shutro-erp 0.3.3 → 0.3.4

package/dist/sale_portal/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 2377e830cd00a651
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 8041dee6bf9e07ba
 // Bindings of module `sale_portal`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/sale_portal/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 2377e830cd00a651
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 8041dee6bf9e07ba
 // Schema view of module `sale_portal` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -12,6 +12,7 @@ export interface SchemaView {
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
+  readonly 'kosh.image': KoshImage;
   readonly 'kosh.saved_view': KoshSavedView;
   readonly 'mail.activity': MailActivity;
   readonly 'mail.activity.type': MailActivityType;
@@ -20,6 +21,10 @@ export interface SchemaView {
   readonly 'mail.follower': MailFollower;
   readonly 'mail.message': MailMessage;
   readonly 'mail.message.reaction': MailMessageReaction;
+  readonly 'oauth.app': OauthApp;
+  readonly 'oauth.code': OauthCode;
+  readonly 'oauth.grant': OauthGrant;
+  readonly 'oauth.token': OauthToken;
   readonly 'portal.announcement': PortalAnnouncement;
   readonly 'portal.invitation': PortalInvitation;
   readonly 'portal.signature': PortalSignature;
@@ -232,6 +237,29 @@ export interface AuthUserGroup {
 export interface AuthUserGroupMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.user_group'> {
 }
 
+/** `kosh.image` (owner: base). */
+export interface KoshImage {
+  readonly name: 'kosh.image';
+  readonly fields: {
+    readonly id: F.Id<'kosh.image'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly ownerModel: F.Char<{ readonly required: true }>;
+    readonly ownerId: F.Integer<{ readonly required: true }>;
+    readonly mime: F.Char<{ readonly required: true }>;
+    readonly data: F.Text<{ readonly required: true }>;
+    readonly hash: F.Char<{ readonly required: true }>;
+  };
+  readonly methods: KoshImageMethods;
+}
+
+/** Methods of `kosh.image`: declared ones and transitions. */
+export interface KoshImageMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'kosh.image'> {
+}
+
 /** `kosh.saved_view` (owner: base). */
 export interface KoshSavedView {
   readonly name: 'kosh.saved_view';
@@ -434,6 +462,105 @@ export interface MailMessageReaction {
 export interface MailMessageReactionMethods extends F.Methods<typeof import('../../messaging/index.js').messagingShutro, 'mail.message.reaction'> {
 }
 
+/** `oauth.app` (owner: base). */
+export interface OauthApp {
+  readonly name: 'oauth.app';
+  readonly fields: {
+    readonly id: F.Id<'oauth.app'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly name: F.Char<{ readonly required: true }>;
+    readonly clientId: F.Char<{ readonly required: true }>;
+    readonly secretHash: F.Char;
+    readonly confidential: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly redirectUris: F.Text<{ readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly homepage: F.Char;
+    readonly active: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly owner: F.Many2one<'res.users'>;
+  };
+  readonly methods: OauthAppMethods;
+}
+
+/** Methods of `oauth.app`: declared ones and transitions. */
+export interface OauthAppMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.app'> {
+}
+
+/** `oauth.code` (owner: base). */
+export interface OauthCode {
+  readonly name: 'oauth.code';
+  readonly fields: {
+    readonly id: F.Id<'oauth.code'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly codeHash: F.Char<{ readonly required: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly redirectUri: F.Char<{ readonly required: true }>;
+    readonly challenge: F.Char;
+    readonly expiresAt: F.Datetime<{ readonly required: true }>;
+    readonly used: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthCodeMethods;
+}
+
+/** Methods of `oauth.code`: declared ones and transitions. */
+export interface OauthCodeMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.code'> {
+}
+
+/** `oauth.grant` (owner: base). */
+export interface OauthGrant {
+  readonly name: 'oauth.grant';
+  readonly fields: {
+    readonly id: F.Id<'oauth.grant'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly user: F.Many2one<'res.users', { readonly required: true }>;
+    readonly app: F.Many2one<'oauth.app', { readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly lastUsedAt: F.Datetime;
+  };
+  readonly methods: OauthGrantMethods;
+}
+
+/** Methods of `oauth.grant`: declared ones and transitions. */
+export interface OauthGrantMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.grant'> {
+}
+
+/** `oauth.token` (owner: base). */
+export interface OauthToken {
+  readonly name: 'oauth.token';
+  readonly fields: {
+    readonly id: F.Id<'oauth.token'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly accessHash: F.Char<{ readonly required: true }>;
+    readonly refreshHash: F.Char<{ readonly required: true }>;
+    readonly accessExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly refreshExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly rotated: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthTokenMethods;
+}
+
+/** Methods of `oauth.token`: declared ones and transitions. */
+export interface OauthTokenMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.token'> {
+}
+
 /** `portal.announcement` (owner: portal). */
 export interface PortalAnnouncement {
   readonly name: 'portal.announcement';

