_moved, ', ')
+      using errcode = '55006';
+  end if;
+
+  if new.amount_paid is distinct from old.amount_paid
+     and new.amount_paid is distinct from document_amount_paid(new.id) then
+    raise exception 'document_amount_paid_is_derived: % has been settled by %, which is what its matching says. The figure is never keyed.',
+      coalesce(old.number, old.id::text), document_amount_paid(new.id)
+      using errcode = '55006';
+  end if;
+
+  if new.payment_state is distinct from old.payment_state
+     and new.amount_paid is not distinct from old.amount_paid then
+    raise exception 'document_payment_state_is_derived: the settlement of % follows from what was matched against it, and is never keyed.',
+      coalesce(old.number, old.id::text)
+      using errcode = '55006';
+  end if;
+
+  return new;
+end;
+$$;
+
+comment on function documents_guard_posted() is
+  'Once a document has left draft: its state does not change, it is not deleted, and no column moves but the closed list of what happens to a document after it is issued — amount_paid (to the figure the matching gives, and no other), payment_state, sent_at, peppol_status, peppol_message_id. Refuses document_posted, by name, to everybody. Becoming posted is held to what post_document() writes — a posted entry built for this document, booked on its day, that gave it its number — document_posted_by_hand otherwise; and nobody inserts a document that is already posted (document_born_posted).';
+
+comment on function entries_guard_posted() is
+  'Once an entry has left draft: it is not deleted, its state does not change and no column moves (entry_posted); nobody inserts one that is already posted (entry_born_posted). Becoming posted is held to what post_entry() produces, read on the row and in the counter — an instant it was posted at, no financial year but the one its date falls in, at least one line, an open period, and, where the country numbers without a hole and the caller does not hold entries.import, the number the counter of its journal has just delivered: entry_posted_by_hand otherwise.';

package/dist/assets/migrations/20260918174312_schema_version_0_4_0.sql

@@ -0,0 +1,53 @@
+-- Ekwo OS — the schema this release defines is 0.4.0.
+--
+-- `ekwo_schema_version()` is the one place the number lives, and a migration
+-- is the only thing that moves it. A database then answers for the files it
+-- has actually run rather than for what somebody believed it had run: the
+-- column default and `init_instance()` both call this function, so a fresh
+-- install records the new number without a second edit, and `ekwo migrate`
+-- reads it back onto `instance.schema_version` for a database that was
+-- installed at an older one.
+--
+-- Between 0.3.0 and here the schema gained the whole life of a declaration,
+-- a firm that keeps the books of its clients, a statement a bank sent, and a
+-- posted row that does not move. The packages of this release read all of it,
+-- and a 0.3.0 database has none of it: `tax_filings` with `tax_filing_boxes`
+-- and `tax_filing_deposits`, and `file_filing()`, `record_filing_outcome()`,
+-- `reopen_filing()`, `upcoming_filings()` and `filing_drift()` around them;
+-- the `client` preset with `documents.deposit`, `company.export`, and
+-- `portfolio_upcoming_filings()` and `portfolio_filings_touched_since()`;
+-- `export_company()` and `import_company()` with `company_archive_registry`;
+-- `import_bank_statement()` with `bank_statement_lines` and
+-- `bank_transactions.import_key`; `document_lines.vat_category` and
+-- `vat_rate`, there since the first schema and written at last, then frozen
+-- at posting, and `companies.peppol_scheme` and
+-- `peppol_identifier`, which the invoice written for the network is read
+-- from; `documents.client_ref` and `rehearse_post_document()`, which the
+-- command line keeps books through; `companies_with_capability()`, which
+-- every policy of a company's table now asks once per statement; and
+-- `document_amount_paid()` with the four guards that refuse, by name, a change
+-- to a posted document, to a posted entry, and a posting that did not go
+-- through `post_entry()` — `document_posted`, `entry_posted`,
+-- `document_born_posted`, `entry_born_posted`, `entry_posted_by_hand`,
+-- `document_posted_by_hand` — which the command line and the MCP server
+-- explain rather than report as a failure. So the packages declare 0.4.0 as
+-- their floor and refuse an older database by name, rather than improvising
+-- over a column that is not there.
+
+create or replace function ekwo_schema_version()
+returns text
+language sql
+immutable
+as $$
+  select '0.4.0'::text;
+$$;
+
+comment on function ekwo_schema_version() is
+  'Schema version of the installed release. Bumped by a migration, never by hand.';
+
+-- `create or replace` keeps the privileges the function already had, and the
+-- revoke is what every migration of this directory ends with: a function that
+-- comes out with the built-in default is published by Supabase as an
+-- anonymous RPC endpoint.
+revoke execute on all functions in schema public from public;
+grant execute on function ekwo_schema_version() to authenticated, service_role;

package/dist/assets/modules/assets/module.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://ekwo.ai/schemas/module/1.json",
+  "code": "assets",
+  "name": "Fixed assets",
+  "description": "Fixed assets, their depreciation schedule and their disposal. The durations, the declining coefficients and the prorata convention of a country are pack data; the engine knows no country.",
+  "schema": "assets",
+  "version": "1.0.0",
+  "status": "available",
+  "requires_socle_min": "20260913075903",
+  "posts": true,
+  "mcp": { "prefix": "assets" },
+  "pack": { "section": "assets" }
+}