@burdenoff/microfe-store 2026.1013.2 → 2026.1014.1

package/dist/generated/global-types.d.ts

@@ -408,6 +408,8 @@ export type Addon = {
     isActive?: Maybe<Scalars['Boolean']['output']>;
     /** The name of the addon (e.g., 'Extra Bots', 'Additional Storage'). */
     name?: Maybe<Scalars['String']['output']>;
+    /** Apple App Store / Google Play SKU for this addon. */
+    nativeProductId?: Maybe<Scalars['String']['output']>;
     /** The price of the addon. */
     price?: Maybe<Scalars['Float']['output']>;
     /** Historical record of price changes for this addon */
@@ -1361,6 +1363,20 @@ export type AssignedQuota = {
     scope: QuotaScope;
     workspaceId?: Maybe<Scalars['ID']['output']>;
 };
+export type AssistantAccountBudget = {
+    __typename?: 'AssistantAccountBudget';
+    billingAccountId: Scalars['ID']['output'];
+    dailyMicroUsd: Scalars['Int']['output'];
+    dailyTokens: Scalars['Int']['output'];
+    enabled: Scalars['Boolean']['output'];
+};
+export type AssistantBudgetReceipt = {
+    __typename?: 'AssistantBudgetReceipt';
+    heldMicroUsd: Scalars['Int']['output'];
+    heldTokens: Scalars['Int']['output'];
+    id: Scalars['ID']['output'];
+    status: Scalars['String']['output'];
+};
 export type AttachMediaToStepInput = {
     /** Operation context for scoping (workspaceId, userId, productId, moduleId, etc.) */
     context?: InputMaybe<ContextInput>;
@@ -2921,6 +2937,10 @@ export type ComplianceAuditLogEntry = {
 /** Input for configuring tenant settings */
 export type ConfigureTenantInput = {
     complianceRegion?: InputMaybe<Scalars['String']['input']>;
+    /**
+     * Ignored and never stored. Burdenoff does no white-labelling: every product keeps its own brand.
+     * @deprecated No white-labelling — products keep their own brand. This setting is ignored.
+     */
     customBranding?: InputMaybe<Scalars['JSON']['input']>;
     dataResidency?: InputMaybe<Scalars['String']['input']>;
     features?: InputMaybe<Scalars['JSON']['input']>;
@@ -3142,6 +3162,10 @@ export type ContextWidgetConversationPayload = {
 };
 export type Coupon = {
     __typename?: 'Coupon';
+    /** Purchase flows (PLAN / ADD_ON / STORE) this coupon may be redeemed against. Empty = all entity types. */
+    applicableEntityTypes: Array<CouponEntityType>;
+    /** Product slugs (e.g. "vibecontrols", "fluidgrids") this coupon may be redeemed against. Empty = all products. */
+    applicableProductIds: Array<Scalars['String']['output']>;
     applicableProducts: Array<Scalars['String']['output']>;
     applicableServices: Array<Scalars['String']['output']>;
     campaignId?: Maybe<Scalars['String']['output']>;
@@ -3172,6 +3196,12 @@ export type Coupon = {
     validUntil?: Maybe<Scalars['DateTime']['output']>;
     value: Scalars['Float']['output'];
 };
+/** Which purchase flow a coupon may be redeemed against (BOFF-7391). */
+export declare enum CouponEntityType {
+    AddOn = "ADD_ON",
+    Plan = "PLAN",
+    Store = "STORE"
+}
 export type CouponFilterInput = {
     campaignId?: InputMaybe<Scalars['String']['input']>;
     scope?: InputMaybe<CouponScope>;
@@ -3457,6 +3487,8 @@ export type CreateContentPageInput = {
     visibility?: InputMaybe<ContentVisibility>;
 };
 export type CreateCouponInput = {
+    applicableEntityTypes?: InputMaybe<Array<CouponEntityType>>;
+    applicableProductIds?: InputMaybe<Array<Scalars['String']['input']>>;
     applicableProducts?: InputMaybe<Array<Scalars['String']['input']>>;
     applicableServices?: InputMaybe<Array<Scalars['String']['input']>>;
     campaignId?: InputMaybe<Scalars['String']['input']>;
@@ -5646,6 +5678,25 @@ export type EraseResult = {
     retainedForLegalReason?: Maybe<Scalars['String']['output']>;
     service: Scalars['String']['output'];
 };
+/** A visitor asking for a human, on a conversation they are already in. Anonymous like the rest of explore: the conversation token is the only proof of ownership, and the only thing we ask the visitor for is where to reply. */
+export type EscalateExploreConversationInput = {
+    /** Bearer secret for the conversation being handed over. */
+    conversationToken: Scalars['String']['input'];
+    /** Where the reply should go. Validated server-side and stored lower-cased; an address we cannot deliver to is refused with `INVALID_EMAIL` rather than accepted into a ticket nobody can answer. */
+    email: Scalars['String']['input'];
+    /** Anything the visitor wants to add in their own words. Optional — the point of the handover is that the conversation already says what the problem is. Capped server-side; the server truncates rather than rejecting. */
+    note?: InputMaybe<Scalars['String']['input']>;
+    /** `PlatformProduct` id of the site the visitor is on, so the handover reaches that product's support inbox instead of the default one. */
+    productId?: InputMaybe<Scalars['String']['input']>;
+    /** reCAPTCHA v3 token — required only when `exploreCatalog.captchaRequired`, and minted with the SAME action as a chat message. */
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
+};
+export type EscalateExploreConversationResult = {
+    __typename?: 'EscalateExploreConversationResult';
+    /** False when this submit found a handover that already existed — the double-clicked button, the retried request, the reloaded page. Not an error: the conversation is with a human either way. */
+    created: Scalars['Boolean']['output'];
+    escalation: ExploreEscalation;
+};
 export type EvaluateFeatureFlagsInput = {
     /** Specific flag keys to evaluate. If empty, evaluates ALL active flags. */
     keys?: InputMaybe<Array<Scalars['String']['input']>>;
@@ -5653,6 +5704,10 @@ export type EvaluateFeatureFlagsInput = {
     productSlug?: InputMaybe<Scalars['String']['input']>;
     workspaceId: Scalars['String']['input'];
 };
+export type ExchangeOwnDelegationInput = {