package/dist/sale_project/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: b044bca835096ac0
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 7dbe00f1ac846381
 // Bindings of module `sale_project`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/sale_project/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: b044bca835096ac0
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 7dbe00f1ac846381
 // Schema view of module `sale_project` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -12,6 +12,7 @@ export interface SchemaView {
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
+  readonly 'kosh.image': KoshImage;
   readonly 'kosh.saved_view': KoshSavedView;
   readonly 'mail.activity': MailActivity;
   readonly 'mail.activity.type': MailActivityType;
@@ -20,6 +21,10 @@ export interface SchemaView {
   readonly 'mail.follower': MailFollower;
   readonly 'mail.message': MailMessage;
   readonly 'mail.message.reaction': MailMessageReaction;
+  readonly 'oauth.app': OauthApp;
+  readonly 'oauth.code': OauthCode;
+  readonly 'oauth.grant': OauthGrant;
+  readonly 'oauth.token': OauthToken;
   readonly 'product.category': ProductCategory;
   readonly 'product.product': ProductProduct;
   readonly 'project.project': ProjectProject;
@@ -233,6 +238,29 @@ export interface AuthUserGroup {
 export interface AuthUserGroupMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.user_group'> {
 }
 
+/** `kosh.image` (owner: base). */
+export interface KoshImage {
+  readonly name: 'kosh.image';
+  readonly fields: {
+    readonly id: F.Id<'kosh.image'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly ownerModel: F.Char<{ readonly required: true }>;
+    readonly ownerId: F.Integer<{ readonly required: true }>;
+    readonly mime: F.Char<{ readonly required: true }>;
+    readonly data: F.Text<{ readonly required: true }>;
+    readonly hash: F.Char<{ readonly required: true }>;
+  };
+  readonly methods: KoshImageMethods;
+}
+
+/** Methods of `kosh.image`: declared ones and transitions. */
+export interface KoshImageMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'kosh.image'> {
+}
+
 /** `kosh.saved_view` (owner: base). */
 export interface KoshSavedView {
   readonly name: 'kosh.saved_view';
@@ -435,6 +463,105 @@ export interface MailMessageReaction {
 export interface MailMessageReactionMethods extends F.Methods<typeof import('../../messaging/index.js').messagingShutro, 'mail.message.reaction'> {
 }
 
