@knowledge-stack/ksapi 1.154.1 → 1.155.0

package/src/apis/UserPermissionsApi.ts

@@ -15,6 +15,10 @@
 
 import * as runtime from '../runtime';
 import type {
+  BulkGrantRequest,
+  BulkGrantResponse,
+  BulkOperationResponse,
+  BulkRevokeRequest,
   CreatePermissionRequest,
   ErrorResponse,
   HTTPValidationError,
@@ -26,6 +30,14 @@ import type {
   UserPermissionOrder,
 } from '../models/index';
 import {
+    BulkGrantRequestFromJSON,
+    BulkGrantRequestToJSON,
+    BulkGrantResponseFromJSON,
+    BulkGrantResponseToJSON,
+    BulkOperationResponseFromJSON,
+    BulkOperationResponseToJSON,
+    BulkRevokeRequestFromJSON,
+    BulkRevokeRequestToJSON,
     CreatePermissionRequestFromJSON,
     CreatePermissionRequestToJSON,
     ErrorResponseFromJSON,
@@ -46,6 +58,14 @@ import {
     UserPermissionOrderToJSON,
 } from '../models/index';
 
+export interface BulkGrantUserPermissionsRequest {
+    bulkGrantRequest: BulkGrantRequest;
+}
+
+export interface BulkRevokeUserPermissionsRequest {
+    bulkRevokeRequest: BulkRevokeRequest;
+}
+
 export interface CreateUserPermissionRequest {
     createPermissionRequest: CreatePermissionRequest;
 }
@@ -78,6 +98,54 @@ export interface UpdateUserPermissionRequest {
  * @interface UserPermissionsApiInterface
  */
 export interface UserPermissionsApiInterface {
+    /**
+     * Creates request options for bulkGrantUserPermissions without sending the request
+     * @param {BulkGrantRequest} bulkGrantRequest 
+     * @throws {RequiredError}
+     * @memberof UserPermissionsApiInterface
+     */
+    bulkGrantUserPermissionsRequestOpts(requestParameters: BulkGrantUserPermissionsRequest): Promise<runtime.RequestOpts>;
+
+    /**
+     * Grant many (user, object, capability) permissions (admin/owner only).  Each grant is applied in its own transaction, reporting a per-item outcome keyed on the (user_id, object_id) pair: a missing/trashed object or a user not in the tenant is ``not_found``, hitting the per-user cap is ``permission_limit``, and an already-covered grant is ``subsumed``.
+     * @summary Bulk Grant User Permissions Handler
+     * @param {BulkGrantRequest} bulkGrantRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof UserPermissionsApiInterface
+     */
+    bulkGrantUserPermissionsRaw(requestParameters: BulkGrantUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BulkGrantResponse>>;
+
+    /**
+     * Grant many (user, object, capability) permissions (admin/owner only).  Each grant is applied in its own transaction, reporting a per-item outcome keyed on the (user_id, object_id) pair: a missing/trashed object or a user not in the tenant is ``not_found``, hitting the per-user cap is ``permission_limit``, and an already-covered grant is ``subsumed``.
+     * Bulk Grant User Permissions Handler
+     */
+    bulkGrantUserPermissions(requestParameters: BulkGrantUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BulkGrantResponse>;
+
+    /**
+     * Creates request options for bulkRevokeUserPermissions without sending the request
+     * @param {BulkRevokeRequest} bulkRevokeRequest 
+     * @throws {RequiredError}
+     * @memberof UserPermissionsApiInterface
+     */
+    bulkRevokeUserPermissionsRequestOpts(requestParameters: BulkRevokeUserPermissionsRequest): Promise<runtime.RequestOpts>;
+
+    /**
+     * Revoke many permissions by their ids (admin/owner only), per item.  A permission id not found in the tenant lands in ``failed`` as ``not_found``.
+     * @summary Bulk Revoke User Permissions Handler
+     * @param {BulkRevokeRequest} bulkRevokeRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof UserPermissionsApiInterface
+     */
+    bulkRevokeUserPermissionsRaw(requestParameters: BulkRevokeUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BulkOperationResponse>>;
+
+    /**
+     * Revoke many permissions by their ids (admin/owner only), per item.  A permission id not found in the tenant lands in ``failed`` as ``not_found``.
+     * Bulk Revoke User Permissions Handler
+     */
+    bulkRevokeUserPermissions(requestParameters: BulkRevokeUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BulkOperationResponse>;
+
     /**
      * Creates request options for createUserPermission without sending the request
      * @param {CreatePermissionRequest} createPermissionRequest 
@@ -199,6 +267,120 @@ export interface UserPermissionsApiInterface {
  */
 export class UserPermissionsApi extends runtime.BaseAPI implements UserPermissionsApiInterface {
 
