@burdenoff/microfe-store 2026.1013.3 → 2026.1028.1

package/dist/generated/global-types.d.ts

@@ -408,6 +408,8 @@ export type Addon = {
     isActive?: Maybe<Scalars['Boolean']['output']>;
     /** The name of the addon (e.g., 'Extra Bots', 'Additional Storage'). */
     name?: Maybe<Scalars['String']['output']>;
+    /** Apple App Store / Google Play SKU for this addon. */
+    nativeProductId?: Maybe<Scalars['String']['output']>;
     /** The price of the addon. */
     price?: Maybe<Scalars['Float']['output']>;
     /** Historical record of price changes for this addon */
@@ -746,6 +748,8 @@ export declare enum AgentStatus {
 /** Per-model LLM token prices (USD per 1M tokens) used to weight AI-credit charges. */
 export type AiModelPrice = {
     __typename?: 'AiModelPrice';
+    cacheReadMultiplier: Scalars['Float']['output'];
+    cacheWriteMultiplier: Scalars['Float']['output'];
     inputPer1M: Scalars['Float']['output'];
     isActive: Scalars['Boolean']['output'];
     model: Scalars['String']['output'];
@@ -1361,6 +1365,20 @@ export type AssignedQuota = {
     scope: QuotaScope;
     workspaceId?: Maybe<Scalars['ID']['output']>;
 };
+export type AssistantAccountBudget = {
+    __typename?: 'AssistantAccountBudget';
+    billingAccountId: Scalars['ID']['output'];
+    dailyMicroUsd: Scalars['Int']['output'];
+    dailyTokens: Scalars['Int']['output'];
+    enabled: Scalars['Boolean']['output'];
+};
+export type AssistantBudgetReceipt = {
+    __typename?: 'AssistantBudgetReceipt';
+    heldMicroUsd: Scalars['Int']['output'];
+    heldTokens: Scalars['Int']['output'];
+    id: Scalars['ID']['output'];
+    status: Scalars['String']['output'];
+};
 export type AttachMediaToStepInput = {
     /** Operation context for scoping (workspaceId, userId, productId, moduleId, etc.) */
     context?: InputMaybe<ContextInput>;
@@ -1550,6 +1568,82 @@ export type AutomationSubscriber = {
     status: AutomationStatus;
     subscriberId: Scalars['String']['output'];
 };
+/** A workspace's avatar credits, in one person's view when actorId is given (contract v2). Whole credits, 0 or more. */
+export type AvatarMinutesBalance = {
+    __typename?: 'AvatarMinutesBalance';
+    /** Credits left for this person now: carried + free within the person's ceiling + plan. */
+    availableMinutes: Scalars['Int']['output'];
+    /** Carried credits left. */
+    carriedRemaining: Scalars['Int']['output'];
+    /** Always 2. */
+    contractVersion: Scalars['Int']['output'];
+    /** The counted free row's amount; 0 without one. */
+    freeMinutesPerMonth: Scalars['Int']['output'];
+    /** Free credits left in this workspace this month, before the person's ceiling. */
+    freeRemaining: Scalars['Int']['output'];
+    /** This person's own open holds that block them; null without actorId. */
+    heldByActorMinutes?: Maybe<Scalars['Int']['output']>;
+    /** Credits reserved by open sessions in this workspace. */
+    heldMinutes: Scalars['Int']['output'];
+    /** Whether a plan with more credits exists for the product. Display only, never an entitlement. */
+    morePlanCreditsAvailable: Scalars['Boolean']['output'];
+    /** The per-person free ceiling; null when off. */
+    personFreeCeiling?: Maybe<Scalars['Int']['output']>;
+    /** The person's free credits left this UTC month; null when the ceiling is off or without actorId. */
+    personFreeRemaining?: Maybe<Scalars['Int']['output']>;
+    /** The counted plans' amounts, summed. */
+    planMinutesPerMonth: Scalars['Int']['output'];
+    /** Plan credits left in this workspace this month. */
+    planRemaining: Scalars['Int']['output'];
+    reason?: Maybe<AvatarMinutesReason>;
+    /** The next 1st, 00:00 UTC (ISO-8601 with milliseconds). */
+    resetsAt: Scalars['String']['output'];
+    state: AvatarMinutesState;
+};
+export declare enum AvatarMinutesEndClass {
+    Exact = "EXACT",
+    None = "NONE",
+    Uncertain = "UNCERTAIN"
+}
+export declare enum AvatarMinutesMode {
+    Enforce = "ENFORCE",
+    Observe = "OBSERVE"
+}
+export declare enum AvatarMinutesReason {
+    FreeCeiling = "FREE_CEILING",
+    NotIncluded = "NOT_INCLUDED",
+    OwnSession = "OWN_SESSION",
+    ZeroSessionLimit = "ZERO_SESSION_LIMIT"
+}
+export type AvatarMinutesReservation = {
+    __typename?: 'AvatarMinutesReservation';
+    chargedMinutes?: Maybe<Scalars['Int']['output']>;
+    /** AVATAR, SWEEPER or SUPERSEDE. */
+    closedBy?: Maybe<Scalars['String']['output']>;
+    reservedMinutes: Scalars['Int']['output'];
+    sessionId: Scalars['ID']['output'];
+    /** RESERVED, ACTIVE, SETTLED, RELEASED or EXPIRED. */
+    state: Scalars['String']['output'];
+};
+/** HMAC-SHA256 envelope of a signed avatar-minutes call (DESIGN 3.7): the key id (environment-prefixed), the signing instant (strict ISO-8601 UTC with milliseconds) and the MAC (64 lowercase hex). */
+export type AvatarMinutesSignature = {
+    issuedAt: Scalars['String']['input'];
+    kid: Scalars['String']['input'];
+    value: Scalars['String']['input'];
+};
+export declare enum AvatarMinutesState {
+    Available = "AVAILABLE",
+    Exhausted = "EXHAUSTED",
+    InUse = "IN_USE"
+}
+/** The provider's session status at settle, noted once on the SETTLED reservation (P-27). */
+export declare enum AvatarProviderSessionStatus {
+    Canceled = "CANCELED",
+    Ended = "ENDED",
+    Ending = "ENDING",
+    Failed = "FAILED",
+    Other = "OTHER"
+}
 export declare enum BackoffStrategy {
     Exponential = "EXPONENTIAL",
     ExponentialWithJitter = "EXPONENTIAL_WITH_JITTER",
@@ -1781,13 +1875,17 @@ export type BillingSubscription = {
 };
 export type BillingWebhookLog = {
     __typename?: 'BillingWebhookLog';
+    attemptCount: Scalars['Int']['output'];
     context?: Maybe<Scalars['JSON']['output']>;
     createdAt: Scalars['DateTime']['output'];
+    deadLetteredAt?: Maybe<Scalars['DateTime']['output']>;
     error?: Maybe<Scalars['String']['output']>;
     event: Scalars['String']['output'];
     id: Scalars['ID']['output'];
+    nextAttemptAt?: Maybe<Scalars['DateTime']['output']>;
     payload: Scalars['JSON']['output'];
     processed: Scalars['Boolean']['output'];
+    processingStartedAt?: Maybe<Scalars['DateTime']['output']>;
     provider: Scalars['String']['output'];
 };
 /** Paginated page of BillingWebhookLog rows, for the admin webhook-log viewer — unlike getUnprocessedFailedWebhooks, not restricted to the payment-succeeded event types eligible for refund creation. */
@@ -2904,6 +3002,20 @@ export declare enum CircuitState {
     HalfOpen = "HALF_OPEN",
     Open = "OPEN"
 }
+export type CloseAvatarMinutesInput = {
+    /** The decider's wall-clock time; audit only. */
+    decidedAt: Scalars['String']['input'];
+    endClass: AvatarMinutesEndClass;
+    /** Sets the rounding by the exhaustive table in DESIGN 3.1. */
+    endReason: Scalars['String']['input'];
+    ownerDecided: Scalars['Boolean']['input'];
+    /** Anchors the lease; absent for a failed start. */
+    readyAt?: InputMaybe<Scalars['String']['input']>;
+    sessionId: Scalars['ID']['input'];
+    /** The decision's span (DESIGN 3.1), whole milliseconds; 0 when not confirmed. */
+    spanMs: Scalars['Int']['input'];
+    workspaceId: Scalars['ID']['input'];
+};
 export type ComplaintStats = {
     __typename?: 'ComplaintStats';
     complaintRate: Scalars['Float']['output'];
@@ -2921,6 +3033,10 @@ export type ComplianceAuditLogEntry = {
 /** Input for configuring tenant settings */
 export type ConfigureTenantInput = {
     complianceRegion?: InputMaybe<Scalars['String']['input']>;
+    /**
+     * Ignored and never stored. Burdenoff does no white-labelling: every product keeps its own brand.
+     * @deprecated No white-labelling — products keep their own brand. This setting is ignored.
