@burdenoff/microfe-billing 2026.511.1 → 2026.513.1

package/dist/generated/global-types.d.ts

@@ -85,6 +85,13 @@ export type ApiKey = {
     prefix: Scalars['String']['output'];
     scopes: Array<Scalars['String']['output']>;
 };
+/** Paginated list of API keys */
+export type ApiKeyConnection = {
+    __typename?: 'APIKeyConnection';
+    apiKeys: Array<ApiKey>;
+    hasMore: Scalars['Boolean']['output'];
+    totalCount: Scalars['Int']['output'];
+};
 export type ApiKeyInput = {
     apiKey: Scalars['String']['input'];
     apiSecret: Scalars['String']['input'];
@@ -242,7 +249,22 @@ export declare enum ActorType {
     /** Human user */
     User = "USER"
 }
-/** Specific adapter/provider type for each ChannelPlatform. ChannelPlatform = High-level category (EMAIL, SMS, PUSH, etc.) AdapterType = Specific provider implementation Currently supported adapters (must match Prisma schema): EMAIL: AWS_SES, AZURE_ACS SMS: AWS_SNS, TWILIO_SMS WHATSAPP: WHATSAPP_CLOUD, WHATSAPP_TWILIO SLACK: SLACK_BOT TEAMS: TEAMS_BOT DISCORD: DISCORD_BOT PUSH: FCM INAPP: INAPP_NATIVE WEBHOOK: WEBHOOK_HTTP */
+/**
+ * Specific adapter/provider type for each ChannelPlatform.
+ * ChannelPlatform = High-level category (EMAIL, SMS, PUSH, etc.)
+ * AdapterType = Specific provider implementation
+ *
+ * Currently supported adapters (must match Prisma schema):
+ *   EMAIL: AWS_SES, AZURE_ACS
+ *   SMS: AWS_SNS, TWILIO_SMS
+ *   WHATSAPP: WHATSAPP_CLOUD, WHATSAPP_TWILIO
+ *   SLACK: SLACK_BOT
+ *   TEAMS: TEAMS_BOT
+ *   DISCORD: DISCORD_BOT
+ *   PUSH: FCM
+ *   INAPP: INAPP_NATIVE
+ *   WEBHOOK: WEBHOOK_HTTP
+ */
 export declare enum AdapterType {
     /** Amazon Simple Email Service */
     AwsSes = "AWS_SES",
@@ -367,13 +389,19 @@ export type Addon = {
     createdAt?: Maybe<Scalars['DateTime']['output']>;
     /** The currency in which the addon is priced. Defaults to 'USD'. */
     currency?: Maybe<Scalars['String']['output']>;
-    /** Prices for all supported currencies with beautiful rounding. Example: { "USD": 2.00, "INR": 199, "EUR": 1.99, "GBP": 1.79 } */
+    /**
+     * Prices for all supported currencies with beautiful rounding.
+     * Example: { "USD": 2.00, "INR": 199, "EUR": 1.99, "GBP": 1.79 }
+     */
     currencyPrices?: Maybe<Scalars['JSON']['output']>;
     /** The duration for which the addon is valid (e.g., monthly, yearly). Defaults to 'monthly'. */
     duration?: Maybe<PlanDuration>;
     /** A list of features provided by this addon, such as extra quotas or special services. */
     features?: Maybe<Array<Maybe<SubscriptionFeatures>>>;
-    /** Geography-specific price overrides. The billing account's country/state/region plus currency decide whether one of these overrides applies. */
+    /**
+     * Geography-specific price overrides. The billing account's country/state/region plus
+     * currency decide whether one of these overrides applies.
+     */
     geoPricingOverrides: Array<GeoPricingOverride>;
     /** The unique identifier for the Addon, automatically generated as a UUID. */
     id?: Maybe<Scalars['ID']['output']>;
@@ -390,7 +418,10 @@ export type Addon = {
     /** The timestamp when the addon was last updated. */
     updatedAt?: Maybe<Scalars['DateTime']['output']>;
 };
-/** Tracks historical price changes for an Addon. A new record is created whenever an addon's price is updated. */
+/**
+ * Tracks historical price changes for an Addon.
+ * A new record is created whenever an addon's price is updated.
+ */
 export type AddonPriceHistory = {
     __typename?: 'AddonPriceHistory';
     /** The addon this price change belongs to */
@@ -436,7 +467,11 @@ export type AddonSubscription = {
     updatedAt?: Maybe<Scalars['DateTime']['output']>;
 };
 export type AddonsFilter = {
-    /** Include free addons (price = 0) in the response. Defaults to true. Set to false on user-facing browse pages since free addons are auto-assigned and cannot be purchased. */
+    /**
+     * Include free addons (price = 0) in the response.
+     * Defaults to true. Set to false on user-facing browse pages
+     * since free addons are auto-assigned and cannot be purchased.
+     */
     includeFree?: InputMaybe<Scalars['Boolean']['input']>;
     /** Filter addons by product ID. When set, only addons with this productID are returned. */
     productId?: InputMaybe<Scalars['String']['input']>;
@@ -655,7 +690,11 @@ export type AgentProfile = {
     createdAt: Scalars['DateTime']['output'];
     currentChats: Scalars['Int']['output'];
     currentTickets: Scalars['Int']['output'];
-    /** Anonymized display alias surfaced to end-users in support conversations. Stable per agent (deterministic-on-first-use) so the same agent always shows the same alias to a given user. Real userId / user are admin-only. */
+    /**
+     * Anonymized display alias surfaced to end-users in support conversations.
+     * Stable per agent (deterministic-on-first-use) so the same agent always shows
+     * the same alias to a given user. Real userId / user are admin-only.
+     */
     displayAlias?: Maybe<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
     isAvailable: Scalars['Boolean']['output'];
@@ -793,6 +832,12 @@ export type AppCollectionEdge = {
     cursor: Scalars['String']['output'];
     node: AppCollection;
 };
+export type AppConnection = {
+    __typename?: 'AppConnection';
+    apps: Array<App>;
+    hasMore: Scalars['Boolean']['output'];
+    totalCount: Scalars['Int']['output'];
+};
 export type AppCreateResponse = {
     __typename?: 'AppCreateResponse';
     app: App;
@@ -1016,6 +1061,12 @@ export type AppUserDelegation = {
     userId: Scalars['String']['output'];
     workspaceIds: Array<Scalars['String']['output']>;
 };
+export type AppUserDelegationConnection = {
+    __typename?: 'AppUserDelegationConnection';
+    delegations: Array<AppUserDelegation>;
+    hasMore: Scalars['Boolean']['output'];
+    totalCount: Scalars['Int']['output'];
+};
 export declare enum AppVisibility {
     Internal = "INTERNAL",
     Private = "PRIVATE",
@@ -1093,7 +1144,10 @@ export type Application = {
     /** Structured tag assignments via wspace-tags-svc. Resource type: APPLICATION. */
     tagAssignments: Array<ApplicationTagAssignment>;
     /**
-     * Legacy free-text tag list. Maintained for backwards compatibility while consumers migrate to `tagAssignments`. New writes should use the `addTagToApplication` / `removeTagFromApplication` mutations and consume `tagAssignments` (resolved via wspace-tags-svc).
+     * Legacy free-text tag list. Maintained for backwards compatibility while
+     * consumers migrate to `tagAssignments`. New writes should use the
+     * `addTagToApplication` / `removeTagFromApplication` mutations and consume
+     * `tagAssignments` (resolved via wspace-tags-svc).
      * @deprecated Use tagAssignments for structured tag data via wspace-tags-svc
      */
     tags: Array<Scalars['String']['output']>;
@@ -1154,7 +1208,10 @@ export type ApplicationScope = {
     metadata?: Maybe<Scalars['JSON']['output']>;
     scope: Scalars['String']['output'];
 };
-/** Tag assignment binding a UniversalTag to an Application. Mirrors the universal tag-assignment shape from wspace-tags-svc.UniversalTagAssignment. */
+/**
+ * Tag assignment binding a UniversalTag to an Application. Mirrors the universal
+ * tag-assignment shape from wspace-tags-svc.UniversalTagAssignment.
+ */
 export type ApplicationTagAssignment = {
     __typename?: 'ApplicationTagAssignment';
     assignedAt?: Maybe<Scalars['DateTime']['output']>;
@@ -1311,6 +1368,13 @@ export type AuthAuditLog = {
     resourceType?: Maybe<Scalars['String']['output']>;
     userAgent?: Maybe<Scalars['String']['output']>;
 };
+/** Paginated list of auth audit logs */
+export type AuthAuditLogConnection = {
+    __typename?: 'AuthAuditLogConnection';
+    auditLogs: Array<AuthAuditLog>;
+    hasMore: Scalars['Boolean']['output'];
+    totalCount: Scalars['Int']['output'];
+};
 export type AuthContext = {
     deviceId?: InputMaybe<Scalars['String']['input']>;
     ipAddress?: InputMaybe<Scalars['String']['input']>;
@@ -1352,7 +1416,10 @@ export type AuthMethodConfigInput = {
     samlEntityId?: InputMaybe<Scalars['String']['input']>;
     samlSsoUrl?: InputMaybe<Scalars['String']['input']>;
 };
-/** Authentication response with optional MFA challenge support When requiresMFA is true, user/tokens will be null until MFA verification */
+/**
+ * Authentication response with optional MFA challenge support
+ * When requiresMFA is true, user/tokens will be null until MFA verification
+ */
 export type AuthPayload = {
     __typename?: 'AuthPayload';
     accessToken?: Maybe<Scalars['String']['output']>;
@@ -1454,7 +1521,10 @@ export type BatchOperationResult = {
     failedIds?: Maybe<Array<Scalars['ID']['output']>>;
     success: Scalars['Boolean']['output'];
 };
-/** BillingAccount entity - resolvable via Federation Gateway. Other services (e.g., store-svc) can reference BillingAccount by id. */
+/**
+ * BillingAccount entity - resolvable via Federation Gateway.
+ * Other services (e.g., store-svc) can reference BillingAccount by id.
+ */
 export type BillingAccount = {
     __typename?: 'BillingAccount';
     /** The billing addresses associated with this billing account */
@@ -1585,7 +1655,10 @@ export type BillingOrder = {
     /** External order ID from the service (e.g., "store-order-12345") */
     id: Scalars['ID']['output'];
     items: Scalars['JSON']['output'];
-    /** Tax is calculated at payment time and stored in Transaction/Payment, not BillingOrder. Tax info can be found in metadata.paymentTaxAmount, metadata.paymentTaxRate, metadata.paymentTotal */
+    /**
+     * Tax is calculated at payment time and stored in Transaction/Payment, not BillingOrder.
+     * Tax info can be found in metadata.paymentTaxAmount, metadata.paymentTaxRate, metadata.paymentTotal
+     */
     metadata?: Maybe<Scalars['JSON']['output']>;
     orgId: Scalars['String']['output'];
     status: BillingOrderStatus;
@@ -1975,15 +2048,28 @@ export type ChangePasswordInput = {
 /** Channel represents a configured connection to a communication platform */
 export type Channel = {
     __typename?: 'Channel';
-    /** Specific adapter type (SENDGRID, AWS_SES, TWILIO, etc.) Used for priority-based fallback delivery. */
+    /**
+     * Specific adapter type (SENDGRID, AWS_SES, TWILIO, etc.)
+     * Used for priority-based fallback delivery.
+     */
     adapterType?: Maybe<AdapterType>;
-    /** Channel type discriminator — determines delivery behaviour. NOTIFICATION (EMAIL, SMS): outbound-only, adapter failover supported. COMMUNICATION (SLACK, TEAMS, DISCORD, WHATSAPP, WEBCHAT, INAPP, WEBHOOK): bi-directional. */
+    /**
+     * Channel type discriminator — determines delivery behaviour.
+     * NOTIFICATION (EMAIL, SMS): outbound-only, adapter failover supported.
+     * COMMUNICATION (SLACK, TEAMS, DISCORD, WHATSAPP, WEBCHAT, INAPP, WEBHOOK): bi-directional.
+     */
     channelType: ChannelType;
-    /** Typed channel configuration. Returns structured configuration with defaults applied. */
+    /**
+     * Typed channel configuration.
+     * Returns structured configuration with defaults applied.
+     */
     config: ChannelConfig;
     /** Channel connection (authenticated credentials) */
     connection?: Maybe<ChannelConnection>;
-    /** Real-time connection health (system-monitored: HEALTHY, DEGRADED, UNHEALTHY). Updated automatically based on API calls and health checks. */
+    /**
+     * Real-time connection health (system-monitored: HEALTHY, DEGRADED, UNHEALTHY).
+     * Updated automatically based on API calls and health checks.
+     */
     connectionHealth: ConnectionHealth;
     /** Number of consecutive API failures (resets to 0 on success) */
     consecutiveFailures: Scalars['Int']['output'];
@@ -2015,9 +2101,16 @@ export type Channel = {
     organizationId: Scalars['ID']['output'];
     /** Communication platform (Slack, Teams, Discord, etc.) */
     platform: ChannelPlatform;
-    /** Platform-specific configuration (webhook URLs, channel IDs, etc.) Raw JSON for backward compatibility. */
+    /**
+     * Platform-specific configuration (webhook URLs, channel IDs, etc.)
+     * Raw JSON for backward compatibility.
+     */
     platformConfig?: Maybe<Scalars['JSON']['output']>;
-    /** Priority for fallback ordering (lower = higher priority, tried first). Example: SendGrid(1) → AWS SES(2) → Azure ACS(3) All ACTIVE channels are included in the failover chain. */
+    /**
+     * Priority for fallback ordering (lower = higher priority, tried first).
+     * Example: SendGrid(1) → AWS SES(2) → Azure ACS(3)
+     * All ACTIVE channels are included in the failover chain.
+     */
     priority: Scalars['Int']['output'];
     /** Current channel status (admin-controlled: ACTIVE, INACTIVE, etc.) */
     status: ChannelStatus;
@@ -2043,7 +2136,10 @@ export declare enum ChannelAuthType {
     /** Webhook-only (no authentication) */
     Webhook = "WEBHOOK"
 }
-/** Channel configuration settings. Strongly-typed configuration instead of generic JSON. */
+/**
+ * Channel configuration settings.
+ * Strongly-typed configuration instead of generic JSON.
+ */
 export type ChannelConfig = {
     __typename?: 'ChannelConfig';
     /** Default workflow ID to execute for incoming messages (if any) */
@@ -2060,7 +2156,10 @@ export type ChannelConfig = {
     platformSettings?: Maybe<Scalars['JSON']['output']>;
     /** Rate limit: maximum messages per hour for this channel. */
     rateLimitPerHour?: Maybe<Scalars['Int']['output']>;
-    /** Rate limit: maximum messages per minute for this channel. Platform-specific limits apply (e.g., Slack: 60/min, WhatsApp: varies). */
+    /**
+     * Rate limit: maximum messages per minute for this channel.
+     * Platform-specific limits apply (e.g., Slack: 60/min, WhatsApp: varies).
+     */
     rateLimitPerMinute?: Maybe<Scalars['Int']['output']>;
     /** Webhook URL for receiving platform events */
     webhookUrl?: Maybe<Scalars['String']['output']>;
@@ -2086,7 +2185,10 @@ export type ChannelConfigInput = {
     /** Webhook URL */
     webhookUrl?: InputMaybe<Scalars['String']['input']>;
 };
-/** ChannelConnection represents an authenticated connection to a platform All credentials are encrypted with AES-256-GCM */
+/**
+ * ChannelConnection represents an authenticated connection to a platform
+ * All credentials are encrypted with AES-256-GCM
+ */
 export type ChannelConnection = {
     __typename?: 'ChannelConnection';
     /** Authentication type used */
@@ -2113,7 +2215,10 @@ export type ChannelConnection = {
     lastTestedAt?: Maybe<Scalars['DateTime']['output']>;
     /** Whether OAuth tokens need refresh (within 24h of expiry) */
     needsTokenRefresh: Scalars['Boolean']['output'];
-    /** Platform-specific metadata (channel IDs, team info, etc.) NOTE: Non-sensitive data only */
+    /**
+     * Platform-specific metadata (channel IDs, team info, etc.)
+     * NOTE: Non-sensitive data only
+     */
     platformMetadata?: Maybe<Scalars['JSON']['output']>;
     /** Tag assignments for this connection (stub — returns empty until wspace-tags-svc supports org-scoped assignments) */
     tagAssignments: Array<ChannelConnectionTagAssignment>;
@@ -2124,7 +2229,10 @@ export type ChannelConnection = {
     /** Last update timestamp */
     updatedAt: Scalars['DateTime']['output'];
 };
-/** Paginated list of channel connections with cursor support. Pass `nextCursor` from a previous response as `cursor` in the next call. */
+/**
+ * Paginated list of channel connections with cursor support.
+ * Pass `nextCursor` from a previous response as `cursor` in the next call.
+ */
 export type ChannelConnectionList = {
     __typename?: 'ChannelConnectionList';
     hasMore: Scalars['Boolean']['output'];
@@ -2208,7 +2316,14 @@ export type ChannelDeliveryInput = {
     connectionId?: InputMaybe<Scalars['ID']['input']>;
     /** Notification content */
     content: ChannelDeliveryContentInput;
-    /** Internal Botlit user ID. When provided, the service automatically resolves the user's DM conversation ID from their UserPlatformConnection record and uses it as the delivery recipient. Requires the user to have connected via OAuth (dmAllowed=true) with notificationsEnabled=true. Either `recipient` or `internalUserId` must be provided. */
+    /**
+     * Internal Botlit user ID. When provided, the service automatically resolves
+     * the user's DM conversation ID from their UserPlatformConnection record and
+     * uses it as the delivery recipient. Requires the user to have connected via
+     * OAuth (dmAllowed=true) with notificationsEnabled=true.
+     *
+     * Either `recipient` or `internalUserId` must be provided.
+     */
     internalUserId?: InputMaybe<Scalars['ID']['input']>;
     /** Optional reference to originating notification in notification-svc */
     notificationId?: InputMaybe<Scalars['ID']['input']>;
@@ -2218,7 +2333,18 @@ export type ChannelDeliveryInput = {
     organizationId: Scalars['ID']['input'];
     /** Target delivery platform (EMAIL, SMS, PUSH, SLACK, TEAMS, etc.) */
     platform: ChannelPlatform;
-    /** Recipient identifier based on platform: - EMAIL: email address - SMS: phone number (E.164 format) - PUSH: device token - SLACK/TEAMS/DISCORD: user ID or channel ID - WHATSAPP: phone number - WEBHOOK: webhook URL - INAPP: user ID Either `recipient` or `internalUserId` must be provided. */
+    /**
+     * Recipient identifier based on platform:
+     * - EMAIL: email address
+     * - SMS: phone number (E.164 format)
+     * - PUSH: device token
+     * - SLACK/TEAMS/DISCORD: user ID or channel ID
+     * - WHATSAPP: phone number
+     * - WEBHOOK: webhook URL
+     * - INAPP: user ID
+     *
+     * Either `recipient` or `internalUserId` must be provided.
+     */
     recipient?: InputMaybe<Scalars['String']['input']>;
 };
 /** Delivery options for channel delivery */
@@ -2289,7 +2415,10 @@ export declare enum ChannelExportFormat {
     /** JSON-Lines; one row per line (streaming-friendly). */
     Jsonl = "JSONL"
 }
-/** Export job descriptor returned by channel export mutations. Poll `channelExportJob(id:)` until status=COMPLETED, then GET downloadUrl. */
+/**
+ * Export job descriptor returned by channel export mutations.
+ * Poll `channelExportJob(id:)` until status=COMPLETED, then GET downloadUrl.
+ */
 export type ChannelExportJob = {
     __typename?: 'ChannelExportJob';
     byteSize?: Maybe<Scalars['Int']['output']>;
@@ -2378,11 +2507,54 @@ export type ChannelList = {
     hasMore: Scalars['Boolean']['output'];
     /** List of channels */
     items: Array<Channel>;
-    /** Opaque cursor for fetching the next page (base64 last-id with stable id-tiebreaker). Pass via `pagination.cursor` on the next call. Null when no more results. Non-breaking: offset pagination still works for existing clients. */
+    /**
+     * Opaque cursor for fetching the next page (base64 last-id with stable id-tiebreaker).
+     * Pass via `pagination.cursor` on the next call. Null when no more results.
+     * Non-breaking: offset pagination still works for existing clients.
+     */
     nextCursor?: Maybe<Scalars['String']['output']>;
     /** Total count (for pagination) */
     total: Scalars['Int']['output'];
 };
+/** Organization-level channel settings */
+export type ChannelOrgSettings = {
+    __typename?: 'ChannelOrgSettings';
+    /** Default priority for new channels (0=lowest … 4=highest) */
+    defaultPriority: Scalars['Int']['output'];
+    /** Persist an audit log entry for every channel operation */
+    enableAuditLogging: Scalars['Boolean']['output'];
+    /** Verify HMAC signatures on all incoming webhooks */
+    enableWebhookVerification: Scalars['Boolean']['output'];
+    /** How often to run scheduled connection health checks (minutes) */
+    healthCheckIntervalMinutes: Scalars['Int']['output'];
+    /** Organization ID these settings belong to */
+    organizationId: Scalars['ID']['output'];
+    /** Global rate limit: maximum messages per hour across all channels */
+    rateLimitPerHour: Scalars['Int']['output'];
+    /** Global rate limit: maximum messages per minute across all channels */
+    rateLimitPerMinute: Scalars['Int']['output'];
+    /** Idle session timeout for the channel UI (minutes) */
+    sessionTimeoutMinutes: Scalars['Int']['output'];
+    /** Last updated timestamp */
+    updatedAt: Scalars['DateTime']['output'];
+};
+/** Input for updating organization-level channel settings */
+export type ChannelOrgSettingsInput = {
+    /** Default priority for new channels (0–4) */
+    defaultPriority?: InputMaybe<Scalars['Int']['input']>;
+    /** Enable audit logging */
+    enableAuditLogging?: InputMaybe<Scalars['Boolean']['input']>;
+    /** Enable webhook signature verification */
+    enableWebhookVerification?: InputMaybe<Scalars['Boolean']['input']>;
+    /** Health check interval in minutes */
+    healthCheckIntervalMinutes?: InputMaybe<Scalars['Int']['input']>;
+    /** Rate limit per hour */
+    rateLimitPerHour?: InputMaybe<Scalars['Int']['input']>;
+    /** Rate limit per minute */
+    rateLimitPerMinute?: InputMaybe<Scalars['Int']['input']>;
+    /** Session timeout in minutes */
+    sessionTimeoutMinutes?: InputMaybe<Scalars['Int']['input']>;
+};
 export type ChannelPaginationInput = {
     cursor?: InputMaybe<Scalars['String']['input']>;
     limit?: InputMaybe<Scalars['Int']['input']>;
@@ -2483,11 +2655,32 @@ export type ChannelTagAssignment = {
     tag?: Maybe<UniversalTag>;
     tagId: Scalars['ID']['output'];
 };
-/** Channel type discriminator — determines delivery behaviour and webhook handling. NOTIFICATION channels (EMAIL, SMS) are outbound-only: - Support priority-based failover across adapters. - No inbound webhook processing. - No DM conversations. - Recipient resolved via externalEmail (email) or externalUserId (phone). COMMUNICATION channels (SLACK, TEAMS, DISCORD, WHATSAPP, WEBCHAT, INAPP, WEBHOOK) are bi-directional: - Inbound webhooks processed and forwarded to conversations-svc. - DM conversations tracked via dmConversationId. - Recipient resolved via dmConversationId set during OAuth / pairing. */
+/**
+ * Channel type discriminator — determines delivery behaviour and webhook handling.