+    /**
+     * Creates request options for bulkGrantUserPermissions without sending the request
+     */
+    async bulkGrantUserPermissionsRequestOpts(requestParameters: BulkGrantUserPermissionsRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['bulkGrantRequest'] == null) {
+            throw new runtime.RequiredError(
+                'bulkGrantRequest',
+                'Required parameter "bulkGrantRequest" was null or undefined when calling bulkGrantUserPermissions().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearerAuth", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/v1/user-permissions/bulk`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: BulkGrantRequestToJSON(requestParameters['bulkGrantRequest']),
+        };
+    }
+
+    /**
+     * Grant many (user, object, capability) permissions (admin/owner only).  Each grant is applied in its own transaction, reporting a per-item outcome keyed on the (user_id, object_id) pair: a missing/trashed object or a user not in the tenant is ``not_found``, hitting the per-user cap is ``permission_limit``, and an already-covered grant is ``subsumed``.
+     * Bulk Grant User Permissions Handler
+     */
+    async bulkGrantUserPermissionsRaw(requestParameters: BulkGrantUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BulkGrantResponse>> {
+        const requestOptions = await this.bulkGrantUserPermissionsRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => BulkGrantResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Grant many (user, object, capability) permissions (admin/owner only).  Each grant is applied in its own transaction, reporting a per-item outcome keyed on the (user_id, object_id) pair: a missing/trashed object or a user not in the tenant is ``not_found``, hitting the per-user cap is ``permission_limit``, and an already-covered grant is ``subsumed``.
+     * Bulk Grant User Permissions Handler
+     */
+    async bulkGrantUserPermissions(requestParameters: BulkGrantUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BulkGrantResponse> {
+        const response = await this.bulkGrantUserPermissionsRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Creates request options for bulkRevokeUserPermissions without sending the request
+     */
+    async bulkRevokeUserPermissionsRequestOpts(requestParameters: BulkRevokeUserPermissionsRequest): Promise<runtime.RequestOpts> {
+        if (requestParameters['bulkRevokeRequest'] == null) {
+            throw new runtime.RequiredError(
+                'bulkRevokeRequest',
+                'Required parameter "bulkRevokeRequest" was null or undefined when calling bulkRevokeUserPermissions().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearerAuth", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+
+        let urlPath = `/v1/user-permissions/bulk-delete`;
+
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: BulkRevokeRequestToJSON(requestParameters['bulkRevokeRequest']),
+        };
+    }
+
+    /**
+     * Revoke many permissions by their ids (admin/owner only), per item.  A permission id not found in the tenant lands in ``failed`` as ``not_found``.
+     * Bulk Revoke User Permissions Handler
+     */
+    async bulkRevokeUserPermissionsRaw(requestParameters: BulkRevokeUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BulkOperationResponse>> {
+        const requestOptions = await this.bulkRevokeUserPermissionsRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => BulkOperationResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Revoke many permissions by their ids (admin/owner only), per item.  A permission id not found in the tenant lands in ``failed`` as ``not_found``.
+     * Bulk Revoke User Permissions Handler
+     */
+    async bulkRevokeUserPermissions(requestParameters: BulkRevokeUserPermissionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BulkOperationResponse> {
+        const response = await this.bulkRevokeUserPermissionsRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+
     /**
      * Creates request options for createUserPermission without sending the request
      */

package/src/apis/index.ts

@@ -7,7 +7,9 @@ export * from './ApiConnectionsApi';
 export * from './ApiKeysApi';
 export * from './AuditEventsApi';
 export * from './AuthApi';
+export * from './BulkDeleteApi';
 export * from './BulkDownloadApi';
+export * from './BulkMoveApi';
 export * from './ChunkLineagesApi';
 export * from './ChunksApi';
 export * from './DataSourcesApi';