+     */
     customBranding?: InputMaybe<Scalars['JSON']['input']>;
     dataResidency?: InputMaybe<Scalars['String']['input']>;
     features?: InputMaybe<Scalars['JSON']['input']>;
@@ -3142,6 +3258,10 @@ export type ContextWidgetConversationPayload = {
 };
 export type Coupon = {
     __typename?: 'Coupon';
+    /** Purchase flows (PLAN / ADD_ON / STORE) this coupon may be redeemed against. Empty = all entity types. */
+    applicableEntityTypes: Array<CouponEntityType>;
+    /** Product slugs (e.g. "vibecontrols", "fluidgrids") this coupon may be redeemed against. Empty = all products. */
+    applicableProductIds: Array<Scalars['String']['output']>;
     applicableProducts: Array<Scalars['String']['output']>;
     applicableServices: Array<Scalars['String']['output']>;
     campaignId?: Maybe<Scalars['String']['output']>;
@@ -3172,6 +3292,12 @@ export type Coupon = {
     validUntil?: Maybe<Scalars['DateTime']['output']>;
     value: Scalars['Float']['output'];
 };
+/** Which purchase flow a coupon may be redeemed against (BOFF-7391). */
+export declare enum CouponEntityType {
+    AddOn = "ADD_ON",
+    Plan = "PLAN",
+    Store = "STORE"
+}
 export type CouponFilterInput = {
     campaignId?: InputMaybe<Scalars['String']['input']>;
     scope?: InputMaybe<CouponScope>;
@@ -3457,6 +3583,8 @@ export type CreateContentPageInput = {
     visibility?: InputMaybe<ContentVisibility>;
 };
 export type CreateCouponInput = {
+    applicableEntityTypes?: InputMaybe<Array<CouponEntityType>>;
+    applicableProductIds?: InputMaybe<Array<Scalars['String']['input']>>;
     applicableProducts?: InputMaybe<Array<Scalars['String']['input']>>;
     applicableServices?: InputMaybe<Array<Scalars['String']['input']>>;
     campaignId?: InputMaybe<Scalars['String']['input']>;
@@ -5646,6 +5774,25 @@ export type EraseResult = {
     retainedForLegalReason?: Maybe<Scalars['String']['output']>;
     service: Scalars['String']['output'];
 };
+/** A visitor asking for a human, on a conversation they are already in. Anonymous like the rest of explore: the conversation token is the only proof of ownership, and the only thing we ask the visitor for is where to reply. */
+export type EscalateExploreConversationInput = {
+    /** Bearer secret for the conversation being handed over. */
+    conversationToken: Scalars['String']['input'];
+    /** Where the reply should go. Validated server-side and stored lower-cased; an address we cannot deliver to is refused with `INVALID_EMAIL` rather than accepted into a ticket nobody can answer. */
+    email: Scalars['String']['input'];
+    /** Anything the visitor wants to add in their own words. Optional — the point of the handover is that the conversation already says what the problem is. Capped server-side; the server truncates rather than rejecting. */
+    note?: InputMaybe<Scalars['String']['input']>;
+    /** `PlatformProduct` id of the site the visitor is on, so the handover reaches that product's support inbox instead of the default one. */
+    productId?: InputMaybe<Scalars['String']['input']>;
+    /** reCAPTCHA v3 token — required only when `exploreCatalog.captchaRequired`, and minted with the SAME action as a chat message. */
+    recaptchaToken?: InputMaybe<Scalars['String']['input']>;
+};
+export type EscalateExploreConversationResult = {
+    __typename?: 'EscalateExploreConversationResult';
+    /** False when this submit found a handover that already existed — the double-clicked button, the retried request, the reloaded page. Not an error: the conversation is with a human either way. */
+    created: Scalars['Boolean']['output'];
+    escalation: ExploreEscalation;
+};
 export type EvaluateFeatureFlagsInput = {
     /** Specific flag keys to evaluate. If empty, evaluates ALL active flags. */
     keys?: InputMaybe<Array<Scalars['String']['input']>>;
@@ -5653,6 +5800,10 @@ export type EvaluateFeatureFlagsInput = {
     productSlug?: InputMaybe<Scalars['String']['input']>;
     workspaceId: Scalars['String']['input'];
 };
+export type ExchangeOwnDelegationInput = {
+    delegationId: Scalars['ID']['input'];
+    scopes?: InputMaybe<Array<Scalars['String']['input']>>;
+};
 export type ExchangeTokenInput = {
     appId: Scalars['String']['input'];
     scopes?: InputMaybe<Array<Scalars['String']['input']>>;
@@ -5715,6 +5866,8 @@ export type ExploreAdminFilter = {
     from?: InputMaybe<Scalars['DateTime']['input']>;
     /** Salted IP hash, to group one visitor's sessions. */
     ipHash?: InputMaybe<Scalars['String']['input']>;
+    /** Only conversations containing an answer a visitor marked NOT helpful. */
+    notHelpfulOnly?: InputMaybe<Scalars['Boolean']['input']>;
     /** Match conversations that started on this product's website. */
     productSlug?: InputMaybe<Scalars['String']['input']>;
     /** Free-text match against message content. */
@@ -5735,6 +5888,8 @@ export type ExploreAdminMessage = {
     createdAt: Scalars['DateTime']['output'];
     ctas: Array<ExploreCta>;
     errorCode?: Maybe<Scalars['String']['output']>;
+    /** What the visitor said about this answer — rating, reason and comment — or null when they said nothing, which is the ordinary case. `answered` is our own machine verdict on whether we could ground a reply; this is the visitor's, and it is the only one of the two that can say an answer was confidently wrong. */
+    feedback?: Maybe<ExploreFeedback>;
     followUps: Array<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
     references: Array<ExploreReference>;
@@ -5761,7 +5916,11 @@ export type ExploreAdminStats = {
     byProduct: Array<ExploreAdminProductStat>;
     clicks: Scalars['Int']['output'];
     conversations: Scalars['Int']['output'];
+    /** Answers a visitor marked helpful. */
+    helpful: Scalars['Int']['output'];
     messages: Scalars['Int']['output'];
+    /** Answers a visitor marked NOT helpful. Read against `unanswered`: those are the gaps we already know about, these are the ones we thought we had covered. */
+    notHelpful: Scalars['Int']['output'];
     /** Assistant answers the corpus could not ground. */
     unanswered: Scalars['Int']['output'];
 };
@@ -5774,8 +5933,20 @@ export type ExploreAgentActivity = {
 export type ExploreAgentCatalog = {
     __typename?: 'ExploreAgentCatalog';
     builtAt: Scalars['DateTime']['output'];
+    /** At most one highlight per product, product-slug ordered, identical on every replica. Empty when the corpus carries no concept pages — never null, never an error. */
+    conceptHighlights: Array<ExploreAgentConcept>;
     products: Array<ExploreAgentProduct>;
 };
+/** One product's concept page and the illustration that stands for it — what `/explore` offers a visitor who has not asked anything yet. `imageUrl` is absolute, on the product's own published origin, and drawn from the same allow-list an answer's images come from; `alt` is the illustration's own published alt text. */
+export type ExploreAgentConcept = {
+    __typename?: 'ExploreAgentConcept';
+    alt: Scalars['String']['output'];
+    imageUrl: Scalars['String']['output'];
+    product: Scalars['String']['output'];
+    productName: Scalars['String']['output'];
+    title: Scalars['String']['output'];
+    url: Scalars['String']['output'];
+};
 export type ExploreAgentCtaSuggestion = {
     __typename?: 'ExploreAgentCtaSuggestion';
     label: Scalars['String']['output'];
@@ -5878,6 +6049,8 @@ export type ExploreAttachmentInput = {
 export type ExploreCatalog = {
     __typename?: 'ExploreCatalog';
     captchaRequired: Scalars['Boolean']['output'];
+    /** Illustrations for the welcome screen, at most 8. The focused product's highlight (see `exploreCatalog(productSlug:)`) comes first. Empty is ORDINARY, not an error: these are fetched from the agent in a separate best-effort query precisely so that an agent which does not serve them yet — or at all — costs the catalog nothing. A page must render the rest of the catalog unchanged when this is empty, and must never read it as a signal that explore is unavailable. That is `enabled`. */
+    conceptHighlights: Array<ExploreConceptHighlight>;
     enabled: Scalars['Boolean']['output'];
     examplePrompts: Array<Scalars['String']['output']>;
     limits: ExploreLimits;
@@ -5886,6 +6059,17 @@ export type ExploreCatalog = {
     welcomeBody: Scalars['String']['output'];
     welcomeTitle: Scalars['String']['output'];
 };
+/** One product's concept illustration, passed through from the agent's concept index so the welcome screen has something to SHOW before the first message. `imageUrl` is a mockup, not a screenshot of a running product — the same illustrations the answer path embeds, and the UI must label them the same way. `url` is the concept page the illustration belongs to, which is where a visitor who clicks it should land. At most one per product upstream, so the list reads as a gallery of the fleet rather than as several views of whichever product happened to sort first. */
+export type ExploreConceptHighlight = {
+    __typename?: 'ExploreConceptHighlight';
+    alt: Scalars['String']['output'];
+    imageUrl: Scalars['String']['output'];
+    /** Product slug, matching `ExploreProduct.slug`. */
+    product: Scalars['String']['output'];
+    productName: Scalars['String']['output'];
+    title: Scalars['String']['output'];
+    url: Scalars['String']['output'];
+};
 /** An explore conversation. `token` is the bearer secret for every subsequent call and is returned ONLY on the request that minted it (or echoed back to the caller that already holds it) — it is never read back out of storage. */
 export type ExploreConversation = {
     __typename?: 'ExploreConversation';
@@ -5903,6 +6087,26 @@ export type ExploreCta = {
     product?: Maybe<Scalars['String']['output']>;
     url: Scalars['String']['output'];
 };
+/** What became of the handover. */
+export type ExploreEscalation = {
+    __typename?: 'ExploreEscalation';
+    createdAt: Scalars['DateTime']['output'];
+    /** The address a human will reply to, as stored. Echoed back so the UI shows the server's view rather than what was typed — and, on a repeat submit, the address the FIRST handover used, which is where the answer is actually going. */
+    email: Scalars['String']['output'];
+};
+/** What one visitor thought of one answer. The signal `/explore` did not have. Every question got an answer, so "we answer 100% of questions" was true and told us nothing; this is the only record that a specific answer was wrong, thin or off-topic. At most one per message — a visitor may change their mind, and the new verdict replaces the old one. */
+export type ExploreFeedback = {
+    __typename?: 'ExploreFeedback';
+    comment?: Maybe<Scalars['String']['output']>;
+    createdAt: Scalars['DateTime']['output'];
+    rating: ExploreFeedbackRating;
+    /** One of INACCURATE INCOMPLETE OFF_TOPIC HARD_TO_FOLLOW OTHER. Null for HELPFUL. */
+    reason?: Maybe<Scalars['String']['output']>;
+};
+export declare enum ExploreFeedbackRating {
+    Helpful = "HELPFUL",
+    NotHelpful = "NOT_HELPFUL"
+}
 /** Server-enforced limits, surfaced so the UI can pre-validate instead of discovering them through an error. */
 export type ExploreLimits = {
     __typename?: 'ExploreLimits';
@@ -5927,6 +6131,8 @@ export type ExploreMessage = {
     createdAt: Scalars['DateTime']['output'];
     ctas: Array<ExploreCta>;
     errorCode?: Maybe<Scalars['String']['output']>;
+    /** What this visitor said about this answer, or null if they said nothing — which is the ordinary case. Never populated for a USER message or for an answer that has not completed: neither is a thing anyone can rate. */
+    feedback?: Maybe<ExploreFeedback>;
     /** Suggested next questions, derived from what this answer actually covered. Empty until the turn completes, and empty when nothing useful can be derived. */
     followUps: Array<Scalars['String']['output']>;
     id: Scalars['ID']['output'];
@@ -6132,6 +6338,12 @@ export type ExternalOidcConfigurationInput = {
     redirectUri?: InputMaybe<Scalars['String']['input']>;
     scopes?: InputMaybe<Array<Scalars['String']['input']>>;
 };
+export type ExternalRefundResult = {
+    __typename?: 'ExternalRefundResult';
+    alreadyRecorded: Scalars['Boolean']['output'];