+    delegationId: Scalars['ID']['input'];
+    scopes?: InputMaybe<Array<Scalars['String']['input']>>;
+};
 export type ExchangeTokenInput = {
     appId: Scalars['String']['input'];
     scopes?: InputMaybe<Array<Scalars['String']['input']>>;
@@ -5715,6 +5770,8 @@ export type ExploreAdminFilter = {
     from?: InputMaybe<Scalars['DateTime']['input']>;
     /** Salted IP hash, to group one visitor's sessions. */
     ipHash?: InputMaybe<Scalars['String']['input']>;
+    /** Only conversations containing an answer a visitor marked NOT helpful. */
+    notHelpfulOnly?: InputMaybe<Scalars['Boolean']['input']>;
     /** Match conversations that started on this product's website. */
     productSlug?: InputMaybe<Scalars['String']['input']>;
     /** Free-text match against message content. */
@@ -5735,6 +5792,8 @@ export type ExploreAdminMessage = {
     createdAt: Scalars['DateTime']['output'];
     ctas: Array<ExploreCta>;
     errorCode?: Maybe<Scalars['String']['output']>;
+    /** What the visitor said about this answer — rating, reason and comment — or null when they said nothing, which is the ordinary case. `answered` is our own machine verdict on whether we could ground a reply; this is the visitor's, and it is the only one of the two that can say an answer was confidently wrong. */
+    feedback?: Maybe<ExploreFeedback>;
     followUps: Array<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
     references: Array<ExploreReference>;
@@ -5761,7 +5820,11 @@ export type ExploreAdminStats = {
     byProduct: Array<ExploreAdminProductStat>;
     clicks: Scalars['Int']['output'];
     conversations: Scalars['Int']['output'];
+    /** Answers a visitor marked helpful. */
+    helpful: Scalars['Int']['output'];
     messages: Scalars['Int']['output'];
+    /** Answers a visitor marked NOT helpful. Read against `unanswered`: those are the gaps we already know about, these are the ones we thought we had covered. */
+    notHelpful: Scalars['Int']['output'];
     /** Assistant answers the corpus could not ground. */
     unanswered: Scalars['Int']['output'];
 };
@@ -5774,8 +5837,20 @@ export type ExploreAgentActivity = {
 export type ExploreAgentCatalog = {
     __typename?: 'ExploreAgentCatalog';
     builtAt: Scalars['DateTime']['output'];
+    /** At most one highlight per product, product-slug ordered, identical on every replica. Empty when the corpus carries no concept pages — never null, never an error. */
+    conceptHighlights: Array<ExploreAgentConcept>;
     products: Array<ExploreAgentProduct>;
 };
+/** One product's concept page and the illustration that stands for it — what `/explore` offers a visitor who has not asked anything yet. `imageUrl` is absolute, on the product's own published origin, and drawn from the same allow-list an answer's images come from; `alt` is the illustration's own published alt text. */
+export type ExploreAgentConcept = {
+    __typename?: 'ExploreAgentConcept';
+    alt: Scalars['String']['output'];
+    imageUrl: Scalars['String']['output'];
+    product: Scalars['String']['output'];
+    productName: Scalars['String']['output'];
+    title: Scalars['String']['output'];
+    url: Scalars['String']['output'];
+};
 export type ExploreAgentCtaSuggestion = {
     __typename?: 'ExploreAgentCtaSuggestion';
     label: Scalars['String']['output'];
@@ -5878,6 +5953,8 @@ export type ExploreAttachmentInput = {
 export type ExploreCatalog = {
     __typename?: 'ExploreCatalog';
     captchaRequired: Scalars['Boolean']['output'];
+    /** Illustrations for the welcome screen, at most 8. The focused product's highlight (see `exploreCatalog(productSlug:)`) comes first. Empty is ORDINARY, not an error: these are fetched from the agent in a separate best-effort query precisely so that an agent which does not serve them yet — or at all — costs the catalog nothing. A page must render the rest of the catalog unchanged when this is empty, and must never read it as a signal that explore is unavailable. That is `enabled`. */
+    conceptHighlights: Array<ExploreConceptHighlight>;
     enabled: Scalars['Boolean']['output'];
     examplePrompts: Array<Scalars['String']['output']>;
     limits: ExploreLimits;
@@ -5886,6 +5963,17 @@ export type ExploreCatalog = {
     welcomeBody: Scalars['String']['output'];
     welcomeTitle: Scalars['String']['output'];
 };
+/** One product's concept illustration, passed through from the agent's concept index so the welcome screen has something to SHOW before the first message. `imageUrl` is a mockup, not a screenshot of a running product — the same illustrations the answer path embeds, and the UI must label them the same way. `url` is the concept page the illustration belongs to, which is where a visitor who clicks it should land. At most one per product upstream, so the list reads as a gallery of the fleet rather than as several views of whichever product happened to sort first. */
+export type ExploreConceptHighlight = {
+    __typename?: 'ExploreConceptHighlight';
+    alt: Scalars['String']['output'];
+    imageUrl: Scalars['String']['output'];
+    /** Product slug, matching `ExploreProduct.slug`. */
+    product: Scalars['String']['output'];
+    productName: Scalars['String']['output'];
+    title: Scalars['String']['output'];
+    url: Scalars['String']['output'];
+};
 /** An explore conversation. `token` is the bearer secret for every subsequent call and is returned ONLY on the request that minted it (or echoed back to the caller that already holds it) — it is never read back out of storage. */
 export type ExploreConversation = {
     __typename?: 'ExploreConversation';
@@ -5903,6 +5991,26 @@ export type ExploreCta = {
     product?: Maybe<Scalars['String']['output']>;
     url: Scalars['String']['output'];
 };
+/** What became of the handover. */
+export type ExploreEscalation = {