package/src/models/BulkDeleteRequest.ts

@@ -0,0 +1,90 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Knowledge Stack API
+ * Knowledge Stack backend API for authentication and knowledge management.  ## Integrating (RPA / machine clients)  **Base URL.** Knowledge Stack is self-hosted — point at your own deployment host (see `servers`). The `localhost` entry is for local development only.  **Authentication.** Send `Authorization: Bearer <api-key>` on every request. Mint an API key once via `POST /v1/api-keys` from a signed-in browser session; the raw `sk-user-...` secret is returned **only** at creation, so store it then. A key inherits its owning user\'s live tenant role and path permissions — create RPA keys from a least-privilege user, and set `expires_at` for rotation. The `ks_uat` cookie scheme is browser-only and cannot be used by headless clients.  **Async work is polled, not pushed.** There are no outbound webhooks. - `POST /v1/documents/ingest` returns `201` immediately with a `workflow_id`;   poll `GET /v1/system-jobs/document_versions/{workflow_id}` until `status` is   terminal (anything other than `pending`/`processing`). The `Location` response   header points at this poll resource. - `POST /v1/workflow-runs/{run_id}/start` returns `202`; poll   `GET /v1/workflow-runs/{run_id}` until `execution_state` is `COMPLETED` or   `FAILED`. The `Location` header points at the run resource. - `POST /v1/agent/ask` is **synchronous** — it blocks until the agent finishes   and returns the answer inline. Use a generous HTTP timeout.  **Pagination.** List endpoints accept `limit`/`offset` and return `{items, total, limit, offset}`.  **Errors.** Every non-2xx body is `{detail, code, request_id}`. `code` is a stable value from a closed set (see the `ErrorResponse` schema\'s `code` enum) — branch on it rather than parsing `detail`. Quota rejections return `429` with a `Retry-After` header; transient lock contention returns a retryable `503`. Quote `request_id` (also the `x-request-id` response header) to support.  **Idempotency.** `POST /v1/workflow-runs` accepts an `idempotency_key` to dedupe retried run creation. `agent/ask` charges one message *before* running and does not refund a client-cancelled call. 
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Soft-delete the selected folders and documents to Trash.
+ * @export
+ * @interface BulkDeleteRequest
+ */
+export interface BulkDeleteRequest {
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof BulkDeleteRequest
+     */
+    folderIds?: Array<string>;
+    /**
+     * 
+     * @type {Array<string>}
+     * @memberof BulkDeleteRequest
+     */
+    documentIds?: Array<string>;
+}
+export const BulkDeleteRequestPropertyValidationAttributesMap: {
+    [property: string]: {
+        maxLength?: number,
+        minLength?: number,
+        pattern?: string,
+        maximum?: number,
+        exclusiveMaximum?: boolean,
+        minimum?: number,
+        exclusiveMinimum?: boolean,
+        multipleOf?: number,
+        maxItems?: number,
+        minItems?: number,
+        uniqueItems?: boolean
+    }
+} = {
+}
+
+
+/**
+ * Check if a given object implements the BulkDeleteRequest interface.
+ */
+export function instanceOfBulkDeleteRequest(value: object): value is BulkDeleteRequest {
+    return true;
+}
+
+export function BulkDeleteRequestFromJSON(json: any): BulkDeleteRequest {
+    return BulkDeleteRequestFromJSONTyped(json, false);
+}
+
+export function BulkDeleteRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): BulkDeleteRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'folderIds': json['folder_ids'] == null ? undefined : json['folder_ids'],
+        'documentIds': json['document_ids'] == null ? undefined : json['document_ids'],
+    };
+}
+
+export function BulkDeleteRequestToJSON(json: any): BulkDeleteRequest {
+    return BulkDeleteRequestToJSONTyped(json, false);
+}
+
+export function BulkDeleteRequestToJSONTyped(value?: BulkDeleteRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'folder_ids': value['folderIds'],
+        'document_ids': value['documentIds'],
+    };
+}
+