+    chargeId: Scalars['ID']['output'];
+    refundId: Scalars['ID']['output'];
+};
 export type ExternalSettlementResult = {
     __typename?: 'ExternalSettlementResult';
     /** True when the externalRef already had a settlement (idempotent replay). */
@@ -6384,6 +6596,10 @@ export type GetStoreProductTagsInput = {
 export type GrantAppDelegationInternalInput = {
     /** Client ID of the first-party system app (e.g. burdenoff_integration_core). */
     clientId: Scalars['String']['input'];
+    /** Scopes the delegation must keep for other grants that share it (e.g. the user's other integration connections). A retained scope is kept only while the existing delegation is ACTIVE and already holds it, and only while the app still allows it; otherwise it is dropped, never rejected. A grant therefore never restores or adds a scope beyond the requested scopes. */
+    retainedScopes?: InputMaybe<Array<Scalars['String']['input']>>;
+    /** Workspaces the delegation must keep for other grants that share it. Kept only while the existing delegation is ACTIVE and already covers them: restoring a REVOKED or EXPIRED delegation covers only workspaceIds. Ignored when workspaceIds is empty (unrestricted). */
+    retainedWorkspaceIds?: InputMaybe<Array<Scalars['String']['input']>>;
     /** Scopes to grant — must be a subset of the app's scopes. */
     scopes: Array<Scalars['String']['input']>;
     /** The user granting (and target of) the self-delegation. */
@@ -6393,6 +6609,8 @@ export type GrantAppDelegationInternalInput = {
 };
 export type GrantAppWorkspaceAccessInput = {
     appId: Scalars['ID']['input'];
+    /** Restore a REVOKED authorization only if its revokedReason is exactly this value (one conditional write); otherwise behave as create-only. Lets an automated provisioner undo its own withdrawal but never an operator's revocation. Takes precedence over reactivateRevoked. */
+    reactivateIfRevokedReason?: InputMaybe<Scalars['String']['input']>;
     /** Whether an existing REVOKED authorization may be restored. Defaults to true for explicit administrative grants. Automated provisioning should pass false so an operator revocation remains durable. */
     reactivateRevoked?: InputMaybe<Scalars['Boolean']['input']>;
     /** Optional subset of the app's global scopes. Empty array means the authorization inherits the app's full scope list. */
@@ -6718,6 +6936,8 @@ export type InitiatePaymentInput = {
     quantity?: InputMaybe<Scalars['Int']['input']>;
     /** Whether to save the card for future purchases (only for new card payments) */
     saveCard?: InputMaybe<Scalars['Boolean']['input']>;
+    /** For PLAN purchase of a PER_SEAT plan: the number of seats to charge for. Clamped server-side to [plan.minSeats, plan.maxSeats]; defaults to plan.minSeats (or 1) when omitted. Ignored for FLAT_RATE plans. */
+    seatCount?: InputMaybe<Scalars['Int']['input']>;
     /** For ADDON purchase: subscription ID to attach addon to. Required if billing account has multiple active subscriptions. If only one active subscription exists, it will be auto-selected. */
     subscriptionId?: InputMaybe<Scalars['ID']['input']>;
     /** For PLAN upgrade: the subscription ID being upgraded from. If provided, this is an upgrade - old quotas will be moved to new subscription. */
@@ -7114,6 +7334,8 @@ export type IssueAppAsUserTokenInternalInput = {
     scopes?: InputMaybe<Array<Scalars['String']['input']>>;
     /** The user the app will act on behalf of (must have an active delegation). */
     targetUserId: Scalars['String']['input'];
+    /** Bind the token to this one workspace instead of every workspace the delegation covers. The delegation must cover it. Callers minting for a single workspace (an integration connection) should always pass it. */
+    workspaceId?: InputMaybe<Scalars['String']['input']>;
 };
 export type ItemOrder = {
     __typename?: 'ItemOrder';
@@ -7923,6 +8145,8 @@ export type Mutation = {
     /** Accept an organization invite (must be logged in as the invited user) */
     acceptOrganizationInvite: OrganizationMember;
     acceptSourcingOffer: SourcingOrderSummary;
+    /** Signed (DESIGN 3.7). The provider is ready: RESERVED to ACTIVE. */
+    activateAvatarMinutes: AvatarMinutesReservation;
     /** Activate a channel */
     activateChannel: Channel;
     /** Activate a connection */
@@ -8099,6 +8323,8 @@ export type Mutation = {
     /** Clear all items from the cart */
     clearCart: CartPayload;
     cloneSchedule: ScheduledJob;
+    /** Signed (DESIGN 3.7). The avatar's end decision: SETTLED with the charge, or RELEASED. */
+    closeAvatarMinutes: AvatarMinutesReservation;
     closeSupportTicket: SupportTicket;
     /** Complete the OAuth flow after the user returns from the developer's OAuth page. Exchanges the authorization code for tokens and activates the integration connection. */
     completeAppOAuth: AppInstallation;
@@ -8109,6 +8335,8 @@ export type Mutation = {
     completeSupportAttachmentUpload: SupportAttachmentFile;
     /** Mark a tour as completed for a user */
     completeTour: TourUserProgress;
+    configureAssistantAccountBudget: AssistantAccountBudget;
+    configureAssistantModelPrice: AiModelPrice;
     configureEntitlementSeats: ProductEntitlement;
     /** Configure Kerberos authentication for a tenant */
     configureKerberos: KerberosConfig;
@@ -8309,6 +8537,8 @@ export type Mutation = {
     deactivateResource: Scalars['Boolean']['output'];
     /** Deactivate a tour schedule */
     deactivateTourSchedule: TourSchedule;
+    /** Stops a subject from firing webhooks. The row is kept so a later registration reactivates it. Same ownership rule as registration. */
+    deactivateWebhookEventSubject: WebhookEventSubject;
     /** Pure quota decrement — called by wspace-activity-svc after writing a UsageRecord. Only decrements QuotaAssignment.limits.value. Does NOT write back to activity-svc. Requires the quotaAssignmentId already resolved by checkQuotaExhausted. */
     decrementQuota: Scalars['Boolean']['output'];
     /** Delete current user's account permanently Requires password confirmation */
@@ -8463,6 +8693,7 @@ export type Mutation = {
     /** Detach media from a tour step */
     detachMediaFromStep: Scalars['Boolean']['output'];
     disableAuthMethod: Scalars['Boolean']['output'];
+    /** Disable every MFA method of the caller. When `code` is given (a current TOTP code, or one of the caller's unused backup codes) it must verify against an enabled method before anything is disabled. */
     disableMFA: Scalars['Boolean']['output'];
     disableMaintenanceMode: MaintenanceModeStatus;
     disableSchedule: ScheduledJob;
@@ -8478,13 +8709,16 @@ export type Mutation = {
     enableMFA: Scalars['Boolean']['output'];
     enableMaintenanceMode: MaintenanceModeStatus;
     enrollSubscriberInAutomation: AutomationSubscriber;
-    /** Idempotently ensure a user is an organization member, primarily for the workspace-invite-accept flow where an invitee gains a workspace inside an org they're not yet a member of. Unlike `addOrganizationMember`: * Returns `OrganizationMember` whether the row was inserted or already existed — no CONFLICT on repeat calls (case 1: already a member). * Does NOT overwrite the existing `role` column on a pre-existing row (case 2: don't demote). * Triggers a real-role assignment in global-rbac-svc at scope = orgId only when the actor has NO existing role assignment at that scope (case 3: real role comes from RBAC, not the data-layer string). The `role` arg defaults to `GUEST` — the most restrictive enum value — because invitees arriving via a workspace invite should not gain first-class org membership. The data-layer string column is a coarse classifier; the authoritative permission decision is evaluated by global-rbac-svc against `actor_role_assignments`. See BOFF-2649 + the RBAC guide at `dev/platform/context/rbac/RBAC_GUIDE_FOR_AI_TOOLS.md`. Called from wspace-workspace-svc::acceptInvitation via service-context (`X-Actor-Type: service`), which bypasses the workspace-admin check inside the resolver. Best-effort from the caller's side — failures must NOT block the upstream invite acceptance. */
+    /** Idempotently ensure a user is an organization member, primarily for the workspace-invite-accept flow where an invitee gains a workspace inside an org they're not yet a member of. Unlike `addOrganizationMember`: * Returns `OrganizationMember` whether the row was inserted or already existed — no CONFLICT on repeat calls (case 1: already a member). * Does NOT overwrite the existing `role` column on a pre-existing row (case 2: don't demote). * Triggers a real-role assignment in global-rbac-svc at scope = orgId only when the actor has NO existing role assignment at that scope (case 3: real role comes from RBAC, not the data-layer string). The `role` arg defaults to `GUEST` — the most restrictive enum value — because invitees arriving via a workspace invite should not gain first-class org membership. The data-layer string column is a coarse classifier; the authoritative permission decision is evaluated by global-rbac-svc against `actor_role_assignments`. See BOFF-2649 + the RBAC guide at `dev/platform/context/identity/rbac/RBAC_GUIDE_FOR_AI_TOOLS.md`. Called from wspace-workspace-svc::acceptInvitation via service-context (`X-Actor-Type: service`), which bypasses the workspace-admin check inside the resolver. Best-effort from the caller's side — failures must NOT block the upstream invite acceptance. */
     ensureOrganizationMember: EnsureOrganizationMemberResult;
     /** Ensure a billing order exists for a store order. Called from the checkout frontend when no billingOrderId is present (e.g. the buyer had no billing account at order-creation time). Creates the billing order server-side so the correct callbackGraphQL endpoint is registered and the billing service can call back after payment to confirm the store order. */
     ensureStoreOrderBillingOrder: EnsureStoreOrderBillingOrderResponse;
     /** Anonymise the subject on the billing layer. With dryRun=true, returns what would change without mutating. Financial records (Transaction, Invoice, Payment) are RETAINED for the statutory 7-year window. */
     eraseSubject: EraseResult;
+    /** Hand this conversation to a person, with its transcript attached. The agent answers only from a baked corpus, so the questions it cannot answer are exactly the ones worth a person's time. This turns the dead end into a handover: it files the conversation as a contact inquiry — the same record the website contact form writes, in the same console, with the same emails — so nobody has to ask the visitor to type their problem out a second time. Requires the conversation token and nothing else. A token that does not own a conversation is reported as NOT_FOUND, never FORBIDDEN, exactly as every other token-scoped call reports it: FORBIDDEN would confirm the conversation exists. Unlike `submitExploreFeedback` this is NOT fire-and-forget — it throws rather than reporting a handover that did not happen, because the visitor is about to be told that someone will get back to them. Rate-limited on the same per-IP budget as sending a message and gated by the same reCAPTCHA, because it is the same anonymous visitor making another public write. Idempotent: one handover per conversation, so a double-clicked button returns the first one rather than putting a second ticket in front of support. */
+    escalateExploreConversation: EscalateExploreConversationResult;
     escalateSupportTicket: SupportTicket;
+    exchangeOwnDelegation: AppAsUserTokenResponse;
     /** Exchange app token for app-as-user token (Token Exchange flow) */
     exchangeToken: AppAsUserTokenResponse;
     executeJobNow: JobExecution;
@@ -8566,7 +8800,7 @@ export type Mutation = {
     initiateNTLMChallenge: NtlmChallengeResult;
     /** Initiate a payment for credits, plans, or addons This creates a Stripe PaymentIntent or Razorpay Order with tax included Returns client secret (Stripe) or order ID (Razorpay) for frontend to complete payment */
     initiatePayment: InitiatePaymentResponse;
-    /** Install an application */