+ *
+ * NOTIFICATION channels (EMAIL, SMS) are outbound-only:
+ *   - Support priority-based failover across adapters.
+ *   - No inbound webhook processing.
+ *   - No DM conversations.
+ *   - Recipient resolved via externalEmail (email) or externalUserId (phone).
+ *
+ * COMMUNICATION channels (SLACK, TEAMS, DISCORD, WHATSAPP, WEBCHAT, INAPP, WEBHOOK)
+ * are bi-directional:
+ *   - Inbound webhooks processed and forwarded to conversations-svc.
+ *   - DM conversations tracked via dmConversationId.
+ *   - Recipient resolved via dmConversationId set during OAuth / pairing.
+ */
 export declare enum ChannelType {
-    /** Bi-directional platform channels: SLACK, TEAMS, DISCORD, WHATSAPP, WEBCHAT, INAPP, WEBHOOK. Processes inbound webhooks and supports DM conversations. */
+    /**
+     * Bi-directional platform channels: SLACK, TEAMS, DISCORD,
+     * WHATSAPP, WEBCHAT, INAPP, WEBHOOK.
+     * Processes inbound webhooks and supports DM conversations.
+     */
     Communication = "COMMUNICATION",
-    /** Outbound-only delivery channels: EMAIL, SMS. Supports adapter-level failover (e.g. AWS SES → Azure ACS). */
+    /**
+     * Outbound-only delivery channels: EMAIL, SMS.
+     * Supports adapter-level failover (e.g. AWS SES → Azure ACS).
+     */
     Notification = "NOTIFICATION"
 }
 export type Charge = {
@@ -2607,7 +2800,16 @@ export type ConfigureWorkspaceInput = {
     endpoint?: InputMaybe<Scalars['String']['input']>;
     region?: InputMaybe<Scalars['String']['input']>;
 };
-/** Real-time health status of a channel's connection. Monitored by the system based on API calls and health checks. - `status` = Admin-controlled (ACTIVE, INACTIVE, ARCHIVED) - `connectionHealth` = System-monitored (HEALTHY, DEGRADED, UNHEALTHY) Example: Channel status = ACTIVE but connectionHealth = UNHEALTHY means admin enabled the channel but the API is down. */
+/**
+ * Real-time health status of a channel's connection.
+ * Monitored by the system based on API calls and health checks.
+ *
+ * - `status` = Admin-controlled (ACTIVE, INACTIVE, ARCHIVED)
+ * - `connectionHealth` = System-monitored (HEALTHY, DEGRADED, UNHEALTHY)
+ *
+ * Example: Channel status = ACTIVE but connectionHealth = UNHEALTHY
+ *          means admin enabled the channel but the API is down.
+ */
 export declare enum ConnectionHealth {
     /** Partial failures, high latency, or rate limiting */
     Degraded = "DEGRADED",
@@ -2769,7 +2971,10 @@ export declare enum ContentVisibility {
     Internal = "INTERNAL",
     Public = "PUBLIC"
 }
-/** Context filter input for querying records by context. Supports exact match filtering on context fields. */
+/**
+ * Context filter input for querying records by context.
+ * Supports exact match filtering on context fields.
+ */
 export type ContextFilterInput = {
     /** Filter by organization ID */
     organizationId?: InputMaybe<Scalars['ID']['input']>;
@@ -2780,7 +2985,10 @@ export type ContextFilterInput = {
     /** Filter by workspace ID */
     workspaceId?: InputMaybe<Scalars['ID']['input']>;
 };
-/** Operation context for filtering and scoping data. All fields are optional and can be extended as needed. */
+/**
+ * Operation context for filtering and scoping data.
+ * All fields are optional and can be extended as needed.
+ */
 export type ContextInput = {
     /** Additional custom context as JSON */
     custom?: InputMaybe<Scalars['JSON']['input']>;
@@ -3054,7 +3262,12 @@ export type CreateCategoryInput = {
 export type CreateChannelInput = {
     /** Specific adapter type (SENDGRID, AWS_SES, TWILIO, etc.) */
     adapterType?: InputMaybe<AdapterType>;
-    /** Channel type: NOTIFICATION (EMAIL/SMS) or COMMUNICATION (SLACK/TEAMS/etc). If omitted, defaults based on platform: EMAIL, SMS → NOTIFICATION All others → COMMUNICATION */
+    /**
+     * Channel type: NOTIFICATION (EMAIL/SMS) or COMMUNICATION (SLACK/TEAMS/etc).
+     * If omitted, defaults based on platform:
+     *   EMAIL, SMS → NOTIFICATION
+     *   All others → COMMUNICATION
+     */
     channelType?: InputMaybe<ChannelType>;
     /** Operation context for scoping */
     context?: InputMaybe<ContextInput>;
@@ -3068,7 +3281,11 @@ export type CreateChannelInput = {
     platform: ChannelPlatform;
     /** Platform-specific configuration (webhook URLs, etc.) */
     platformConfig?: InputMaybe<Scalars['JSON']['input']>;
-    /** Priority for fallback ordering (lower = higher priority). Default is 100. Use 1 for highest priority. All ACTIVE channels are included in the failover chain. */
+    /**
+     * Priority for fallback ordering (lower = higher priority).
+     * Default is 100. Use 1 for highest priority.
+     * All ACTIVE channels are included in the failover chain.
+     */
     priority?: InputMaybe<Scalars['Int']['input']>;
     /** Channel status (default: ACTIVE) */
     status?: InputMaybe<ChannelStatus>;
@@ -3367,6 +3584,8 @@ export type CreateOrganizationInput = {
     logo?: InputMaybe<Scalars['String']['input']>;
     metadata?: InputMaybe<Scalars['JSON']['input']>;
     name: Scalars['String']['input'];
+    /** reCAPTCHA token required when CAPTCHA_ENABLED=true. */
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
     settings?: InputMaybe<Scalars['JSON']['input']>;
     slug: Scalars['String']['input'];
     status?: InputMaybe<Scalars['String']['input']>;
@@ -3557,6 +3776,8 @@ export type CreatePublicSupportTicketInput = {
     customFields?: InputMaybe<Scalars['JSON']['input']>;
     description: Scalars['String']['input'];
     metadata?: InputMaybe<Scalars['JSON']['input']>;
+    /** reCAPTCHA token required when CAPTCHA_ENABLED=true. */
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
     source?: InputMaybe<TicketSource>;
     subject: Scalars['String']['input'];
 };
@@ -3772,7 +3993,10 @@ export type CreateStoreOrderInput = {
     lineItems: Array<StoreLineItemInput>;
     /** Additional metadata */
     metadata?: InputMaybe<Scalars['JSON']['input']>;
-    /** Total product cost (sum of all line items) Note: Currency, tax, and final billing amount calculated by billing service */
+    /**
+     * Total product cost (sum of all line items)
+     * Note: Currency, tax, and final billing amount calculated by billing service
+     */
     total: Scalars['Float']['input'];
 };
 export type CreateSubscriptionInput = {
@@ -3835,6 +4059,8 @@ export type CreateTenantInput = {
     customDomain?: InputMaybe<Scalars['String']['input']>;
     metadata?: InputMaybe<Scalars['JSON']['input']>;
     name: Scalars['String']['input'];
+    /** reCAPTCHA token required when CAPTCHA_ENABLED=true. */
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
     slug: Scalars['String']['input'];
     type?: InputMaybe<TenantType>;
 };
@@ -4058,7 +4284,10 @@ export type CreditRate = {
     rateUSD: Scalars['Float']['output'];
     updatedAt: Scalars['DateTime']['output'];
 };
-/** CreditTransaction entity - resolvable via Federation Gateway. Other services (e.g., store-svc) can reference CreditTransaction by id. */
+/**
+ * CreditTransaction entity - resolvable via Federation Gateway.
+ * Other services (e.g., store-svc) can reference CreditTransaction by id.
+ */
 export type CreditTransaction = {
     __typename?: 'CreditTransaction';
     amount: Scalars['Float']['output'];
@@ -4265,7 +4494,10 @@ export type DeleteUserResult = {
     message: Scalars['String']['output'];
     success: Scalars['Boolean']['output'];
 };
-/** Paginated list of delivery attempts with cursor support. Pass `nextCursor` from a previous response as `cursor` in the next call. */
+/**
+ * Paginated list of delivery attempts with cursor support.
+ * Pass `nextCursor` from a previous response as `cursor` in the next call.
+ */
 export type DeliveryAttemptList = {
     __typename?: 'DeliveryAttemptList';
     hasMore: Scalars['Boolean']['output'];
@@ -4784,13 +5016,22 @@ export declare enum DevportalExportFormat {
     /** JSON-Lines; one row per line (good for streaming consumers). */
     Jsonl = "JSONL"
 }
-/** Export job descriptor returned from any of the entity-specific export mutations. For small exports the job typically transitions to COMPLETED synchronously (within the request); larger exports may return CREATED and require the caller to poll `devportalExportJob(id:)`. */
+/**
+ * Export job descriptor returned from any of the entity-specific export
+ * mutations. For small exports the job typically transitions to COMPLETED
+ * synchronously (within the request); larger exports may return CREATED and
+ * require the caller to poll `devportalExportJob(id:)`.
+ */
 export type DevportalExportJob = {
     __typename?: 'DevportalExportJob';
     byteSize?: Maybe<Scalars['Int']['output']>;
     completedAt?: Maybe<Scalars['DateTime']['output']>;
     createdAt: Scalars['DateTime']['output'];
-    /** Stable URL the caller can GET to retrieve the full payload. Today this is a presigned-style URL hosted by devportal-svc itself; once the platform S3 wiring lands it will be a true presigned S3 URL with TTL. */
+    /**
+     * Stable URL the caller can GET to retrieve the full payload. Today this is
+     * a presigned-style URL hosted by devportal-svc itself; once the platform
+     * S3 wiring lands it will be a true presigned S3 URL with TTL.
+     */
     downloadUrl?: Maybe<Scalars['String']['output']>;
     /** ISO timestamp when downloadUrl expires (24h default). */
     downloadUrlExpiresAt?: Maybe<Scalars['DateTime']['output']>;
@@ -4920,9 +5161,16 @@ export type EffectivePermissions = {
     actorId: Scalars['String']['output'];
     /** Cache key for debugging and invalidation */
     cacheKey?: Maybe<Scalars['String']['output']>;
-    /** When this permission set should be considered stale. Frontend should refresh after this time. */
+    /**
+     * When this permission set should be considered stale.
+     * Frontend should refresh after this time.
+     */
     expiresAt: Scalars['DateTime']['output'];
-    /** Flat permission strings for easy frontend matching. Format: "{resourceType}:{action}" e.g., ["project:read", "project:write", "task:*"] Includes wildcards for ADMIN level (e.g., "project:*") */
+    /**
+     * Flat permission strings for easy frontend matching.
+     * Format: "{resourceType}:{action}" e.g., ["project:read", "project:write", "task:*"]
+     * Includes wildcards for ADMIN level (e.g., "project:*")
+     */
     permissionStrings: Array<Scalars['String']['output']>;
     /** Resource types and their effective levels */
     permissions: Array<EffectiveResourcePermission>;
@@ -5227,7 +5475,10 @@ export type FailedBillingOrderCallbacksResponse = {
     orders: Array<BillingOrder>;
     totalCount: Scalars['Int']['output'];
 };
-/** Platform-wide feature flag definition. Managed by super admins. Can be scoped to a product and category. */
+/**
+ * Platform-wide feature flag definition.
+ * Managed by super admins. Can be scoped to a product and category.
+ */
 export type FeatureFlag = {
     __typename?: 'FeatureFlag';
     category?: Maybe<Scalars['String']['output']>;
@@ -5255,7 +5506,10 @@ export type FeatureFlagBulkEvaluation = {
     __typename?: 'FeatureFlagBulkEvaluation';
     evaluations: Array<FeatureFlagEvaluation>;
 };
-/** Result of evaluating a single feature flag for a specific context. Compatible with OpenFeature ResolutionDetails. */
+/**
+ * Result of evaluating a single feature flag for a specific context.
+ * Compatible with OpenFeature ResolutionDetails.
+ */
 export type FeatureFlagEvaluation = {
     __typename?: 'FeatureFlagEvaluation';
     errorCode?: Maybe<Scalars['String']['output']>;
@@ -5358,6 +5612,7 @@ export type GenerateApiKeyInput = {
     appId: Scalars['String']['input'];
     expiresAt?: InputMaybe<Scalars['String']['input']>;
     name: Scalars['String']['input'];
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
     scope: Array<Scalars['String']['input']>;
 };
 export type GenerateAppAsUserTokenInput = {
@@ -5400,7 +5655,10 @@ export type GetStoreProductTagsInput = {
 };
 export type GrantAppWorkspaceAccessInput = {
     appId: Scalars['ID']['input'];
-    /** Optional subset of the app's global scopes. Empty array means the authorization inherits the app's full scope list. */
+    /**
+     * Optional subset of the app's global scopes. Empty array means the
+     * authorization inherits the app's full scope list.
+     */
     scopes?: InputMaybe<Array<Scalars['String']['input']>>;
     tenantId: Scalars['ID']['input'];
     workspaceId: Scalars['ID']['input'];
@@ -5431,13 +5689,31 @@ export type GrantDelegationInput = {
     userId?: InputMaybe<Scalars['String']['input']>;
     workspaceIds?: InputMaybe<Array<Scalars['String']['input']>>;
 };
-/** GraphQL callback configuration for external service notifications Supports two authentication methods (controlled by CALLBACK_AUTH_METHOD env var): 1. token (default): Direct HTTP with authToken 2. internal-gateway: Service credentials via internal gateway */
+/**
+ * GraphQL callback configuration for external service notifications
+ * Supports two authentication methods (controlled by CALLBACK_AUTH_METHOD env var):
+ * 1. token (default): Direct HTTP with authToken
+ * 2. internal-gateway: Service credentials via internal gateway
+ */
 export type GraphQlCallbackInput = {
-    /** Authentication token for callback (optional) Required only when CALLBACK_AUTH_METHOD=token (default) Not needed when CALLBACK_AUTH_METHOD=internal-gateway Example: Bearer store-service-webhook-secret-xyz */
+    /**
+     * Authentication token for callback (optional)
+     * Required only when CALLBACK_AUTH_METHOD=token (default)
+     * Not needed when CALLBACK_AUTH_METHOD=internal-gateway
+     * Example: Bearer store-service-webhook-secret-xyz
+     */
     authToken?: InputMaybe<Scalars['String']['input']>;
-    /** GraphQL endpoint URL of the external service Must be HTTPS and match BILLING_CALLBACK_ALLOWED_ENDPOINTS/HOSTS/SUFFIXES. Localhost is allowed only outside production for local development. Example: https://graphqlworkspaces.burdenoff.com/workspaces/graphql */
+    /**
+     * GraphQL endpoint URL of the external service
+     * Must be HTTPS and match BILLING_CALLBACK_ALLOWED_ENDPOINTS/HOSTS/SUFFIXES.
+     * Localhost is allowed only outside production for local development.
+     * Example: https://graphqlworkspaces.burdenoff.com/workspaces/graphql
+     */
     endpoint: Scalars['String']['input'];
-    /** Name of the GraphQL mutation to call on payment completion Example: updateOrderPaymentStatus */
+    /**
+     * Name of the GraphQL mutation to call on payment completion
+     * Example: updateOrderPaymentStatus
+     */
     mutationName: Scalars['String']['input'];
 };
 export type Group = {
@@ -5687,7 +5963,10 @@ export type InitiatePaymentInput = {
     amount: Scalars['Float']['input'];
     /** For PLAN purchase: enable automatic renewal when subscription expires */
     autoRenew?: InputMaybe<Scalars['Boolean']['input']>;
-    /** For PLAN purchase with autoRenew: payment method ID to use for auto-renewal Must be a verified saved payment method. Required if autoRenew is true. */
+    /**
+     * For PLAN purchase with autoRenew: payment method ID to use for auto-renewal
+     * Must be a verified saved payment method. Required if autoRenew is true.
+     */
     autoRenewPaymentMethodId?: InputMaybe<Scalars['ID']['input']>;
     /** Billing account ID (required for tax calculation) */
     billingAccountId: Scalars['ID']['input'];
@@ -5695,7 +5974,11 @@ export type InitiatePaymentInput = {
     creditAmount?: InputMaybe<Scalars['Int']['input']>;
     /** Currency code (e.g., INR, USD) */
     currency: Scalars['String']['input'];
-    /** For PLAN downgrade: the active higher-tier subscription ID being replaced. Old subscription is left active until natural expiry — no cancellation, no refund. User retains old plan quotas during overlap; continues on new plan after expiry. */
+    /**
+     * For PLAN downgrade: the active higher-tier subscription ID being replaced.
+     * Old subscription is left active until natural expiry — no cancellation, no refund.
+     * User retains old plan quotas during overlap; continues on new plan after expiry.
+     */
     downgradeFromSubscriptionId?: InputMaybe<Scalars['ID']['input']>;
     /** For PLAN purchase: whether this is an annual subscription (12 months with discount) */
     isAnnual?: InputMaybe<Scalars['Boolean']['input']>;
@@ -5721,9 +6004,16 @@ export type InitiatePaymentInput = {
     quantity?: InputMaybe<Scalars['Int']['input']>;
     /** Whether to save the card for future purchases (only for new card payments) */
     saveCard?: InputMaybe<Scalars['Boolean']['input']>;
-    /** For ADDON purchase: subscription ID to attach addon to. Required if billing account has multiple active subscriptions. If only one active subscription exists, it will be auto-selected. */
+    /**
+     * For ADDON purchase: subscription ID to attach addon to.
+     * Required if billing account has multiple active subscriptions.
+     * If only one active subscription exists, it will be auto-selected.
+     */
     subscriptionId?: InputMaybe<Scalars['ID']['input']>;
-    /** For PLAN upgrade: the subscription ID being upgraded from. If provided, this is an upgrade - old quotas will be moved to new subscription. */
+    /**
+     * For PLAN upgrade: the subscription ID being upgraded from.
+     * If provided, this is an upgrade - old quotas will be moved to new subscription.
+     */
     upgradeFromSubscriptionId?: InputMaybe<Scalars['ID']['input']>;
 };
 /** Response from initiatePayment mutation */
@@ -6102,7 +6392,10 @@ export type KerberosConfigInput = {
     realm: Scalars['String']['input'];
     servicePrincipal: Scalars['String']['input'];
 };
-/** KeyboardShortcut entity - defines a keyboard shortcut action. Shortcuts can be global (all products) or product-specific. */
+/**
+ * KeyboardShortcut entity - defines a keyboard shortcut action.
+ * Shortcuts can be global (all products) or product-specific.
+ */
 export type KeyboardShortcut = {
     __typename?: 'KeyboardShortcut';
     /** Category for grouping (e.g., "Navigation", "Actions", "UI", "Help") */
@@ -6403,6 +6696,13 @@ export type MfaMethodStatus = {
     status: Scalars['String']['output'];
     updatedAt: Scalars['DateTime']['output'];
 };
+/** Paginated list of MFA method statuses */
+export type MfaMethodStatusConnection = {
+    __typename?: 'MFAMethodStatusConnection';
+    hasMore: Scalars['Boolean']['output'];
+    methods: Array<MfaMethodStatus>;
+    totalCount: Scalars['Int']['output'];
+};
 export type MfaSetupResult = {
     __typename?: 'MFASetupResult';
     backupCodes?: Maybe<Array<Scalars['String']['output']>>;
@@ -6445,7 +6745,10 @@ export type MessageAttachmentInput = {
     /** Attachment URL */
     url: Scalars['String']['input'];
 };
-/** MessageDeliveryAttempt represents a single delivery attempt (transient, 7-day TTL) Used for debugging and monitoring only */
+/**
+ * MessageDeliveryAttempt represents a single delivery attempt (transient, 7-day TTL)
+ * Used for debugging and monitoring only
+ */
 export type MessageDeliveryAttempt = {
     __typename?: 'MessageDeliveryAttempt';
     /** Associated channel */
@@ -6519,7 +6822,10 @@ export type MonthlyEarning = {
     orders: Scalars['Int']['output'];
     year: Scalars['Int']['output'];
 };
-/** Input for delivering a notification across multiple platforms and recipients simultaneously. The service fans out per-platform in parallel with independent failover per platform. */
+/**
+ * Input for delivering a notification across multiple platforms and recipients simultaneously.
+ * The service fans out per-platform in parallel with independent failover per platform.
+ */
 export type MultiPlatformDeliveryInput = {
     /** Notification content (same content sent to all platforms/recipients) */
     content: ChannelDeliveryContentInput;
@@ -6548,7 +6854,10 @@ export type MultiPlatformDeliveryResult = {
     /** Total number of recipients across all platforms */
     totalRecipients: Scalars['Int']['output'];
 };
-/** Per-recipient addresses for multi-platform delivery. Populate the field that matches each target platform. */
+/**
+ * Per-recipient addresses for multi-platform delivery.
+ * Populate the field that matches each target platform.
+ */
 export type MultiPlatformRecipientInput = {
     /** Email address (for EMAIL platform) */
     email?: InputMaybe<Scalars['String']['input']>;
@@ -6570,9 +6879,15 @@ export type MultiPlatformRecipientInput = {
 /** Root mutation type */
 export type Mutation = {
     __typename?: 'Mutation';
-    /** Placeholder field to allow empty Mutation type extension. Must be @shareable since it exists in multiple subgraphs. */
+    /**
+     * Placeholder field to allow empty Mutation type extension.
+     * Must be @shareable since it exists in multiple subgraphs.
+     */
     _empty?: Maybe<Scalars['String']['output']>;
-    /** Placeholder mutation (extended by modules) @rbac(public: true, scopeType: "global") */
+    /**
+     * Placeholder mutation (extended by modules)
+     *   @rbac(public: true, scopeType: "global")
+     */
     _placeholder?: Maybe<Scalars['String']['output']>;
     _privacyEcho?: Maybe<Scalars['String']['output']>;
     /** Accept an organization invitation */
@@ -6608,7 +6923,11 @@ export type Mutation = {
     addReleaseTesters: Array<ReleaseTrackUser>;
     addSubscribersToList: NewsletterList;
     addSuppression: NewsletterSuppression;
-    /** Bind a tag to an Application. The tag must already exist in wspace-tags-svc. Currently a stub-adapter no-op until the global-layer integration with wspace-tags-svc lands (see tracker). */
+    /**
+     * Bind a tag to an Application. The tag must already exist in wspace-tags-svc.
+     * Currently a stub-adapter no-op until the global-layer integration with
+     * wspace-tags-svc lands (see tracker).
+     */
     addTagToApplication: ApplicationTagAssignment;
     addTicketTags: SupportTicket;
     /** Add an item to the cart (creates cart if needed) */
@@ -6636,7 +6955,10 @@ export type Mutation = {
     approveReview: ProductReview;
     approveTranslation: Translation;
     approveWaitlist: NewsletterWaitlist;
-    /** Soft archive a billing account. Financial history is preserved and the account is removed from active billing operations. */
+    /**
+     * Soft archive a billing account. Financial history is preserved and the account is removed
+     * from active billing operations.
+     */
     archiveBillingAccount: BillingAccount;
     /** Archive a channel */
     archiveChannel: Channel;
@@ -6651,18 +6973,36 @@ export type Mutation = {
     archiveTour: Tour;
     /** Archive a workspace */
     archiveWorkspace: Workspace;
-    /** Assign the "Authenticated User" role to a user at the global scope. This should be called when a new user signs up to give them basic platform access. This mutation is idempotent - calling it multiple times for the same user is safe. SECURITY: This mutation is restricted to service and super_admin actors only. It should be called by global-auth-svc when a user signs up, not directly by users. */
+    /**
+     * Assign the "Authenticated User" role to a user at the global scope.