+/** `oauth.app` (owner: base). */
+export interface OauthApp {
+  readonly name: 'oauth.app';
+  readonly fields: {
+    readonly id: F.Id<'oauth.app'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly name: F.Char<{ readonly required: true }>;
+    readonly clientId: F.Char<{ readonly required: true }>;
+    readonly secretHash: F.Char;
+    readonly confidential: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly redirectUris: F.Text<{ readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly homepage: F.Char;
+    readonly active: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly owner: F.Many2one<'res.users'>;
+  };
+  readonly methods: OauthAppMethods;
+}
+
+/** Methods of `oauth.app`: declared ones and transitions. */
+export interface OauthAppMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.app'> {
+}
+
+/** `oauth.code` (owner: base). */
+export interface OauthCode {
+  readonly name: 'oauth.code';
+  readonly fields: {
+    readonly id: F.Id<'oauth.code'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly codeHash: F.Char<{ readonly required: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly redirectUri: F.Char<{ readonly required: true }>;
+    readonly challenge: F.Char;
+    readonly expiresAt: F.Datetime<{ readonly required: true }>;
+    readonly used: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthCodeMethods;
+}
+
+/** Methods of `oauth.code`: declared ones and transitions. */
+export interface OauthCodeMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.code'> {
+}
+
+/** `oauth.grant` (owner: base). */
+export interface OauthGrant {
+  readonly name: 'oauth.grant';
+  readonly fields: {
+    readonly id: F.Id<'oauth.grant'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly user: F.Many2one<'res.users', { readonly required: true }>;
+    readonly app: F.Many2one<'oauth.app', { readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly lastUsedAt: F.Datetime;
+  };
+  readonly methods: OauthGrantMethods;
+}
+
+/** Methods of `oauth.grant`: declared ones and transitions. */
+export interface OauthGrantMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.grant'> {
+}
+
+/** `oauth.token` (owner: base). */
+export interface OauthToken {
+  readonly name: 'oauth.token';
+  readonly fields: {
+    readonly id: F.Id<'oauth.token'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly accessHash: F.Char<{ readonly required: true }>;
+    readonly refreshHash: F.Char<{ readonly required: true }>;
+    readonly accessExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly refreshExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly rotated: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthTokenMethods;
+}
+
+/** Methods of `oauth.token`: declared ones and transitions. */
+export interface OauthTokenMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.token'> {
+}
+
 /** `product.category` (owner: product). */
 export interface ProductCategory {
   readonly name: 'product.category';

package/dist/sales/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 2d9d91e59673d178
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 680b65ef8ba5f90d
 // Bindings of module `sales`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/sales/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 2d9d91e59673d178
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 680b65ef8ba5f90d
 // Schema view of module `sales` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -12,6 +12,7 @@ export interface SchemaView {
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
+  readonly 'kosh.image': KoshImage;
   readonly 'kosh.saved_view': KoshSavedView;
   readonly 'mail.activity': MailActivity;
   readonly 'mail.activity.type': MailActivityType;
@@ -20,6 +21,10 @@ export interface SchemaView {
   readonly 'mail.follower': MailFollower;
   readonly 'mail.message': MailMessage;
   readonly 'mail.message.reaction': MailMessageReaction;
+  readonly 'oauth.app': OauthApp;
+  readonly 'oauth.code': OauthCode;
+  readonly 'oauth.grant': OauthGrant;
+  readonly 'oauth.token': OauthToken;
   readonly 'product.category': ProductCategory;
   readonly 'product.product': ProductProduct;
   readonly 'res.company': ResCompany;
@@ -229,6 +234,29 @@ export interface AuthUserGroup {
 export interface AuthUserGroupMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.user_group'> {
 }
 
+/** `kosh.image` (owner: base). */
+export interface KoshImage {
+  readonly name: 'kosh.image';
+  readonly fields: {
+    readonly id: F.Id<'kosh.image'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly ownerModel: F.Char<{ readonly required: true }>;
+    readonly ownerId: F.Integer<{ readonly required: true }>;
+    readonly mime: F.Char<{ readonly required: true }>;
+    readonly data: F.Text<{ readonly required: true }>;
+    readonly hash: F.Char<{ readonly required: true }>;
+  };
+  readonly methods: KoshImageMethods;
+}
+
+/** Methods of `kosh.image`: declared ones and transitions. */
+export interface KoshImageMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'kosh.image'> {
+}
+
 /** `kosh.saved_view` (owner: base). */
 export interface KoshSavedView {
   readonly name: 'kosh.saved_view';
@@ -431,6 +459,105 @@ export interface MailMessageReaction {
 export interface MailMessageReactionMethods extends F.Methods<typeof import('../../messaging/index.js').messagingShutro, 'mail.message.reaction'> {
 }
 