+    __typename?: 'ExploreEscalation';
+    createdAt: Scalars['DateTime']['output'];
+    /** The address a human will reply to, as stored. Echoed back so the UI shows the server's view rather than what was typed — and, on a repeat submit, the address the FIRST handover used, which is where the answer is actually going. */
+    email: Scalars['String']['output'];
+};
+/** What one visitor thought of one answer. The signal `/explore` did not have. Every question got an answer, so "we answer 100% of questions" was true and told us nothing; this is the only record that a specific answer was wrong, thin or off-topic. At most one per message — a visitor may change their mind, and the new verdict replaces the old one. */
+export type ExploreFeedback = {
+    __typename?: 'ExploreFeedback';
+    comment?: Maybe<Scalars['String']['output']>;
+    createdAt: Scalars['DateTime']['output'];
+    rating: ExploreFeedbackRating;
+    /** One of INACCURATE INCOMPLETE OFF_TOPIC HARD_TO_FOLLOW OTHER. Null for HELPFUL. */
+    reason?: Maybe<Scalars['String']['output']>;
+};
+export declare enum ExploreFeedbackRating {
+    Helpful = "HELPFUL",
+    NotHelpful = "NOT_HELPFUL"
+}
 /** Server-enforced limits, surfaced so the UI can pre-validate instead of discovering them through an error. */
 export type ExploreLimits = {
     __typename?: 'ExploreLimits';
@@ -5927,6 +6035,8 @@ export type ExploreMessage = {
     createdAt: Scalars['DateTime']['output'];
     ctas: Array<ExploreCta>;
     errorCode?: Maybe<Scalars['String']['output']>;
+    /** What this visitor said about this answer, or null if they said nothing — which is the ordinary case. Never populated for a USER message or for an answer that has not completed: neither is a thing anyone can rate. */
+    feedback?: Maybe<ExploreFeedback>;
     /** Suggested next questions, derived from what this answer actually covered. Empty until the turn completes, and empty when nothing useful can be derived. */
     followUps: Array<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
@@ -6384,6 +6494,10 @@ export type GetStoreProductTagsInput = {
 export type GrantAppDelegationInternalInput = {
     /** Client ID of the first-party system app (e.g. burdenoff_integration_core). */
     clientId: Scalars['String']['input'];
+    /** Scopes the delegation must keep for other grants that share it (e.g. the user's other integration connections). A retained scope is kept only while the existing delegation is ACTIVE and already holds it, and only while the app still allows it; otherwise it is dropped, never rejected. A grant therefore never restores or adds a scope beyond the requested scopes. */
+    retainedScopes?: InputMaybe<Array<Scalars['String']['input']>>;
+    /** Workspaces the delegation must keep for other grants that share it. Kept only while the existing delegation is ACTIVE and already covers them: restoring a REVOKED or EXPIRED delegation covers only workspaceIds. Ignored when workspaceIds is empty (unrestricted). */
+    retainedWorkspaceIds?: InputMaybe<Array<Scalars['String']['input']>>;
     /** Scopes to grant — must be a subset of the app's scopes. */
     scopes: Array<Scalars['String']['input']>;
     /** The user granting (and target of) the self-delegation. */
@@ -6393,6 +6507,8 @@ export type GrantAppDelegationInternalInput = {
 };
 export type GrantAppWorkspaceAccessInput = {
     appId: Scalars['ID']['input'];
+    /** Restore a REVOKED authorization only if its revokedReason is exactly this value (one conditional write); otherwise behave as create-only. Lets an automated provisioner undo its own withdrawal but never an operator's revocation. Takes precedence over reactivateRevoked. */
+    reactivateIfRevokedReason?: InputMaybe<Scalars['String']['input']>;
     /** Whether an existing REVOKED authorization may be restored. Defaults to true for explicit administrative grants. Automated provisioning should pass false so an operator revocation remains durable. */
     reactivateRevoked?: InputMaybe<Scalars['Boolean']['input']>;
     /** Optional subset of the app's global scopes. Empty array means the authorization inherits the app's full scope list. */
@@ -7114,6 +7230,8 @@ export type IssueAppAsUserTokenInternalInput = {
     scopes?: InputMaybe<Array<Scalars['String']['input']>>;
     /** The user the app will act on behalf of (must have an active delegation). */
     targetUserId: Scalars['String']['input'];
+    /** Bind the token to this one workspace instead of every workspace the delegation covers. The delegation must cover it. Callers minting for a single workspace (an integration connection) should always pass it. */
+    workspaceId?: InputMaybe<Scalars['String']['input']>;
 };
 export type ItemOrder = {
     __typename?: 'ItemOrder';
@@ -8109,6 +8227,8 @@ export type Mutation = {
     completeSupportAttachmentUpload: SupportAttachmentFile;
     /** Mark a tour as completed for a user */
     completeTour: TourUserProgress;
+    configureAssistantAccountBudget: AssistantAccountBudget;
+    configureAssistantModelPrice: AiModelPrice;
     configureEntitlementSeats: ProductEntitlement;
     /** Configure Kerberos authentication for a tenant */
     configureKerberos: KerberosConfig;
@@ -8463,6 +8583,7 @@ export type Mutation = {
     /** Detach media from a tour step */
     detachMediaFromStep: Scalars['Boolean']['output'];
     disableAuthMethod: Scalars['Boolean']['output'];
+    /** Disable every MFA method of the caller. When `code` is given (a current TOTP code, or one of the caller's unused backup codes) it must verify against an enabled method before anything is disabled. */
     disableMFA: Scalars['Boolean']['output'];
     disableMaintenanceMode: MaintenanceModeStatus;
     disableSchedule: ScheduledJob;
@@ -8478,13 +8599,16 @@ export type Mutation = {
     enableMFA: Scalars['Boolean']['output'];