+    /** Install an application. For a workspace-private custom node, installing a newer version published to the organization over an active installation updates it (BOFF-9766); the previous version stays installed in the workspace so workflows pinned to it keep running, and uninstall removes every version. */
     installApp: AppInstallation;
     /** Install a purchased app to a workspace. Validates that the product was purchased before allowing installation. If orderId is not provided, will find the most recent processed order for this product. version: optional specific version to install (e.g. "1.2.0"), resolved against the linked devportal Application's published/deprecated versions. Omit to install the product's current latest version (default behavior). */
     installPurchasedApp: InstallPurchasedAppResult;
@@ -8613,6 +8847,8 @@ export type Mutation = {
     newsletterEraseSubject: NewsletterEraseResult;
     /** Export the subject's newsletter data: subscriber rows, per-list memberships, consent ledger entries, automation enrolments, waitlist entries. */
     newsletterExportSubject: Scalars['JSON']['output'];
+    /** Signed (P-27). The settle owner's provider-status note for the fault list; writes no credits. */
+    noteAvatarSessionProviderStatus: Scalars['Boolean']['output'];
     /** Notify candidates who have more than one application on file (and so may have received more than one take-home assignment email as a result of a since-fixed missing duplicate-email check) that they only need to complete ONE of the assignments they received (admin). Grouped by email address — sends exactly one notice per unique candidate email, never one per duplicate application/round, and re-running this is safe: an email already notified is skipped unless `force` is set. */
     notifyDuplicateApplicants: DuplicateNoticeResult;
     openCircuitBreaker: CircuitBreakerState;
@@ -8624,6 +8860,8 @@ export type Mutation = {
     payInvoice: Invoice;
     permanentlyDeleteSchedule: Scalars['Boolean']['output'];
     placeLegalHold: LegalHold;
+    /** Internal-only: polls "Deploy Devportal Node" GitHub Actions run history and records the result in NodeSandboxBuildCheck — see services/nodeSandboxBuildPoll.ts. Invoked on a schedule by global-scheduler-svc's INTERNAL_API executor; also callable from the admin build-log UI for an on-demand refresh. Returns `skipped: true` (not an error) when NODE_SANDBOX_DISPATCH_TOKEN is unset OR the GitHub call itself fails (e.g. the token lacks Actions:read) — callers must check `skipped` rather than assume a non-error response means it actually polled. */
+    pollNodeSandboxBuildChecks: NodeSandboxBuildPollResult;
     prepareSupportAttachmentUpload: SupportAttachmentUploadSession;
     /** Process a refund for an app sale. Privileged financial mutation: reverses money to a buyer and adjusts the org's pending balance. Gated on `devportal-sale:manage` (the same permission as `retrySaleCreditSync`), with an in-resolver org-ADMIN check as defense-in-depth. */
     processAppSaleRefund: DeveloperOrgSale;
@@ -8643,6 +8881,8 @@ export type Mutation = {
     publishApplication: Application;
     /** Developer action: submit a draft (or rejected) version for platform review. Status becomes pending_review. The store is NOT updated until an admin approves. */
     publishApplicationVersion: ApplicationVersion;
+    /** Developer-organization admin action (BOFF-9657): publish a draft (or rejected) version of a PRIVATE NODE application straight to the workspaces of your organization, without platform review. The version must carry a package whose validation passed, a READY sandbox image and no failed or running operation smoke test. `workspaceId` is a workspace you administer; its organization becomes the node's owning organization on the first publish, and every later publish must come from that organization. The version is never listed in the public Node Store; it is installable only into workspaces of the owning organization. Authorization is enforced in the resolver: the caller must be an OWNER or ADMIN of the application's developer organization (or own a personal application) and an admin of `workspaceId`. The gateway's organization scope cannot evaluate this today because user sessions carry no verified organization claim, so the directive declares the permission and authenticates the caller. */
+    publishApplicationVersionToOrganization: ApplicationVersion;
     /** Publish ONE curated catalog node version (from the fluidgrids-nodes repo) to every enabled sandbox provider — the same PublishOrchestrator the devportal path uses, so the two cannot drift. That drift is not hypothetical: the catalog previously had no publish trigger at all, so nodes were built and pinned by hand and 14 of 31 prod-bound nodes ended up running code older than fluidgrids-nodes main. One entrypoint, two triggers (devportal publish, catalog CI) is the fix. NOT actor-authenticated: the caller is CI, not a platform user or app, so this verifies a shared secret in the resolver (checked against DEVPORTAL_CALLBACK_SECRET, or CALLBACK_SECRET as shipped by the Secrets Manager bundle) exactly as reportNodeSandboxBuildStatus does. Sent as an argument rather than a header because global-public-gateway forwards only a fixed header allowlist to subgraphs. `zipUrl` must be fetchable by this service — CI uploads the packaged node and passes a presigned URL. `isFirstPublish` tells the orchestrator whether this node type has ever been built before, which is what lets it annotate a provider that cannot self-onboard (Cloudflare) instead of reporting a mystery failure. Defaults to false: a catalog node already running on Cloudflare has a Durable Object class, so only a genuinely new node should pass true. Returns a JSON array of per-provider outcomes so CI can log them and fail the job when nothing could build. */
     publishCatalogNodeVersion: Scalars['JSON']['output'];
     publishFAQ: Faq;
@@ -8682,6 +8922,8 @@ export type Mutation = {
     recordEarningEntry: EarningsEntry;
     /** Record that a visitor followed a link the answer offered. Fire-and-forget from the browser: a click must never be blocked or delayed by analytics, so this reports `recorded: false` rather than throwing when the click cannot be attributed. */
     recordExploreClick: RecordExploreClickResult;
+    /** Record a completed external refund without invoking a payment provider. */
+    recordExternalRefund: ExternalRefundResult;
     /** Record a SETTLED (or pending/failed) external/manual Charge + Transaction on behalf of a workspace/org by explicit id. Service/super_admin only — routed through the internal gateway. Bypasses the Stripe/Razorpay sync path. */
     recordExternalSettlement: ExternalSettlementResult;
     recordFAQView: Faq;
@@ -8714,6 +8956,8 @@ export type Mutation = {
     /** Register a resource with custom RBAC configurations. */
     registerResource: Resource;
     registerSupportAttachmentPart: Scalars['Boolean']['output'];
+    /** Creates or updates subject mappings for a product. Idempotent: a product's service can call it on every deploy. An existing mapping can only be changed by the actor that registered it, or by a super admin. */
+    registerWebhookEventSubjects: Array<WebhookEventSubject>;
     reinstatePublisher: Publisher;
     rejectApplication: Application;
     /** Platform admin only: reject a pending_review version with a reason. The developer can fix their submission and re-submit. */
@@ -8794,6 +9038,8 @@ export type Mutation = {
     replaceChannelTags: Array<ChannelTagAssignment>;
     /** Replace all tags on a store product */
     replaceStoreProductTags: Array<StoreProductTagAssignment>;
+    /** Replay one dead-lettered provider webhook through the durable worker. */
+    replayBillingWebhook?: Maybe<BillingWebhookLog>;
     /** Send an email reply to a contact inquiry. The reply is sent via the notification pipeline (notification-svc → channel-svc → email provider). Auto-updates status to REVIEWED. */
     replyToContactInquiry: ContactInquiryReplyResult;
     /** Send a branded email reply to an applicant (admin). Delivered to the applicant's email via the notification pipeline. Does not change status — the admin controls status explicitly. `message` is rich-text HTML from the admin's editor; it is sanitized to an allowlist before it reaches the email. */
@@ -8831,6 +9077,9 @@ export type Mutation = {
     resendOrganizationInvite: OrganizationInvite;
     resendSurvey: CustomerSatisfactionSurvey;
     resendVerificationEmail: ResendVerificationResult;
+    reserveAssistantAccountBudget: AssistantBudgetReceipt;
+    /** Signed (DESIGN 3.7). Reserves credits for a session (ENFORCE) or records its shadow (OBSERVE). */
+    reserveAvatarMinutes: AvatarMinutesReservation;
     resetCircuitBreaker: CircuitBreakerState;
     /** Reset password using token from email */
     resetPassword: Scalars['Boolean']['output'];
@@ -8852,6 +9101,8 @@ export type Mutation = {
     restoreChannel: Channel;
     restoreScheduleVersion: ScheduledJob;
     restoreTemplateVersion: NewsletterTemplate;
+    /** Service-trusted internal REDUCTION of a first-party self-delegation, keyed by the app's client id and the user: used when one of several integration connections that share it is deleted or revoked. It never creates, re-enables or widens a delegation: it returns null when there is none (never granted, or erased), a REVOKED or EXPIRED one unchanged, and otherwise the delegation cut down to the requested scopes and workspaces it already held (REVOKED if none are left). Not blocked by a deactivated app: withdrawing access is always permitted. Gated to internal service / super_admin callers and restricted to first-party system apps. */
+    restrictAppDelegationInternal?: Maybe<AppUserDelegation>;
     /** Public endpoint — no authentication required. Email is normalized (trimmed, lowercased) and validated in the provider. Returns NOT_FOUND when no matching unsubscribed record exists; does not leak which side of the check failed. */
     resubscribe: NewsletterSubscriber;
     /** Resume a paused subscription */
@@ -8869,6 +9120,8 @@ export type Mutation = {
     /** Retry invoice generation for a successful transaction that never got an invoice recorded (a transient Zoho Books/Stripe Invoicing failure at payment time). transactionId is the transaction that has no invoiceNumber in its metadata yet — surfaced via getTransactionsByBillingAccount / getTransaction, not the invoice list (which only shows transactions that already have an invoice). */
     retryInvoiceGeneration: Invoice;
     retryJobExecution: JobExecution;
+    /** Platform admin only: re-dispatch the sandbox image build for a NODE version whose build never completed (stuck PENDING) or failed (FAILED / DISPATCH_FAILED / UNSUPPORTED). Calls the exact same dispatch path a fresh publish uses — it does not create a new version or touch review status, it only re-attempts the build for the existing one. */
+    retryNodeSandboxBuild: Scalars['Boolean']['output'];
     /** Retry a failed payout */
     retryPayout: DeveloperOrgPayout;
     /** Retry a failed refund */
@@ -8881,7 +9134,9 @@ export type Mutation = {
     revokeAPIKey: Scalars['Boolean']['output'];
     /** Revoke all sessions except the current one. Returns the number of sessions that were revoked. */
     revokeAllSessions: RevokeAllSessionsResult;
-    /** Revoke an app's access to a workspace. Returns false if the row was already REVOKED or never existed. */
+    /** Service-trusted internal revoke of a first-party self-delegation, keyed by the app's client id and the user — the counterpart of grantAppDelegationInternal, used when the last integration connection that needed it is deleted or revoked. Idempotent: returns true when an ACTIVE delegation was revoked and false when there was none (never granted, already revoked or expired). Gated to internal service / super_admin callers and restricted to first-party system apps. */
+    revokeAppDelegationInternal: Scalars['Boolean']['output'];
+    /** Revoke an app's access to a workspace. Returns false if the row was already REVOKED or never existed. An owner or super_admin revoking an already-REVOKED row replaces the revocation on record (reason, actor, time). */