package/src/models/BulkFailureReason.ts

@@ -0,0 +1,65 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Knowledge Stack API
+ * Knowledge Stack backend API for authentication and knowledge management.  ## Integrating (RPA / machine clients)  **Base URL.** Knowledge Stack is self-hosted — point at your own deployment host (see `servers`). The `localhost` entry is for local development only.  **Authentication.** Send `Authorization: Bearer <api-key>` on every request. Mint an API key once via `POST /v1/api-keys` from a signed-in browser session; the raw `sk-user-...` secret is returned **only** at creation, so store it then. A key inherits its owning user\'s live tenant role and path permissions — create RPA keys from a least-privilege user, and set `expires_at` for rotation. The `ks_uat` cookie scheme is browser-only and cannot be used by headless clients.  **Async work is polled, not pushed.** There are no outbound webhooks. - `POST /v1/documents/ingest` returns `201` immediately with a `workflow_id`;   poll `GET /v1/system-jobs/document_versions/{workflow_id}` until `status` is   terminal (anything other than `pending`/`processing`). The `Location` response   header points at this poll resource. - `POST /v1/workflow-runs/{run_id}/start` returns `202`; poll   `GET /v1/workflow-runs/{run_id}` until `execution_state` is `COMPLETED` or   `FAILED`. The `Location` header points at the run resource. - `POST /v1/agent/ask` is **synchronous** — it blocks until the agent finishes   and returns the answer inline. Use a generous HTTP timeout.  **Pagination.** List endpoints accept `limit`/`offset` and return `{items, total, limit, offset}`.  **Errors.** Every non-2xx body is `{detail, code, request_id}`. `code` is a stable value from a closed set (see the `ErrorResponse` schema\'s `code` enum) — branch on it rather than parsing `detail`. Quota rejections return `429` with a `Retry-After` header; transient lock contention returns a retryable `503`. Quote `request_id` (also the `x-request-id` response header) to support.  **Idempotency.** `POST /v1/workflow-runs` accepts an `idempotency_key` to dedupe retried run creation. `agent/ask` charges one message *before* running and does not refund a client-cancelled call. 
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+/**
+ * Why a single item in a bulk operation was not applied.
+ * 
+ * Every value is produced by a specific, pre-checked gate — an *unexpected*
+ * per-item error is deliberately not caught (it surfaces as a 500) rather than
+ * hidden behind a vague catch-all.
+ * @export
+ */
+export const BulkFailureReason = {
+    NotFound: 'not_found',
+    Forbidden: 'forbidden',
+    SystemManaged: 'system_managed',
+    Subsumed: 'subsumed',
+    Cycle: 'cycle',
+    Sealed: 'sealed',
+    CheckedOut: 'checked_out',
+    NameConflict: 'name_conflict',
+    InProgressWorkflow: 'in_progress_workflow',
+    PermissionLimit: 'permission_limit'
+} as const;
+export type BulkFailureReason = typeof BulkFailureReason[keyof typeof BulkFailureReason];
+
+
+export function instanceOfBulkFailureReason(value: any): boolean {
+    for (const key in BulkFailureReason) {
+        if (Object.prototype.hasOwnProperty.call(BulkFailureReason, key)) {
+            if (BulkFailureReason[key as keyof typeof BulkFailureReason] === value) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+export function BulkFailureReasonFromJSON(json: any): BulkFailureReason {
+    return BulkFailureReasonFromJSONTyped(json, false);
+}
+
+export function BulkFailureReasonFromJSONTyped(json: any, ignoreDiscriminator: boolean): BulkFailureReason {
+    return json as BulkFailureReason;
+}
+
+export function BulkFailureReasonToJSON(value?: BulkFailureReason | null): any {
+    return value as any;
+}
+
+export function BulkFailureReasonToJSONTyped(value: any, ignoreDiscriminator: boolean): BulkFailureReason {
+    return value as BulkFailureReason;
+}
+