+     * This should be called when a new user signs up to give them basic platform access.
+     * This mutation is idempotent - calling it multiple times for the same user is safe.
+     *
+     * SECURITY: This mutation is restricted to service and super_admin actors only.
+     * It should be called by global-auth-svc when a user signs up, not directly by users.
+     */
     assignAuthenticatedUserRole: AssignAuthenticatedUserRoleResult;
     assignEntitlementSeat: ProductEntitlement;
     /** Assign a role to an actor */
     assignRoleToActor: ActorRoleAssignment;
     assignSeat: LicenseSeat;
     assignSupportTicket: SupportTicket;
+    /** Assign a tag to a user */
+    assignTagToUser: UserTagAssignment;
     /** Attach media to a tour step */
     attachMediaToStep: TourStepMedia;
-    /** Erase the subject's auth-layer data. With dryRun=true, returns counts without mutating. Sessions and refresh tokens are always purged; the User row is anonymised (email/name nulled, status=DEACTIVATED) rather than deleted to preserve referential integrity for audit logs. */
+    /**
+     * Erase the subject's auth-layer data. With dryRun=true, returns counts
+     * without mutating. Sessions and refresh tokens are always purged; the
+     * User row is anonymised (email/name nulled, status=DEACTIVATED) rather
+     * than deleted to preserve referential integrity for audit logs.
+     */
     authEraseSubject: AuthEraseResult;
-    /** Export the subject's auth-layer data (account, sessions, MFA settings, OAuth accounts, app delegations, audit log entries owned by the user). Idempotent — repeated calls return identical bundles. */
+    /**
+     * Export the subject's auth-layer data (account, sessions, MFA settings,
+     * OAuth accounts, app delegations, audit log entries owned by the user).
+     * Idempotent — repeated calls return identical bundles.
+     */
     authExportSubject: Scalars['JSON']['output'];
     authenticate: AuthResult;
     authenticateAPIKey: AuthResult;
@@ -6697,7 +7037,10 @@ export type Mutation = {
     bulkDeleteActivityLogs: Scalars['Int']['output'];
     bulkPauseSchedules: SchedulerBulkOperationResult;
     bulkResumeSchedules: SchedulerBulkOperationResult;
-    /** Bulk set user's opt-in/out preference for multiple feature flags. RBAC is scoped to the target workspace via `input.workspaceId`. */
+    /**
+     * Bulk set user's opt-in/out preference for multiple feature flags.
+     * RBAC is scoped to the target workspace via `input.workspaceId`.
+     */
     bulkSetUserFeatureFlagPreferences: Array<UserFeatureFlagPreference>;
     bulkUpdateSchedules: SchedulerBulkOperationResult;
     bulkUpdateTranslations: BulkOperationResult;
@@ -6716,12 +7059,24 @@ export type Mutation = {
     cancelPayout: DeveloperOrgPayout;
     /** Cancel a scheduled notification */
     cancelScheduledNotification: Scalars['Boolean']['output'];
-    /** Cancel a subscription - disables auto-renewal but keeps subscription active until endDate. The subscription will not renew when it expires. */
+    /**
+     * Cancel a subscription - disables auto-renewal but keeps subscription active until endDate.
+     * The subscription will not renew when it expires.
+     */
     cancelSubscription: BillingSubscription;
     changePassword: Scalars['Boolean']['output'];
-    /** Erase channel-layer subject data. With dryRun=true returns counts. Per-user platform connections are PURGED (OAuth tokens etc). Delivery / webhook / suppression rows are anonymised but retained for spam-complaint / abuse forensics (`retainedForLegalReason: "abuse-2yr"`). */
+    /**
+     * Erase channel-layer subject data. With dryRun=true returns counts.
+     * Per-user platform connections are PURGED (OAuth tokens etc).
+     * Delivery / webhook / suppression rows are anonymised but retained for
+     * spam-complaint / abuse forensics (`retainedForLegalReason: "abuse-2yr"`).
+     */
     channelEraseSubject: ChannelEraseResult;
-    /** Export the subject's channel-layer data: per-user platform connections, delivery attempts addressed to the subject, webhook events, and any channel rows the subject created. */
+    /**
+     * Export the subject's channel-layer data: per-user platform connections,
+     * delivery attempts addressed to the subject, webhook events, and any
+     * channel rows the subject created.
+     */
     channelExportSubject: Scalars['JSON']['output'];
     /** Check push MFA challenge status (polling) */
     checkPushMFAStatus: PushMfaStatus;
@@ -6762,7 +7117,10 @@ export type Mutation = {
     createAutomationStep: AutomationStep;
     /** Create a new billing account for the current org (from context) */
     createBillingAccount: BillingAccount;
-    /** Create a billing order for external service (e.g., store) Stores order details + GraphQL callback endpoint for payment notifications */
+    /**
+     * Create a billing order for external service (e.g., store)
+     * Stores order details + GraphQL callback endpoint for payment notifications
+     */
     createBillingOrder: CreateBillingOrderResponse;
     createCampaign: NewsletterCampaign;
     createCannedResponse: CannedResponse;
@@ -6828,7 +7186,10 @@ export type Mutation = {
     createProduct: StoreProduct;
     createProductEntitlement: ProductEntitlement;
     createPromoCode: PromoCode;
-    /** Create a support ticket from a public/unauthenticated source (e.g. website contact form). Does not require authentication. */
+    /**
+     * Create a support ticket from a public/unauthenticated source (e.g. website contact form).
+     * Does not require authentication.
+     */
     createPublicSupportTicket: SupportTicket;
     createQuota: Scalars['Boolean']['output'];
     createRecurringBillingPlan: RecurringBillingPlan;
@@ -6879,9 +7240,15 @@ export type Mutation = {
     createTourTemplate: TourTemplate;
     createTranslation: Translation;
     createTranslationKey: TranslationKey;
-    /** Create complete tenant structure for a new user (tenant, org, workspace) This is typically called after user email verification */
+    /**
+     * Create complete tenant structure for a new user (tenant, org, workspace)
+     * This is typically called after user email verification
+     */
     createUserTenantStructure: CreateUserTenantStructureResponse;
-    /** Create a visibility rule for a resource. Auto-registers the resource if not already registered. */
+    /**
+     * Create a visibility rule for a resource.
+     * Auto-registers the resource if not already registered.
+     */
     createVisibilityRule: VisibilityRule;
     createWebhook: Webhook;
     /** Create a new workspace */
@@ -6903,13 +7270,21 @@ export type Mutation = {
     deactivateResource: Scalars['Boolean']['output'];
     /** Deactivate a tour schedule */
     deactivateTourSchedule: TourSchedule;
-    /** Pure quota decrement — called by wspace-activity-svc after writing a UsageRecord. Only decrements QuotaAssignment.limits.value. Does NOT write back to activity-svc. Requires the quotaAssignmentId already resolved by checkQuotaExhausted. */
+    /**
+     * Pure quota decrement — called by wspace-activity-svc after writing a UsageRecord.
+     * Only decrements QuotaAssignment.limits.value. Does NOT write back to activity-svc.
+     * Requires the quotaAssignmentId already resolved by checkQuotaExhausted.
+     */
     decrementQuota: Scalars['Boolean']['output'];
-    /** Delete current user's account permanently Requires password confirmation */
+    /**
+     * Delete current user's account permanently
+     * Requires password confirmation
+     */
     deleteAccount: AccountActionResult;
     deleteActivityLog: Scalars['Boolean']['output'];
     deleteAffiliateCode: Scalars['Boolean']['output'];
     deleteAgentProfile: Scalars['Boolean']['output'];
+    deleteApp: AccountActionResult;
     /** Delete an app collection */
     deleteAppCollection: Scalars['Boolean']['output'];
     /** Delete a review */
@@ -6932,7 +7307,10 @@ export type Mutation = {
     deleteDiscount: Scalars['Boolean']['output'];
     /** Delete an entitlement */
     deleteEntitlement: Scalars['Boolean']['output'];
-    /** Delete external OIDC configuration Admin only */
+    /**
+     * Delete external OIDC configuration
+     * Admin only
+     */
     deleteExternalOIDCConfig: AccountActionResult;
     deleteFAQ: Scalars['Boolean']['output'];
     /** Delete a feature flag (super admin only) */
@@ -7023,11 +7401,21 @@ export type Mutation = {
     /** Soft-delete a user platform connection */
     deleteUserPlatformConnection: Scalars['Boolean']['output'];
     deleteWebhook: Scalars['Boolean']['output'];
-    /** Deliver the same notification to multiple recipients in bulk. More efficient than multiple single calls for broadcast scenarios. */
+    /**
+     * Deliver the same notification to multiple recipients in bulk.
+     * More efficient than multiple single calls for broadcast scenarios.
+     */
     deliverBulkNotification: BulkChannelDeliveryResult;
-    /** Deliver a notification across multiple platforms and multiple recipients in one call. Fans out per-platform in parallel (Promise.allSettled) with independent failover per platform. Adapters that natively support multi-recipient (SES, ACS) send one API call; others loop concurrently. */
+    /**
+     * Deliver a notification across multiple platforms and multiple recipients in one call.
+     * Fans out per-platform in parallel (Promise.allSettled) with independent failover per platform.
+     * Adapters that natively support multi-recipient (SES, ACS) send one API call; others loop concurrently.
+     */
     deliverMultiPlatformNotification: MultiPlatformDeliveryResult;
-    /** Deliver a notification to a single recipient via Channel service. Called by global-notification-svc to deliver through platform adapters. */
+    /**
+     * Deliver a notification to a single recipient via Channel service.
+     * Called by global-notification-svc to deliver through platform adapters.
+     */
     deliverNotification: ChannelDeliveryResult;
     deprecateApplicationVersion: ApplicationVersion;
     deprecateProduct: StoreProduct;
@@ -7049,7 +7437,11 @@ export type Mutation = {
     enableMFA: Scalars['Boolean']['output'];
     enableMaintenanceMode: MaintenanceModeStatus;
     enrollSubscriberInAutomation: AutomationSubscriber;
-    /** Anonymise the subject on the billing layer. With dryRun=true, returns what would change without mutating. Financial records (Transaction, Invoice, Payment) are RETAINED for the statutory 7-year window. */
+    /**
+     * Anonymise the subject on the billing layer. With dryRun=true, returns
+     * what would change without mutating. Financial records (Transaction,
+     * Invoice, Payment) are RETAINED for the statutory 7-year window.
+     */
     eraseSubject: EraseResult;
     escalateSupportTicket: SupportTicket;
     /** Exchange app token for app-as-user token (Token Exchange flow) */
@@ -7069,7 +7461,11 @@ export type Mutation = {
     exportDeveloperOrganizations: DevportalExportJob;
     /** Export per-organization revenue rows matching the optional filter. */
     exportRevenue: DevportalExportJob;
-    /** Export the subject's billing-layer data (billing accounts, subscriptions, invoices, payment methods on file, transaction history, credits, usage). Idempotent. */
+    /**
+     * Export the subject's billing-layer data (billing accounts, subscriptions,
+     * invoices, payment methods on file, transaction history, credits, usage).
+     * Idempotent.
+     */
     exportSubject: Scalars['JSON']['output'];
     /** Export webhook event records matching the filter. */
     exportWebhookEvents: ChannelExportJob;
@@ -7086,7 +7482,10 @@ export type Mutation = {
     generateHMACSecret: HmacCredentialResult;
     /** Generate an invoice for a subscription */
     generateInvoice: Invoice;
-    /** Generate OIDC authorization URL for SSO login Returns URL to redirect user to the IdP */
+    /**
+     * Generate OIDC authorization URL for SSO login
+     * Returns URL to redirect user to the IdP
+     */
     generateOIDCAuthUrl: OidcAuthUrlResult;
     /** Generate passkey authentication options (for login) */
     generatePasskeyAuthenticationOptions: PasskeyAuthenticationOptions;
@@ -7101,7 +7500,11 @@ export type Mutation = {
     /** Generate challenge message for wallet signature */
     generateWalletChallenge: WalletChallengeResult;
     getSupportAttachmentPartUploadUrls: Array<SupportAttachmentPresignedPart>;
-    /** Grant an app access to act on a specific workspace. Idempotent: re-granting an ACTIVE authorization updates its scopes; re-granting a REVOKED one flips it back to ACTIVE and clears the revoke fields. */
+    /**
+     * Grant an app access to act on a specific workspace. Idempotent: re-granting
+     * an ACTIVE authorization updates its scopes; re-granting a REVOKED one flips
+     * it back to ACTIVE and clears the revoke fields.
+     */
     grantAppWorkspaceAccess: AppWorkspaceAuthorization;
     grantConsent: ConsentRecord;
     grantCredits: CreditTransaction;
@@ -7115,29 +7518,63 @@ export type Mutation = {
     /** Mark webhook as ignored */
     ignoreWebhook: Scalars['Boolean']['output'];
     importSubscribers: ImportSubscribersResult;
-    /** Initialize billing roles for a billing account by cloning billing role templates. Use this when a new billing account is created. Returns the number of roles created (0 if roles already exist). */
+    /**
+     * Initialize billing roles for a billing account by cloning billing role templates.
+     * Use this when a new billing account is created.
+     *
+     * Returns the number of roles created (0 if roles already exist).
+     */
     initializeBillingRoles: InitializeBillingRolesResult;
-    /** Initialize organization roles by cloning organization role templates. Use this when a new organization is created. The creator will be assigned the Owner role. Returns the number of roles created (0 if roles already exist). SECURITY: This mutation is restricted to service and super_admin actors only. It should be called by global-tenant-svc when an organization is created, not directly by users. */
+    /**
+     * Initialize organization roles by cloning organization role templates.
+     * Use this when a new organization is created. The creator will be assigned the Owner role.
+     *
+     * Returns the number of roles created (0 if roles already exist).
+     *
+     * SECURITY: This mutation is restricted to service and super_admin actors only.
+     * It should be called by global-tenant-svc when an organization is created, not directly by users.
+     */
     initializeOrganizationRoles: InitializeOrganizationRolesResult;
     /** Initiate Kerberos SPNEGO authentication */
     initiateKerberosAuth: KerberosChallengeResult;
     /** Initiate NTLM authentication (returns Type 2 challenge) */
     initiateNTLMChallenge: NtlmChallengeResult;
-    /** Initiate a payment for credits, plans, or addons This creates a Stripe PaymentIntent or Razorpay Order with tax included Returns client secret (Stripe) or order ID (Razorpay) for frontend to complete payment */
+    /**
+     * Initiate a payment for credits, plans, or addons
+     * This creates a Stripe PaymentIntent or Razorpay Order with tax included
+     * Returns client secret (Stripe) or order ID (Razorpay) for frontend to complete payment
+     */
     initiatePayment: InitiatePaymentResponse;
     /** Install an application */
     installApp: AppInstallation;
-    /** Install a purchased app to a workspace. Validates that the product was purchased before allowing installation. If orderId is not provided, will find the most recent processed order for this product. */
+    /**
+     * Install a purchased app to a workspace.
+     * Validates that the product was purchased before allowing installation.
+     * If orderId is not provided, will find the most recent processed order for this product.
+     */
     installPurchasedApp: InstallPurchasedAppResult;
     /** Invite a user to join an organization */
     inviteDeveloperOrgMember: DeveloperOrgInvitation;
     /** Invite a user to an organization by email */
     inviteOrganizationMember: OrganizationInvite;
-    /** Public endpoint — no authentication required. Email is normalized (trimmed, lowercased). Must be protected by API gateway rate limiting (recommended: 5 req/min per IP). */
+    /**
+     * Public endpoint — no authentication required. Email is normalized (trimmed, lowercased).
+     * Must be protected by API gateway rate limiting (recommended: 5 req/min per IP).
+     */
     joinWaitlist: NewsletterWaitlist;
     /** Leave an organization */
     leaveDeveloperOrganization: Scalars['Boolean']['output'];
-    /** Link a personal integration connection (from wspace-integrations-svc) to a bot channel. Called by microfe-botlit after the user completes OAuth in microfe-integrations. Steps performed internally: 1. Fetch IntegrationConnection data from wspace-integrations-svc via internal GQL 2. Extract platform identity (slackUserId / msUserId / discordUserId / phone) from metadata 3. Open a DM conversation using the bot token from ChannelConnection 4. Upsert UserPlatformConnection (source=OAUTH, dmAllowed=true, dmConversationId set) 5. Send welcome DM (Slack / Teams / Discord where supported) */
+    /**
+     * Link a personal integration connection (from wspace-integrations-svc) to a bot channel.
+     * Called by microfe-botlit after the user completes OAuth in microfe-integrations.
+     *
+     * Steps performed internally:
+     *   1. Fetch IntegrationConnection data from wspace-integrations-svc via internal GQL
+     *   2. Extract platform identity (slackUserId / msUserId / discordUserId / phone) from metadata
+     *   3. Open a DM conversation using the bot token from ChannelConnection
+     *   4. Upsert UserPlatformConnection (source=OAUTH, dmAllowed=true, dmConversationId set)
+     *   5. Send welcome DM (Slack / Teams / Discord where supported)
+     */
     linkIntegrationConnection: UserPlatformConnection;
     linkTickets: TicketLink;
     /** Link wallet to existing user account */
@@ -7160,9 +7597,18 @@ export type Mutation = {
     mergeTickets: SupportTicket;
     /** Moderate a review (admin) */
     moderateAppReview: AppReview;
-    /** Erase newsletter subscriber data. With dryRun=true returns counts. Subscriber + per-list rows + automation enrolments PURGED. Suppression entry ANONYMISED (email hashed) — kept to honour CAN-SPAM unsubscribe permanence. Bounce/complaint/consent-audit rows anonymised but retained for deliverability forensics. */
+    /**
+     * Erase newsletter subscriber data. With dryRun=true returns counts.
+     * Subscriber + per-list rows + automation enrolments PURGED.
+     * Suppression entry ANONYMISED (email hashed) — kept to honour CAN-SPAM
+     * unsubscribe permanence. Bounce/complaint/consent-audit rows anonymised
+     * but retained for deliverability forensics.
+     */
     newsletterEraseSubject: NewsletterEraseResult;
-    /** Export the subject's newsletter data: subscriber rows, per-list memberships, consent ledger entries, automation enrolments, waitlist entries. */
+    /**
+     * Export the subject's newsletter data: subscriber rows, per-list memberships,
+     * consent ledger entries, automation enrolments, waitlist entries.
+     */
     newsletterExportSubject: Scalars['JSON']['output'];
     openCircuitBreaker: CircuitBreakerState;
     /** Pause a subscription */
@@ -7182,7 +7628,11 @@ export type Mutation = {
     processScheduledNotifications: Scalars['Int']['output'];
     /** Process a webhook manually (for retry) */
     processWebhook: WebhookProcessingResult;
-    /** Switch a tenant to DEDICATED mode and begin provisioning. Sets status to PROVISIONING until endpoint is set. If endpoint is provided, sets status directly to ACTIVE. */
+    /**
+     * Switch a tenant to DEDICATED mode and begin provisioning.
+     * Sets status to PROVISIONING until endpoint is set.
+     * If endpoint is provided, sets status directly to ACTIVE.
+     */
     provisionDedicatedTenant: Tenant;
     /** Public unsubscribe via HMAC-signed token from email link. No authentication required. */
     publicUnsubscribeByToken: Scalars['Boolean']['output'];
@@ -7242,7 +7692,10 @@ export type Mutation = {
     /** Reject an organization invite (must be logged in as the invited user) */
     rejectOrganizationInvite: OrganizationInvite;
     rejectPayoutRequest: PayoutRequest;
-    /** Admin rejects a submitted product with a mandatory reason. Publisher can edit and resubmit afterwards. */
+    /**
+     * Admin rejects a submitted product with a mandatory reason. Publisher can
+     * edit and resubmit afterwards.
+     */
     rejectProduct: StoreProduct;
     rejectPublisher: Publisher;
     rejectReview: ProductReview;
@@ -7276,16 +7729,27 @@ export type Mutation = {
     removeSuppression: Scalars['Boolean']['output'];
     /** Remove a single tag binding from an Application. */
     removeTagFromApplication: Scalars['Boolean']['output'];
+    /** Remove a tag from a user */
+    removeTagFromUser: AccountActionResult;
     removeTicketTags: SupportTicket;
-    /** Remove user's preference for a feature flag (reverts to default). RBAC is scoped to the target workspace. */
+    /**
+     * Remove user's preference for a feature flag (reverts to default).
+     * RBAC is scoped to the target workspace.
+     */
     removeUserFeatureFlagPreference: Scalars['Boolean']['output'];
     /** Remove a visibility rule */
     removeVisibilityRule: Scalars['Boolean']['output'];
-    /** Remove a workspace override, reverting to the platform default. RBAC is scoped to the target workspace. */
+    /**
+     * Remove a workspace override, reverting to the platform default.
+     * RBAC is scoped to the target workspace.
+     */
     removeWorkspaceFeatureFlagOverride: Scalars['Boolean']['output'];
     /** Remove a member from a workspace */
     removeWorkspaceMember: Scalars['Boolean']['output'];
-    /** Remove workspace metadata (membership and routing) Note: This only removes metadata. Use workspaces service to delete actual workspace content. */
+    /**
+     * Remove workspace metadata (membership and routing)
+     * Note: This only removes metadata. Use workspaces service to delete actual workspace content.
+     */
     removeWorkspaceMetadata: Scalars['Boolean']['output'];
     /** Rename a passkey */
     renamePasskey: PasskeyInfo;
@@ -7303,7 +7767,10 @@ export type Mutation = {
     replaceChannelTags: Array<ChannelTagAssignment>;
     /** Replace all tags on a store product */
     replaceStoreProductTags: Array<StoreProductTagAssignment>;
-    /** Send an email reply to a contact inquiry. The reply is sent via the notification pipeline (notification-svc → channel-svc → email provider). Auto-updates status to REVIEWED. */
+    /**
+     * Send an email reply to a contact inquiry. The reply is sent via the notification
+     * pipeline (notification-svc → channel-svc → email provider). Auto-updates status to REVIEWED.
+     */
     replyToContactInquiry: ContactInquiryReplyResult;
     replyToReview: ProductReviewReply;
     /** Report a review */
@@ -7311,7 +7778,10 @@ export type Mutation = {
     /** Reprocess a failed webhook event */
     reprocessWebhook: WebhookProcessingResult;
     requestBillingPayout: PayoutRequest;
-    /** Request a credit withdrawal. Converts purchased + earned credits to a PayoutRequest denominated in USD at the current credit rate. Uses the specified payout account for payment. */
+    /**
+     * Request a credit withdrawal. Converts purchased + earned credits to a PayoutRequest
+     * denominated in USD at the current credit rate. Uses the specified payout account for payment.
+     */
     requestCreditWithdrawal: PayoutRequest;
     /** Request a manual payout (devportal legacy alias) */
     requestDeveloperOrgPayout: DeveloperOrgPayout;
@@ -7355,7 +7825,10 @@ export type Mutation = {
     resumeSLA: SupportTicket;
     resumeScheduledJob: ScheduledJob;
     retireSubprocessor: Subprocessor;
-    /** Manually retry GraphQL callback for a failed billing order (admin only) Useful for retrying after fixing issues in external service */
+    /**
+     * Manually retry GraphQL callback for a failed billing order (admin only)
+     * Useful for retrying after fixing issues in external service
+     */
     retryBillingOrderCallback: RetryBillingOrderCallbackResponse;
     /** Retry a failed delivery attempt */
     retryDelivery: MessageDeliveryResult;
@@ -7368,9 +7841,15 @@ export type Mutation = {
     revertTranslation: Translation;
     reviewTranslation: Translation;
     revokeAPIKey: Scalars['Boolean']['output'];
-    /** Revoke all sessions except the current one. Returns the number of sessions that were revoked. */
+    /**
+     * Revoke all sessions except the current one.