     enableMaintenanceMode: MaintenanceModeStatus;
     enrollSubscriberInAutomation: AutomationSubscriber;
-    /** Idempotently ensure a user is an organization member, primarily for the workspace-invite-accept flow where an invitee gains a workspace inside an org they're not yet a member of. Unlike `addOrganizationMember`: * Returns `OrganizationMember` whether the row was inserted or already existed — no CONFLICT on repeat calls (case 1: already a member). * Does NOT overwrite the existing `role` column on a pre-existing row (case 2: don't demote). * Triggers a real-role assignment in global-rbac-svc at scope = orgId only when the actor has NO existing role assignment at that scope (case 3: real role comes from RBAC, not the data-layer string). The `role` arg defaults to `GUEST` — the most restrictive enum value — because invitees arriving via a workspace invite should not gain first-class org membership. The data-layer string column is a coarse classifier; the authoritative permission decision is evaluated by global-rbac-svc against `actor_role_assignments`. See BOFF-2649 + the RBAC guide at `dev/platform/context/rbac/RBAC_GUIDE_FOR_AI_TOOLS.md`. Called from wspace-workspace-svc::acceptInvitation via service-context (`X-Actor-Type: service`), which bypasses the workspace-admin check inside the resolver. Best-effort from the caller's side — failures must NOT block the upstream invite acceptance. */
+    /** Idempotently ensure a user is an organization member, primarily for the workspace-invite-accept flow where an invitee gains a workspace inside an org they're not yet a member of. Unlike `addOrganizationMember`: * Returns `OrganizationMember` whether the row was inserted or already existed — no CONFLICT on repeat calls (case 1: already a member). * Does NOT overwrite the existing `role` column on a pre-existing row (case 2: don't demote). * Triggers a real-role assignment in global-rbac-svc at scope = orgId only when the actor has NO existing role assignment at that scope (case 3: real role comes from RBAC, not the data-layer string). The `role` arg defaults to `GUEST` — the most restrictive enum value — because invitees arriving via a workspace invite should not gain first-class org membership. The data-layer string column is a coarse classifier; the authoritative permission decision is evaluated by global-rbac-svc against `actor_role_assignments`. See BOFF-2649 + the RBAC guide at `dev/platform/context/identity/rbac/RBAC_GUIDE_FOR_AI_TOOLS.md`. Called from wspace-workspace-svc::acceptInvitation via service-context (`X-Actor-Type: service`), which bypasses the workspace-admin check inside the resolver. Best-effort from the caller's side — failures must NOT block the upstream invite acceptance. */
     ensureOrganizationMember: EnsureOrganizationMemberResult;
     /** Ensure a billing order exists for a store order. Called from the checkout frontend when no billingOrderId is present (e.g. the buyer had no billing account at order-creation time). Creates the billing order server-side so the correct callbackGraphQL endpoint is registered and the billing service can call back after payment to confirm the store order. */
     ensureStoreOrderBillingOrder: EnsureStoreOrderBillingOrderResponse;
     /** Anonymise the subject on the billing layer. With dryRun=true, returns what would change without mutating. Financial records (Transaction, Invoice, Payment) are RETAINED for the statutory 7-year window. */
     eraseSubject: EraseResult;
+    /** Hand this conversation to a person, with its transcript attached. The agent answers only from a baked corpus, so the questions it cannot answer are exactly the ones worth a person's time. This turns the dead end into a handover: it files the conversation as a contact inquiry — the same record the website contact form writes, in the same console, with the same emails — so nobody has to ask the visitor to type their problem out a second time. Requires the conversation token and nothing else. A token that does not own a conversation is reported as NOT_FOUND, never FORBIDDEN, exactly as every other token-scoped call reports it: FORBIDDEN would confirm the conversation exists. Unlike `submitExploreFeedback` this is NOT fire-and-forget — it throws rather than reporting a handover that did not happen, because the visitor is about to be told that someone will get back to them. Rate-limited on the same per-IP budget as sending a message and gated by the same reCAPTCHA, because it is the same anonymous visitor making another public write. Idempotent: one handover per conversation, so a double-clicked button returns the first one rather than putting a second ticket in front of support. */
+    escalateExploreConversation: EscalateExploreConversationResult;
     escalateSupportTicket: SupportTicket;
+    exchangeOwnDelegation: AppAsUserTokenResponse;
     /** Exchange app token for app-as-user token (Token Exchange flow) */
     exchangeToken: AppAsUserTokenResponse;
     executeJobNow: JobExecution;
@@ -8624,6 +8748,8 @@ export type Mutation = {
     payInvoice: Invoice;
     permanentlyDeleteSchedule: Scalars['Boolean']['output'];
     placeLegalHold: LegalHold;
+    /** Internal-only: polls "Deploy Devportal Node" GitHub Actions run history and records the result in NodeSandboxBuildCheck — see services/nodeSandboxBuildPoll.ts. Invoked on a schedule by global-scheduler-svc's INTERNAL_API executor; also callable from the admin build-log UI for an on-demand refresh. Returns `skipped: true` (not an error) when NODE_SANDBOX_DISPATCH_TOKEN is unset OR the GitHub call itself fails (e.g. the token lacks Actions:read) — callers must check `skipped` rather than assume a non-error response means it actually polled. */
+    pollNodeSandboxBuildChecks: NodeSandboxBuildPollResult;
     prepareSupportAttachmentUpload: SupportAttachmentUploadSession;