+/** `oauth.app` (owner: base). */
+export interface OauthApp {
+  readonly name: 'oauth.app';
+  readonly fields: {
+    readonly id: F.Id<'oauth.app'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly name: F.Char<{ readonly required: true }>;
+    readonly clientId: F.Char<{ readonly required: true }>;
+    readonly secretHash: F.Char;
+    readonly confidential: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly redirectUris: F.Text<{ readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly homepage: F.Char;
+    readonly active: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly owner: F.Many2one<'res.users'>;
+  };
+  readonly methods: OauthAppMethods;
+}
+
+/** Methods of `oauth.app`: declared ones and transitions. */
+export interface OauthAppMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.app'> {
+}
+
+/** `oauth.code` (owner: base). */
+export interface OauthCode {
+  readonly name: 'oauth.code';
+  readonly fields: {
+    readonly id: F.Id<'oauth.code'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly codeHash: F.Char<{ readonly required: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly redirectUri: F.Char<{ readonly required: true }>;
+    readonly challenge: F.Char;
+    readonly expiresAt: F.Datetime<{ readonly required: true }>;
+    readonly used: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthCodeMethods;
+}
+
+/** Methods of `oauth.code`: declared ones and transitions. */
+export interface OauthCodeMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.code'> {
+}
+
+/** `oauth.grant` (owner: base). */
+export interface OauthGrant {
+  readonly name: 'oauth.grant';
+  readonly fields: {
+    readonly id: F.Id<'oauth.grant'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly user: F.Many2one<'res.users', { readonly required: true }>;
+    readonly app: F.Many2one<'oauth.app', { readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly lastUsedAt: F.Datetime;
+  };
+  readonly methods: OauthGrantMethods;
+}
+
+/** Methods of `oauth.grant`: declared ones and transitions. */
+export interface OauthGrantMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.grant'> {
+}
+
+/** `oauth.token` (owner: base). */
+export interface OauthToken {
+  readonly name: 'oauth.token';
+  readonly fields: {
+    readonly id: F.Id<'oauth.token'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly accessHash: F.Char<{ readonly required: true }>;
+    readonly refreshHash: F.Char<{ readonly required: true }>;
+    readonly accessExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly refreshExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly rotated: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthTokenMethods;
+}
+
+/** Methods of `oauth.token`: declared ones and transitions. */
+export interface OauthTokenMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.token'> {
+}
+
 /** `product.category` (owner: product). */
 export interface ProductCategory {
   readonly name: 'product.category';