+     * Returns the number of sessions that were revoked.
+     */
     revokeAllSessions: RevokeAllSessionsResult;
-    /** Revoke an app's access to a workspace. Returns false if the row was already REVOKED or never existed. */
+    /**
+     * Revoke an app's access to a workspace. Returns false if the row was already
+     * REVOKED or never existed.
+     */
     revokeAppWorkspaceAccess: Scalars['Boolean']['output'];
     revokeConsent: NewsletterConsent;
     revokeDelegation: Scalars['Boolean']['output'];
@@ -7379,11 +7858,17 @@ export type Mutation = {
     revokeHMACCredential: Scalars['Boolean']['output'];
     revokeLicense: ProductEntitlement;
     revokeSeat: LicenseSeat;
-    /** Revoke (log out) a specific session by ID. Returns true if the session was successfully revoked. */
+    /**
+     * Revoke (log out) a specific session by ID.
+     * Returns true if the session was successfully revoked.
+     */
     revokeSession: Scalars['Boolean']['output'];
     /** Revoke a signed cookie session */
     revokeSignedCookieSession: Scalars['Boolean']['output'];
-    /** Revoke a user's platform connection (sets dmAllowed = false, clears tokens). Does NOT delete the record — keeps presence history intact. */
+    /**
+     * Revoke a user's platform connection (sets dmAllowed = false, clears tokens).
+     * Does NOT delete the record — keeps presence history intact.
+     */
     revokeUserPlatformConnection: UserPlatformConnection;
     rollbackRelease: ProductRelease;
     rotateAPIKey: ApiKeyRotateResult;
@@ -7400,7 +7885,11 @@ export type Mutation = {
     scheduleNewsletter: Newsletter;
     /** Schedule a notification for future delivery */
     scheduleNotification: ScheduledNotification;
-    /** Seed default feature flags across all products. Creates all default flags if they don't already exist. Returns the count of newly created flags. Skips flags that already exist (by key uniqueness). */
+    /**
+     * Seed default feature flags across all products.
+     * Creates all default flags if they don't already exist. Returns the count of newly created flags.
+     * Skips flags that already exist (by key uniqueness).
+     */
     seedDefaultFeatureFlags: Scalars['Int']['output'];
     /** Bulk create default shortcuts for a product */
     seedDefaultShortcuts: Scalars['Int']['output'];
@@ -7419,7 +7908,11 @@ export type Mutation = {
     setAgentOnline: AgentProfile;
     /** Set or update billing address for a billing account */
     setBillingAddress: BillingAddress;
-    /** Set a billing account as the default for an org. Only one billing account can be default per org. If another account is currently default, it will be unset. */
+    /**
+     * Set a billing account as the default for an org.
+     * Only one billing account can be default per org.
+     * If another account is currently default, it will be unset.
+     */
     setDefaultBillingAccount: BillingAccount;
     setDefaultLanguage: Language;
     /** Set a payment method as default */
@@ -7430,12 +7923,21 @@ export type Mutation = {
     setNotificationTopicSubscription: NotificationTopicSubscription;
     /** Set default permission level for a role on a resource type */
     setRoleDefaultPermission: Role;
-    /** Set or update the endpoint URL for a DEDICATED tenant. Transitions PROVISIONING → ACTIVE when endpoint is set. */
+    /**
+     * Set or update the endpoint URL for a DEDICATED tenant.
+     * Transitions PROVISIONING → ACTIVE when endpoint is set.
+     */
     setTenantEndpoint: Tenant;
-    /** Set user's opt-in/out preference for a previewable feature flag. RBAC is scoped to the target workspace via `input.workspaceId`. */
+    /**
+     * Set user's opt-in/out preference for a previewable feature flag.
+     * RBAC is scoped to the target workspace via `input.workspaceId`.
+     */
     setUserFeatureFlagPreference: UserFeatureFlagPreference;
     setUserLanguagePreference: UserLanguagePreference;
-    /** Set workspace-level override for a feature flag (super admin or workspace admin). RBAC is scoped to the target workspace via `input.workspaceId`. */
+    /**
+     * Set workspace-level override for a feature flag (super admin or workspace admin).
+     * RBAC is scoped to the target workspace via `input.workspaceId`.
+     */
     setWorkspaceFeatureFlagOverride: WorkspaceFeatureFlagOverride;
     setupMFA: MfaSetupResult;
     sideloadApp: StoreAppInstallation;
@@ -7456,19 +7958,42 @@ export type Mutation = {
     /** Mark a tour as started for a user */
     startTour: TourUserProgress;
     submitApplication: Application;
-    /** Submit an application to the store for review. Awaits the store-svc submit call and returns the application with the resulting store submission metadata attached to `metadata.storeSubmissionStatus`. The target store's requiresApproval flag decides whether the submission lands in PENDING_REVIEW (public default) or is auto-published (private registries that trust their publishers). */
+    /**
+     * Submit an application to the store for review. Awaits the store-svc
+     * submit call and returns the application with the resulting store
+     * submission metadata attached to `metadata.storeSubmissionStatus`.
+     *
+     * The target store's requiresApproval flag decides whether the submission
+     * lands in PENDING_REVIEW (public default) or is auto-published (private
+     * registries that trust their publishers).
+     */
     submitApplicationForReview: Application;
-    /** Submit a contact inquiry from a public website (no authentication required). Validates reCAPTCHA token server-side using the product's secret key fetched from the tenant service via internal gateway. */
+    /**
+     * Submit a contact inquiry from a public website (no authentication required).
+     * Validates reCAPTCHA token server-side using the product's secret key
+     * fetched from the tenant service via internal gateway.
+     */
     submitContactInquiry: SubmitContactInquiryResult;
-    /** Submit a product to its target store for review. The store's requiresApproval flag decides whether the product goes to PENDING_REVIEW or is auto-published. */
+    /**
+     * Submit a product to its target store for review. The store's
+     * requiresApproval flag decides whether the product goes to PENDING_REVIEW
+     * or is auto-published.
+     */
     submitProduct: StoreProduct;
     submitPublisherVerification: Publisher;
     submitSatisfactionSurvey: CustomerSatisfactionSurvey;
     subscribe: NewsletterSubscriber;
     subscribeToStore: UserStoreSubscription;
-    /** Anonymise the subject across support records. With dryRun=true returns counts without mutating. Ticket bodies and agent resolution history are retained for legal-claims defence (`retainedForLegalReason: "claims-3yr"`). */
+    /**
+     * Anonymise the subject across support records. With dryRun=true returns
+     * counts without mutating. Ticket bodies and agent resolution history are
+     * retained for legal-claims defence (`retainedForLegalReason: "claims-3yr"`).
+     */
     supportEraseSubject: SupportEraseResult;
-    /** Export the subject's support data: tickets they raised, messages they authored, contact inquiries, CSAT surveys submitted. */
+    /**
+     * Export the subject's support data: tickets they raised, messages they
+     * authored, contact inquiries, CSAT surveys submitted.
+     */
     supportExportSubject: Scalars['JSON']['output'];
     suppressIdentifier: SuppressionEntry;
     /** Suspend an installation (admin) */
@@ -7481,9 +8006,17 @@ export type Mutation = {
     suspendTenant: Tenant;
     /** Suspend a workspace */
     suspendWorkspace: Workspace;
-    /** Sync tour steps (smart update in ONE call) Send all desired steps, backend handles: update existing, create new, delete removed */
+    /**
+     * Sync tour steps (smart update in ONE call)
+     * Send all desired steps, backend handles: update existing, create new, delete removed
+     */
     syncTourSteps: Array<TourStep>;
-    /** Sync workspace metadata from workspace layer to global layer. Called by wspace-workspace-svc when a workspace is created directly via workspace layer. This is the reverse of syncFromGlobal - it syncs global ← wspace. Creates workspace metadata + owner membership in global-tenant-svc. */
+    /**
+     * Sync workspace metadata from workspace layer to global layer.
+     * Called by wspace-workspace-svc when a workspace is created directly via workspace layer.
+     * This is the reverse of syncFromGlobal - it syncs global ← wspace.
+     * Creates workspace metadata + owner membership in global-tenant-svc.
+     */
     syncWorkspaceFromWspace: SyncWorkspaceFromWspaceResponse;
     tagChannel: ChannelTagAssignment;
     tagChannelConnection: ChannelConnectionTagAssignment;
@@ -7561,6 +8094,8 @@ export type Mutation = {
     updateCategory: ProductCategory;
     /** Update an existing channel */
     updateChannel: Channel;
+    /** Save (upsert) organization-level channel settings. */
+    updateChannelOrgSettings: ChannelOrgSettings;
     /** Update connection metadata (not credentials) */
     updateConnection: ChannelConnection;
     /** Update the status of a contact inquiry (authenticated, for superadmins) */
@@ -7597,9 +8132,15 @@ export type Mutation = {
     updateKeyboardShortcut: KeyboardShortcut;
     updateKnowledgeBaseArticle: KnowledgeBaseArticle;
     updateLanguage: Language;
-    /** Update the current user's dashboard widget layout preferences. Replaces the dashboard.widgets array within preferences. */
+    /**
+     * Update the current user's dashboard widget layout preferences.
+     * Replaces the dashboard.widgets array within preferences.
+     */
     updateMyDashboardPreferences: Scalars['JSON']['output'];
-    /** Update the current user's general preferences. Merges the provided JSON into the existing preferences field. */
+    /**
+     * Update the current user's general preferences.
+     * Merges the provided JSON into the existing preferences field.
+     */
     updateMyPreferences: UserPreference;
     updateNewsletter: Newsletter;
     updateNewsletterAutomation: NewsletterAutomation;
@@ -7648,11 +8189,18 @@ export type Mutation = {
     updateScheduleTemplate: ScheduleTemplate;
     updateScheduledJob: ScheduledJob;
     updateStore: Store;
-    /** Update order payment status (called by billing service callback) This is a PUBLIC mutation called by the billing service after payment completion */
+    /**
+     * Update order payment status (called by billing service callback)
+     *
+     * This is a PUBLIC mutation called by the billing service after payment completion
+     */
     updateStoreOrderPaymentStatus: UpdateStoreOrderPaymentStatusResponse;
     updateSubprocessor: Subprocessor;
     updateSubscriber: NewsletterSubscriber;
-    /** Update the seat count on an active PER_SEAT subscription. Syncs quantity to the payment gateway and updates the seat quota ceiling. */
+    /**
+     * Update the seat count on an active PER_SEAT subscription.
+     * Syncs quantity to the payment gateway and updates the seat quota ceiling.
+     */
     updateSubscriptionSeats: BillingSubscription;
     updateSupportMessage: SupportMessage;
     updateSupportTicket: SupportTicket;
@@ -7694,11 +8242,17 @@ export type Mutation = {
     /** Upload tour media */
     uploadTourMedia: TourMedia;
     upsertComplianceSettings: NewsletterComplianceSettings;
-    /** Create or update external OIDC configuration (Google, Microsoft, etc.) Admin only */
+    /**
+     * Create or update external OIDC configuration (Google, Microsoft, etc.)
+     * Admin only
+     */
     upsertExternalOIDCConfig: ExternalOidcConfiguration;
     /** Create or update fulfillment details for an order (admin) */
     upsertOrderFulfillment: OrderFulfillment;
-    /** Upsert a platform connection from a passively-observed webhook event (source = SEEN). Used by WebhookProcessor to track users without granting DM access. */
+    /**
+     * Upsert a platform connection from a passively-observed webhook event (source = SEEN).
+     * Used by WebhookProcessor to track users without granting DM access.
+     */
     upsertSeenUser: UserPlatformConnection;
     useCannedResponse: CannedResponse;
     validateApiKey: TokenValidationResponse;
@@ -7719,7 +8273,17 @@ export type Mutation = {
     /** Verify a payment method (micro-deposits) */
     verifyPaymentMethod: DeveloperOrgPaymentMethod;
     verifyPublisherPayoutMethod: PublisherPayoutMethod;
-    /** Verify a WhatsApp pairing code entered by the user in the dashboard. Called by wspace-integrations-svc during its CUSTOM auth step. Looks up the UserPlatformConnection (source=SEEN) for the channel + phone number, checks the pairing code matches and has not expired, then: - Sets pairingStatus = APPROVED - Sets dmAllowed = true - Sets dmConversationId to the WhatsApp JID format Returns true on success, throws on failure. */
+    /**
+     * Verify a WhatsApp pairing code entered by the user in the dashboard.
+     * Called by wspace-integrations-svc during its CUSTOM auth step.
+     *
+     * Looks up the UserPlatformConnection (source=SEEN) for the channel + phone number,
+     * checks the pairing code matches and has not expired, then:
+     *   - Sets pairingStatus = APPROVED
+     *   - Sets dmAllowed = true
+     *   - Sets dmConversationId to the WhatsApp JID format
+     * Returns true on success, throws on failure.
+     */
     verifyWhatsAppPairingCode: Scalars['Boolean']['output'];
     /** Void an invoice */
     voidInvoice: Invoice;
@@ -7738,6 +8302,7 @@ export type MutationAcceptDeveloperOrgInvitationArgs = {
 /** Root mutation type */
 export type MutationAcceptOrganizationInviteArgs = {
     inviteId: Scalars['ID']['input'];
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
 };
 /** Root mutation type */
 export type MutationActivateChannelArgs = {
@@ -7978,6 +8543,11 @@ export type MutationAssignSupportTicketArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationAssignTagToUserArgs = {
+    tagId: Scalars['ID']['input'];
+    userId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationAttachMediaToStepArgs = {
     input: AttachMediaToStepInput;
 };
@@ -8712,6 +9282,10 @@ export type MutationDeleteAgentProfileArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationDeleteAppArgs = {
+    id: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationDeleteAppCollectionArgs = {
     id: Scalars['ID']['input'];
 };
@@ -9730,6 +10304,11 @@ export type MutationRemoveTagFromApplicationArgs = {
     input: RemoveTagFromApplicationInput;
 };
 /** Root mutation type */
+export type MutationRemoveTagFromUserArgs = {
+    tagId: Scalars['ID']['input'];
+    userId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationRemoveTicketTagsArgs = {
     id: Scalars['ID']['input'];
     tags: Array<Scalars['String']['input']>;
@@ -10550,6 +11129,11 @@ export type MutationUpdateChannelArgs = {
     input: UpdateChannelInput;
 };
 /** Root mutation type */
+export type MutationUpdateChannelOrgSettingsArgs = {
+    input: ChannelOrgSettingsInput;
+    organizationId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationUpdateConnectionArgs = {
     id: Scalars['ID']['input'];
     input: UpdateConnectionInput;
@@ -11091,7 +11675,12 @@ export type MutationVoteOnAppReviewArgs = {
 export type MutationWithdrawConsentArgs = {
     input: WithdrawConsentInput;
 };
-/** Filter inputs for `myContactInquiries`. Search and email-filter are deliberately not exposed — the query is already scoped to the caller's email, so a full-text search across `name`/`subject` would only surface inquiries the caller already owns. */
+/**
+ * Filter inputs for `myContactInquiries`.
+ * Search and email-filter are deliberately not exposed — the query is already
+ * scoped to the caller's email, so a full-text search across `name`/`subject`
+ * would only surface inquiries the caller already owns.
+ */
 export type MyContactInquiryFilterInput = {
     /** Filter by product ID */
     productId?: InputMaybe<Scalars['String']['input']>;
@@ -11212,7 +11801,11 @@ export type NewsletterConsent = {
     subscriberId: Scalars['String']['output'];
     userAgent?: Maybe<Scalars['String']['output']>;
 };
-/** Newsletter-specific context output type. Returns the stored context for each record. Module-specific to avoid federation conflicts with OperationContext in other subgraphs. */
+/**
+ * Newsletter-specific context output type.
+ * Returns the stored context for each record.
+ * Module-specific to avoid federation conflicts with OperationContext in other subgraphs.
+ */
 export type NewsletterContext = {
     __typename?: 'NewsletterContext';
     /** Additional custom context as JSON */
@@ -11230,7 +11823,10 @@ export type NewsletterContext = {
     /** Workspace ID for workspace-level scoping */
     workspaceId?: Maybe<Scalars['ID']['output']>;
 };
-/** Newsletter context filter input for querying records by context. Supports exact match filtering on context fields. */
+/**
+ * Newsletter context filter input for querying records by context.
+ * Supports exact match filtering on context fields.
+ */
 export type NewsletterContextFilterInput = {
     /** Filter by organization ID */
     organizationId?: InputMaybe<Scalars['ID']['input']>;
@@ -11245,7 +11841,10 @@ export type NewsletterContextFilterInput = {
     /** Filter by workspace ID */
     workspaceId?: InputMaybe<Scalars['ID']['input']>;
 };
-/** Newsletter context input for filtering and scoping data. All fields are optional and can be extended as needed. */
+/**
+ * Newsletter context input for filtering and scoping data.
+ * All fields are optional and can be extended as needed.
+ */
 export type NewsletterContextInput = {
     /** Additional custom context as JSON */
     custom?: InputMaybe<Scalars['JSON']['input']>;
@@ -11892,7 +12491,10 @@ export type OidcHybridConfig = {
     supportedGrantTypes: Array<Scalars['String']['output']>;
     supportedResponseTypes: Array<Scalars['String']['output']>;
 };
-/** Operation context output type. Returns the stored context for each record. */
+/**
+ * Operation context output type.
+ * Returns the stored context for each record.
+ */
 export type OperationContext = {
     __typename?: 'OperationContext';
     /** App ID for app-level scoping */
@@ -12042,7 +12644,10 @@ export type OrderStatusUpdatedEvent = {
     updatedAt: Scalars['String']['output'];
     workspaceId?: Maybe<Scalars['ID']['output']>;
 };
-/** Organization type stub - represents an organization entity from another service This service doesn't own the Organization model, but references it */
+/**
+ * Organization type stub - represents an organization entity from another service
+ * This service doesn't own the Organization model, but references it
+ */
 export type Organization = {
     __typename?: 'Organization';
     createdAt: Scalars['DateTime']['output'];
@@ -12072,6 +12677,51 @@ export type Organization = {
     /** Workspaces belonging to this organization */
     workspaces: Array<Workspace>;
 };
+/** A single persistent organization audit log entry. */
+export type OrganizationAuditLog = {
+    __typename?: 'OrganizationAuditLog';
+    action: Scalars['String']['output'];
+    actorId: Scalars['ID']['output'];
+    actorType: Scalars['String']['output'];
+    createdAt: Scalars['DateTime']['output'];
+    id: Scalars['ID']['output'];
+    metadata?: Maybe<Scalars['JSON']['output']>;
+    organizationId: Scalars['ID']['output'];
+    targetId?: Maybe<Scalars['ID']['output']>;
+    targetType: Scalars['String']['output'];
+};
+/** Paginated connection of OrganizationAuditLog entries. */
+export type OrganizationAuditLogConnection = {
+    __typename?: 'OrganizationAuditLogConnection';
+    edges: Array<OrganizationAuditLogEdge>;
+    pageInfo: OrganizationAuditLogPageInfo;
+    totalCount: Scalars['Int']['output'];
+};
+/** Edge wrapper for keyset pagination over OrganizationAuditLog. */
+export type OrganizationAuditLogEdge = {
+    __typename?: 'OrganizationAuditLogEdge';
+    cursor: Scalars['String']['output'];
+    node: OrganizationAuditLog;
+};
+/** Page info for relay-style cursor pagination. */
+export type OrganizationAuditLogPageInfo = {
+    __typename?: 'OrganizationAuditLogPageInfo';
+    endCursor?: Maybe<Scalars['String']['output']>;
+    hasNextPage: Scalars['Boolean']['output'];
+};
+/**
+ * Inline export payload for `exportOrganizationsCsv`. Returns CSV text along
+ * with a count of rows and a flag if the result was capped at the requested
+ * limit. Pattern mirrors `TenantExport` from the tenant module.
+ */
+export type OrganizationCsvExport = {
+    __typename?: 'OrganizationCsvExport';
+    csv: Scalars['String']['output'];
+    format: Scalars['String']['output'];
+    generatedAt: Scalars['DateTime']['output'];
+    rowCount: Scalars['Int']['output'];
+    truncated: Scalars['Boolean']['output'];
+};
 /** Filter input for querying organizations */
 export type OrganizationFilterInput = {
     search?: InputMaybe<Scalars['String']['input']>;
@@ -12159,7 +12809,10 @@ export type PageInfo = {
     hasPreviousPage: Scalars['Boolean']['output'];
     startCursor?: Maybe<Scalars['String']['output']>;
 };
-/** Response type for getTransactionsByBillingAccount query Contains basic billing account info and paginated transactions */
+/**
+ * Response type for getTransactionsByBillingAccount query
+ * Contains basic billing account info and paginated transactions
+ */
 export type PaginatedBillingAccountTransactions = {
     __typename?: 'PaginatedBillingAccountTransactions';
     /** Billing-specific email (for invoices) */
@@ -12398,7 +13051,10 @@ export declare enum PaymentMethodType {
     Paypal = "PAYPAL",
     Wallet = "WALLET"
 }
-/** Payment provider configuration for frontend integration Contains only public keys safe to expose to the client */
+/**
+ * Payment provider configuration for frontend integration
+ * Contains only public keys safe to expose to the client
+ */
 export type PaymentProviderConfig = {
     __typename?: 'PaymentProviderConfig';
     /** Whether Razorpay is configured and available */
@@ -12412,7 +13068,9 @@ export type PaymentProviderConfig = {
 };
 /** Preferred payment provider */
 export declare enum PaymentProviderPreference {
+    AppleIap = "APPLE_IAP",
     Auto = "AUTO",
+    GooglePlay = "GOOGLE_PLAY",
     Razorpay = "RAZORPAY",
     Stripe = "STRIPE"
 }
@@ -12646,13 +13304,19 @@ export type Plan = {
     createdAt?: Maybe<Scalars['DateTime']['output']>;
     /** The currency in which the plan is priced. Defaults to 'USD'. */
     currency?: Maybe<Scalars['String']['output']>;
-    /** Prices for all supported currencies with beautiful rounding. Example: { "USD": 2.00, "INR": 199, "EUR": 1.99, "GBP": 1.79 } */
+    /**
+     * Prices for all supported currencies with beautiful rounding.
+     * Example: { "USD": 2.00, "INR": 199, "EUR": 1.99, "GBP": 1.79 }
+     */
     currencyPrices?: Maybe<Scalars['JSON']['output']>;
     /** The duration for which the plan is valid (e.g., monthly, yearly). Defaults to 'monthly'. */
     duration?: Maybe<PlanDuration>;
     /** A list of features provided by this plan, such as quotas or special services. */
     features?: Maybe<Array<Maybe<SubscriptionFeatures>>>;
-    /** Geography-specific price overrides. The billing account's country/state/region plus currency decide whether one of these overrides applies. */
+    /**
+     * Geography-specific price overrides. The billing account's country/state/region plus
+     * currency decide whether one of these overrides applies.