     /** Process a refund for an app sale. Privileged financial mutation: reverses money to a buyer and adjusts the org's pending balance. Gated on `devportal-sale:manage` (the same permission as `retrySaleCreditSync`), with an in-resolver org-ADMIN check as defense-in-depth. */
     processAppSaleRefund: DeveloperOrgSale;
@@ -8831,6 +8957,7 @@ export type Mutation = {
     resendOrganizationInvite: OrganizationInvite;
     resendSurvey: CustomerSatisfactionSurvey;
     resendVerificationEmail: ResendVerificationResult;
+    reserveAssistantAccountBudget: AssistantBudgetReceipt;
     resetCircuitBreaker: CircuitBreakerState;
     /** Reset password using token from email */
     resetPassword: Scalars['Boolean']['output'];
@@ -8852,6 +8979,8 @@ export type Mutation = {
     restoreChannel: Channel;
     restoreScheduleVersion: ScheduledJob;
     restoreTemplateVersion: NewsletterTemplate;
+    /** Service-trusted internal REDUCTION of a first-party self-delegation, keyed by the app's client id and the user: used when one of several integration connections that share it is deleted or revoked. It never creates, re-enables or widens a delegation: it returns null when there is none (never granted, or erased), a REVOKED or EXPIRED one unchanged, and otherwise the delegation cut down to the requested scopes and workspaces it already held (REVOKED if none are left). Not blocked by a deactivated app: withdrawing access is always permitted. Gated to internal service / super_admin callers and restricted to first-party system apps. */
+    restrictAppDelegationInternal?: Maybe<AppUserDelegation>;
     /** Public endpoint — no authentication required. Email is normalized (trimmed, lowercased) and validated in the provider. Returns NOT_FOUND when no matching unsubscribed record exists; does not leak which side of the check failed. */
     resubscribe: NewsletterSubscriber;
     /** Resume a paused subscription */
@@ -8869,6 +8998,8 @@ export type Mutation = {
     /** Retry invoice generation for a successful transaction that never got an invoice recorded (a transient Zoho Books/Stripe Invoicing failure at payment time). transactionId is the transaction that has no invoiceNumber in its metadata yet — surfaced via getTransactionsByBillingAccount / getTransaction, not the invoice list (which only shows transactions that already have an invoice). */
     retryInvoiceGeneration: Invoice;
     retryJobExecution: JobExecution;
+    /** Platform admin only: re-dispatch the sandbox image build for a NODE version whose build never completed (stuck PENDING) or failed (FAILED / DISPATCH_FAILED / UNSUPPORTED). Calls the exact same dispatch path a fresh publish uses — it does not create a new version or touch review status, it only re-attempts the build for the existing one. */
+    retryNodeSandboxBuild: Scalars['Boolean']['output'];
     /** Retry a failed payout */
     retryPayout: DeveloperOrgPayout;
     /** Retry a failed refund */
@@ -8881,7 +9012,9 @@ export type Mutation = {
     revokeAPIKey: Scalars['Boolean']['output'];
     /** Revoke all sessions except the current one. Returns the number of sessions that were revoked. */
     revokeAllSessions: RevokeAllSessionsResult;
-    /** Revoke an app's access to a workspace. Returns false if the row was already REVOKED or never existed. */
+    /** Service-trusted internal revoke of a first-party self-delegation, keyed by the app's client id and the user — the counterpart of grantAppDelegationInternal, used when the last integration connection that needed it is deleted or revoked. Idempotent: returns true when an ACTIVE delegation was revoked and false when there was none (never granted, already revoked or expired). Gated to internal service / super_admin callers and restricted to first-party system apps. */
+    revokeAppDelegationInternal: Scalars['Boolean']['output'];
+    /** Revoke an app's access to a workspace. Returns false if the row was already REVOKED or never existed. An owner or super_admin revoking an already-REVOKED row replaces the revocation on record (reason, actor, time). */
     revokeAppWorkspaceAccess: Scalars['Boolean']['output'];
     revokeConsent: NewsletterConsent;
     revokeDelegation: Scalars['Boolean']['output'];
@@ -8921,6 +9054,8 @@ export type Mutation = {
     scheduleNotification: ScheduledNotification;
     /** Overwrite the built-in AthleteBridge user-facing tours from the service-owned seed file. */
     seedAtheleteBridgeUserTours: SeedAtheleteBridgeUserToursResult;
+    /** Overwrite the service-owned BigConsole onboarding tours. Repeated calls update the same slugs. */
+    seedBigconsoleUserTours: SeedBigconsoleUserToursResult;
     /** Overwrite the built-in Buildmyiq user-facing dashboard tour from the service-owned seed file. */
     seedBuildmyiqUserTours: SeedBuildmyiqUserToursResult;
     /** Overwrite the built-in CollabKin user-facing dashboard tour from the service-owned seed file. */
@@ -8992,6 +9127,7 @@ export type Mutation = {
     setUserLanguagePreference: UserLanguagePreference;
     /** Set workspace-level override for a feature flag (super admin or workspace admin). RBAC is scoped to the target workspace via `input.workspaceId`. */
     setWorkspaceFeatureFlagOverride: WorkspaceFeatureFlagOverride;
+    settleAssistantAccountBudget: AssistantBudgetReceipt;
     setupMFA: MfaSetupResult;
     /** Share a WORKFLOW-type application as a public link by setting its visibility to UNLISTED. Only the developer who owns the app can call this. The app must have a manifest (workflow definition) set. */
     shareWorkflow: Application;
@@ -9019,6 +9155,8 @@ export type Mutation = {
     submitAssignmentResponse: SubmitAssignmentResponsePayload;
     /** Submit a contact inquiry from a public website (no authentication required). Validates reCAPTCHA token server-side using the product's secret key fetched from the tenant service via internal gateway. */