     revokeAppWorkspaceAccess: Scalars['Boolean']['output'];
     revokeConsent: NewsletterConsent;
     revokeDelegation: Scalars['Boolean']['output'];
@@ -8907,7 +9162,7 @@ export type Mutation = {
     rotateConnectionCredentials: ChannelConnection;
     /** Run health check on a channel */
     runChannelHealthCheck: ChannelHealthCheck;
-    /** Admin/service-initiated DSAR for an arbitrary subject (e.g. a support-filed or regulator-filed request, or a same-layer service driving the flow on a subject's behalf). Restricted to super_admin and service actors only — never reachable by a regular user for another person's data. */
+    /** Admin/service-initiated DSAR for an arbitrary subject (e.g. a support-filed or regulator-filed request, or a same-layer service driving the flow on a subject's behalf). Restricted to super_admin and service actors only — never reachable by a regular user for another person's data. `subjectEmail` is optional and additive: it lets the fan-out also reach records that are keyed by email only (e.g. a guest contact-inquiry or a newsletter signup with no account), such as `ContactInquiry`, `NewsletterWaitlist`, and `NewsletterSuppression`. Omit it for a subject who only has account-linked records. */
     runDsarRequestForSubject: DsarOrchestrationResult;
     runMonthlyPayouts: PayoutRunLog;
     /** Self-service DSAR: export or erase the CALLING actor's own data across every fan-out target. Self-scoped (Type-A pattern) — subjectId is always the calling actor's own id; there is no identity argument, so this can never be used to act on someone else's data. */
@@ -8921,6 +9176,8 @@ export type Mutation = {
     scheduleNotification: ScheduledNotification;
     /** Overwrite the built-in AthleteBridge user-facing tours from the service-owned seed file. */
     seedAtheleteBridgeUserTours: SeedAtheleteBridgeUserToursResult;
+    /** Overwrite the service-owned BigConsole onboarding tours. Repeated calls update the same slugs. */
+    seedBigconsoleUserTours: SeedBigconsoleUserToursResult;
     /** Overwrite the built-in Buildmyiq user-facing dashboard tour from the service-owned seed file. */
     seedBuildmyiqUserTours: SeedBuildmyiqUserToursResult;
     /** Overwrite the built-in CollabKin user-facing dashboard tour from the service-owned seed file. */
@@ -8963,6 +9220,8 @@ export type Mutation = {
     serviceResolvePayoutAccount: PayoutAccount;
     /** Mirror a billing PayoutRequest status change back onto the DeveloperOrgPayout it originated from (BOFF-7192). Billing owns the payout system-of-record and is where admins approve/reject/mark-paid; this keeps devportal's own payout history in sync so it doesn't stay stuck showing a stale status forever. Looked up by sourceIdempotencyKey ("devportal:payout:<id>", set when the request was originally mirrored to billing) — a no-op if the key isn't a devportal-originated one, or no matching local payout exists. Service/super_admin only — internal gateway. */
     serviceSyncPayoutStatus?: Maybe<DeveloperOrgPayout>;
+    /** M2M: create or update the calling service's catalogue listing for an item that service sells through its own checkout (BOFF-3430), for cross-product discovery. Idempotent on (calling service identity, input.externalId): call it on every change of the source item. The owning service is always the verified service identity of the caller, never an input field. Set status ARCHIVED to take the listing down. A listing an admin has delisted or rejected stays off display until an admin restores it. Service-actor only. */
+    serviceUpsertExternalListing: StoreProduct;
     setAgentAway: AgentProfile;
     setAgentOffline: AgentProfile;
     setAgentOnline: AgentProfile;
@@ -8992,6 +9251,7 @@ export type Mutation = {
     setUserLanguagePreference: UserLanguagePreference;
     /** Set workspace-level override for a feature flag (super admin or workspace admin). RBAC is scoped to the target workspace via `input.workspaceId`. */
     setWorkspaceFeatureFlagOverride: WorkspaceFeatureFlagOverride;
+    settleAssistantAccountBudget: AssistantBudgetReceipt;
     setupMFA: MfaSetupResult;
     /** Share a WORKFLOW-type application as a public link by setting its visibility to UNLISTED. Only the developer who owns the app can call this. The app must have a manifest (workflow definition) set. */
     shareWorkflow: Application;
@@ -9019,6 +9279,8 @@ export type Mutation = {
     submitAssignmentResponse: SubmitAssignmentResponsePayload;
     /** Submit a contact inquiry from a public website (no authentication required). Validates reCAPTCHA token server-side using the product's secret key fetched from the tenant service via internal gateway. */
     submitContactInquiry: SubmitContactInquiryResult;
+    /** Rate one answer. Same fire-and-forget posture as `recordExploreClick`: a rating that cannot be attributed — an unfinished answer, a USER turn, a token that does not own the message — comes back `recorded: false` rather than as an error, and never as FORBIDDEN, which would confirm that a message id exists. Submitting again REPLACES the previous rating for that message, so changing your mind is an ordinary action rather than a duplicate or a failure. */
+    submitExploreFeedback: SubmitExploreFeedbackResult;
     /** Submit feedback for an interview round (admin). */
     submitInterviewFeedback: InterviewFeedback;
     /** Submit a job application from a public website (no authentication required). Validates reCAPTCHA, stores the resume in private storage, and notifies the applicant + careers inbox. */
@@ -9049,6 +9311,8 @@ export type Mutation = {
     syncStoreSubmissionStatus: Scalars['Boolean']['output'];
     /** Sync tour steps (smart update in ONE call) Send all desired steps, backend handles: update existing, create new, delete removed */
     syncTourSteps: Array<TourStep>;
+    /** Mirror a workspace deletion from the workspace layer to the global layer. Called by wspace-workspace-svc after its deleteWorkspace soft-deletes the workspace, so the global registry (myWorkspaces, the context switcher, routing) stops listing it as ACTIVE. Marks the global row DELETED and keeps it for audit. Idempotent: an unknown or already-deleted workspace succeeds without changes. */
+    syncWorkspaceDeletionFromWspace: SyncWorkspaceFromWspaceResponse;
     /** Sync workspace metadata from workspace layer to global layer. Called by wspace-workspace-svc when a workspace is created directly via workspace layer. This is the reverse of syncFromGlobal - it syncs global ← wspace. Creates workspace metadata + owner membership in global-tenant-svc. */
     syncWorkspaceFromWspace: SyncWorkspaceFromWspaceResponse;
     tagChannel: ChannelTagAssignment;
@@ -9303,7 +9567,6 @@ export type Mutation = {
     /** M2M: create or update a ShippingAddress for an EXPLICIT user, on behalf of a calling service. Product backends (e.g. Kadaikodi) call this through the INTERNAL gateway so a user's address lives in the canonical store owner rather than a per-product copy. Pass `input.id` to update an existing row (must belong to `input.userId`); omit it to create. Service-actor only. */
     upsertUserShippingAddress: ShippingAddress;
     useCannedResponse: CannedResponse;
-    validateApiKey: TokenValidationResponse;
     /** Validate an HMAC signature */
     validateHMACSignature: HmacValidationResult;
     /** Validate a signed cookie */
@@ -9344,6 +9607,13 @@ export type MutationAcceptSourcingOfferArgs = {
     offerId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationActivateAvatarMinutesArgs = {
+    readyAt: Scalars['String']['input'];
+    sessionId: Scalars['ID']['input'];
+    signature: AvatarMinutesSignature;
+    workspaceId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationActivateChannelArgs = {
     id: Scalars['ID']['input'];
 };
@@ -9634,10 +9904,12 @@ export type MutationAttachMediaToStepArgs = {
 /** Root mutation type */
 export type MutationAuthEraseSubjectArgs = {
     dryRun?: InputMaybe<Scalars['Boolean']['input']>;
+    subjectEmail?: InputMaybe<Scalars['String']['input']>;
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
 export type MutationAuthExportSubjectArgs = {
+    subjectEmail?: InputMaybe<Scalars['String']['input']>;
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
@@ -9855,6 +10127,11 @@ export type MutationCloneScheduleArgs = {
     sourceId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationCloseAvatarMinutesArgs = {
+    input: CloseAvatarMinutesInput;
+    signature: AvatarMinutesSignature;
+};
+/** Root mutation type */
 export type MutationCloseSupportTicketArgs = {
     id: Scalars['ID']['input'];
 };
@@ -9888,6 +10165,19 @@ export type MutationCompleteTourArgs = {
     userId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationConfigureAssistantAccountBudgetArgs = {
+    billingAccountId: Scalars['ID']['input'];
+    dailyMicroUsd: Scalars['Int']['input'];
+    dailyTokens: Scalars['Int']['input'];
+    enabled: Scalars['Boolean']['input'];
+};
+/** Root mutation type */
+export type MutationConfigureAssistantModelPriceArgs = {
+    inputPer1M: Scalars['String']['input'];
+    model: Scalars['String']['input'];
+    outputPer1M: Scalars['String']['input'];
+};
+/** Root mutation type */
 export type MutationConfigureEntitlementSeatsArgs = {
     entitlementId: Scalars['ID']['input'];
     maxSeats: Scalars['Int']['input'];
@@ -10450,6 +10740,10 @@ export type MutationDeactivateTourScheduleArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationDeactivateWebhookEventSubjectArgs = {
+    subject: Scalars['String']['input'];
+};
+/** Root mutation type */
 export type MutationDecrementQuotaArgs = {
     amount: Scalars['Int']['input'];
     billingAccountId: Scalars['ID']['input'];
@@ -10848,6 +11142,10 @@ export type MutationDisableAuthMethodArgs = {
     authType: AuthType;
 };
 /** Root mutation type */
+export type MutationDisableMfaArgs = {
+    code?: InputMaybe<Scalars['String']['input']>;
+};
+/** Root mutation type */
 export type MutationDisableScheduleArgs = {
     id: Scalars['ID']['input'];
     reason?: InputMaybe<Scalars['String']['input']>;
@@ -10910,15 +11208,24 @@ export type MutationEnsureStoreOrderBillingOrderArgs = {
 /** Root mutation type */
 export type MutationEraseSubjectArgs = {
     dryRun?: InputMaybe<Scalars['Boolean']['input']>;
+    subjectEmail?: InputMaybe<Scalars['String']['input']>;
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationEscalateExploreConversationArgs = {
+    input: EscalateExploreConversationInput;
+};
+/** Root mutation type */
 export type MutationEscalateSupportTicketArgs = {
     escalateTo?: InputMaybe<Scalars['String']['input']>;
     id: Scalars['ID']['input'];
     reason: Scalars['String']['input'];
 };
 /** Root mutation type */
+export type MutationExchangeOwnDelegationArgs = {
+    input: ExchangeOwnDelegationInput;
+};
+/** Root mutation type */
 export type MutationExchangeTokenArgs = {
     input: ExchangeTokenInput;
 };
@@ -10967,6 +11274,7 @@ export type MutationExportRevenueArgs = {
 };
 /** Root mutation type */
 export type MutationExportSubjectArgs = {
+    subjectEmail?: InputMaybe<Scalars['String']['input']>;
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
@@ -11254,6 +11562,12 @@ export type MutationNewsletterExportSubjectArgs = {
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationNoteAvatarSessionProviderStatusArgs = {
+    sessionId: Scalars['ID']['input'];
+    signature: AvatarMinutesSignature;
+    status: AvatarProviderSessionStatus;
+};
+/** Root mutation type */
 export type MutationNotifyDuplicateApplicantsArgs = {
     input: NotifyDuplicateApplicantsInput;
 };
@@ -11338,6 +11652,11 @@ export type MutationPublishApplicationVersionArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationPublishApplicationVersionToOrganizationArgs = {
+    id: Scalars['ID']['input'];
+    workspaceId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationPublishCatalogNodeVersionArgs = {
     isFirstPublish?: InputMaybe<Scalars['Boolean']['input']>;
     nodeType: Scalars['String']['input'];
@@ -11469,6 +11788,10 @@ export type MutationRecordExploreClickArgs = {
     input: RecordExploreClickInput;
 };