+     */
     geoPricingOverrides: Array<GeoPricingOverride>;
     /** The unique identifier for the Plan, automatically generated as a UUID. */
     id?: Maybe<Scalars['ID']['output']>;
@@ -12670,10 +13334,16 @@ export type Plan = {
     price?: Maybe<Scalars['Float']['output']>;
     /** Historical record of price changes for this plan */
     priceHistory: Array<PlanPriceHistory>;
-    /** Per-seat rate used when pricingModel is PER_SEAT. Total charge = pricePerSeat × seatCount. */
+    /**
+     * Per-seat rate used when pricingModel is PER_SEAT.
+     * Total charge = pricePerSeat × seatCount.
+     */
     pricePerSeat?: Maybe<Scalars['Float']['output']>;
-    /** Whether this plan bills at a flat rate or per seat. PER_SEAT plans pass seatCount as quantity to Stripe/Razorpay. */
-    pricingModel?: Maybe<PlanPricingModel>;
+    /**
+     * Whether this plan bills at a flat rate or per seat.
+     * PER_SEAT plans pass seatCount as quantity to Stripe/Razorpay.
+     */
+    pricingModel?: Maybe<PlanPricingModel>;
     /** Which product the plan belongs to (reference to product microservice) */
     productID?: Maybe<Scalars['String']['output']>;
     /** The list of subscriptions associated with this plan. */
@@ -12685,7 +13355,10 @@ export declare enum PlanDuration {
     Monthly = "monthly",
     Yearly = "yearly"
 }
-/** Tracks historical price changes for a Plan. A new record is created whenever a plan's price is updated. */
+/**
+ * Tracks historical price changes for a Plan.
+ * A new record is created whenever a plan's price is updated.
+ */
 export type PlanPriceHistory = {
     __typename?: 'PlanPriceHistory';
     /** Who made the price change (actor ID) */
@@ -12717,7 +13390,11 @@ export type PlanQuotaInput = {
     quotaId: Scalars['ID']['input'];
 };
 export type PlansFilter = {
-    /** Include free plans (price = 0) in the response. Defaults to true. Set to false on user-facing browse pages since free plans are auto-assigned and cannot be purchased. */
+    /**
+     * Include free plans (price = 0) in the response.
+     * Defaults to true. Set to false on user-facing browse pages
+     * since free plans are auto-assigned and cannot be purchased.
+     */
     includeFree?: InputMaybe<Scalars['Boolean']['input']>;
     /** Filter plans by product ID. When set, only plans with this productID are returned. */
     productId?: InputMaybe<Scalars['String']['input']>;
@@ -12734,7 +13411,10 @@ export type PlatformDeliveryResult = {
     /** Whether at least one recipient was delivered successfully */
     success: Scalars['Boolean']['output'];
 };
-/** PlatformProduct entity - resolvable via Federation Gateway. Other services can reference PlatformProduct by id or slug. */
+/**
+ * PlatformProduct entity - resolvable via Federation Gateway.
+ * Other services can reference PlatformProduct by id or slug.
+ */
 export type PlatformProduct = {
     __typename?: 'PlatformProduct';
     /** Number of active users */
@@ -12775,7 +13455,11 @@ export type PlatformProduct = {
     ogImage?: Maybe<Scalars['String']['output']>;
     /** Google Play Store URL */
     playStoreUrl?: Maybe<Scalars['String']['output']>;
-    /** reCAPTCHA secret key (server-side) for backend verification. Only accessible via internal gateway (platformProduct query requires auth). The publicProduct query does NOT resolve this field. */
+    /**
+     * reCAPTCHA secret key (server-side) for backend verification.
+     * Only accessible via internal gateway (platformProduct query requires auth).
+     * The publicProduct query does NOT resolve this field.
+     */
     recaptchaSecretKey?: Maybe<Scalars['String']['output']>;
     /** reCAPTCHA site key (public) for frontend verification */
     recaptchaSiteKey?: Maybe<Scalars['String']['output']>;
@@ -12978,7 +13662,10 @@ export type ProductChartSnapshot = {
     storeId?: Maybe<Scalars['ID']['output']>;
     window: Scalars['String']['output'];
 };
-/** A content page (privacy policy, terms of service, etc.) stored in markdown format. Supports global defaults (productId = null) and per-product overrides. */
+/**
+ * A content page (privacy policy, terms of service, etc.) stored in markdown format.
+ * Supports global defaults (productId = null) and per-product overrides.
+ */
 export type ProductContentPage = {
     __typename?: 'ProductContentPage';
     content: Scalars['String']['output'];
@@ -13371,9 +14058,15 @@ export type PushMfaStatus = {
 /** Root query type */
 export type Query = {
     __typename?: 'Query';
-    /** Placeholder field to allow empty Query type extension. Must be @shareable since it exists in multiple subgraphs. */
+    /**
+     * Placeholder field to allow empty Query type extension.
+     * Must be @shareable since it exists in multiple subgraphs.
+     */
     _empty?: Maybe<Scalars['String']['output']>;
-    /** Health check for the service @rbac(public: true, scopeType: "global") */
+    /**
+     * Health check for the service
+     *   @rbac(public: true, scopeType: "global")
+     */
     _health: Scalars['String']['output'];
     _newsletterSubscriptionsPlaceholder?: Maybe<Scalars['String']['output']>;
     _privacyHealth?: Maybe<Scalars['String']['output']>;
@@ -13381,8 +14074,11 @@ export type Query = {
     actionDefinitions: Array<ActionDefinition>;
     /** Get all active schedules (for background processing) */
     activeSchedules: Array<TourSchedule>;
-    /** Get all active sessions for the current user. The `isCurrent` field indicates which session belongs to this request. */
-    activeSessions: Array<Session>;
+    /**
+     * Get all active sessions for the current user.
+     * The `isCurrent` field indicates which session belongs to this request.
+     */
+    activeSessions: SessionConnection;
     activityLog?: Maybe<ActivityLog>;
     activityLogs: ActivityLogConnection;
     /** Get permission overrides for an actor in a scope */
@@ -13408,7 +14104,7 @@ export type Query = {
     agentProfiles: AgentProfileConnection;
     app?: Maybe<App>;
     /** List API keys for a specific app */
-    appApiKeys: Array<ApiKey>;
+    appApiKeys: ApiKeyConnection;
     /** Get a collection by ID */
     appCollection?: Maybe<AppCollection>;
     /** Get a collection by slug */
@@ -13430,24 +14126,59 @@ export type Query = {
     application?: Maybe<Application>;
     applicationAnalytics: Array<ApplicationAnalytics>;
     applications: ApplicationConnection;
-    /** Internal: get all approved waitlist entries for an email. Used by tenant-svc for product access checks. */
+    /**
+     * Internal: get all approved waitlist entries for an email.
+     * Used by tenant-svc for product access checks.
+     */
     approvedWaitlistProducts: Array<NewsletterWaitlist>;
-    appsActingAsCurrentUser: Array<App>;
+    appsActingAsCurrentUser: AppConnection;
     auditLogs: AuditLogConnection;
     /** List auth audit events visible to the current user. */
-    authAuditLogs: Array<AuthAuditLog>;
+    authAuditLogs: AuthAuditLogConnection;
     authMethodConfig?: Maybe<AuthMethodConfig>;
     authStrategiesHealth: Array<AuthStrategyHealth>;
     automationSteps: Array<AutomationStep>;
     automationSubscribers: Array<AutomationSubscriber>;
     availableAgents: Array<AgentProfile>;
     availableAuthMethods: Array<AuthMethod>;
-    /** Get available preview features the user can opt-in to within a workspace. Returns only flags that are previewable, active, and allowed by workspace admin. Bounded by limit/offset to avoid unbounded fetches. */
+    /**
+     * Get available preview features the user can opt-in to within a workspace.
+     * Returns only flags that are previewable, active, and allowed by workspace admin.
+     * Bounded by limit/offset to avoid unbounded fetches.
+     */
     availableFeaturePreviews: Array<FeatureFlag>;
     bounceStats: BounceStats;
-    /** Browse store products with unified filtering, sorting, and pagination. Search is treated as a filter - all filters combine with AND logic. Example usage: ```graphql query { browseStore(input: { filter: { search: "ai notification" type: NODE pricingModel: FREE minRating: 4.0 compatibleWith: "workspaces" } sortBy: RELEVANCE pagination: { limit: 20, offset: 0 } }) { products { id name rating downloads } totalCount hasMore facets { categories { value count } } } } ``` */
+    /**
+     * Browse store products with unified filtering, sorting, and pagination.
+     * Search is treated as a filter - all filters combine with AND logic.
+     *
+     * Example usage:
+     * ```graphql
+     * query {
+     *   browseStore(input: {
+     *     filter: {
+     *       search: "ai notification"
+     *       type: NODE
+     *       pricingModel: FREE
+     *       minRating: 4.0
+     *       compatibleWith: "workspaces"
+     *     }
+     *     sortBy: RELEVANCE
+     *     pagination: { limit: 20, offset: 0 }
+     *   }) {
+     *     products { id name rating downloads }
+     *     totalCount
+     *     hasMore
+     *     facets { categories { value count } }
+     *   }
+     * }
+     * ```
+     */
     browseStore: BrowseStoreResult;
-    /** Calculate tax for a purchase (preview without creating payment) Used by checkout to show tax breakdown before payment */
+    /**
+     * Calculate tax for a purchase (preview without creating payment)
+     * Used by checkout to show tax breakdown before payment
+     */
     calculateTax: TaxCalculationResult;
     campaign?: Maybe<NewsletterCampaign>;
     campaignBounces: Array<NewsletterBounce>;
@@ -13474,7 +14205,10 @@ export type Query = {
     checkPermissions: Array<PermissionCheckResult>;
     /** Check if a plan has an entitlement for a specific store item */
     checkPlanEntitlement?: Maybe<SubscriptionEntitlement>;
-    /** Check if the current user can access a specific product. Returns access status and reason. */
+    /**
+     * Check if the current user can access a specific product.
+     * Returns access status and reason.
+     */
     checkProductAccess: ProductAccessResult;
     checkQuotaExhausted: QuotaCheckResult;
     /** Check if an actor can see a resource */
@@ -13484,7 +14218,10 @@ export type Query = {
     circuitBreakerStatus?: Maybe<CircuitBreakerState>;
     compareVariants: VariantComparisonResult;
     complaintStats: ComplaintStats;
-    /** Returns compliance-related audit events (consent changes, suppressions, bounces, complaints) for a given platform product, sorted by most recent first. */
+    /**
+     * Returns compliance-related audit events (consent changes, suppressions, bounces, complaints)
+     * for a given platform product, sorted by most recent first.
+     */
     complianceAuditLog: Array<ComplianceAuditLogEntry>;
     complianceSettings?: Maybe<NewsletterComplianceSettings>;
     consentLedger: ConsentRecordConnection;
@@ -13495,19 +14232,25 @@ export type Query = {
     contactInquiry?: Maybe<ContactInquiry>;
     /** Get a single content page by ID */
     contentPage?: Maybe<ProductContentPage>;
-    /** Get a content page by slug and optional product ID. If productId is null, returns the global default page. */
+    /**
+     * Get a content page by slug and optional product ID.
+     * If productId is null, returns the global default page.
+     */
     contentPageBySlug?: Maybe<ProductContentPage>;
     /** List content pages with optional filtering by product */
     contentPages: ProductContentPageList;
-    /** Convert an amount from one currency to another (uses live exchange rates) Default fromCurrency is USD */
+    /**
+     * Convert an amount from one currency to another (uses live exchange rates)
+     * Default fromCurrency is USD
+     */
     convertCurrency: CurrencyConversion;
     currentUser?: Maybe<User>;
-    currentUserApps: Array<App>;
-    currentUserDelegations: Array<AppUserDelegation>;
+    currentUserApps: AppConnection;
+    currentUserDelegations: AppUserDelegationConnection;
     /** List delegations where current user granted access to apps */
-    currentUserGrantedDelegations: Array<AppUserDelegation>;
+    currentUserGrantedDelegations: AppUserDelegationConnection;
     /** List MFA methods configured for the current user. */
-    currentUserMFAMethods: Array<MfaMethodStatus>;
+    currentUserMFAMethods: MfaMethodStatusConnection;
     customerSatisfactionSurvey?: Maybe<CustomerSatisfactionSurvey>;
     customerSatisfactionSurveys: CustomerSatisfactionSurveyConnection;
     deadLetterQueueEntries: DeadLetterQueueConnection;
@@ -13572,9 +14315,27 @@ export type Query = {
     estimateNewsletterRecipients: NewsletterRecipientEstimate;
     /** Estimate shipping for an order with a specific method */
     estimateOrderShipping: OrderShippingEstimate;
-    /** Evaluate feature flags for the current actor in a workspace context. Used by frontend providers for bulk flag evaluation. Returns OpenFeature-compatible ResolutionDetails for each flag. RBAC is scoped to the target workspace via `input.workspaceId`. */
+    /**
+     * Evaluate feature flags for the current actor in a workspace context.
+     * Used by frontend providers for bulk flag evaluation.
+     * Returns OpenFeature-compatible ResolutionDetails for each flag.
+     * RBAC is scoped to the target workspace via `input.workspaceId`.
+     */
     evaluateFeatureFlags: FeatureFlagBulkEvaluation;
+    /**
+     * Synchronous super_admin export of organizations as a CSV string. Returns
+     * inline CSV (RFC-4180 with CWE-1236 protection) plus row count and a
+     * truncated flag indicating the result was capped at the requested limit.
+     */
+    exportOrganizationsCsv: OrganizationCsvExport;
     exportSubscribers: Array<ExportSubscriber>;
+    /**
+     * Synchronous superadmin export of tenants as a CSV string. The wspace-export-svc
+     * pipeline is workspace-scoped (every entity needs `workspace_id`) and therefore
+     * cannot host a global tenant export. Returning the data inline keeps the surface
+     * small; switch to a global-export-svc when the row volume warrants async jobs.
+     */
+    exportTenantsCsv: TenantExport;
     exportTranslations: TranslationsExport;
     faq?: Maybe<Faq>;
     faqs: FaqConnection;
@@ -13586,9 +14347,15 @@ export type Query = {
     /** List feature flags with optional filtering (super admin only) */
     featureFlags: FeatureFlagList;
     featuredProducts: Array<StoreProduct>;
-    /** Get available filter options for a given context. Useful for populating filter dropdowns in UI. */
+    /**
+     * Get available filter options for a given context.
+     * Useful for populating filter dropdowns in UI.
+     */
     filterOptions: FilterOptionsResult;
-    /** Get active subscriptions for a billing account (optimized for dashboard) Only returns subscriptions with status = 'active' */
+    /**
+     * Get active subscriptions for a billing account (optimized for dashboard)
+     * Only returns subscriptions with status = 'active'
+     */
     getActiveSubscriptions: Array<BillingSubscription>;
     /** Get the price change history for a specific addon */
     getAddonPriceHistory: Array<AddonPriceHistory>;
@@ -13606,7 +14373,11 @@ export type Query = {
     /** Get a billing account by ID */
     getBillingAccount?: Maybe<BillingAccount>;
     getBillingAccountCreditTransactions: PaginatedCreditTransactions;
-    /** Get usage summary for all quotas of a billing account. Returns both subscription (PRODUCT_SPECIFIC) and pooled quotas. If productId is provided, filters subscription quotas by that product. */
+    /**
+     * Get usage summary for all quotas of a billing account.
+     * Returns both subscription (PRODUCT_SPECIFIC) and pooled quotas.
+     * If productId is provided, filters subscription quotas by that product.
+     */
     getBillingAccountQuotasSummary: BillingAccountQuotasSummary;
     /** Get all billing accounts for the current org (from context) */
     getBillingAccountsByOrg: Array<BillingAccount>;
@@ -13619,12 +14390,24 @@ export type Query = {
     /** Get a channel by ID */
     getChannel?: Maybe<Channel>;
     getChannelConnectionTags: Array<ChannelConnectionTagAssignment>;
-    /** Get recent delivery attempts for a channel. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. Falls back to offset when `cursor` is absent. */
+    /**
+     * Get recent delivery attempts for a channel.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     * Falls back to offset when `cursor` is absent.
+     */
     getChannelDeliveryAttempts: DeliveryAttemptList;
+    /**
+     * Get organization-level channel settings.
+     * Returns defaults when no settings have been saved yet.
+     */
+    getChannelOrgSettings: ChannelOrgSettings;
     /** Get channel statistics */
     getChannelStats: ChannelStats;
     getChannelTags: Array<ChannelTagAssignment>;
-    /** Get recent webhook events for a channel. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. */
+    /**
+     * Get recent webhook events for a channel.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     */
     getChannelWebhookEvents: WebhookEventList;
     /** Get all channels with optional filtering */
     getChannels: ChannelList;
@@ -13632,19 +14415,29 @@ export type Query = {
     getChannelsByOrganization: ChannelList;
     /** Get channels by platform */
     getChannelsByPlatform: ChannelList;
-    /** Get channels for failover (sorted by priority, ascending). Returns channels for a platform that are enabled for failover. Used by delivery logic for priority-based fallback. */
+    /**
+     * Get channels for failover (sorted by priority, ascending).
+     * Returns channels for a platform that are enabled for failover.
+     * Used by delivery logic for priority-based fallback.
+     */
     getChannelsForFailover: Array<Channel>;
     /** Get a charge by ID */
     getCharge?: Maybe<Charge>;
     /** Get all charges for the current org (from context), optionally filtered by status */
     getCharges: Array<Charge>;
-    /** Get a connection by ID NOTE: Credentials are never returned in queries */
+    /**
+     * Get a connection by ID
+     * NOTE: Credentials are never returned in queries
+     */
     getConnection?: Maybe<ChannelConnection>;
     /** Get connection by channel ID */
     getConnectionByChannel?: Maybe<ChannelConnection>;
     /** Get connection status summary */
     getConnectionStatus: ConnectionStatus;
-    /** Get all connections for an organization. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. */
+    /**
+     * Get all connections for an organization.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     */
     getConnectionsByOrganization: ChannelConnectionList;
     getCostOfCredits: CreditCost;
     /** Get a coupon by ID */
@@ -13653,14 +14446,22 @@ export type Query = {
     getCouponByCode?: Maybe<Coupon>;
     /** Get coupon usage history */
     getCouponUsageHistory: CouponUsageListResponse;
-    /** Get credit balance broken down by type (purchased, earned, granted, withdrawable). Computed from the transaction ledger — use this for withdrawal eligibility checks. */
+    /**
+     * Get credit balance broken down by type (purchased, earned, granted, withdrawable).
+     * Computed from the transaction ledger — use this for withdrawal eligibility checks.
+     */
     getCreditBalanceByType: CreditBalanceByType;
     /** Get credit notes for the current org (from context) */
     getCreditNotes: Array<CreditNote>;
     getCreditTransactionDetails: CreditTransaction;
     /** Get the default/first billing account for the current org (from context) */
     getDefaultBillingAccount?: Maybe<BillingAccount>;
-    /** Get the default billing account for a specific organization by orgId. Returns the billing account where isDefault = true for the given orgId. If no default is set, returns the first active billing account. Used by gateway for automatic billing account resolution in usage tracking. */
+    /**
+     * Get the default billing account for a specific organization by orgId.
+     * Returns the billing account where isDefault = true for the given orgId.
+     * If no default is set, returns the first active billing account.
+     * Used by gateway for automatic billing account resolution in usage tracking.
+     */
     getDefaultBillingAccountByOrgId?: Maybe<BillingAccount>;
     /** Get the default payment method for a billing account */
     getDefaultPaymentMethod?: Maybe<PaymentMethod>;
@@ -13678,11 +14479,20 @@ export type Query = {
     getEntitlement?: Maybe<SubscriptionEntitlement>;
     /** Get external OIDC configuration for a tenant (Google, Microsoft, etc.) */
     getExternalOIDCConfig?: Maybe<ExternalOidcConfiguration>;
-    /** Get billing orders with failed callbacks (admin only) Useful for monitoring and manual retry */
+    /**
+     * Get billing orders with failed callbacks (admin only)
+     * Useful for monitoring and manual retry
+     */
     getFailedBillingOrderCallbacks: FailedBillingOrderCallbacksResponse;
-    /** Get failed delivery attempts for retry. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. */
+    /**
+     * Get failed delivery attempts for retry.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     */
     getFailedDeliveryAttempts: DeliveryAttemptList;
-    /** Get failed webhook events for retry. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. */
+    /**
+     * Get failed webhook events for retry.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     */
     getFailedWebhookEvents: WebhookEventList;
     /** Get an invoice by ID */
     getInvoice?: Maybe<Invoice>;
@@ -13708,7 +14518,10 @@ export type Query = {
     getPaymentFailures: Array<PaymentFailure>;
     /** Get payment methods for a billing account */
     getPaymentMethods: Array<PaymentMethod>;
-    /** Get payment provider configuration for frontend integration Returns public keys only (safe to expose to client) */
+    /**
+     * Get payment provider configuration for frontend integration
+     * Returns public keys only (safe to expose to client)
+     */
     getPaymentProviderConfig: PaymentProviderConfig;
     /** Get all payments for the current org (from context), optionally filtered by status */
     getPayments: Array<Payment>;
@@ -13731,7 +14544,10 @@ export type Query = {
     getReferralCodeByCode?: Maybe<ReferralCode>;
     /** Get a single refund record by ID */
     getRefundRecord?: Maybe<RefundRecord>;
-    /** Get refund records with filters and pagination (for admin dashboard). Uses orgId from context by default. Super admins can override with orgIdFilter. */
+    /**
+     * Get refund records with filters and pagination (for admin dashboard).
+     * Uses orgId from context by default. Super admins can override with orgIdFilter.
+     */
     getRefundRecords: PaginatedRefundRecords;
     /** Get refund statistics (counts and amounts) */
     getRefundStats: RefundStats;
@@ -13748,7 +14564,12 @@ export type Query = {
     getStoreProductTags: Array<StoreProductTagAssignment>;
     /** Get a subscription by ID */
     getSubscription?: Maybe<BillingSubscription>;
-    /** Enhanced subscription overview with better pagination and filtering @param includeExpired - Include past/canceled/expired subscriptions (default: false) @param onlyExpired - Only fetch past subscriptions for lazy loading (default: false) @param searchQuery - Search quotas by name in database (case-insensitive) */
+    /**
+     * Enhanced subscription overview with better pagination and filtering
+     * @param includeExpired - Include past/canceled/expired subscriptions (default: false)
+     * @param onlyExpired - Only fetch past subscriptions for lazy loading (default: false)
+     * @param searchQuery - Search quotas by name in database (case-insensitive)
+     */
     getSubscriptionUsageOverview?: Maybe<Array<SubscriptionWithQuotas>>;
     getSubscriptionUsages: SubscriptionQuotaUsageWithFilter;
     /** Get tax rates */
@@ -13771,7 +14592,10 @@ export type Query = {
     getWebhookStats: WebhookStats;
     /** Health check endpoint */
     health: HealthStatus;
-    /** Get grouped products for homepage. Optionally filter by compatible product (e.g., "bigconsole", "fluidgrids"). */
+    /**
+     * Get grouped products for homepage.
+     * Optionally filter by compatible product (e.g., "bigconsole", "fluidgrids").