     submitContactInquiry: SubmitContactInquiryResult;
+    /** Rate one answer. Same fire-and-forget posture as `recordExploreClick`: a rating that cannot be attributed — an unfinished answer, a USER turn, a token that does not own the message — comes back `recorded: false` rather than as an error, and never as FORBIDDEN, which would confirm that a message id exists. Submitting again REPLACES the previous rating for that message, so changing your mind is an ordinary action rather than a duplicate or a failure. */
+    submitExploreFeedback: SubmitExploreFeedbackResult;
     /** Submit feedback for an interview round (admin). */
     submitInterviewFeedback: InterviewFeedback;
     /** Submit a job application from a public website (no authentication required). Validates reCAPTCHA, stores the resume in private storage, and notifies the applicant + careers inbox. */
@@ -9303,7 +9441,6 @@ export type Mutation = {
     /** M2M: create or update a ShippingAddress for an EXPLICIT user, on behalf of a calling service. Product backends (e.g. Kadaikodi) call this through the INTERNAL gateway so a user's address lives in the canonical store owner rather than a per-product copy. Pass `input.id` to update an existing row (must belong to `input.userId`); omit it to create. Service-actor only. */
     upsertUserShippingAddress: ShippingAddress;
     useCannedResponse: CannedResponse;
-    validateApiKey: TokenValidationResponse;
     /** Validate an HMAC signature */
     validateHMACSignature: HmacValidationResult;
     /** Validate a signed cookie */
@@ -9888,6 +10025,19 @@ export type MutationCompleteTourArgs = {
     userId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationConfigureAssistantAccountBudgetArgs = {
+    billingAccountId: Scalars['ID']['input'];
+    dailyMicroUsd: Scalars['Int']['input'];
+    dailyTokens: Scalars['Int']['input'];
+    enabled: Scalars['Boolean']['input'];
+};
+/** Root mutation type */
+export type MutationConfigureAssistantModelPriceArgs = {
+    inputPer1M: Scalars['String']['input'];
+    model: Scalars['String']['input'];
+    outputPer1M: Scalars['String']['input'];
+};
+/** Root mutation type */
 export type MutationConfigureEntitlementSeatsArgs = {
     entitlementId: Scalars['ID']['input'];
     maxSeats: Scalars['Int']['input'];
@@ -10848,6 +10998,10 @@ export type MutationDisableAuthMethodArgs = {
     authType: AuthType;
 };
 /** Root mutation type */
+export type MutationDisableMfaArgs = {
+    code?: InputMaybe<Scalars['String']['input']>;
+};
+/** Root mutation type */
 export type MutationDisableScheduleArgs = {
     id: Scalars['ID']['input'];
     reason?: InputMaybe<Scalars['String']['input']>;
@@ -10913,12 +11067,20 @@ export type MutationEraseSubjectArgs = {
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationEscalateExploreConversationArgs = {
+    input: EscalateExploreConversationInput;
+};
+/** Root mutation type */
 export type MutationEscalateSupportTicketArgs = {
     escalateTo?: InputMaybe<Scalars['String']['input']>;
     id: Scalars['ID']['input'];
     reason: Scalars['String']['input'];
 };
 /** Root mutation type */
+export type MutationExchangeOwnDelegationArgs = {
+    input: ExchangeOwnDelegationInput;
+};
+/** Root mutation type */
 export type MutationExchangeTokenArgs = {
     input: ExchangeTokenInput;
 };
@@ -11877,6 +12039,10 @@ export type MutationResendVerificationEmailArgs = {
     email: Scalars['String']['input'];
 };
 /** Root mutation type */
+export type MutationReserveAssistantAccountBudgetArgs = {
+    input: ReserveAssistantBudgetInput;
+};
+/** Root mutation type */
 export type MutationResetCircuitBreakerArgs = {
     scope: Scalars['String']['input'];
     scopeValue: Scalars['String']['input'];
@@ -11943,6 +12109,10 @@ export type MutationRestoreTemplateVersionArgs = {
     version: Scalars['Int']['input'];
 };
 /** Root mutation type */
+export type MutationRestrictAppDelegationInternalArgs = {
+    input: RestrictAppDelegationInternalInput;
+};
+/** Root mutation type */
 export type MutationResubscribeArgs = {
     email: Scalars['String']['input'];
     platformProductId?: InputMaybe<Scalars['String']['input']>;
@@ -11992,6 +12162,10 @@ export type MutationRetryJobExecutionArgs = {
     executionId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationRetryNodeSandboxBuildArgs = {
+    id: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationRetryPayoutArgs = {
     id: Scalars['ID']['input'];
 };
@@ -12021,6 +12195,10 @@ export type MutationRevokeApiKeyArgs = {
     keyId: Scalars['String']['input'];
 };
 /** Root mutation type */
+export type MutationRevokeAppDelegationInternalArgs = {
+    input: RevokeAppDelegationInternalInput;
+};
+/** Root mutation type */
 export type MutationRevokeAppWorkspaceAccessArgs = {
     input: RevokeAppWorkspaceAccessInput;
 };
@@ -12263,6 +12441,13 @@ export type MutationSetWorkspaceFeatureFlagOverrideArgs = {
     input: SetWorkspaceFeatureFlagOverrideInput;
 };
 /** Root mutation type */
+export type MutationSettleAssistantAccountBudgetArgs = {
+    id: Scalars['ID']['input'];
+    inputTokens: Scalars['Int']['input'];
+    outputTokens: Scalars['Int']['input'];
+    workspaceId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationSetupMfaArgs = {
     method: MfaMethod;
 };
@@ -12340,6 +12525,10 @@ export type MutationSubmitContactInquiryArgs = {
     input: SubmitContactInquiryInput;
 };
 /** Root mutation type */
+export type MutationSubmitExploreFeedbackArgs = {
+    input: SubmitExploreFeedbackInput;
+};
+/** Root mutation type */
 export type MutationSubmitInterviewFeedbackArgs = {
     input: SubmitInterviewFeedbackInput;
 };
@@ -13215,10 +13404,6 @@ export type MutationUseCannedResponseArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root mutation type */