 /** Root mutation type */
+export type MutationRecordExternalRefundArgs = {
+    input: RecordExternalRefundInput;
+};
+/** Root mutation type */
 export type MutationRecordExternalSettlementArgs = {
     input: RecordExternalSettlementInput;
 };
@@ -11556,6 +11879,10 @@ export type MutationRegisterSupportAttachmentPartArgs = {
     input: RegisterSupportAttachmentPartInput;
 };
 /** Root mutation type */
+export type MutationRegisterWebhookEventSubjectsArgs = {
+    input: RegisterWebhookEventSubjectsInput;
+};
+/** Root mutation type */
 export type MutationReinstatePublisherArgs = {
     id: Scalars['ID']['input'];
 };
@@ -11778,6 +12105,10 @@ export type MutationReplaceStoreProductTagsArgs = {
     input: ReplaceStoreProductTagsInput;
 };
 /** Root mutation type */
+export type MutationReplayBillingWebhookArgs = {
+    logId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationReplyToContactInquiryArgs = {
     id: Scalars['ID']['input'];
     message: Scalars['String']['input'];
@@ -11877,6 +12208,15 @@ export type MutationResendVerificationEmailArgs = {
     email: Scalars['String']['input'];
 };
 /** Root mutation type */
+export type MutationReserveAssistantAccountBudgetArgs = {
+    input: ReserveAssistantBudgetInput;
+};
+/** Root mutation type */
+export type MutationReserveAvatarMinutesArgs = {
+    input: ReserveAvatarMinutesInput;
+    signature: AvatarMinutesSignature;
+};
+/** Root mutation type */
 export type MutationResetCircuitBreakerArgs = {
     scope: Scalars['String']['input'];
     scopeValue: Scalars['String']['input'];
@@ -11943,6 +12283,10 @@ export type MutationRestoreTemplateVersionArgs = {
     version: Scalars['Int']['input'];
 };
 /** Root mutation type */
+export type MutationRestrictAppDelegationInternalArgs = {
+    input: RestrictAppDelegationInternalInput;
+};
+/** Root mutation type */
 export type MutationResubscribeArgs = {
     email: Scalars['String']['input'];
     platformProductId?: InputMaybe<Scalars['String']['input']>;
@@ -11992,6 +12336,10 @@ export type MutationRetryJobExecutionArgs = {
     executionId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationRetryNodeSandboxBuildArgs = {
+    id: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationRetryPayoutArgs = {
     id: Scalars['ID']['input'];
 };
@@ -12021,6 +12369,10 @@ export type MutationRevokeApiKeyArgs = {
     keyId: Scalars['String']['input'];
 };
 /** Root mutation type */
+export type MutationRevokeAppDelegationInternalArgs = {
+    input: RevokeAppDelegationInternalInput;
+};
+/** Root mutation type */
 export type MutationRevokeAppWorkspaceAccessArgs = {
     input: RevokeAppWorkspaceAccessInput;
 };
@@ -12098,6 +12450,7 @@ export type MutationRunChannelHealthCheckArgs = {
 export type MutationRunDsarRequestForSubjectArgs = {
     dryRun?: InputMaybe<Scalars['Boolean']['input']>;
     mode: DsarMode;
+    subjectEmail?: InputMaybe<Scalars['String']['input']>;
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
@@ -12195,6 +12548,10 @@ export type MutationServiceSyncPayoutStatusArgs = {
     input: ServiceSyncPayoutStatusInput;
 };
 /** Root mutation type */
+export type MutationServiceUpsertExternalListingArgs = {
+    input: ServiceUpsertExternalListingInput;
+};
+/** Root mutation type */
 export type MutationSetAgentAwayArgs = {
     message?: InputMaybe<Scalars['String']['input']>;
 };
@@ -12263,6 +12620,13 @@ export type MutationSetWorkspaceFeatureFlagOverrideArgs = {
     input: SetWorkspaceFeatureFlagOverrideInput;
 };
 /** Root mutation type */
+export type MutationSettleAssistantAccountBudgetArgs = {
+    id: Scalars['ID']['input'];
+    inputTokens: Scalars['Int']['input'];
+    outputTokens: Scalars['Int']['input'];
+    workspaceId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationSetupMfaArgs = {
     method: MfaMethod;
 };
@@ -12340,6 +12704,10 @@ export type MutationSubmitContactInquiryArgs = {
     input: SubmitContactInquiryInput;
 };
 /** Root mutation type */
+export type MutationSubmitExploreFeedbackArgs = {
+    input: SubmitExploreFeedbackInput;
+};
+/** Root mutation type */
 export type MutationSubmitInterviewFeedbackArgs = {
     input: SubmitInterviewFeedbackInput;
 };
@@ -12371,10 +12739,12 @@ export type MutationSubscribeToStoreArgs = {
 /** Root mutation type */
 export type MutationSupportEraseSubjectArgs = {
     dryRun?: InputMaybe<Scalars['Boolean']['input']>;
+    subjectEmail?: InputMaybe<Scalars['String']['input']>;
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
 export type MutationSupportExportSubjectArgs = {
+    subjectEmail?: InputMaybe<Scalars['String']['input']>;
     subjectId: Scalars['ID']['input'];
 };
 /** Root mutation type */
@@ -12418,6 +12788,10 @@ export type MutationSyncTourStepsArgs = {
     tourId: Scalars['ID']['input'];
 };
 /** Root mutation type */
+export type MutationSyncWorkspaceDeletionFromWspaceArgs = {
+    workspaceId: Scalars['ID']['input'];
+};
+/** Root mutation type */
 export type MutationSyncWorkspaceFromWspaceArgs = {
     input: SyncWorkspaceFromWspaceInput;
 };
@@ -13215,10 +13589,6 @@ export type MutationUseCannedResponseArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root mutation type */
-export type MutationValidateApiKeyArgs = {
-    apiKey: Scalars['String']['input'];
-};
-/** Root mutation type */
 export type MutationValidateHmacSignatureArgs = {
     algorithm?: InputMaybe<Scalars['String']['input']>;
     appId: Scalars['ID']['input'];
@@ -13655,6 +14025,39 @@ export declare enum NewsletterWaitlistStatus {
     Pending = "PENDING",
     Rejected = "REJECTED"
 }
+/** One observed run of the "Deploy Devportal Node" GitHub Actions workflow, polled from run history rather than pushed via callback — see workers/nodeSandboxBuildPoll.ts. applicationVersionId/slug/version are best-effort, parsed from the run's title; null on runs from before the workflow embedded them, or a title that didn't parse. */
+export type NodeSandboxBuildCheck = {
+    __typename?: 'NodeSandboxBuildCheck';
+    applicationVersionId?: Maybe<Scalars['String']['output']>;
+    checkedAt: Scalars['DateTime']['output'];
+    failureStep?: Maybe<Scalars['String']['output']>;
+    id: Scalars['ID']['output'];
+    runConclusion?: Maybe<Scalars['String']['output']>;
+    runId: Scalars['String']['output'];
+    runStartedAt?: Maybe<Scalars['DateTime']['output']>;
+    runStatus: Scalars['String']['output'];
+    runUpdatedAt?: Maybe<Scalars['DateTime']['output']>;
+    runUrl: Scalars['String']['output'];
+    slug?: Maybe<Scalars['String']['output']>;
+    version?: Maybe<Scalars['String']['output']>;
+};
+export type NodeSandboxBuildCheckConnection = {
+    __typename?: 'NodeSandboxBuildCheckConnection';
+    edges: Array<NodeSandboxBuildCheckEdge>;
+    pageInfo: PageInfo;
+    totalCount: Scalars['Int']['output'];
+};
+export type NodeSandboxBuildCheckEdge = {
+    __typename?: 'NodeSandboxBuildCheckEdge';
+    cursor: Scalars['String']['output'];
+    node: NodeSandboxBuildCheck;
+};
+/** Result of a pollNodeSandboxBuildChecks call. `skipped: true` means no GitHub Actions run history was fetched this call (token unset or the GitHub API call failed) — `recorded` is only meaningful when `skipped` is false. */
+export type NodeSandboxBuildPollResult = {
+    __typename?: 'NodeSandboxBuildPollResult';
+    recorded: Scalars['Int']['output'];
+    skipped: Scalars['Boolean']['output'];
+};
 export type Notification = {
     __typename?: 'Notification';
     actions: Array<NotificationAction>;
@@ -13939,6 +14342,14 @@ export type NotificationReadFilterInput = {
     type?: InputMaybe<NotificationType>;
     userId: Scalars['ID']['input'];
 };
+/** Sender-owned processing status only; provider acknowledgement is not delivery certification. */
+export type NotificationSendStatus = {
+    __typename?: 'NotificationSendStatus';
+    deliveryStatus?: Maybe<NotificationDeliveryStatus>;
+    id: Scalars['ID']['output'];
+    status: NotificationStatus;
+    triggerStatus: TriggerStatus;
+};
 export type NotificationStats = {
     __typename?: 'NotificationStats';
     byChannel: Scalars['JSON']['output'];
@@ -14436,6 +14847,41 @@ export type OrganizationMemberList = {
     offset: Scalars['Int']['output'];
     total: Scalars['Int']['output'];
 };
+/** A workspace-private custom node of a workspace's organization (BOFF-9766). */
+export type OrganizationPrivateNode = {
+    __typename?: 'OrganizationPrivateNode';
+    applicationId: Scalars['ID']['output'];
+    iconUrl?: Maybe<Scalars['String']['output']>;
+    /** This workspace's active installation. Pass it to uninstallApp to remove the node. */
+    installationId?: Maybe<Scalars['ID']['output']>;
+    /** True when this workspace has an active installation of the node. */
+    installed: Scalars['Boolean']['output'];
+    /** The version this workspace has installed, when installed. */
+    installedVersion?: Maybe<Scalars['String']['output']>;
+    name: Scalars['String']['output'];
+    /** Workflow node type from the version's manifest, e.g. custom/word_counter. */
+    nodeType?: Maybe<Scalars['String']['output']>;
+    nodeVersion?: Maybe<Scalars['String']['output']>;
+    publishedAt?: Maybe<Scalars['DateTime']['output']>;
+    shortDescription?: Maybe<Scalars['String']['output']>;
+    slug: Scalars['String']['output'];
+    /** Installed, and the organization has since published a newer version. */
+    updateAvailable: Scalars['Boolean']['output'];
+    /** Latest version published to the organization. Pass it to installApp. */
+    version: Scalars['String']['output'];
+    /** Id of the latest version published to the organization. */
+    versionId: Scalars['ID']['output'];
+};
+/** The private custom nodes a workspace's organization has published, as seen from one workspace (BOFF-9766). */
+export type OrganizationPrivateNodeListing = {
+    __typename?: 'OrganizationPrivateNodeListing';
+    /** True when the caller administers the workspace and so may install or uninstall. */
+    canManage: Scalars['Boolean']['output'];
+    nodes: Array<OrganizationPrivateNode>;
+    /** Organization the workspace belongs to; null when the caller is not a member or the workspace has no organization. */
+    organizationId?: Maybe<Scalars['ID']['output']>;
+    workspaceId: Scalars['ID']['output'];
+};
 export type OrganizationScheduleQuotas = {
     __typename?: 'OrganizationScheduleQuotas';
     currentActiveSchedules: Scalars['Int']['output'];
@@ -14694,6 +15140,8 @@ export declare enum PaymentMethodType {
     Crypto = "CRYPTO",
     DebitCard = "DEBIT_CARD",
     Netbanking = "NETBANKING",
+    /** Zero-total purchases (e.g. a 100%-off coupon) — no gateway/method involved. */
+    None = "NONE",
     Paypal = "PAYPAL",
     Wallet = "WALLET"
 }
@@ -14985,6 +15433,8 @@ export type Plan = {
     minSeats?: Maybe<Scalars['Int']['output']>;
     /** The name of the plan (e.g., 'Basic', 'Pro', 'Enterprise'). */
     name?: Maybe<Scalars['String']['output']>;
+    /** Apple App Store / Google Play SKU for this plan. */
+    nativeProductId?: Maybe<Scalars['String']['output']>;
     /** The price of the plan. */
     price?: Maybe<Scalars['Float']['output']>;
     /** Historical record of price changes for this plan */
@@ -15914,6 +16364,8 @@ export type Query = {
     agentProfile?: Maybe<AgentProfile>;
     agentProfileByUserId?: Maybe<AgentProfile>;
     agentProfiles: AgentProfileConnection;
+    /** Schema capability for optional cache counts. Older callers keep input/output-only pricing. */
+    aiCacheTokenPricingSupported: Scalars['Boolean']['output'];
     /** Active per-model LLM token prices (USD per 1M tokens) used for AI-credit weighting. */
     aiModelPrices: Array<AiModelPrice>;
     /** Admin query: list all organizations in the platform (optionally filtered). Requires global 'organization:read' permission — super admins and platform admins only. For end-user "my orgs" access use myOrganizations instead. */
@@ -15963,6 +16415,8 @@ export type Query = {
     availableAuthMethods: Array<AuthMethod>;