+     */
     homeGroupedProducts: GroupedStoreProducts;
     homepageSections: Array<HomepageSection>;
     i18nModule?: Maybe<I18nModule>;
@@ -13786,7 +14610,12 @@ export type Query = {
     /** Initiate HTTP Digest auth challenge */
     initiateDigestChallenge: DigestChallengeResult;
     inventoryAdjustments: Array<InventoryAdjustment>;
-    /** Fast check for a single (app, workspace) pair. Used by wspace-auth-svc via the internal global gateway before issuing a workspace token to an app actor. Public (no actor RBAC) because the internal gateway is the only caller and it trusts the x-actor-* headers it injects. */
+    /**
+     * Fast check for a single (app, workspace) pair. Used by wspace-auth-svc via
+     * the internal global gateway before issuing a workspace token to an app
+     * actor. Public (no actor RBAC) because the internal gateway is the only
+     * caller and it trusts the x-actor-* headers it injects.
+     */
     isAppAuthorizedForWorkspace: Scalars['Boolean']['output'];
     isAppInstalled?: Maybe<StoreAppInstallation>;
     isEmailSuppressed: Scalars['Boolean']['output'];
@@ -13807,32 +14636,59 @@ export type Query = {
     listCoupons: CouponsListResponse;
     /** List all referral codes (admin) */
     listReferralCodes: ReferralCodesListResponse;
-    /** List all platform connections for a channel. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. */
+    /**
+     * List all platform connections for a channel.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     */
     listUserPlatformConnectionsByChannel: UserPlatformConnectionList;
-    /** List all platform connections for an organization. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. */
+    /**
+     * List all platform connections for an organization.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     */
     listUserPlatformConnectionsByOrganization: UserPlatformConnectionList;
-    /** List all platform connections for a given internal user. Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`. */
+    /**
+     * List all platform connections for a given internal user.
+     * Supports cursor pagination — pass `cursor` from the previous page's `nextCursor`.
+     */
     listUserPlatformConnectionsByUser: UserPlatformConnectionList;
     lookupAffiliateCode?: Maybe<AffiliateCode>;
     lowStockProducts: Array<LowStockProduct>;
-    /** Returns products the current user can access based on their actor type, email domain, and waitlist approval status. Used by app shells for nav. */
+    /**
+     * Returns products the current user can access based on their actor type,
+     * email domain, and waitlist approval status. Used by app shells for nav.
+     */
     myAccessibleProducts: PlatformProductList;
     myActivityLogs: ActivityLogConnection;
     myAffiliateCodes: AffiliateCodeConnection;
     myAgentProfile?: Maybe<AgentProfile>;
     /** List API keys for current user's apps */
-    myApiKeys: Array<ApiKey>;
+    myApiKeys: ApiKeyConnection;
     /** Get my installations */
     myAppInstallations: AppInstallationConnection;
     /** Get my review for an application */
     myAppReview?: Maybe<AppReview>;
-    /** Get all workspaces the actor is authorized to access Returns list with basic routing details (name, workspaceId, publicUrl) */
+    /**
+     * Get all workspaces the actor is authorized to access
+     * Returns list with basic routing details (name, workspaceId, publicUrl)
+     */
     myAuthorizedWorkspaces: WorkspaceRoutingList;
     /** Get the current user's active cart */
     myCart?: Maybe<Cart>;
-    /** Get the authenticated caller's own contact inquiries. Matches by email (case-insensitive). The public `submitContactInquiry` mutation stores submissions with `createdBy = "anonymous"`, so there is no userId to filter on; scoping by the gateway-forwarded email is the only reliable way to link a signed-in user back to their earlier anonymous submissions. */
+    /**
+     * Get the authenticated caller's own contact inquiries.
+     *
+     * Matches by email (case-insensitive). The public `submitContactInquiry`
+     * mutation stores submissions with `createdBy = "anonymous"`, so there is no
+     * userId to filter on; scoping by the gateway-forwarded email is the only
+     * reliable way to link a signed-in user back to their earlier anonymous
+     * submissions.
+     */
     myContactInquiries: ContactInquiryList;
-    /** Get the current user's dashboard widget layout preferences. Returns the dashboard configuration JSON from preferences, or null if no customization has been saved (frontend uses defaults). */
+    /**
+     * Get the current user's dashboard widget layout preferences.
+     * Returns the dashboard configuration JSON from preferences,
+     * or null if no customization has been saved (frontend uses defaults).
+     */
     myDashboardPreferences?: Maybe<Scalars['JSON']['output']>;
     /** Get my developer organizations (where I'm a member) */
     myDeveloperOrganizations: Array<DeveloperOrganization>;
@@ -13857,16 +14713,25 @@ export type Query = {
     myPayoutRequests: PayoutRequestConnection;
     /** Get my pending invitations */
     myPendingInvitations: Array<DeveloperOrgInvitation>;
-    /** Get current user's permissions in a scope (self-service). Returns full permission details including roles, permission strings, and cache TTL. */
+    /**
+     * Get current user's permissions in a scope (self-service).
+     * Returns full permission details including roles, permission strings, and cache TTL.
+     */
     myPermissions: EffectivePermissions;
-    /** Get the current user's full preferences record. Creates a default record if none exists. */
+    /**
+     * Get the current user's full preferences record.
+     * Creates a default record if none exists.
+     */
     myPreferences?: Maybe<UserPreference>;
     /** List user's registered public keys */
     myPublicKeys: Array<PublicKeyInfo>;
     /** Get the current user's publisher profile, or null if none exists yet. */
     myPublisher?: Maybe<Publisher>;
     myReviews: Array<ProductReview>;
-    /** Get current user's roles in a scope (lightweight, self-service). Use this for quick role checks without fetching full permissions. */
+    /**
+     * Get current user's roles in a scope (lightweight, self-service).
+     * Use this for quick role checks without fetching full permissions.
+     */
     myRoles: MyRolesResult;
     myStoreAppInstallations: StoreAppInstallationConnection;
     /** Stores the current user is subscribed to (auto-includes public stores). */
@@ -13877,14 +14742,24 @@ export type Query = {
     myTenants: TenantList;
     /** Get unread notification count for authenticated user */
     myUnreadNotificationCount: Scalars['Int']['output'];
-    /** Get the current authenticated user's platform connection for a given channel. Uses the actor's internal user ID from request context — no internalUserId argument needed. Returns null if the user has not connected this channel. */
+    /**
+     * Get the current authenticated user's platform connection for a given channel.
+     * Uses the actor's internal user ID from request context — no internalUserId
+     * argument needed. Returns null if the user has not connected this channel.
+     */
     myUserPlatformConnection?: Maybe<UserPlatformConnection>;
-    /** Public: check waitlist status by email + product. Returns null if not on waitlist. Rate-limited at API gateway level. */
+    /**
+     * Public: check waitlist status by email + product. Returns null if not on waitlist.
+     * Rate-limited at API gateway level.
+     */
     myWaitlistStatus?: Maybe<NewsletterWaitlist>;
     /** List user's linked wallets */
     myWallets: Array<WalletInfo>;
     myWishlist: Array<UserWishlist>;
-    /** Get workspaces where the current user is a member Self-service query - returns only the authenticated user's workspaces */
+    /**
+     * Get workspaces where the current user is a member
+     * Self-service query - returns only the authenticated user's workspaces
+     */
     myWorkspaces: WorkspaceList;
     newsletter?: Maybe<Newsletter>;
     newsletterAutomation?: Maybe<NewsletterAutomation>;
@@ -13934,6 +14809,12 @@ export type Query = {
     orderFulfillment?: Maybe<OrderFulfillment>;
     /** Get a single organization by ID */
     organization?: Maybe<Organization>;
+    /**
+     * Paginated keyset connection over the persistent OrganizationAuditLog table.
+     * Returns audit events for a single organization, newest first. Supports
+     * optional filtering by `action` (event name) and `actorId`.
+     */
+    organizationAuditLogsConnection: OrganizationAuditLogConnection;
     /** Get an organization by slug within a tenant */
     organizationBySlug?: Maybe<Organization>;
     /** Get pending invites for an organization (admin view) */
@@ -13979,25 +14860,52 @@ export type Query = {
     productOrders: ItemOrdersList;
     productReleases: Array<ProductRelease>;
     productReviews: Array<ProductReview>;
-    /** Get shortcuts for a specific product (includes global shortcuts). Bounded by limit/offset to avoid unbounded fetches. */
+    /**
+     * Get shortcuts for a specific product (includes global shortcuts).
+     * Bounded by limit/offset to avoid unbounded fetches.
+     */
     productShortcuts: Array<KeyboardShortcut>;
     /** Get product-level tour statistics */
     productTourStatistics: ProductTourStatistics;
     products: Array<StoreProduct>;
     pseudoLocaleStats: PseudoLocaleStats;
-    /** Get all active addons for a specific product (public, no authentication required). Used by product website pricing pages. Only returns active addons. */
+    /**
+     * Get all active addons for a specific product (public, no authentication required).
+     * Used by product website pricing pages.
+     * Only returns active addons.
+     */
     publicAddons: Array<Addon>;
-    /** Get a public content page by slug and optional product ID. Only returns pages with visibility=PUBLIC and isPublished=true. */
+    /**
+     * Get a public content page by slug and optional product ID.
+     * Only returns pages with visibility=PUBLIC and isPublished=true.
+     */
     publicContentPage?: Maybe<ProductContentPage>;
-    /** List public content pages for a product. Only returns pages with visibility=PUBLIC and isPublished=true. */
+    /**
+     * List public content pages for a product.
+     * Only returns pages with visibility=PUBLIC and isPublished=true.
+     */
     publicContentPages: ProductContentPageList;
-    /** Get all active plans for a specific product (public, no authentication required). Used by product website pricing pages. Only returns active plans with their features. */
+    /**
+     * Get all active plans for a specific product (public, no authentication required).
+     * Used by product website pricing pages.
+     * Only returns active plans with their features.
+     */
     publicPlans: Array<Plan>;
-    /** Get a platform product by slug (public, no auth required). Returns only ACTIVE or WAITLIST products. Does NOT expose sensitive fields like recaptchaSecretKey. */
+    /**
+     * Get a platform product by slug (public, no auth required).
+     * Returns only ACTIVE or WAITLIST products.
+     * Does NOT expose sensitive fields like recaptchaSecretKey.
+     */
     publicProduct?: Maybe<PlatformProduct>;
-    /** Get all platform products (public, no auth required). Returns only ACTIVE or WAITLIST products (WAITLIST products are visible for waitlist signup). */
+    /**
+     * Get all platform products (public, no auth required).
+     * Returns only ACTIVE or WAITLIST products (WAITLIST products are visible for waitlist signup).
+     */
     publicProducts: PlatformProductList;
-    /** Resolve a public content page for a product with template variable replacement. Only returns pages with visibility=PUBLIC and isPublished=true. */
+    /**
+     * Resolve a public content page for a product with template variable replacement.
+     * Only returns pages with visibility=PUBLIC and isPublished=true.
+     */
     publicResolvedContentPage?: Maybe<ProductContentPage>;
     publicScheduleTemplates: ScheduleTemplateConnection;
     publishedProducts: Array<StoreProduct>;
@@ -14012,7 +14920,11 @@ export type Query = {
     recentArticles: Array<KnowledgeBaseArticle>;
     releaseAuditEvents: Array<ProductReleaseAuditEvent>;
     releaseTracks: Array<ReleaseTrack>;
-    /** Resolve the effective content page for a product. Returns the product-specific page if it exists, otherwise the global default. Template variables in content (e.g. {{productName}}) are replaced with product data. */
+    /**
+     * Resolve the effective content page for a product.
+     * Returns the product-specific page if it exists, otherwise the global default.
+     * Template variables in content (e.g. {{productName}}) are replaced with product data.
+     */
     resolvedContentPage?: Maybe<ProductContentPage>;
     /** Get a specific registered resource by ID */
     resource?: Maybe<Resource>;
@@ -14048,7 +14960,11 @@ export type Query = {
     searchFAQs: Array<Faq>;
     searchKnowledgeBase: Array<KnowledgeBaseArticle>;
     searchProducts: Array<StoreProduct>;
-    /** Get search suggestions for autocomplete. Returns suggestions from product names, tags, categories, and authors. Uses trigram matching for fuzzy search. */
+    /**
+     * Get search suggestions for autocomplete.
+     * Returns suggestions from product names, tags, categories, and authors.
+     * Uses trigram matching for fuzzy search.
+     */
     searchSuggestions: Array<SearchSuggestion>;
     searchTicketTemplates: Array<TicketTemplate>;
     searchTickets: Array<SupportTicket>;
@@ -14060,7 +14976,26 @@ export type Query = {
     /** Fetch a store by id or slug. */
     store?: Maybe<Store>;
     storeAppInstallation?: Maybe<StoreAppInstallation>;
-    /** Get detailed product information for the app details page. Includes product data, reviews, related products, publisher info, and version history. Automatically increments view count. Example usage: ```graphql query { storeProductDetails(input: { id: "product-123" }) { product { id name description manifest rating downloads } reviews { id rating comment } relatedProducts { id name icon } publisher { id name isVerified } versions { id version status } userReview { id rating } isPurchased } } ``` */
+    /**
+     * Get detailed product information for the app details page.
+     * Includes product data, reviews, related products, publisher info, and version history.
+     * Automatically increments view count.
+     *
+     * Example usage:
+     * ```graphql
+     * query {
+     *   storeProductDetails(input: { id: "product-123" }) {
+     *     product { id name description manifest rating downloads }
+     *     reviews { id rating comment }
+     *     relatedProducts { id name icon }
+     *     publisher { id name isVerified }
+     *     versions { id version status }
+     *     userReview { id rating }
+     *     isPurchased
+     *   }
+     * }
+     * ```
+     */
     storeProductDetails: StoreProductDetailsResult;
     /** List all stores the caller can see. */
     stores: Array<Store>;
@@ -14090,7 +15025,11 @@ export type Query = {
     tenant?: Maybe<Tenant>;
     /** Get a tenant by slug */
     tenantBySlug?: Maybe<Tenant>;
-    /** Get tenant routing info by ID. Lightweight query for gateway routing decisions. Returns type (SHARED/DEDICATED), endpoint, and status. */
+    /**
+     * Get tenant routing info by ID.
+     * Lightweight query for gateway routing decisions.
+     * Returns type (SHARED/DEDICATED), endpoint, and status.
+     */
     tenantRoutingInfo?: Maybe<TenantRoutingInfo>;
     /** List all tenants with optional filtering and pagination */
     tenants: TenantList;
@@ -14130,7 +15069,12 @@ export type Query = {
     tourUserProgressList: Array<TourUserProgress>;
     /** Get tours with optional filtering and pagination */
     tours: ToursResponse;
-    /** Get tours for a specific context (product/module/page). Public endpoint consumed by frontend SDKs without authentication (the resolver returns published, active, in-window tours and uses an anonymous actor id). See spec global-specs/modules/tours/RBAC.md:34. */
+    /**
+     * Get tours for a specific context (product/module/page).
+     * Public endpoint consumed by frontend SDKs without authentication
+     * (the resolver returns published, active, in-window tours and uses an
+     * anonymous actor id). See spec global-specs/modules/tours/RBAC.md:34.
+     */
     toursForContext: Array<Tour>;
     translation?: Maybe<Translation>;
     translationAudit: TranslationAuditList;
@@ -14141,24 +15085,35 @@ export type Query = {
     translationKeys: TranslationKeyList;
     translationStats: Scalars['JSON']['output'];
     translations: TranslationList;
-    /** Get popular/trending search terms. Useful for showing suggestions when search input is empty. */
+    /**
+     * Get popular/trending search terms.
+     * Useful for showing suggestions when search input is empty.
+     */
     trendingSearches: Array<Scalars['String']['output']>;
     /** Get a user by ID (admin only) */
     user?: Maybe<User>;
     /** Get total count of users (for analytics) */
     userCount: Scalars['Int']['output'];
-    /** Get a user's feature flag preferences in a workspace. Bounded by limit/offset to avoid unbounded fetches. */
+    /**
+     * Get a user's feature flag preferences in a workspace.
+     * Bounded by limit/offset to avoid unbounded fetches.
+     */
     userFeatureFlagPreferences: Array<UserFeatureFlagPreference>;
     userLanguagePreference?: Maybe<UserLanguagePreference>;
     /** Check if the current user has reviewed a specific product */
     userReviewForProduct?: Maybe<ProductReview>;
+    /** Get tags assigned to a user */
+    userTags: Array<UserTagAssignment>;
     /** Get all of a user's progress across tours */
     userTourProgresses: Array<TourUserProgress>;
     /** List users with filtering and pagination (admin only) */
     users: UserConnection;
     /** Validate a coupon code for a specific order */
     validateCoupon: ValidateCouponResponse;
-    /** Validate a license key without modifying state. Used by vibecontrols agents + wspace services to check license validity before plugin load. */
+    /**
+     * Validate a license key without modifying state. Used by vibecontrols
+     * agents + wspace services to check license validity before plugin load.
+     */
     validateLicense: LicenseValidationResult;
     validatePromoCode: PromoCodeValidationResult;
     /** Get visibility rules for a resource */
@@ -14176,13 +15131,23 @@ export type Query = {
     workspaceAnalyticsSummary: WorkspaceTourAnalyticsSummary;
     /** Get a workspace by slug within a tenant */
     workspaceBySlug?: Maybe<Workspace>;
-    /** Get workspace overrides for a specific workspace. Bounded by limit/offset to avoid unbounded fetches. */
+    /**
+     * Get workspace overrides for a specific workspace.
+     * Bounded by limit/offset to avoid unbounded fetches.
+     */
     workspaceFeatureFlagOverrides: Array<WorkspaceFeatureFlagOverride>;
     /** Get members of a workspace */
     workspaceMembers: WorkspaceMemberList;
-    /** Get public details of a workspace by ID Returns public info if actor is authorized */
+    /**
+     * Get public details of a workspace by ID
+     * Returns public info if actor is authorized
+     */
     workspacePublicDetails?: Maybe<WorkspacePublicDetails>;
-    /** Get workspace routing info by ID Returns workspace name, endpoint (publicUrl), region for routing purposes Requires actor to be a member of the workspace */
+    /**
+     * Get workspace routing info by ID
+     * Returns workspace name, endpoint (publicUrl), region for routing purposes
+     * Requires actor to be a member of the workspace
+     */
     workspaceRouting?: Maybe<WorkspaceRouting>;
     /** Get workspace store orders with pagination */
     workspaceStoreOrders: StoreOrdersResult;
@@ -14818,11 +15783,21 @@ export type QueryEvaluateFeatureFlagsArgs = {
     input: EvaluateFeatureFlagsInput;
 };
 /** Root query type */
+export type QueryExportOrganizationsCsvArgs = {
+    filter?: InputMaybe<OrganizationFilterInput>;
+    limit?: InputMaybe<Scalars['Int']['input']>;
+};
+/** Root query type */
 export type QueryExportSubscribersArgs = {
     platformProductId?: InputMaybe<Scalars['String']['input']>;
     subscribed?: InputMaybe<Scalars['Boolean']['input']>;
 };
 /** Root query type */
+export type QueryExportTenantsCsvArgs = {
+    filter?: InputMaybe<TenantFilterInput>;
+    limit?: InputMaybe<Scalars['Int']['input']>;
+};
+/** Root query type */
 export type QueryExportTranslationsArgs = {
     format: ImportJobFormat;
     languageCode?: InputMaybe<Scalars['String']['input']>;
@@ -14955,6 +15930,10 @@ export type QueryGetChannelDeliveryAttemptsArgs = {
     limit?: InputMaybe<Scalars['Int']['input']>;
 };
 /** Root query type */
+export type QueryGetChannelOrgSettingsArgs = {
+    organizationId: Scalars['ID']['input'];
+};
+/** Root query type */
 export type QueryGetChannelStatsArgs = {
     id: Scalars['ID']['input'];
 };
@@ -15793,6 +16772,14 @@ export type QueryOrganizationArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root query type */
+export type QueryOrganizationAuditLogsConnectionArgs = {
+    action?: InputMaybe<Scalars['String']['input']>;
+    actorId?: InputMaybe<Scalars['ID']['input']>;
+    after?: InputMaybe<Scalars['String']['input']>;
+    first?: InputMaybe<Scalars['Int']['input']>;
+    organizationId: Scalars['ID']['input'];
+};
+/** Root query type */
 export type QueryOrganizationBySlugArgs = {
     slug: Scalars['String']['input'];
     tenantId: Scalars['String']['input'];
@@ -16473,6 +17460,10 @@ export type QueryUserReviewForProductArgs = {
     productId: Scalars['String']['input'];
 };
 /** Root query type */
+export type QueryUserTagsArgs = {
+    userId: Scalars['ID']['input'];
+};
+/** Root query type */
 export type QueryUserTourProgressesArgs = {
     pagination?: InputMaybe<TourPagination>;
     userId?: InputMaybe<Scalars['ID']['input']>;
@@ -16593,7 +17584,12 @@ export type Quota = {
     name?: Maybe<Scalars['String']['output']>;
     /** Defines whether this quota template is pooled (shared across products) or product-specific. */
     quotaType?: Maybe<QuotaType>;
-    /** When does usage reset for assignments of this quota? NEVER = static limit (seats, agents, storage cap) DAILY = resets each day at midnight UTC (API requests/day, AI sessions/day) MONTHLY = resets at the start of each billing cycle */
+    /**
+     * When does usage reset for assignments of this quota?
+     * NEVER = static limit (seats, agents, storage cap)
+     * DAILY = resets each day at midnight UTC (API requests/day, AI sessions/day)
+     * MONTHLY = resets at the start of each billing cycle
+     */
     resetPeriod?: Maybe<QuotaResetPeriod>;
     /** A Quota is reusable or not (e.g., bot,seats). */
     reusable?: Maybe<Scalars['Boolean']['output']>;
@@ -16618,7 +17614,11 @@ export type QuotaAssignment = {
     endtime?: Maybe<Scalars['DateTime']['output']>;
     /** The unique identifier for the QuotaAssignment, automatically generated as a UUID. */
     id?: Maybe<Scalars['ID']['output']>;
-    /** When limits were last restored to their original value by the reset job. Null means this assignment has never been reset in-place. The daily QuotaResetWorkflow uses this to find assignments that need resetting. */
+    /**
+     * When limits were last restored to their original value by the reset job.
+     * Null means this assignment has never been reset in-place.
+     * The daily QuotaResetWorkflow uses this to find assignments that need resetting.
+     */
     lastResetAt?: Maybe<Scalars['DateTime']['output']>;
     /** A JSON object defining the limits associated with the assigned quota (e.g., data caps, usage limits). */
     limits?: Maybe<Scalars['JSON']['output']>;
@@ -16626,7 +17626,10 @@ export type QuotaAssignment = {
     name?: Maybe<Scalars['String']['output']>;
     /** The type of quota - POOLED (billing account level) or PRODUCT_SPECIFIC (subscription level). */
     quotaType?: Maybe<QuotaType>;
-    /** Copied from parent Quota.resetPeriod at creation. Tells the reset job how often limits.value should be restored. DAILY = restore every midnight UTC. */
+    /**
+     * Copied from parent Quota.resetPeriod at creation. Tells the reset job how often
+     * limits.value should be restored. DAILY = restore every midnight UTC.
+     */
     resetPeriod?: Maybe<QuotaResetPeriod>;
     /** A Quota is reusable or not (e.g., bot,seats). */
     reusable?: Maybe<Scalars['Boolean']['output']>;
@@ -17191,10 +18194,18 @@ export type RegisterProductAssetInput = {
     caption?: InputMaybe<Scalars['String']['input']>;
     fileName?: InputMaybe<Scalars['String']['input']>;
     fileType: ProductAssetType;
-    /** File ID returned from wspace-files-svc's completeUpload mutation. The browser uploads the file directly to files-svc, then calls this mutation to link it to the product. */
+    /**
+     * File ID returned from wspace-files-svc's completeUpload mutation.