-export type MutationValidateApiKeyArgs = {
-    apiKey: Scalars['String']['input'];
-};
-/** Root mutation type */
 export type MutationValidateHmacSignatureArgs = {
     algorithm?: InputMaybe<Scalars['String']['input']>;
     appId: Scalars['ID']['input'];
@@ -13655,6 +13840,39 @@ export declare enum NewsletterWaitlistStatus {
     Pending = "PENDING",
     Rejected = "REJECTED"
 }
+/** One observed run of the "Deploy Devportal Node" GitHub Actions workflow, polled from run history rather than pushed via callback — see workers/nodeSandboxBuildPoll.ts. applicationVersionId/slug/version are best-effort, parsed from the run's title; null on runs from before the workflow embedded them, or a title that didn't parse. */
+export type NodeSandboxBuildCheck = {
+    __typename?: 'NodeSandboxBuildCheck';
+    applicationVersionId?: Maybe<Scalars['String']['output']>;
+    checkedAt: Scalars['DateTime']['output'];
+    failureStep?: Maybe<Scalars['String']['output']>;
+    id: Scalars['ID']['output'];
+    runConclusion?: Maybe<Scalars['String']['output']>;
+    runId: Scalars['String']['output'];
+    runStartedAt?: Maybe<Scalars['DateTime']['output']>;
+    runStatus: Scalars['String']['output'];
+    runUpdatedAt?: Maybe<Scalars['DateTime']['output']>;
+    runUrl: Scalars['String']['output'];
+    slug?: Maybe<Scalars['String']['output']>;
+    version?: Maybe<Scalars['String']['output']>;
+};
+export type NodeSandboxBuildCheckConnection = {
+    __typename?: 'NodeSandboxBuildCheckConnection';
+    edges: Array<NodeSandboxBuildCheckEdge>;
+    pageInfo: PageInfo;
+    totalCount: Scalars['Int']['output'];
+};
+export type NodeSandboxBuildCheckEdge = {
+    __typename?: 'NodeSandboxBuildCheckEdge';
+    cursor: Scalars['String']['output'];
+    node: NodeSandboxBuildCheck;
+};
+/** Result of a pollNodeSandboxBuildChecks call. `skipped: true` means no GitHub Actions run history was fetched this call (token unset or the GitHub API call failed) — `recorded` is only meaningful when `skipped` is false. */
+export type NodeSandboxBuildPollResult = {
+    __typename?: 'NodeSandboxBuildPollResult';
+    recorded: Scalars['Int']['output'];
+    skipped: Scalars['Boolean']['output'];
+};
 export type Notification = {
     __typename?: 'Notification';
     actions: Array<NotificationAction>;
@@ -14694,6 +14912,8 @@ export declare enum PaymentMethodType {
     Crypto = "CRYPTO",
     DebitCard = "DEBIT_CARD",
     Netbanking = "NETBANKING",
+    /** Zero-total purchases (e.g. a 100%-off coupon) — no gateway/method involved. */
+    None = "NONE",
     Paypal = "PAYPAL",
     Wallet = "WALLET"
 }
@@ -14985,6 +15205,8 @@ export type Plan = {
     minSeats?: Maybe<Scalars['Int']['output']>;
     /** The name of the plan (e.g., 'Basic', 'Pro', 'Enterprise'). */
     name?: Maybe<Scalars['String']['output']>;
+    /** Apple App Store / Google Play SKU for this plan. */
+    nativeProductId?: Maybe<Scalars['String']['output']>;
     /** The price of the plan. */
     price?: Maybe<Scalars['Float']['output']>;
     /** Historical record of price changes for this plan */
@@ -16504,6 +16726,8 @@ export type Query = {
     newsletterVariant?: Maybe<NewsletterVariant>;
     newsletterVariants: Array<NewsletterVariant>;
     newsletters: Array<Newsletter>;
+    /** Platform admin only: recent observed runs of the node-sandbox build workflow, newest first — see workers/nodeSandboxBuildPoll.ts. Optionally filtered to one version's runs. */
+    nodeSandboxBuildChecks: NodeSandboxBuildCheckConnection;
     /** Get a single notification by ID */
     notification?: Maybe<Notification>;
     /** Get notification events/history for a specific notification */
@@ -18608,6 +18832,12 @@ export type QueryNewslettersArgs = {
     offset?: InputMaybe<Scalars['Int']['input']>;
 };
 /** Root query type */
+export type QueryNodeSandboxBuildChecksArgs = {
+    applicationVersionId?: InputMaybe<Scalars['ID']['input']>;
+    limit?: InputMaybe<Scalars['Int']['input']>;
+    offset?: InputMaybe<Scalars['Int']['input']>;
+};
+/** Root query type */
 export type QueryNotificationArgs = {
     id: Scalars['ID']['input'];
 };
@@ -20448,6 +20678,13 @@ export type ResendVerificationResult = {
     message: Scalars['String']['output'];
     success: Scalars['Boolean']['output'];
 };
+export type ReserveAssistantBudgetInput = {
+    id: Scalars['ID']['input'];
+    inputTokens: Scalars['Int']['input'];
+    model: Scalars['String']['input'];
+    outputTokens: Scalars['Int']['input'];
+    workspaceId: Scalars['ID']['input'];
+};
 /** Input for resolving (or creating) the default billing account for a user/org. At least one of `orgId` or `ownerUserId` MUST be supplied: - `orgId` present → resolve-or-create the org's default billing account. - `ownerUserId` only → resolve an EXISTING billing account already associated with that user's earnings/payout accounts. Creation requires an `orgId` anchor because a billing account is always org-scoped. */
 export type ResolveBillingAccountInput = {
     /** Opaque org id that anchors the billing account. When present the org's default billing account is resolved-or-created. */
@@ -20495,6 +20732,17 @@ export type ResourceTypeProductInfo = {
     products: Array<Scalars['String']['output']>;
     resourceType: Scalars['String']['output'];
 };
+/** Input for the service-trusted internal reduction of a first-party self-delegation. */
+export type RestrictAppDelegationInternalInput = {
+    /** Client ID of the first-party system app (e.g. burdenoff_integration_core). */
+    clientId: Scalars['String']['input'];
+    /** The most the delegation may keep: it keeps only those of these scopes it already holds (and the app still allows), and is revoked if none are left. */
+    scopes: Array<Scalars['String']['input']>;
+    /** The user whose delegation to the app is reduced. */