package/src/models/BulkGrantItem.ts

@@ -0,0 +1,119 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Knowledge Stack API
+ * Knowledge Stack backend API for authentication and knowledge management.  ## Integrating (RPA / machine clients)  **Base URL.** Knowledge Stack is self-hosted — point at your own deployment host (see `servers`). The `localhost` entry is for local development only.  **Authentication.** Send `Authorization: Bearer <api-key>` on every request. Mint an API key once via `POST /v1/api-keys` from a signed-in browser session; the raw `sk-user-...` secret is returned **only** at creation, so store it then. A key inherits its owning user\'s live tenant role and path permissions — create RPA keys from a least-privilege user, and set `expires_at` for rotation. The `ks_uat` cookie scheme is browser-only and cannot be used by headless clients.  **Async work is polled, not pushed.** There are no outbound webhooks. - `POST /v1/documents/ingest` returns `201` immediately with a `workflow_id`;   poll `GET /v1/system-jobs/document_versions/{workflow_id}` until `status` is   terminal (anything other than `pending`/`processing`). The `Location` response   header points at this poll resource. - `POST /v1/workflow-runs/{run_id}/start` returns `202`; poll   `GET /v1/workflow-runs/{run_id}` until `execution_state` is `COMPLETED` or   `FAILED`. The `Location` header points at the run resource. - `POST /v1/agent/ask` is **synchronous** — it blocks until the agent finishes   and returns the answer inline. Use a generous HTTP timeout.  **Pagination.** List endpoints accept `limit`/`offset` and return `{items, total, limit, offset}`.  **Errors.** Every non-2xx body is `{detail, code, request_id}`. `code` is a stable value from a closed set (see the `ErrorResponse` schema\'s `code` enum) — branch on it rather than parsing `detail`. Quota rejections return `429` with a `Retry-After` header; transient lock contention returns a retryable `503`. Quote `request_id` (also the `x-request-id` response header) to support.  **Idempotency.** `POST /v1/workflow-runs` accepts an `idempotency_key` to dedupe retried run creation. `agent/ask` charges one message *before* running and does not refund a client-cancelled call. 
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { PermissionCapability } from './PermissionCapability';
+import {
+    PermissionCapabilityFromJSON,
+    PermissionCapabilityFromJSONTyped,
+    PermissionCapabilityToJSON,
+    PermissionCapabilityToJSONTyped,
+} from './PermissionCapability';
+
+/**
+ * One requested grant: a capability on an object (PDO id) for a user.
+ * @export
+ * @interface BulkGrantItem
+ */
+export interface BulkGrantItem {
+    /**
+     * 
+     * @type {string}
+     * @memberof BulkGrantItem
+     */
+    userId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof BulkGrantItem
+     */
+    objectId: string;
+    /**
+     * 
+     * @type {PermissionCapability}
+     * @memberof BulkGrantItem
+     */
+    capability: PermissionCapability;
+    /**
+     * 
+     * @type {boolean}
+     * @memberof BulkGrantItem
+     */
+    canApprove?: boolean;
+}
+
+
+export const BulkGrantItemPropertyValidationAttributesMap: {
+    [property: string]: {
+        maxLength?: number,
+        minLength?: number,
+        pattern?: string,
+        maximum?: number,
+        exclusiveMaximum?: boolean,
+        minimum?: number,
+        exclusiveMinimum?: boolean,
+        multipleOf?: number,
+        maxItems?: number,
+        minItems?: number,
+        uniqueItems?: boolean
+    }
+} = {
+}
+
+
+/**
+ * Check if a given object implements the BulkGrantItem interface.
+ */
+export function instanceOfBulkGrantItem(value: object): value is BulkGrantItem {
+    if (!('userId' in value) || value['userId'] === undefined) return false;
+    if (!('objectId' in value) || value['objectId'] === undefined) return false;
+    if (!('capability' in value) || value['capability'] === undefined) return false;
+    return true;
+}
+
+export function BulkGrantItemFromJSON(json: any): BulkGrantItem {
+    return BulkGrantItemFromJSONTyped(json, false);
+}
+
+export function BulkGrantItemFromJSONTyped(json: any, ignoreDiscriminator: boolean): BulkGrantItem {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'userId': json['user_id'],
+        'objectId': json['object_id'],
+        'capability': PermissionCapabilityFromJSON(json['capability']),
+        'canApprove': json['can_approve'] == null ? undefined : json['can_approve'],
+    };
+}
+
+export function BulkGrantItemToJSON(json: any): BulkGrantItem {
+    return BulkGrantItemToJSONTyped(json, false);
+}
+
+export function BulkGrantItemToJSONTyped(value?: BulkGrantItem | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'user_id': value['userId'],
+        'object_id': value['objectId'],
+        'capability': PermissionCapabilityToJSON(value['capability']),
+        'can_approve': value['canApprove'],
+    };
+}
+