+     * The browser uploads the file directly to files-svc, then calls this
+     * mutation to link it to the product.
+     */
     filesSvcId: Scalars['ID']['input'];
     locale?: InputMaybe<Scalars['String']['input']>;
-    /** If true (default), marks previous assets of the same fileType+locale as no longer current. Set to false to keep multiple live copies (e.g. when building a screenshot gallery). */
+    /**
+     * If true (default), marks previous assets of the same fileType+locale as
+     * no longer current. Set to false to keep multiple live copies (e.g. when
+     * building a screenshot gallery).
+     */
     makeCurrent?: InputMaybe<Scalars['Boolean']['input']>;
     mimeType?: InputMaybe<Scalars['String']['input']>;
     orderIndex?: InputMaybe<Scalars['Int']['input']>;
@@ -17328,7 +18339,11 @@ export type ResolveContextWidgetConversationInput = {
     title?: InputMaybe<Scalars['String']['input']>;
     workspaceId: Scalars['ID']['input'];
 };
-/** Registered resource with custom permission configurations. Resources are only registered when they have non-default permissions (overrides, visibility rules, or scoped assignments). */
+/**
+ * Registered resource with custom permission configurations.
+ * Resources are only registered when they have non-default permissions
+ * (overrides, visibility rules, or scoped assignments).
+ */
 export type Resource = {
     __typename?: 'Resource';
     children: Array<Resource>;
@@ -17953,6 +18968,13 @@ export type Session = {
     status: SessionStatus;
     userAgent?: Maybe<Scalars['String']['output']>;
 };
+/** Paginated list of sessions */
+export type SessionConnection = {
+    __typename?: 'SessionConnection';
+    hasMore: Scalars['Boolean']['output'];
+    sessions: Array<Session>;
+    totalCount: Scalars['Int']['output'];
+};
 export declare enum SessionStatus {
     Active = "ACTIVE",
     Expired = "EXPIRED",
@@ -18207,17 +19229,32 @@ export type SpendCreditResponse = {
 export type SpendCreditsInput = {
     addOnIds?: InputMaybe<Array<InputMaybe<AddOnInputPayment>>>;
     billingAccountId: Scalars['String']['input'];
-    /** For plan downgrades — the active higher-tier subscription ID. Old subscription's auto-renewal is cancelled so it won't charge again; it stays active until natural expiry and then the new plan continues. */
+    /**
+     * For plan downgrades — the active higher-tier subscription ID.
+     * Old subscription's auto-renewal is cancelled so it won't charge again;
+     * it stays active until natural expiry and then the new plan continues.
+     */
     downgradeFromSubscriptionId?: InputMaybe<Scalars['String']['input']>;
     isAnnual?: InputMaybe<Scalars['Boolean']['input']>;
     /** Order ID to purchase using credits (for store orders, etc.) */
     orderId?: InputMaybe<Scalars['String']['input']>;
     planId?: InputMaybe<Scalars['String']['input']>;
-    /** Number of seats for PER_SEAT plans. Stored on the created subscription. Credits required = pricePerSeat × seatCount × creditsPerUSD (instead of plan.price). Ignored for FLAT_RATE plans. */
+    /**
+     * Number of seats for PER_SEAT plans. Stored on the created subscription.
+     * Credits required = pricePerSeat × seatCount × creditsPerUSD (instead of plan.price).
+     * Ignored for FLAT_RATE plans.
+     */
     seatCount?: InputMaybe<Scalars['Int']['input']>;
-    /** For addon purchases - the subscription ID to attach addons to. Required if billing account has multiple active subscriptions. If only one active subscription exists, it will be auto-selected. */
+    /**
+     * For addon purchases - the subscription ID to attach addons to.
+     * Required if billing account has multiple active subscriptions.
+     * If only one active subscription exists, it will be auto-selected.
+     */
     subscriptionId?: InputMaybe<Scalars['String']['input']>;
-    /** For plan upgrades - the subscription ID to upgrade from. Old quotas will be moved to the new subscription. */
+    /**
+     * For plan upgrades - the subscription ID to upgrade from.
+     * Old quotas will be moved to the new subscription.
+     */
     upgradeFromSubscriptionId?: InputMaybe<Scalars['String']['input']>;
 };
 export type Store = {
@@ -18281,7 +19318,10 @@ export type StoreFacets = {
     /** Available types with counts */
     types: Array<FacetCount>;
 };
-/** Unified filter input for browsing/searching store products. All filters combine with AND logic - search is treated as a filter. */
+/**
+ * Unified filter input for browsing/searching store products.
+ * All filters combine with AND logic - search is treated as a filter.
+ */
 export type StoreFilterInput = {
     /** Filter by author name (partial match) */
     authorName?: InputMaybe<Scalars['String']['input']>;
@@ -18291,7 +19331,10 @@ export type StoreFilterInput = {
     categories?: InputMaybe<Array<Scalars['String']['input']>>;
     /** Filter by exact category match (e.g., "Customer Support", "Notification") */
     category?: InputMaybe<Scalars['String']['input']>;
-    /** Filter by compatible product (e.g., "workspaces", "fluidgrids", "bigconsole") Products must be compatible with this product. */
+    /**
+     * Filter by compatible product (e.g., "workspaces", "fluidgrids", "bigconsole")
+     * Products must be compatible with this product.
+     */
     compatibleWith?: InputMaybe<Scalars['String']['input']>;
     /** Filter only featured products */
     featured?: InputMaybe<Scalars['Boolean']['input']>;
@@ -18321,11 +19364,24 @@ export type StoreFilterInput = {
     publisherId?: InputMaybe<Scalars['String']['input']>;
     /** Filter products that require shipping */
     requiresShipping?: InputMaybe<Scalars['Boolean']['input']>;
-    /** Full-text search query. Searches across: - name (highest priority) - description - tags - authorName, category (lowest priority) Uses PostgreSQL tsvector with weighted ranking. */
+    /**
+     * Full-text search query. Searches across:
+     * - name (highest priority)
+     * - description
+     * - tags
+     * - authorName, category (lowest priority)
+     * Uses PostgreSQL tsvector with weighted ranking.
+     */
     search?: InputMaybe<Scalars['String']['input']>;
     /** Filter by product status (defaults to PUBLISHED for consumer queries) */
     status?: InputMaybe<ProductStatus>;
-    /** Filter by type-specific subtype. Examples: - For AGENT: "task_automation", "conversational", "research" - For NODE: "action", "trigger", "integration", "ai" - For WIDGET: "chart", "metric", "table", "map" */
+    /**
+     * Filter by type-specific subtype.
+     * Examples:
+     * - For AGENT: "task_automation", "conversational", "research"
+     * - For NODE: "action", "trigger", "integration", "ai"
+     * - For WIDGET: "chart", "metric", "table", "map"
+     */
     subType?: InputMaybe<Scalars['String']['input']>;
     /** Filter by multiple subtypes (OR within this filter) */
     subTypes?: InputMaybe<Array<Scalars['String']['input']>>;
@@ -18350,7 +19406,12 @@ export declare enum StoreInstallationStatus {
     Pending = "PENDING",
     Uninstalled = "UNINSTALLED"
 }
-/** StoreItem entity reference. The actual StoreItem is defined in the Store service. In Federation 2 setup, this will be marked with @key directive. For now, this is a reference type that returns the itemId for the Gateway to resolve. */
+/**
+ * StoreItem entity reference.
+ * The actual StoreItem is defined in the Store service.
+ * In Federation 2 setup, this will be marked with @key directive.
+ * For now, this is a reference type that returns the itemId for the Gateway to resolve.
+ */
 export type StoreItem = {
     __typename?: 'StoreItem';
     /** The unique identifier for the store item */
@@ -18377,7 +19438,11 @@ export type StoreLineItemInput = {
     /** Product version at time of purchase */
     version?: InputMaybe<Scalars['String']['input']>;
 };
-/** External entity stub for StoreOrder from store-svc. Federation gateway will resolve full StoreOrder data from store-svc. Used by: BillingAccount.storeOrders (if extended), Transaction.storeOrder */
+/**
+ * External entity stub for StoreOrder from store-svc.
+ * Federation gateway will resolve full StoreOrder data from store-svc.
+ * Used by: BillingAccount.storeOrders (if extended), Transaction.storeOrder
+ */
 export type StoreOrder = {
     __typename?: 'StoreOrder';
     appliedEntitlementId?: Maybe<Scalars['String']['output']>;
@@ -18388,7 +19453,11 @@ export type StoreOrder = {
     /** Context JSON (must include workspace_id) */
     context: Scalars['JSON']['output'];
     createdAt: Scalars['DateTime']['output'];
-    /** Currency captured when the store order was created. Billing may still convert at payment time, but this is the canonical order currency for checkout display and reconciliation. */
+    /**
+     * Currency captured when the store order was created.
+     * Billing may still convert at payment time, but this is the canonical
+     * order currency for checkout display and reconciliation.
+     */
     currency: Scalars['String']['output'];
     /** Fulfillment tracking for physical orders */
     fulfillment?: Maybe<OrderFulfillment>;
@@ -18401,7 +19470,10 @@ export type StoreOrder = {
     /** When payment was completed (null if still pending) */
     purchasedAt?: Maybe<Scalars['DateTime']['output']>;
     status: OrderStatus;
-    /** Total product cost (sum of line items) Note: Currency, tax, and final billing amount handled by billing service */
+    /**
+     * Total product cost (sum of line items)
+     * Note: Currency, tax, and final billing amount handled by billing service
+     */
     total: Scalars['Float']['output'];
     transaction?: Maybe<Transaction>;
     /** Transaction ID from billing service (set after payment) */
@@ -18425,7 +19497,11 @@ export type StorePaginationInput = {
     /** Number of items to skip (for offset pagination) */
     offset?: InputMaybe<Scalars['Int']['input']>;
 };
-/** External entity stub for StoreProduct from store-svc. Federation gateway will resolve full StoreProduct data from store-svc. Used by: SubscriptionEntitlement.storeProduct */
+/**
+ * External entity stub for StoreProduct from store-svc.
+ * Federation gateway will resolve full StoreProduct data from store-svc.
+ * Used by: SubscriptionEntitlement.storeProduct
+ */
 export type StoreProduct = {
     __typename?: 'StoreProduct';
     /** Allow orders when out of stock (physical products) */
@@ -18435,7 +19511,10 @@ export type StoreProduct = {
     /** Brand name (physical products) */
     brand?: Maybe<Scalars['String']['output']>;
     category?: Maybe<Scalars['String']['output']>;
-    /** Compatible products (from manifest.compatibility.products) Examples: ["fluidgrids", "workspaces", "bigconsole", "botlit"] */
+    /**
+     * Compatible products (from manifest.compatibility.products)
+     * Examples: ["fluidgrids", "workspaces", "bigconsole", "botlit"]
+     */
     compatibleProducts: Array<Scalars['String']['output']>;
     content?: Maybe<Scalars['JSON']['output']>;
     context?: Maybe<Scalars['JSON']['output']>;
@@ -18454,9 +19533,15 @@ export type StoreProduct = {
     height?: Maybe<Scalars['Float']['output']>;
     icon?: Maybe<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
-    /** Integration dependencies (from manifest.dependencies.integrations) Examples: ["slack", "sendgrid", "zendesk", "salesforce"] */
+    /**
+     * Integration dependencies (from manifest.dependencies.integrations)
+     * Examples: ["slack", "sendgrid", "zendesk", "salesforce"]
+     */
     integrationDeps: Array<Scalars['String']['output']>;
-    /** Whether this product is already purchased by the current billing account. Computed field based on billingAccountId context. */
+    /**
+     * Whether this product is already purchased by the current billing account.
+     * Computed field based on billingAccountId context.
+     */
     isPurchased?: Maybe<Scalars['Boolean']['output']>;
     /** Product length (physical products) */
     length?: Maybe<Scalars['Float']['output']>;
@@ -18487,7 +19572,10 @@ export type StoreProduct = {
     rating?: Maybe<Scalars['Float']['output']>;
     rejectedReason?: Maybe<Scalars['String']['output']>;
     repositoryUrl?: Maybe<Scalars['String']['output']>;
-    /** Required permissions (from manifest.permissions) Examples: ["network.outbound", "database.write", "notification.email"] */
+    /**
+     * Required permissions (from manifest.permissions)
+     * Examples: ["network.outbound", "database.write", "notification.email"]
+     */
     requiredPermissions: Array<Scalars['String']['output']>;
     /** Whether this product requires shipping (physical products) */
     requiresShipping?: Maybe<Scalars['Boolean']['output']>;
@@ -18506,7 +19594,13 @@ export type StoreProduct = {
     /** Current stock quantity (physical products) */
     stockQuantity?: Maybe<Scalars['Int']['output']>;
     storeId?: Maybe<Scalars['ID']['output']>;
-    /** Type-specific subtype from manifest.json. Examples: - Agent: task_automation, conversational, research, code_assistant - Node: action, transform, trigger, logic, integration, data, notification, ai - Widget: chart, metric, table, map, form, text, custom */
+    /**
+     * Type-specific subtype from manifest.json.
+     * Examples:
+     * - Agent: task_automation, conversational, research, code_assistant
+     * - Node: action, transform, trigger, logic, integration, data, notification, ai
+     * - Widget: chart, metric, table, map, form, text, custom
+     */
     subType?: Maybe<Scalars['String']['output']>;
     submittedAt?: Maybe<Scalars['DateTime']['output']>;
     submittedBy?: Maybe<Scalars['String']['output']>;
@@ -18632,7 +19726,10 @@ export type SubmissionStatusUpdatedEvent = {
     submissionId: Scalars['ID']['output'];
     updatedAt: Scalars['String']['output'];
 };
-/** Input for submitting a contact inquiry from a public website. reCAPTCHA token is required for bot protection. */
+/**
+ * Input for submitting a contact inquiry from a public website.
+ * reCAPTCHA token is required only when CAPTCHA_ENABLED=true.
+ */
 export type SubmitContactInquiryInput = {
     /** Company name (optional) */
     company?: InputMaybe<Scalars['String']['input']>;
@@ -18646,8 +19743,8 @@ export type SubmitContactInquiryInput = {
     name: Scalars['String']['input'];
     /** Platform product ID (identifies which product website the form was submitted from) */
     productId?: InputMaybe<Scalars['String']['input']>;
-    /** reCAPTCHA token for bot protection (verified server-side using product's secret key) */
-    recaptchaToken: Scalars['String']['input'];
+    /** reCAPTCHA token for bot protection (verified server-side when CAPTCHA_ENABLED=true) */
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
     /** Subject of the inquiry */
     subject: Scalars['String']['input'];
 };
@@ -18777,20 +19874,43 @@ export type Subscription = {
     _emptyBilling?: Maybe<Scalars['String']['output']>;
     _emptyDevportal?: Maybe<Scalars['String']['output']>;
     _emptyI18n?: Maybe<Scalars['String']['output']>;
-    /** Placeholder field to allow empty Subscription type extension. Each module has a unique placeholder to avoid naming conflicts across subgraphs. */
+    /**
+     * Placeholder field to allow empty Subscription type extension.
+     * Each module has a unique placeholder to avoid naming conflicts across subgraphs.
+     */
     _emptyNewsletter?: Maybe<Scalars['String']['output']>;
     _emptyNotification?: Maybe<Scalars['String']['output']>;
-    /** Placeholder field to allow empty Subscription type extension. Each module has a unique placeholder to avoid naming conflicts across subgraphs. */
+    /**
+     * Placeholder field to allow empty Subscription type extension.
+     * Each module has a unique placeholder to avoid naming conflicts across subgraphs.
+     */
     _emptySupport?: Maybe<Scalars['String']['output']>;
     _emptyTours?: Maybe<Scalars['String']['output']>;
-    /** Placeholder subscription (extended by modules) @rbac(public: true, scopeType: "global") */
+    /**
+     * Placeholder subscription (extended by modules)
+     *   @rbac(public: true, scopeType: "global")
+     */
     _placeholder?: Maybe<Scalars['String']['output']>;
     agentStatusChanged: AgentProfile;
-    /** Fires whenever the AppReview lifecycle changes for a given application (submission -> moderation -> publish/reject). */
+    /**
+     * Fires whenever the AppReview lifecycle changes for a given application
+     * (submission -> moderation -> publish/reject).
+     */
     appReviewStatusChanged: AppReview;
-    /** Subscribe to channel health changes. Emits when a channel's connectionHealth status changes (HEALTHY → DEGRADED, etc.) Use cases: - Real-time dashboard updates showing channel health - Alerting systems monitoring channel availability - Auto-failover logic reacting to health degradation */
+    /**
+     * Subscribe to channel health changes.
+     * Emits when a channel's connectionHealth status changes (HEALTHY → DEGRADED, etc.)
+     *
+     * Use cases:
+     * - Real-time dashboard updates showing channel health
+     * - Alerting systems monitoring channel availability
+     * - Auto-failover logic reacting to health degradation
+     */
     channelHealthChanged: ChannelHealthUpdate;
-    /** Subscribe to connection-status changes for a channel. Emits when isActive or isHealthy flips on the channel's connection. */
+    /**
+     * Subscribe to connection-status changes for a channel.
+     * Emits when isActive or isHealthy flips on the channel's connection.
+     */
     connectionStatusChanged: ConnectionStatusChangedEvent;
     /** Emits the deleted content-page id. */
     contentPageDeleted: Scalars['ID']['output'];
@@ -18799,7 +19919,10 @@ export type Subscription = {
     coverageChanged: CoverageChangeEvent;
     dependencyTriggered: DependencyTriggeredUpdate;
     executionUpdated: ExecutionUpdate;
-    /** Notifies clients when a feature flag definition is created or updated. Subscribers can pass `flagKey` to receive only matching events. */
+    /**
+     * Notifies clients when a feature flag definition is created or updated.
+     * Subscribers can pass `flagKey` to receive only matching events.
+     */
     featureFlagChanged: FeatureFlag;
     /** Emits the deleted feature-flag id so clients can drop it from their cache. */
     featureFlagDeleted: Scalars['ID']['output'];
@@ -18807,39 +19930,71 @@ export type Subscription = {
     /** Subscribe to app installation status changes for a workspace. */
     installationStatusUpdated?: Maybe<InstallationStatusUpdatedEvent>;
     jobStatusUpdated: JobStatusUpdate;
-    /** Notifies clients when a keyboard shortcut is created, updated, or toggled. Subscribers can pass `productId` to scope the stream to a single product. */
+    /**
+     * Notifies clients when a keyboard shortcut is created, updated, or toggled.
+     * Subscribers can pass `productId` to scope the stream to a single product.
+     */
     keyboardShortcutChanged: KeyboardShortcut;
     /** Emits the deleted shortcut id so clients can drop it from their cache. */
     keyboardShortcutDeleted: Scalars['ID']['output'];
     /** Subscribe to license entitlement status changes. */
     licenseStatusUpdated?: Maybe<LicenseStatusUpdatedEvent>;
     metricsUpdated: SchedulerMetricsUpdate;
-    /** Live stream of the authenticated caller's unread notification count. Mirrors the result of `myUnreadNotificationCount` and replaces 30s polling on the FE NotificationCenter — backend publishes on every notification create / read / archive / delete. */
+    /**
+     * Live stream of the authenticated caller's unread notification count.
+     * Mirrors the result of `myUnreadNotificationCount` and replaces 30s
+     * polling on the FE NotificationCenter — backend publishes on every
+     * notification create / read / archive / delete.
+     */
     myUnreadNotificationCountStream: Scalars['Int']['output'];
     newTicketInQueue: SupportTicket;
     /** Subscribe to new notifications for the authenticated user */
     notificationReceived?: Maybe<Notification>;
-    /** Subscribe to delivery status updates for a notification. Useful for real-time tracking of delivery progress. */
+    /**
+     * Subscribe to delivery status updates for a notification.
+     * Useful for real-time tracking of delivery progress.
+     */
     onDeliveryStatusUpdate: ChannelDeliveryStatusUpdate;
     /** Subscribe to order status changes for a specific order or workspace. */
     orderStatusUpdated?: Maybe<OrderStatusUpdatedEvent>;
     /** Emits the deleted product id so clients can drop it from their cache. */
     productDeleted: Scalars['ID']['output'];
-    /** Notifies clients when a platform product is created or updated. Fires on create + update mutations; deletes are reported via `productDeleted`. */
+    /**
+     * Notifies clients when a platform product is created or updated.
+     * Fires on create + update mutations; deletes are reported via `productDeleted`.
+     */
     productUpdated: PlatformProduct;
-    /** Fires when the per-organization revenue rollup recomputes (currently every cron tick or after a settled sale). */
+    /**
+     * Fires when the per-organization revenue rollup recomputes
+     * (currently every cron tick or after a settled sale).
+     */
     revenueUpdated: DeveloperOrgRevenueAnalytics;
     /** Subscribe to publisher submission status changes. */
     submissionStatusUpdated?: Maybe<SubmissionStatusUpdatedEvent>;
+    /** Stream of soft-deleted tenant ids. */
+    tenantDeleted: Scalars['ID']['output'];
+    /**
+     * Stream of tenant lifecycle changes (create/update/configure/suspend/activate/
+     * provision/endpoint-set). Backed by an in-memory pubsub fed by the matching
+     * mutations. Lets the admin tenant list refresh in real time without polling.
+     */
+    tenantUpdated: Tenant;
     ticketMessageAdded: SupportMessage;
     ticketUpdated: SupportTicket;
     translationStatusChanged: TranslationStatusEvent;
     translationUpdated: TranslationUpdateEvent;
     /** Subscribe to unread count changes for the authenticated user */
     unreadCountUpdated?: Maybe<Scalars['Int']['output']>;
-    /** Fires on every WebhookDelivery state transition for the given webhook (PENDING -> DELIVERING -> DELIVERED|FAILED|RETRYING). */
+    /**
+     * Fires on every WebhookDelivery state transition for the given webhook
+     * (PENDING -> DELIVERING -> DELIVERED|FAILED|RETRYING).
+     */
     webhookDeliveryUpdated: WebhookDelivery;
-    /** Subscribe to webhook events received by a channel. Emits when a new WebhookEvent row is persisted (before downstream processing). Resolver-level filter scopes to the requested channelId. */
+    /**
+     * Subscribe to webhook events received by a channel.
+     * Emits when a new WebhookEvent row is persisted (before downstream processing).
+     * Resolver-level filter scopes to the requested channelId.
+     */
     webhookReceived: WebhookReceivedEvent;
 };
 /** Root subscription type */
@@ -18930,6 +20085,10 @@ export type SubscriptionSubmissionStatusUpdatedArgs = {
     publisherId: Scalars['ID']['input'];
 };
 /** Root subscription type */
+export type SubscriptionTenantUpdatedArgs = {
+    tenantId?: InputMaybe<Scalars['ID']['input']>;
+};
+/** Root subscription type */
 export type SubscriptionTicketMessageAddedArgs = {
     ticketId: Scalars['ID']['input'];
 };
@@ -18960,7 +20119,10 @@ export type SubscriptionWebhookDeliveryUpdatedArgs = {
 export type SubscriptionWebhookReceivedArgs = {
     channelId: Scalars['ID']['input'];
 };
-/** SubscriptionEntitlement defines what store items a plan grants access to. This allows plans to provide discounts or free access to store items. */
+/**
+ * SubscriptionEntitlement defines what store items a plan grants access to.
+ * This allows plans to provide discounts or free access to store items.