     /** Get available preview features the user can opt-in to within a workspace. Returns only flags that are previewable, active, and allowed by workspace admin. When `productSlug` is provided (each product app shell passes its own slug), the result is scoped to that product's previewable flags PLUS platform-wide previewable flags — so a product's Feature Previews page never surfaces other products' flags. Omit `productSlug` to get every available preview. Bounded by limit/offset to avoid unbounded fetches. */
     availableFeaturePreviews: Array<FeatureFlag>;
+    /** Signed (DESIGN 3.7). The workspace's balance, in the person's view when actorId is given. */
+    avatarMinutesForService: AvatarMinutesBalance;
     bounceStats: BounceStats;
     /** Browse store products with unified filtering, sorting, and pagination. Search is treated as a filter - all filters combine with AND logic. Example usage: ```graphql query { browseStore(input: { filter: { search: "ai notification" type: NODE pricingModel: FREE minRating: 4.0 compatibleWith: "workspaces" } sortBy: RELEVANCE pagination: { limit: 20, offset: 0 } }) { products { id name rating downloads } totalCount hasMore facets { categories { value count } } } } ``` */
     browseStore: BrowseStoreResult;
@@ -16348,6 +16802,8 @@ export type Query = {
     /** Public listing of an application's installable versions (published or deprecated only — draft/pending_review/rejected versions are never returned here, to avoid exposing unreviewed versions). Used by the Store to let buyers pick a specific version at install time, and by global-store-svc (service actor) to resolve a chosen version's manifest when installing. */
     installableApplicationVersions: Array<ApplicationVersion>;
     installationPermissions?: Maybe<Scalars['JSON']['output']>;
+    /** Runtime routing metadata for an active node installation in the gateway-authenticated workspace. Candidate node types are ordered, with the requested spelling before compatibility aliases. Legacy installation versions are not treated as node runtime versions. */
+    installedStoreNodeRuntime?: Maybe<StoreInstalledNodeRuntime>;
     /** Get a single interview round by ID (admin). */
     interviewRound?: Maybe<InterviewRound>;
     /** Get a single interviewer by ID (admin). */
@@ -16441,6 +16897,8 @@ export type Query = {
     myNotificationCountsByApp: Scalars['JSON']['output'];
     /** Get notification counts by channel for authenticated user */
     myNotificationCountsByChannel: NotificationChannelCounts;
+    /** Status of a notification created by the authenticated sender in the current tenant. */
+    myNotificationSendStatus: NotificationSendStatus;
     /** Get all orders for the authenticated user */
     myOrders: Array<StoreOrder>;
     /** Get a SINGLE invite addressed to the current authenticated user, by id. Backs the per-invite acceptance page reached from the invite email link. Self-scoped: the resolver only returns an invite addressed to the caller's own email (or already resolved to their userId); otherwise it returns NOT_FOUND (existence of another account's invite is never revealed). */
@@ -16504,6 +16962,8 @@ export type Query = {
     newsletterVariant?: Maybe<NewsletterVariant>;
     newsletterVariants: Array<NewsletterVariant>;
     newsletters: Array<Newsletter>;
+    /** Platform admin only: recent observed runs of the node-sandbox build workflow, newest first — see workers/nodeSandboxBuildPoll.ts. Optionally filtered to one version's runs. */
+    nodeSandboxBuildChecks: NodeSandboxBuildCheckConnection;
     /** Get a single notification by ID */
     notification?: Maybe<Notification>;
     /** Get notification events/history for a specific notification */
@@ -16556,6 +17016,8 @@ export type Query = {
     organizationMembers: OrganizationMemberList;
     /** M2M lookup for global-store-svc's shipping-cost quote pipeline: the org's active pickup postal code — the default DeveloperOrgPickupAddress's postalCode, falling back to the legacy pickupPostalCode scalar for orgs that set one before DeveloperOrgPickupAddress existed, then null (caller falls back to the linked billing account's address, then a platform-wide default). */
     organizationPickupPostalCode?: Maybe<Scalars['String']['output']>;
+    /** The workspace-private custom nodes of a workspace's organization (BOFF-9766): every PRIVATE NODE application bound to the organization the workspace belongs to, with its latest version published to that organization and whether this workspace has it installed. Feeds the "Your organization" section of the FluidGrids Node Store, where a workspace admin installs or updates one with `installApp` and removes it with `uninstallApp`. Self-scoped (Type B): the gateway only authenticates the caller. The resolver lists nothing unless the caller is a member of `workspaceId`, and it only ever lists applications bound to that workspace's own organization, so a workspace of another organization sees none of them. */
+    organizationPrivateNodes: OrganizationPrivateNodeListing;
     organizationScheduleQuotas: OrganizationScheduleQuotas;
     payoutRunHistory: Array<PayoutRunLog>;
     pendingDeveloperOrganizationVerifications: DeveloperOrganizationConnection;
@@ -16822,6 +17284,10 @@ export type Query = {
     webhook?: Maybe<Webhook>;
     webhookDeliveries: WebhookDeliveryConnection;
     webhookDelivery?: Maybe<WebhookDelivery>;
+    /** Every webhook event type currently deliverable, for the webhook event picker. Optionally narrowed to one product. */
+    webhookEventCatalog: Array<WebhookEventCatalogEntry>;
+    /** Registered subject mappings. Platform services and super admins only. */
+    webhookEventSubjects: Array<WebhookEventSubject>;
     webhooks: Array<Webhook>;
     /** Get a single workspace by ID */
     workspace?: Maybe<Workspace>;
@@ -17124,6 +17590,13 @@ export type QueryAvailableFeaturePreviewsArgs = {
     workspaceId: Scalars['String']['input'];
 };
 /** Root query type */
+export type QueryAvatarMinutesForServiceArgs = {
+    actorId?: InputMaybe<Scalars['ID']['input']>;
+    productId: Scalars['String']['input'];
+    signature: AvatarMinutesSignature;
+    workspaceId: Scalars['ID']['input'];
+};
+/** Root query type */
 export type QueryBounceStatsArgs = {
     campaignId: Scalars['ID']['input'];
 };
@@ -18189,6 +18662,11 @@ export type QueryInstallationPermissionsArgs = {
     installationId: Scalars['ID']['input'];
 };
 /** Root query type */
+export type QueryInstalledStoreNodeRuntimeArgs = {
+    nodeTypes: Array<Scalars['String']['input']>;
+    nodeVersion?: InputMaybe<Scalars['String']['input']>;
+};
+/** Root query type */
 export type QueryInterviewRoundArgs = {
     id: Scalars['ID']['input'];
 };
@@ -18435,6 +18913,10 @@ export type QueryMyEntitlementsArgs = {
     offset?: InputMaybe<Scalars['Int']['input']>;
 };
 /** Root query type */
+export type QueryMyNotificationSendStatusArgs = {
+    id: Scalars['ID']['input'];
+};
+/** Root query type */
 export type QueryMyOrdersArgs = {
     limit?: InputMaybe<Scalars['Int']['input']>;
     offset?: InputMaybe<Scalars['Int']['input']>;
@@ -18608,6 +19090,12 @@ export type QueryNewslettersArgs = {
     offset?: InputMaybe<Scalars['Int']['input']>;
 };
 /** Root query type */
+export type QueryNodeSandboxBuildChecksArgs = {
+    applicationVersionId?: InputMaybe<Scalars['ID']['input']>;
+    limit?: InputMaybe<Scalars['Int']['input']>;
+    offset?: InputMaybe<Scalars['Int']['input']>;
+};
+/** Root query type */
 export type QueryNotificationArgs = {
     id: Scalars['ID']['input'];
 };
@@ -18741,6 +19229,10 @@ export type QueryOrganizationPickupPostalCodeArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root query type */
+export type QueryOrganizationPrivateNodesArgs = {
+    workspaceId: Scalars['ID']['input'];
+};
+/** Root query type */
 export type QueryPendingDeveloperOrganizationVerificationsArgs = {
     limit?: InputMaybe<Scalars['Int']['input']>;
     offset?: InputMaybe<Scalars['Int']['input']>;
@@ -18970,6 +19462,8 @@ export type QueryPushDevicesForUserInternalArgs = {
 };
 /** Root query type */
 export type QueryQuoteAiCreditsArgs = {
+    cacheReadTokens?: InputMaybe<Scalars['Int']['input']>;
+    cacheWriteTokens?: InputMaybe<Scalars['Int']['input']>;
     inputTokens: Scalars['Int']['input'];
     model: Scalars['String']['input'];
     outputTokens: Scalars['Int']['input'];
@@ -19553,6 +20047,15 @@ export type QueryWebhookDeliveryArgs = {
     id: Scalars['ID']['input'];
 };
 /** Root query type */
+export type QueryWebhookEventCatalogArgs = {
+    productSlug?: InputMaybe<Scalars['String']['input']>;
+};
+/** Root query type */
+export type QueryWebhookEventSubjectsArgs = {
+    includeInactive?: InputMaybe<Scalars['Boolean']['input']>;
+    productSlug?: InputMaybe<Scalars['String']['input']>;
+};
+/** Root query type */
 export type QueryWebhooksArgs = {
     applicationId: Scalars['ID']['input'];
 };
@@ -20026,6 +20529,15 @@ export type RecordExploreClickResult = {
     __typename?: 'RecordExploreClickResult';
     recorded: Scalars['Boolean']['output'];
 };
+export type RecordExternalRefundInput = {
+    amount: Scalars['Float']['input'];
+    chargeId: Scalars['ID']['input'];
+    currency: Scalars['String']['input'];
+    externalRef: Scalars['String']['input'];
+    orgId: Scalars['ID']['input'];
+    reason?: InputMaybe<Scalars['String']['input']>;
+    workspaceId?: InputMaybe<Scalars['ID']['input']>;
+};
 export type RecordExternalSettlementInput = {
     /** Settlement amount in whole currency units (must be > 0). */
     amount: Scalars['Float']['input'];
@@ -20357,6 +20869,12 @@ export type RegisterSupportAttachmentPartInput = {
     sessionId: Scalars['ID']['input'];
     ticketId: Scalars['ID']['input'];
 };
+export type RegisterWebhookEventSubjectsInput = {
+    /** Product slug that owns the subjects (e.g. `vibecontrols`, `fluidgrids`). */
+    productSlug: Scalars['String']['input'];
+    /** Mappings to create or update (at most 100 per call). */
+    subjects: Array<WebhookEventSubjectInput>;
+};
 export type RejectWaitlistInput = {
     id: Scalars['ID']['input'];
     reason?: InputMaybe<Scalars['String']['input']>;
@@ -20448,6 +20966,24 @@ export type ResendVerificationResult = {
     message: Scalars['String']['output'];
     success: Scalars['Boolean']['output'];
 };
+export type ReserveAssistantBudgetInput = {
+    id: Scalars['ID']['input'];
+    inputTokens: Scalars['Int']['input'];
+    model: Scalars['String']['input'];
+    outputTokens: Scalars['Int']['input'];
+    workspaceId: Scalars['ID']['input'];
+};
+export type ReserveAvatarMinutesInput = {
+    actorId: Scalars['ID']['input'];
+    mode: AvatarMinutesMode;
+    productId: Scalars['String']['input'];
+    /** 1 to 60; billing reserves min(available, requested, AVATAR_MINUTES_MAX_PER_SESSION). */
+    requestedMinutes: Scalars['Int']['input'];
+    sessionId: Scalars['ID']['input'];
+    supersedesSessionId?: InputMaybe<Scalars['ID']['input']>;
+    surface: Scalars['String']['input'];
+    workspaceId: Scalars['ID']['input'];
+};
 /** Input for resolving (or creating) the default billing account for a user/org. At least one of `orgId` or `ownerUserId` MUST be supplied: - `orgId` present → resolve-or-create the org's default billing account. - `ownerUserId` only → resolve an EXISTING billing account already associated with that user's earnings/payout accounts. Creation requires an `orgId` anchor because a billing account is always org-scoped. */
 export type ResolveBillingAccountInput = {
     /** Opaque org id that anchors the billing account. When present the org's default billing account is resolved-or-created. */
@@ -20495,6 +21031,17 @@ export type ResourceTypeProductInfo = {
     products: Array<Scalars['String']['output']>;
     resourceType: Scalars['String']['output'];
 };
+/** Input for the service-trusted internal reduction of a first-party self-delegation. */
+export type RestrictAppDelegationInternalInput = {
+    /** Client ID of the first-party system app (e.g. burdenoff_integration_core). */
+    clientId: Scalars['String']['input'];
+    /** The most the delegation may keep: it keeps only those of these scopes it already holds (and the app still allows), and is revoked if none are left. */
+    scopes: Array<Scalars['String']['input']>;
+    /** The user whose delegation to the app is reduced. */
+    userId: Scalars['String']['input'];