package/dist/server/auth/base.js

@@ -147,6 +147,72 @@ const AuthPolicy = defineModel('auth.policy', {
         sessionDays: f.integer({ label: 'Session lifetime (days)' }),
     },
 });
+/**
+ * OAuth 2.0 apps (RFC 0017 §5.2): third-party applications that act for a user who consented, within scopes. The
+ * client secret (confidential apps) is stored as a digest; public apps rely on PKCE. Private: managed by the
+ * Integrations routes and the OAuth flow.
+ */
+const OAuthApp = defineModel('oauth.app', {
+    fields: {
+        name: f.char({ required: true }),
+        clientId: f.char({ required: true, index: 'unique' }),
+        secretHash: f.char(),
+        confidential: f.boolean({ default: true }),
+        /** One per line; the redirect must match one exactly. */
+        redirectUris: f.text({ required: true }),
+        /** The scopes it may ask for, space separated (`*`, `read:<app>`, `write:<app>`). */
+        scopes: f.char({ required: true }),
+        homepage: f.char(),
+        active: f.boolean({ default: true }),
+        owner: f.many2one('res.users', { ondelete: 'set null' }),
+    },
+});
+/** A user's consent to an app, with the scopes granted; revoking it ends every token of it. */
+const OAuthGrant = defineModel('oauth.grant', {
+    fields: {
+        user: f.many2one('res.users', { required: true, ondelete: 'cascade' }),
+        app: f.many2one('oauth.app', { required: true, ondelete: 'cascade' }),
+        scopes: f.char({ required: true }),
+        revoked: f.boolean({ default: false }),
+        lastUsedAt: f.datetime(),
+    },
+});
+/** An authorization code: once, for 10 minutes, bound to its redirect and its PKCE challenge. */
+const OAuthCode = defineModel('oauth.code', {
+    fields: {
+        codeHash: f.char({ required: true, index: 'unique' }),
+        grant: f.many2one('oauth.grant', { required: true, ondelete: 'cascade' }),
+        redirectUri: f.char({ required: true }),
+        challenge: f.char(),
+        expiresAt: f.datetime({ required: true }),
+        used: f.boolean({ default: false }),
+    },
+});
+/** An access token (1 hour) and its refresh token (rotated at each use), both stored as digests. */
+const OAuthToken = defineModel('oauth.token', {
+    fields: {
+        grant: f.many2one('oauth.grant', { required: true, ondelete: 'cascade' }),
+        accessHash: f.char({ required: true, index: 'unique' }),
+        refreshHash: f.char({ required: true, index: 'unique' }),
+        accessExpiresAt: f.datetime({ required: true }),
+        refreshExpiresAt: f.datetime({ required: true }),
+        /** No longer valid: replaced by a newer pair, or revoked. */
+        revoked: f.boolean({ default: false }),
+        /** Replaced by a newer pair: its refresh token coming back means someone else holds it. */
+        rotated: f.boolean({ default: false }),
+    },
+});
+/** Profile photos and company logos (`images.ts`): small images, their bytes in base64. Private: served by routes. */
+const KoshImage = defineModel('kosh.image', {
+    fields: {
+        ownerModel: f.char({ required: true, index: true }),
+        ownerId: f.integer({ required: true, index: true }),
+        mime: f.char({ required: true }),
+        data: f.text({ required: true }),
+        /** The bytes' digest (16 hex): the version in the image's URL. */
+        hash: f.char({ required: true }),
+    },
+});
 /**
  * The security audit log (CLAUDE.md: logins, permission changes, exports, sensitive actions). Append-only: no one
  * may change or delete events (administrators included: the REST API never serves it, and the admin API only reads).
@@ -217,6 +283,11 @@ export const baseShutro = defineModule({
         AuthUserGroup,
         AuthUserGrant,
         AuthPolicy,
+        OAuthApp,
+        OAuthGrant,
+        OAuthCode,
+        OAuthToken,
+        KoshImage,
         AuditEvent,
         SavedView,
     ],
@@ -236,6 +307,11 @@ export const base = defineKoshModule({
         'auth.user_group',
         'auth.user_grant',
         'auth.policy',
+        'oauth.app',
+        'oauth.grant',
+        'oauth.code',
+        'oauth.token',
+        'kosh.image',
         'audit.event',
     ],
 });

package/dist/server/auth/oauth.d.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance } from 'fastify';
+import type { Env, Shutro } from '../orm.js';
+import type { KoshRegistry } from '../registry.js';
+import type { AuthService } from './service.js';
+export declare const ACCESS_SECONDS = 3600;
+/** Access tokens start with it: the server tells them from sessions and API keys at a glance. */
+export declare const ACCESS_PREFIX = "oat_";
+export interface OAuthOptions {
+    /** The back-office's address: the consent page is `<baseUrl>/oauth/authorize`. */
+    readonly baseUrl: string;
+}
+/** A resolved access token: who it acts as, within which scopes. */
+export interface OAuthAccess {
+    readonly token: number;
+    readonly user: number;
+    readonly app: number;
+    readonly scopes: string[];
+}
+/** Finds the access token `token` (`oat_…`), live, of an active app and a grant not revoked. */
+export declare function resolveAccessToken(env: Env, token: string): Promise<OAuthAccess | null>;
+export declare function registerOAuthRoutes(app: FastifyInstance, auth: AuthService, shutro: () => Shutro, registry: KoshRegistry, options: OAuthOptions): void;