package/src/models/BulkGrantItemFailure.ts

@@ -0,0 +1,111 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Knowledge Stack API
+ * Knowledge Stack backend API for authentication and knowledge management.  ## Integrating (RPA / machine clients)  **Base URL.** Knowledge Stack is self-hosted — point at your own deployment host (see `servers`). The `localhost` entry is for local development only.  **Authentication.** Send `Authorization: Bearer <api-key>` on every request. Mint an API key once via `POST /v1/api-keys` from a signed-in browser session; the raw `sk-user-...` secret is returned **only** at creation, so store it then. A key inherits its owning user\'s live tenant role and path permissions — create RPA keys from a least-privilege user, and set `expires_at` for rotation. The `ks_uat` cookie scheme is browser-only and cannot be used by headless clients.  **Async work is polled, not pushed.** There are no outbound webhooks. - `POST /v1/documents/ingest` returns `201` immediately with a `workflow_id`;   poll `GET /v1/system-jobs/document_versions/{workflow_id}` until `status` is   terminal (anything other than `pending`/`processing`). The `Location` response   header points at this poll resource. - `POST /v1/workflow-runs/{run_id}/start` returns `202`; poll   `GET /v1/workflow-runs/{run_id}` until `execution_state` is `COMPLETED` or   `FAILED`. The `Location` header points at the run resource. - `POST /v1/agent/ask` is **synchronous** — it blocks until the agent finishes   and returns the answer inline. Use a generous HTTP timeout.  **Pagination.** List endpoints accept `limit`/`offset` and return `{items, total, limit, offset}`.  **Errors.** Every non-2xx body is `{detail, code, request_id}`. `code` is a stable value from a closed set (see the `ErrorResponse` schema\'s `code` enum) — branch on it rather than parsing `detail`. Quota rejections return `429` with a `Retry-After` header; transient lock contention returns a retryable `503`. Quote `request_id` (also the `x-request-id` response header) to support.  **Idempotency.** `POST /v1/workflow-runs` accepts an `idempotency_key` to dedupe retried run creation. `agent/ask` charges one message *before* running and does not refund a client-cancelled call. 
+ *
+ * The version of the OpenAPI document: 0.1.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { BulkFailureReason } from './BulkFailureReason';
+import {
+    BulkFailureReasonFromJSON,
+    BulkFailureReasonFromJSONTyped,
+    BulkFailureReasonToJSON,
+    BulkFailureReasonToJSONTyped,
+} from './BulkFailureReason';
+
+/**
+ * A grant that could not be created, keyed on its (user, object) pair.
+ * @export
+ * @interface BulkGrantItemFailure
+ */
+export interface BulkGrantItemFailure {
+    /**
+     * 
+     * @type {string}
+     * @memberof BulkGrantItemFailure
+     */
+    userId: string;
+    /**
+     * 
+     * @type {string}
+     * @memberof BulkGrantItemFailure
+     */
+    objectId: string;
+    /**
+     * 
+     * @type {BulkFailureReason}
+     * @memberof BulkGrantItemFailure
+     */
+    reason: BulkFailureReason;
+}
+
+
+export const BulkGrantItemFailurePropertyValidationAttributesMap: {
+    [property: string]: {
+        maxLength?: number,
+        minLength?: number,
+        pattern?: string,
+        maximum?: number,
+        exclusiveMaximum?: boolean,
+        minimum?: number,
+        exclusiveMinimum?: boolean,
+        multipleOf?: number,
+        maxItems?: number,
+        minItems?: number,
+        uniqueItems?: boolean
+    }
+} = {
+}
+
+
+/**
+ * Check if a given object implements the BulkGrantItemFailure interface.
+ */
+export function instanceOfBulkGrantItemFailure(value: object): value is BulkGrantItemFailure {
+    if (!('userId' in value) || value['userId'] === undefined) return false;
+    if (!('objectId' in value) || value['objectId'] === undefined) return false;
+    if (!('reason' in value) || value['reason'] === undefined) return false;
+    return true;
+}
+
+export function BulkGrantItemFailureFromJSON(json: any): BulkGrantItemFailure {
+    return BulkGrantItemFailureFromJSONTyped(json, false);
+}
+
+export function BulkGrantItemFailureFromJSONTyped(json: any, ignoreDiscriminator: boolean): BulkGrantItemFailure {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'userId': json['user_id'],
+        'objectId': json['object_id'],
+        'reason': BulkFailureReasonFromJSON(json['reason']),
+    };
+}
+
+export function BulkGrantItemFailureToJSON(json: any): BulkGrantItemFailure {
+    return BulkGrantItemFailureToJSONTyped(json, false);
+}
+
+export function BulkGrantItemFailureToJSONTyped(value?: BulkGrantItemFailure | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'user_id': value['userId'],
+        'object_id': value['objectId'],
+        'reason': BulkFailureReasonToJSON(value['reason']),
+    };
+}
+