+ */
 export type SubscriptionEntitlement = {
     __typename?: 'SubscriptionEntitlement';
     /** The type of access granted (FREE_ACCESS or DISCOUNT) */
@@ -18975,7 +20137,10 @@ export type SubscriptionEntitlement = {
     id: Scalars['ID']['output'];
     /** Reference to the store item entity (resolved via Federation) */
     item?: Maybe<StoreItem>;
-    /** Reference to the store item (external entity from Store service) Resolved via Federation 2 Gateway */
+    /**
+     * Reference to the store item (external entity from Store service)
+     * Resolved via Federation 2 Gateway
+     */
     itemId: Scalars['String']['output'];
     /** The plan that grants this entitlement */
     plan: Plan;
@@ -19073,14 +20238,25 @@ export type SupportAttachmentUploadSession = {
     uploadType: Scalars['String']['output'];
     uploadUrl?: Maybe<Scalars['String']['output']>;
 };
-/** Privacy-preserving author projection for SupportMessage. End-users only ever see the anonymized alias + generated avatar for agent authors; super_admin / service actors (admin app) see the real identity. */
+/**
+ * Privacy-preserving author projection for SupportMessage. End-users only ever see
+ * the anonymized alias + generated avatar for agent authors; super_admin / service
+ * actors (admin app) see the real identity.
+ */
 export type SupportAuthor = {
     __typename?: 'SupportAuthor';
     avatar: Scalars['String']['output'];
     displayName: Scalars['String']['output'];
-    /** Stable opaque identifier safe for both viewer scopes. For agent authors viewed by an end-user this is the AgentProfile id (NOT the underlying userId); for admin viewers and customer authors it is the underlying actor id. */
+    /**
+     * Stable opaque identifier safe for both viewer scopes. For agent authors viewed
+     * by an end-user this is the AgentProfile id (NOT the underlying userId); for
+     * admin viewers and customer authors it is the underlying actor id.
+     */
     id: Scalars['ID']['output'];
-    /** True when the viewer was scoped down to the anonymized projection. Admins see this as false; end-users see it as true for agent authors. */
+    /**
+     * True when the viewer was scoped down to the anonymized projection. Admins see
+     * this as false; end-users see it as true for agent authors.
+     */
     isAnonymized: Scalars['Boolean']['output'];
     /** AGENT | CUSTOMER | SYSTEM — drives UI styling without leaking identity. */
     kind: SupportAuthorKind;
@@ -19090,7 +20266,11 @@ export declare enum SupportAuthorKind {
     Customer = "CUSTOMER",
     System = "SYSTEM"
 }
-/** Support-specific context output type. Returns the stored context for each record. Uses a unique type name to avoid federation conflicts with other services. */
+/**
+ * Support-specific context output type.
+ * Returns the stored context for each record.
+ * Uses a unique type name to avoid federation conflicts with other services.
+ */
 export type SupportContext = {
     __typename?: 'SupportContext';
     custom?: Maybe<Scalars['JSON']['output']>;
@@ -19101,7 +20281,11 @@ export type SupportContext = {
     userId?: Maybe<Scalars['ID']['output']>;
     workspaceId?: Maybe<Scalars['ID']['output']>;
 };
-/** Context filter input for querying records by context. Supports exact match filtering on context fields. Note: tenantId filtering is applied automatically from context.tenant?.id. */
+/**
+ * Context filter input for querying records by context.
+ * Supports exact match filtering on context fields.
+ * Note: tenantId filtering is applied automatically from context.tenant?.id.
+ */
 export type SupportContextFilterInput = {
     organizationId?: InputMaybe<Scalars['ID']['input']>;
     productId?: InputMaybe<Scalars['ID']['input']>;
@@ -19109,7 +20293,11 @@ export type SupportContextFilterInput = {
     userId?: InputMaybe<Scalars['ID']['input']>;
     workspaceId?: InputMaybe<Scalars['ID']['input']>;
 };
-/** Support context input for filtering and scoping data. All fields are optional and can be extended as needed. Note: tenantId is derived from context.tenant?.id (gateway header), not from client input. */
+/**
+ * Support context input for filtering and scoping data.
+ * All fields are optional and can be extended as needed.
+ * Note: tenantId is derived from context.tenant?.id (gateway header), not from client input.
+ */
 export type SupportContextInput = {
     custom?: InputMaybe<Scalars['JSON']['input']>;
     organizationId?: InputMaybe<Scalars['ID']['input']>;
@@ -19138,7 +20326,10 @@ export type SupportMessage = {
     __typename?: 'SupportMessage';
     attachmentCount: Scalars['Int']['output'];
     attachments: Array<Scalars['String']['output']>;
-    /** Privacy-aware author projection. Returns the anonymized alias + avatar for end-users; admin app (super_admin / service) sees the real identity. */
+    /**
+     * Privacy-aware author projection. Returns the anonymized alias + avatar for
+     * end-users; admin app (super_admin / service) sees the real identity.
+     */
     author: SupportAuthor;
     authorId: Scalars['String']['output'];
     /** Contextual IDs for filtering and scoping (workspaceId, userId, projectId, etc.) */
@@ -19352,7 +20543,10 @@ export type SyncTourStepInput = {
     waitForSelector?: InputMaybe<Scalars['String']['input']>;
     waitForTimeout?: InputMaybe<Scalars['Int']['input']>;
 };
-/** Input for syncing workspace from workspace layer to global layer Called by wspace-workspace-svc after creating a workspace directly */
+/**
+ * Input for syncing workspace from workspace layer to global layer
+ * Called by wspace-workspace-svc after creating a workspace directly
+ */
 export type SyncWorkspaceFromWspaceInput = {
     /** Workspace name */
     name: Scalars['String']['input'];
@@ -19447,13 +20641,20 @@ export type TemplateNotificationResult = {
     /** Number of notifications successfully triggered */
     totalTriggered: Scalars['Int']['output'];
 };
-/** Tenant type stub - represents a tenant entity from the tenant service This service doesn't own the Tenant model, but references it */
+/**
+ * Tenant type stub - represents a tenant entity from the tenant service
+ * This service doesn't own the Tenant model, but references it
+ */
 export type Tenant = {
     __typename?: 'Tenant';
     config?: Maybe<TenantConfig>;
     createdAt: Scalars['DateTime']['output'];
     customDomain?: Maybe<Scalars['String']['output']>;
-    /** Service routing endpoint for dedicated tenants For SHARED tenants, this is null (uses default service) For DEDICATED tenants, this points to the dedicated service instance */
+    /**
+     * Service routing endpoint for dedicated tenants
+     * For SHARED tenants, this is null (uses default service)
+     * For DEDICATED tenants, this points to the dedicated service instance
+     */
     endpoint?: Maybe<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
     metadata?: Maybe<Scalars['JSON']['output']>;
@@ -19476,6 +20677,18 @@ export type TenantConfig = {
     features?: Maybe<Scalars['JSON']['output']>;
     region?: Maybe<Scalars['String']['output']>;
 };
+/**
+ * Inline export payload for `exportTenantsCsv`. Returns CSV text along with a
+ * count of rows and a flag if the result was capped at the requested limit.
+ */
+export type TenantExport = {
+    __typename?: 'TenantExport';
+    csv: Scalars['String']['output'];
+    format: Scalars['String']['output'];
+    generatedAt: Scalars['DateTime']['output'];
+    rowCount: Scalars['Int']['output'];
+    truncated: Scalars['Boolean']['output'];
+};
 /** Filter input for querying tenants */
 export type TenantFilterInput = {
     search?: InputMaybe<Scalars['String']['input']>;
@@ -19491,7 +20704,10 @@ export type TenantList = {
     offset: Scalars['Int']['output'];
     total: Scalars['Int']['output'];
 };
-/** Lightweight tenant routing info used by gateways to decide whether to proxy requests to a dedicated tenant endpoint. */
+/**
+ * Lightweight tenant routing info used by gateways to decide
+ * whether to proxy requests to a dedicated tenant endpoint.
+ */
 export type TenantRoutingInfo = {
     __typename?: 'TenantRoutingInfo';
     endpoint?: Maybe<Scalars['String']['output']>;
@@ -19666,7 +20882,13 @@ export type Tour = {
     metadata?: Maybe<Scalars['JSON']['output']>;
     mobileConfig?: Maybe<Scalars['JSON']['output']>;
     moduleId?: Maybe<Scalars['String']['output']>;
-    /** The current authenticated user's progress for this tour, or null if the user has not interacted with it yet. Resolves to the most recent TourUserProgress row for the requesting actor. Used by the TourTrigger dropdown to render per-tour status chips (Completed / In progress / Skipped) without requiring a second round-trip. */
+    /**
+     * The current authenticated user's progress for this tour, or null if the
+     * user has not interacted with it yet. Resolves to the most recent
+     * TourUserProgress row for the requesting actor. Used by the TourTrigger
+     * dropdown to render per-tour status chips (Completed / In progress /
+     * Skipped) without requiring a second round-trip.
+     */
     myProgress?: Maybe<TourUserProgress>;
     name: Scalars['String']['output'];
     pageId?: Maybe<Scalars['String']['output']>;
@@ -19939,7 +21161,12 @@ export declare enum TourUserStatus {
     NotStarted = "NOT_STARTED",
     Skipped = "SKIPPED"
 }
-/** Tours-specific context output type. Returns the stored context for each record. Uses a unique type name to avoid federation conflicts with other services. Must be @shareable since context types may exist in multiple subgraphs. */
+/**
+ * Tours-specific context output type.
+ * Returns the stored context for each record.
+ * Uses a unique type name to avoid federation conflicts with other services.
+ * Must be @shareable since context types may exist in multiple subgraphs.
+ */
 export type ToursContext = {
     __typename?: 'ToursContext';
     /** Additional custom context as JSON */
@@ -19972,7 +21199,10 @@ export type ToursResponse = {
     total: Scalars['Int']['output'];
     tours: Array<Tour>;
 };
-/** Transaction entity - resolvable via Federation Gateway. Other services (e.g., store-svc) can reference Transaction by id. */
+/**
+ * Transaction entity - resolvable via Federation Gateway.
+ * Other services (e.g., store-svc) can reference Transaction by id.
+ */
 export type Transaction = {
     __typename?: 'Transaction';
     amount: Scalars['Float']['output'];
@@ -20421,7 +21651,10 @@ export type UpdateChannelInput = {
 export type UpdateConnectionInput = {
     /** Operation context for scoping */
     context?: InputMaybe<ContextInput>;
-    /** Platform-specific credentials (API keys, tokens, etc.) Will be encrypted before storage. */
+    /**
+     * Platform-specific credentials (API keys, tokens, etc.)
+     * Will be encrypted before storage.
+     */
     credentials?: InputMaybe<Scalars['JSON']['input']>;
     /** Connection status */
     isActive?: InputMaybe<Scalars['Boolean']['input']>;
@@ -21001,7 +22234,10 @@ export type UpdateSubscriptionInput = {
 export type UpdateSubscriptionSeatsInput = {
     /** Billing account that owns this subscription. */
     billingAccountId: Scalars['ID']['input'];
-    /** New seat count. Must be >= plan.minSeats. Applied immediately on Stripe (with proration) and at next cycle on Razorpay (proration delta charged as a separate one-time order). */
+    /**
+     * New seat count. Must be >= plan.minSeats. Applied immediately on Stripe (with proration)
+     * and at next cycle on Razorpay (proration delta charged as a separate one-time order).
+     */
     seatCount: Scalars['Int']['input'];
     subscriptionId: Scalars['ID']['input'];
 };
@@ -21339,7 +22575,11 @@ export type UsageTrends = {
     /** Predicted usage for next period */
     predictedUsage?: Maybe<Scalars['Float']['output']>;
 };
-/** User type stub - represents a user entity from the auth/user service This service doesn't own the User model, but references it in usage tracking Federation gateway will resolve full User data from auth/user service. */
+/**
+ * User type stub - represents a user entity from the auth/user service
+ * This service doesn't own the User model, but references it in usage tracking
+ * Federation gateway will resolve full User data from auth/user service.
+ */
 export type User = {
     __typename?: 'User';
     /** Tickets assigned to this user (if support agent) */
@@ -21367,13 +22607,21 @@ export type User = {
     updatedAt: Scalars['DateTime']['output'];
     username: Scalars['String']['output'];
 };
-/** User type stub - represents a user entity from the auth/user service This service doesn't own the User model, but references it in usage tracking Federation gateway will resolve full User data from auth/user service. */
+/**
+ * User type stub - represents a user entity from the auth/user service
+ * This service doesn't own the User model, but references it in usage tracking
+ * Federation gateway will resolve full User data from auth/user service.
+ */
 export type UserAssignedTicketsArgs = {
     filter?: InputMaybe<SupportTicketFilterInput>;
     limit?: InputMaybe<Scalars['Int']['input']>;
     offset?: InputMaybe<Scalars['Int']['input']>;
 };
-/** User type stub - represents a user entity from the auth/user service This service doesn't own the User model, but references it in usage tracking Federation gateway will resolve full User data from auth/user service. */
+/**
+ * User type stub - represents a user entity from the auth/user service
+ * This service doesn't own the User model, but references it in usage tracking
+ * Federation gateway will resolve full User data from auth/user service.
+ */
 export type UserTicketsArgs = {
     filter?: InputMaybe<SupportTicketFilterInput>;
     limit?: InputMaybe<Scalars['Int']['input']>;
@@ -21427,10 +22675,17 @@ export type UserLanguagePreference = {
     updatedAt: Scalars['DateTime']['output'];
     userId: Scalars['String']['output'];
 };
-/** UserPlatformConnection represents a verified user identity on a communication platform. It serves as the DM authorization allowlist and notification delivery target. Replaces the former ChannelUser model. */
+/**
+ * UserPlatformConnection represents a verified user identity on a communication platform.
+ * It serves as the DM authorization allowlist and notification delivery target.
+ * Replaces the former ChannelUser model.
+ */
 export type UserPlatformConnection = {
     __typename?: 'UserPlatformConnection';
-    /** Whether the user has a valid DM conversation target (dmAllowed = true AND dmConversationId is set) */
+    /**
+     * Whether the user has a valid DM conversation target
+     * (dmAllowed = true AND dmConversationId is set)
+     */
     canReceiveDm: Scalars['Boolean']['output'];
     /** Associated channel */
     channel: Channel;
@@ -21446,9 +22701,16 @@ export type UserPlatformConnection = {
     customStatus?: Maybe<Scalars['String']['output']>;
     /** When this record was soft-deleted (null = active) */
     deletedAt?: Maybe<Scalars['DateTime']['output']>;
-    /** Whether DMs to/from this user are allowed. Only true when source = OAUTH or PAIRED; never for SEEN. */
+    /**
+     * Whether DMs to/from this user are allowed.
+     * Only true when source = OAUTH or PAIRED; never for SEEN.
+     */
     dmAllowed: Scalars['Boolean']['output'];
-    /** Platform-specific DM conversation ID. Slack: D0A1B2C3 | Teams: conversation reference JSON | WhatsApp: JID | Discord: N/A | Google Chat: space name */
+    /**
+     * Platform-specific DM conversation ID.
+     * Slack: D0A1B2C3 | Teams: conversation reference JSON |
+     * WhatsApp: JID | Discord: N/A | Google Chat: space name
+     */
     dmConversationId?: Maybe<Scalars['String']['output']>;
     /** Platform avatar URL */
     externalAvatarUrl?: Maybe<Scalars['String']['output']>;
@@ -21464,7 +22726,12 @@ export type UserPlatformConnection = {
     externalUsername?: Maybe<Scalars['String']['output']>;
     /** Unique connection ID */
     id: Scalars['ID']['output'];
-    /** Opaque reference to the IntegrationConnection in wspace-integrations-svc that holds this user's personal OAuth token. Set after the user completes the OAuth flow in microfe-integrations and clicks "Link to bot channel". Null for connections created via the legacy Slack OAuth flow. */
+    /**
+     * Opaque reference to the IntegrationConnection in wspace-integrations-svc
+     * that holds this user's personal OAuth token. Set after the user completes
+     * the OAuth flow in microfe-integrations and clicks "Link to bot channel".
+     * Null for connections created via the legacy Slack OAuth flow.
+     */
     integrationConnectionId?: Maybe<Scalars['ID']['output']>;
     /** Internal Botlit user ID (opaque reference) */
     internalUserId?: Maybe<Scalars['ID']['output']>;
@@ -21482,7 +22749,10 @@ export type UserPlatformConnection = {
     organizationId: Scalars['ID']['output'];
     /** When pairing was approved */
     pairingApprovedAt?: Maybe<Scalars['DateTime']['output']>;
-    /** 8-character pairing code (WhatsApp / Discord only). Only present when pairingStatus = PENDING. */
+    /**
+     * 8-character pairing code (WhatsApp / Discord only).
+     * Only present when pairingStatus = PENDING.
+     */
     pairingCode?: Maybe<Scalars['String']['output']>;
     /** When the pairing code expires (1-hour TTL from generation) */
     pairingCodeExpiresAt?: Maybe<Scalars['DateTime']['output']>;
@@ -21500,7 +22770,10 @@ export type UserPlatformConnection = {
     source: UserPlatformSource;
     /** Last update timestamp */
     updatedAt: Scalars['DateTime']['output'];
-    /** User's personal OAuth token expiry (AES-256-GCM encrypted at rest) NOTE: The token itself is never returned by queries; only the expiry is exposed. */
+    /**
+     * User's personal OAuth token expiry (AES-256-GCM encrypted at rest)
+     * NOTE: The token itself is never returned by queries; only the expiry is exposed.
+     */
     userTokenExpiresAt?: Maybe<Scalars['DateTime']['output']>;
     /** Scopes granted by the user's personal OAuth token */
     userTokenScope?: Maybe<Scalars['String']['output']>;
@@ -21524,7 +22797,10 @@ export type UserPlatformConnectionFilterInput = {
     /** Filter by connection source */
     source?: InputMaybe<UserPlatformSource>;
 };
-/** Paginated list of user platform connections with cursor support. Pass `nextCursor` from a previous response as `cursor` in the next call. */
+/**
+ * Paginated list of user platform connections with cursor support.
+ * Pass `nextCursor` from a previous response as `cursor` in the next call.
+ */
 export type UserPlatformConnectionList = {
     __typename?: 'UserPlatformConnectionList';
     hasMore: Scalars['Boolean']['output'];
@@ -21532,20 +22808,35 @@ export type UserPlatformConnectionList = {
     nextCursor?: Maybe<Scalars['String']['output']>;
     total: Scalars['Int']['output'];
 };
-/** How a UserPlatformConnection was established. Controls whether dmAllowed can be set to true. */
+/**
+ * How a UserPlatformConnection was established.
+ * Controls whether dmAllowed can be set to true.
+ */
 export declare enum UserPlatformSource {
     /** Bulk-imported user record (e.g. from CSV or directory sync). */
     Import = "IMPORT",
     /** Admin manually added the user (back-office operation). */
     Manual = "MANUAL",
-    /** Connected via dashboard OAuth flow (Slack, Teams, Google Chat). Grants dmAllowed = true immediately after token exchange. */
+    /**
+     * Connected via dashboard OAuth flow (Slack, Teams, Google Chat).
+     * Grants dmAllowed = true immediately after token exchange.
+     */
     Oauth = "OAUTH",
-    /** Connected via pairing code (WhatsApp, Discord). Grants dmAllowed = true once the user approves the pairing code in the dashboard. */
+    /**
+     * Connected via pairing code (WhatsApp, Discord).
+     * Grants dmAllowed = true once the user approves the pairing code in the dashboard.
+     */
     Paired = "PAIRED",
-    /** Passively observed from an inbound webhook event. Never grants dmAllowed = true automatically. */
+    /**
+     * Passively observed from an inbound webhook event.
+     * Never grants dmAllowed = true automatically.
+     */
     Seen = "SEEN"
 }
-/** User preference record storing theme, notification settings, dashboard customization, and other user-specific configuration. */
+/**
+ * User preference record storing theme, notification settings,
+ * dashboard customization, and other user-specific configuration.
+ */
 export type UserPreference = {
     __typename?: 'UserPreference';
     accessibility?: Maybe<Scalars['JSON']['output']>;
@@ -21558,7 +22849,10 @@ export type UserPreference = {
     updatedAt: Scalars['DateTime']['output'];
     userId: Scalars['String']['output'];
 };
-/** User presence status on the communication platform. Synced from platform webhooks or periodic polling. */
+/**
+ * User presence status on the communication platform.
+ * Synced from platform webhooks or periodic polling.
+ */
 export declare enum UserPresenceStatus {
     /** User is away or idle */
     Away = "AWAY",
@@ -21593,6 +22887,15 @@ export type UserStoreSubscription = {
     subscribedAt: Scalars['DateTime']['output'];
     userId: Scalars['ID']['output'];
 };
+/** Association between a user and a universal tag */
+export type UserTagAssignment = {
+    __typename?: 'UserTagAssignment';
+    createdAt: Scalars['DateTime']['output'];
+    id: Scalars['ID']['output'];
+    tag: UniversalTag;
+    tagId: Scalars['String']['output'];
+    userId: Scalars['String']['output'];
+};
 export type UserWishlist = {
     __typename?: 'UserWishlist';
     addedAt: Scalars['DateTime']['output'];
@@ -21840,7 +23143,10 @@ export declare enum WebhookDeliveryStatus {
     Pending = "PENDING",
     Retrying = "RETRYING"
 }
-/** WebhookEvent represents a received webhook (transient, 7-day TTL) Used for debugging and monitoring only */
+/**
+ * WebhookEvent represents a received webhook (transient, 7-day TTL)
+ * Used for debugging and monitoring only
+ */
 export type WebhookEvent = {
     __typename?: 'WebhookEvent';
     /** Associated channel */
@@ -21876,7 +23182,10 @@ export type WebhookEvent = {
     /** Last update timestamp */
     updatedAt: Scalars['DateTime']['output'];
 };
-/** Paginated list of webhook events with cursor support. Pass `nextCursor` from a previous response as `cursor` in the next call. */
+/**
+ * Paginated list of webhook events with cursor support.
+ * Pass `nextCursor` from a previous response as `cursor` in the next call.
+ */
 export type WebhookEventList = {
     __typename?: 'WebhookEventList';
     hasMore: Scalars['Boolean']['output'];
@@ -22004,11 +23313,18 @@ export type WithdrawConsentInput = {
     subjectId: Scalars['ID']['input'];
     subjectType: Scalars['String']['input'];
 };
-/** Workspace type stub - represents a workspace entity from the workspace service This service doesn't own the Workspace model, but references it */
+/**
+ * Workspace type stub - represents a workspace entity from the workspace service
+ * This service doesn't own the Workspace model, but references it
+ */
 export type Workspace = {
     __typename?: 'Workspace';
     createdAt: Scalars['DateTime']['output'];
-    /** Service routing endpoint for dedicated tenants For SHARED tenants, this is null (uses default workspace service) For DEDICATED tenants, this points to the dedicated workspace service instance */
+    /**
+     * Service routing endpoint for dedicated tenants
+     * For SHARED tenants, this is null (uses default workspace service)
+     * For DEDICATED tenants, this points to the dedicated workspace service instance
+     */
     endpoint?: Maybe<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
     /** Member count */
@@ -22029,7 +23345,10 @@ export type Workspace = {
     type: WorkspaceType;
     updatedAt: Scalars['DateTime']['output'];
 };
-/** Workspace-level override for a feature flag. Workspace admins can disable flags or control user opt-in for their workspace. */
+/**
+ * Workspace-level override for a feature flag.
+ * Workspace admins can disable flags or control user opt-in for their workspace.
+ */
 export type WorkspaceFeatureFlagOverride = {
     __typename?: 'WorkspaceFeatureFlagOverride';
     allowUserOptIn: Scalars['Boolean']['output'];