+    /** The most workspaces the delegation may keep: it keeps only those of these it already covers, and is revoked if none are left. Empty = leave the workspaces as they are. */
+    workspaceIds: Array<Scalars['String']['input']>;
+};
 export type RetryBillingOrderCallbackResponse = {
     __typename?: 'RetryBillingOrderCallbackResponse';
     error?: Maybe<Scalars['String']['output']>;
@@ -20551,8 +21098,19 @@ export type RevokeAllSessionsResult = {
     revokedCount: Scalars['Int']['output'];
     success: Scalars['Boolean']['output'];
 };
+/** Input for the service-trusted internal revoke of a first-party self-delegation. */
+export type RevokeAppDelegationInternalInput = {
+    /** Client ID of the first-party system app (e.g. burdenoff_integration_core). */
+    clientId: Scalars['String']['input'];
+    /** Recorded on the delegation and in the audit log. */
+    reason?: InputMaybe<Scalars['String']['input']>;
+    /** The user whose delegation to the app is revoked. */
+    userId: Scalars['String']['input'];
+};
 export type RevokeAppWorkspaceAccessInput = {
     appId: Scalars['ID']['input'];
+    /** Withdraw only the calling actor's own grant. The authorization is revoked (true) only when the caller is its sole grantor; when others granted it too, only the caller's share is released and it stays ACTIVE (false); one the caller never granted is left untouched (false). An automated provisioner withdrawing its own grant sets this, so it never revokes access an owner or an app installation gave the app, whichever granted first. */
+    onlyIfGrantedByCaller?: InputMaybe<Scalars['Boolean']['input']>;
     reason?: InputMaybe<Scalars['String']['input']>;
     workspaceId: Scalars['ID']['input'];
 };
@@ -21089,6 +21647,15 @@ export type SeedAtheleteBridgeUserToursResult = {
     updatedCount: Scalars['Int']['output'];
     workspaceId: Scalars['String']['output'];
 };
+export type SeedBigconsoleUserToursResult = {
+    __typename?: 'SeedBigconsoleUserToursResult';
+    createdCount: Scalars['Int']['output'];
+    productId: Scalars['String']['output'];
+    totalCount: Scalars['Int']['output'];
+    tours: Array<SeededUserTourResult>;
+    updatedCount: Scalars['Int']['output'];
+    workspaceId: Scalars['String']['output'];
+};
 export type SeedBuildmyiqUserToursResult = {
     __typename?: 'SeedBuildmyiqUserToursResult';
     createdCount: Scalars['Int']['output'];
@@ -21301,6 +21868,31 @@ export type ServiceSyncPayoutStatusInput = {
     /** The billing PayoutRequestStatus after the change (e.g. APPROVED, REJECTED, PAID, FAILED). */
     status: Scalars['String']['input'];
 };
+/** Input for serviceUpsertExternalListing (BOFF-3430). */
+export type ServiceUpsertExternalListingInput = {
+    /** Brand or maker shown on the listing. */
+    brand?: InputMaybe<Scalars['String']['input']>;
+    category?: InputMaybe<Scalars['String']['input']>;
+    /** ISO 4217 currency code, upper case. */
+    currency: Scalars['String']['input'];
+    description?: InputMaybe<Scalars['String']['input']>;
+    /** The item's id in the calling service. Together with the caller's service identity it identifies the listing. */
+    externalId: Scalars['String']['input'];
+    /** Absolute https URL of the item's page in the owning product. */
+    externalUrl: Scalars['String']['input'];
+    metadata?: InputMaybe<Scalars['JSON']['input']>;
+    name: Scalars['String']['input'];
+    price: Scalars['Float']['input'];
+    /** Platform product key of the caller (for example "coolandlovely"). Used as the listing's compatible product and as its slug prefix. */
+    productKey: Scalars['String']['input'];
+    /** Display name for the caller's publisher profile, created on its first listing. */
+    publisherName: Scalars['String']['input'];
+    /** PUBLISHED (shown in discovery), UNLISTED (kept but hidden) or ARCHIVED (taken down). */
+    status: ProductStatus;
+    tags?: InputMaybe<Array<Scalars['String']['input']>>;
+    /** A physical product type (MERCHANDISE, HARDWARE, ACCESSORY, BOOK, EQUIPMENT, APPAREL, COLLECTIBLE or CONSUMABLE). */
+    type: ProductType;
+};
 /** An active user session (login instance) */
 export type Session = {
     __typename?: 'Session';
@@ -21868,6 +22460,12 @@ export declare enum StoreInstallationStatus {
     Pending = "PENDING",
     Uninstalled = "UNINSTALLED"
 }
+export type StoreInstalledNodeRuntime = {
+    __typename?: 'StoreInstalledNodeRuntime';
+    endpointUrl: Scalars['String']['output'];
+    nodeType: Scalars['String']['output'];
+    nodeVersion?: Maybe<Scalars['String']['output']>;
+};
 /** StoreItem entity reference. The actual StoreItem is defined in the Store service. In Federation 2 setup, this will be marked with @key directive. For now, this is a reference type that returns the itemId for the Gateway to resolve. */
 export type StoreItem = {
     __typename?: 'StoreItem';
@@ -21999,6 +22597,12 @@ export type StoreProduct = {
     documentationUrl?: Maybe<Scalars['String']['output']>;
     downloads: Scalars['Int']['output'];
     entitlements: Array<ProductEntitlement>;
+    /** The item's id in the owning product backend (only set with externalService). */
+    externalId?: Maybe<Scalars['String']['output']>;
+    /** Service identity of the product backend that owns this listing when the item is sold by that product's own checkout (for example wspace-coolandlovely-svc). Null for products the store sells itself. Such a listing cannot be added to a store cart or ordered here; send buyers to externalUrl instead. */
+    externalService?: Maybe<Scalars['String']['output']>;
+    /** Page in the owning product where the item can be viewed and bought (only set with externalService). */
+    externalUrl?: Maybe<Scalars['String']['output']>;
     featured: Scalars['Boolean']['output'];
     /** Product height (physical products) */
     height?: Maybe<Scalars['Float']['output']>;
@@ -22240,6 +22844,24 @@ export type SubmitContactInquiryResult = {
     /** Whether the submission was successful */
     success: Scalars['Boolean']['output'];
 };
+/** One visitor's verdict on one answer. Anonymous like the rest of explore: the conversation token is the only proof of ownership, and the visitor is recorded as an `ipHash`, never an IP. */
+export type SubmitExploreFeedbackInput = {
+    /** Optional free text. Capped server-side; the server truncates rather than rejecting, because a rating is never worth failing over its comment. */
+    comment?: InputMaybe<Scalars['String']['input']>;
+    /** Bearer secret for the conversation the answer belongs to. */
+    conversationToken: Scalars['String']['input'];
+    /** The assistant message being rated. Must be COMPLETED. */
+    messageId: Scalars['ID']['input'];
+    rating: ExploreFeedbackRating;
+    /** Why it was not helpful: one of INACCURATE INCOMPLETE OFF_TOPIC HARD_TO_FOLLOW OTHER. Ignored — and stored as null — for HELPFUL, because "what was wrong with it" is not a question a positive rating answers. */
+    reason?: InputMaybe<Scalars['String']['input']>;
+};
+export type SubmitExploreFeedbackResult = {
+    __typename?: 'SubmitExploreFeedbackResult';
+    /** What was actually stored — echoed back so the UI renders the server's view rather than assuming its optimistic one was accepted. Null when `recorded` is false. */
+    feedback?: Maybe<ExploreFeedback>;
+    recorded: Scalars['Boolean']['output'];
+};
 export type SubmitInterviewFeedbackInput = {
     internalNotes?: InputMaybe<Scalars['String']['input']>;
     interviewerId: Scalars['ID']['input'];
@@ -23161,10 +23783,14 @@ export type Tenant = {
     /** Workspaces belonging to this tenant */
     workspaces: Array<Workspace>;
 };
-/** Tenant configuration for regional settings, branding, and features */
+/** Tenant configuration for regional settings, data residency, and features */
 export type TenantConfig = {
     __typename?: 'TenantConfig';
     complianceRegion?: Maybe<Scalars['String']['output']>;
+    /**
+     * Always null. Burdenoff does no white-labelling: every product keeps its own brand, so tenants cannot set a custom logo, colour or favicon.
+     * @deprecated No white-labelling — products keep their own brand. This setting is ignored.
+     */
     customBranding?: Maybe<Scalars['JSON']['output']>;
     dataResidency?: Maybe<Scalars['String']['output']>;
     features?: Maybe<Scalars['JSON']['output']>;
@@ -24210,6 +24836,8 @@ export type UpdateContentPageInput = {
     visibility?: InputMaybe<ContentVisibility>;
 };
 export type UpdateCouponInput = {
+    applicableEntityTypes?: InputMaybe<Array<CouponEntityType>>;
+    applicableProductIds?: InputMaybe<Array<Scalars['String']['input']>>;
     description?: InputMaybe<Scalars['String']['input']>;
     maxTotalUses?: InputMaybe<Scalars['Int']['input']>;
     maxUsesPerUser?: InputMaybe<Scalars['Int']['input']>;
@@ -25545,12 +26173,16 @@ export type UserWishlist = {
     userId: Scalars['String']['output'];
 };
 export type ValidateCouponInput = {
+    /** Addon being purchased — same purpose as planId, for addon purchases. */
+    addonId?: InputMaybe<Scalars['ID']['input']>;
     /** Order amount before discount */
     amount: Scalars['Float']['input'];
     /** Coupon code to validate */
     code: Scalars['String']['input'];
     /** Currency */
     currency: Scalars['String']['input'];
+    /** Plan being purchased — used to resolve product/entity-type scoping (applicableProductIds/applicableEntityTypes) from the Plan record itself, not from a client-asserted product/entity string. */
+    planId?: InputMaybe<Scalars['ID']['input']>;
     /** Optional: product IDs being purchased */
     productIds?: InputMaybe<Array<Scalars['String']['input']>>;
     /** Optional: service IDs being purchased */
@@ -25826,6 +26458,16 @@ export type WebhookEvent = {
     /** Last update timestamp */
     updatedAt: Scalars['DateTime']['output'];
 };
+/** A webhook event type a developer application can subscribe a webhook to. */
+export type WebhookEventCatalogEntry = {
+    __typename?: 'WebhookEventCatalogEntry';
+    description?: Maybe<Scalars['String']['output']>;
+    /** Event type, sent as the X-Event-Type header and the payload `event` field. */
+    eventType: Scalars['String']['output'];
+    /** Product that emits the event (`devportal` for portal lifecycle events). */
+    productSlug: Scalars['String']['output'];
+    source: WebhookEventSource;
+};
 /** Paginated list of webhook events with cursor support. Pass `nextCursor` from a previous response as `cursor` in the next call. */
 export type WebhookEventList = {
     __typename?: 'WebhookEventList';
@@ -25834,6 +26476,33 @@ export type WebhookEventList = {
     nextCursor?: Maybe<Scalars['String']['output']>;
     total: Scalars['Int']['output'];
 };
+/** Where a webhook event type originates. */
+export declare enum WebhookEventSource {
+    /** Fired by the developer portal itself (application and installation lifecycle). */
+    Devportal = "DEVPORTAL",
+    /** Fired from a workspace entity change, through a registered subject mapping. */
+    Workspace = "WORKSPACE"
+}
+/** Maps a workspace graph-event subject to the webhook event type it fires. */
+export type WebhookEventSubject = {
+    __typename?: 'WebhookEventSubject';
+    createdAt: Scalars['DateTime']['output'];
+    description?: Maybe<Scalars['String']['output']>;
+    eventType: Scalars['String']['output'];
+    id: Scalars['ID']['output'];
+    isActive: Scalars['Boolean']['output'];
+    productSlug: Scalars['String']['output'];
+    /** Graph-event subject, `graph.<module>.<Entity>.<action>`. */
+    subject: Scalars['String']['output'];
+    updatedAt: Scalars['DateTime']['output'];
+};
+export type WebhookEventSubjectInput = {
+    description?: InputMaybe<Scalars['String']['input']>;
+    /** Dotted lower-case event type, e.g. `vibe.created`. The `application.` and `installation.` namespaces are reserved for the developer portal. */
+    eventType: Scalars['String']['input'];
+    /** Graph-event subject, `graph.<module>.<Entity>.<action>`. */
+    subject: Scalars['String']['input'];
+};
 /** Webhook processing result */
 export type WebhookProcessingResult = {
     __typename?: 'WebhookProcessingResult';