+    userId: Scalars['String']['input'];
+    /** The most workspaces the delegation may keep: it keeps only those of these it already covers, and is revoked if none are left. Empty = leave the workspaces as they are. */
+    workspaceIds: Array<Scalars['String']['input']>;
+};
 export type RetryBillingOrderCallbackResponse = {
     __typename?: 'RetryBillingOrderCallbackResponse';
     error?: Maybe<Scalars['String']['output']>;
@@ -20551,8 +20799,19 @@ export type RevokeAllSessionsResult = {
     revokedCount: Scalars['Int']['output'];
     success: Scalars['Boolean']['output'];
 };
+/** Input for the service-trusted internal revoke of a first-party self-delegation. */
+export type RevokeAppDelegationInternalInput = {
+    /** Client ID of the first-party system app (e.g. burdenoff_integration_core). */
+    clientId: Scalars['String']['input'];
+    /** Recorded on the delegation and in the audit log. */
+    reason?: InputMaybe<Scalars['String']['input']>;
+    /** The user whose delegation to the app is revoked. */
+    userId: Scalars['String']['input'];
+};
 export type RevokeAppWorkspaceAccessInput = {
     appId: Scalars['ID']['input'];
+    /** Withdraw only the calling actor's own grant. The authorization is revoked (true) only when the caller is its sole grantor; when others granted it too, only the caller's share is released and it stays ACTIVE (false); one the caller never granted is left untouched (false). An automated provisioner withdrawing its own grant sets this, so it never revokes access an owner or an app installation gave the app, whichever granted first. */
+    onlyIfGrantedByCaller?: InputMaybe<Scalars['Boolean']['input']>;
     reason?: InputMaybe<Scalars['String']['input']>;
     workspaceId: Scalars['ID']['input'];
 };
@@ -21089,6 +21348,15 @@ export type SeedAtheleteBridgeUserToursResult = {
     updatedCount: Scalars['Int']['output'];
     workspaceId: Scalars['String']['output'];
 };
+export type SeedBigconsoleUserToursResult = {
+    __typename?: 'SeedBigconsoleUserToursResult';
+    createdCount: Scalars['Int']['output'];
+    productId: Scalars['String']['output'];
+    totalCount: Scalars['Int']['output'];
+    tours: Array<SeededUserTourResult>;
+    updatedCount: Scalars['Int']['output'];
+    workspaceId: Scalars['String']['output'];
+};
 export type SeedBuildmyiqUserToursResult = {
     __typename?: 'SeedBuildmyiqUserToursResult';
     createdCount: Scalars['Int']['output'];
@@ -22240,6 +22508,24 @@ export type SubmitContactInquiryResult = {
     /** Whether the submission was successful */
     success: Scalars['Boolean']['output'];
 };
+/** One visitor's verdict on one answer. Anonymous like the rest of explore: the conversation token is the only proof of ownership, and the visitor is recorded as an `ipHash`, never an IP. */
+export type SubmitExploreFeedbackInput = {
+    /** Optional free text. Capped server-side; the server truncates rather than rejecting, because a rating is never worth failing over its comment. */
+    comment?: InputMaybe<Scalars['String']['input']>;
+    /** Bearer secret for the conversation the answer belongs to. */
+    conversationToken: Scalars['String']['input'];
+    /** The assistant message being rated. Must be COMPLETED. */
+    messageId: Scalars['ID']['input'];
+    rating: ExploreFeedbackRating;
+    /** Why it was not helpful: one of INACCURATE INCOMPLETE OFF_TOPIC HARD_TO_FOLLOW OTHER. Ignored — and stored as null — for HELPFUL, because "what was wrong with it" is not a question a positive rating answers. */
+    reason?: InputMaybe<Scalars['String']['input']>;
+};
+export type SubmitExploreFeedbackResult = {
+    __typename?: 'SubmitExploreFeedbackResult';
+    /** What was actually stored — echoed back so the UI renders the server's view rather than assuming its optimistic one was accepted. Null when `recorded` is false. */
+    feedback?: Maybe<ExploreFeedback>;
+    recorded: Scalars['Boolean']['output'];
+};
 export type SubmitInterviewFeedbackInput = {
     internalNotes?: InputMaybe<Scalars['String']['input']>;
     interviewerId: Scalars['ID']['input'];
@@ -23161,10 +23447,14 @@ export type Tenant = {
     /** Workspaces belonging to this tenant */
     workspaces: Array<Workspace>;
 };
-/** Tenant configuration for regional settings, branding, and features */
+/** Tenant configuration for regional settings, data residency, and features */
 export type TenantConfig = {
     __typename?: 'TenantConfig';
     complianceRegion?: Maybe<Scalars['String']['output']>;
+    /**
+     * Always null. Burdenoff does no white-labelling: every product keeps its own brand, so tenants cannot set a custom logo, colour or favicon.
+     * @deprecated No white-labelling — products keep their own brand. This setting is ignored.
+     */
     customBranding?: Maybe<Scalars['JSON']['output']>;
     dataResidency?: Maybe<Scalars['String']['output']>;
     features?: Maybe<Scalars['JSON']['output']>;
@@ -25545,12 +25835,16 @@ export type UserWishlist = {
     userId: Scalars['String']['output'];
 };
 export type ValidateCouponInput = {
+    /** Addon being purchased — same purpose as planId, for addon purchases. */
+    addonId?: InputMaybe<Scalars['ID']['input']>;
     /** Order amount before discount */
     amount: Scalars['Float']['input'];
     /** Coupon code to validate */
     code: Scalars['String']['input'];
     /** Currency */
     currency: Scalars['String']['input'];
+    /** Plan being purchased — used to resolve product/entity-type scoping (applicableProductIds/applicableEntityTypes) from the Plan record itself, not from a client-asserted product/entity string. */
+    planId?: InputMaybe<Scalars['ID']['input']>;
     /** Optional: product IDs being purchased */
     productIds?: InputMaybe<Array<Scalars['String']['input']>>;
     /** Optional: service IDs being purchased */