activeadmin-graphql 0.3.2 → 0.4.0

data/lib/active_admin/graphql/schema_builder/mutation_update_destroy.rb

@@ -14,6 +14,7 @@ module ActiveAdmin
           proc do
             field fname.to_sym, type_c, null: true, camelize: false,
               visibility: {kind: :mutation_update, graphql_type_name: sb.send(:graphql_type_name_for, aa_res), resource: aa_res},
+              capability: aa_res.graphql_config.capability_for_mutation(:update),
               description: "Update #{model.name}" do
               argument :where, find_type, required: true, camelize: false
               argument :input, update_input, required: true, camelize: false
@@ -80,6 +81,7 @@ module ActiveAdmin
             [delete_name, destroy_name].each do |fname|
               field fname.to_sym, ::GraphQL::Types::Boolean, null: false, camelize: false,
                 visibility: {kind: :mutation_delete, graphql_type_name: type_basename, resource: aa_res},
+                capability: aa_res.graphql_config.capability_for_mutation(:destroy),
                 description: "Destroy #{model.name}" do
                 argument :where, find_type, required: true, camelize: false
               end

data/lib/active_admin/graphql/schema_builder/query_type.rb

@@ -16,6 +16,7 @@ module ActiveAdmin
           aa_by_model = @aa_by_model
           object_types = @object_types
           aa_by_graphql_type_name = @aa_by_graphql_type_name
+          query_type_name_map = aa_by_graphql_type_name_for_queries
           list_filter_input_types = @list_filter_input_types
           find_input_types = @find_input_types
 
@@ -31,7 +32,7 @@ module ActiveAdmin
                 builder: builder,
                 ns: ns,
                 registered_resource_union: registered_resource_union,
-                aa_by_graphql_type_name: aa_by_graphql_type_name
+                aa_by_graphql_type_name: query_type_name_map
               )
             end
 

data/lib/active_admin/graphql/schema_builder/query_type_collection.rb

@@ -7,6 +7,8 @@ module ActiveAdmin
         def add_model_query_fields!(query_class, builder:, ns:, aa_by_model:, object_types:,
           list_filter_input_types:, find_input_types:)
           aa_by_model.each do |model, aa_res|
+            next unless aa_res.graphql_config.queries_enabled
+
             builder.define_query_collection_field!(
               query_class, model, aa_res, builder, ns, object_types, list_filter_input_types
             )
@@ -32,6 +34,7 @@ module ActiveAdmin
                 field_name: plural_route,
                 resource: aa_res
               },
+              capability: aa_res.graphql_config.capability_for_query(:collection),
               description: "Paginated list of #{model.name} (#{aa_res.resource_name.human}); " \
                 "pass +filter+ or legacy +q+ / +scope+ / +order+ (Ransack +q+ matches the JSON index param). " \
                 "Nested resources require the parent foreign key (same as REST route params)." do

data/lib/active_admin/graphql/schema_builder/query_type_member.rb

@@ -19,6 +19,7 @@ module ActiveAdmin
                 field_name: singular,
                 resource: aa_res
               },
+              capability: aa_res.graphql_config.capability_for_query(:member),
               description: "Find #{model.name} by id (same scoping chain as REST +show+). Use +where+ or legacy +id+." do
               argument :where, find_type, required: false, camelize: false
               if ActiveAdmin::PrimaryKey.composite?(model)

data/lib/active_admin/graphql/schema_builder/query_type_policies.rb

@@ -4,14 +4,10 @@ module ActiveAdmin
   module GraphQL
     class SchemaBuilder
       module QueryTypePolicies
-        POLICY_ACTIONS = {
-          read: ActiveAdmin::Authorization::READ,
-          create: ActiveAdmin::Authorization::CREATE,
-          update: ActiveAdmin::Authorization::UPDATE,
-          destroy: ActiveAdmin::Authorization::DESTROY
-        }.freeze
-
         def add_activeadmin_policies_query_field!(query_class, builder:, ns:, aa_by_graphql_type_name:)
+          adapter = builder.send(:policy_adapter)
+          return unless adapter
+
           resource_policy_type = Class.new(::GraphQL::Schema::Object) do
             graphql_name "ActiveAdminResourcePolicies"
             field :type_name, ::GraphQL::Types::String, null: false, camelize: false
@@ -48,7 +44,9 @@ module ActiveAdmin
             end
 
             define_method(:activeadmin_policies) do
-              resources = builder.send(:active_resources).map do |aa_res|
+              resources = builder.send(:active_resources).filter_map do |aa_res|
+                next unless adapter.include_resource?(aa_res)
+
                 {
                   type_name: builder.send(:graphql_type_name_for, aa_res),
                   activeadmin_policies: ActiveAdmin::GraphQL::PolicySetCache.fetch(
@@ -74,6 +72,9 @@ module ActiveAdmin
             define_method(:activeadmin_policies_for) do |type_name:, ids:, path: nil|
               aa_res = aa_by_graphql_type_name[type_name.to_s]
               raise ::GraphQL::ExecutionError, "unknown resource type_name #{type_name.inspect}" unless aa_res
+              unless adapter.include_resource?(aa_res)
+                raise ::GraphQL::ExecutionError, "policies disabled for #{type_name.inspect}"
+              end
 
               proxy = ResourceQueryProxy.new(
                 aa_resource: aa_res,
@@ -99,61 +100,6 @@ module ActiveAdmin
             end
           end
         end
-
-        private
-
-        def policy_action_pairs
-          hook = @namespace.graphql_policy_actions
-          if hook.respond_to?(:call)
-            raw = hook.call(@namespace)
-            return raw.to_h.transform_keys(&:to_sym) if raw.respond_to?(:to_h)
-          end
-          POLICY_ACTIONS
-        end
-
-        def allowed_base_actions(auth:, subject_owner:, subject:, context:)
-          action_mapper = @namespace.graphql_policy_action_mapper
-          policy_action_pairs.each_with_object([]) do |(name, default_action), out|
-            allowed = if action_mapper.respond_to?(:call)
-              action_mapper.call(context, subject_owner, subject, name, default_action)
-            else
-              auth.authorized?(subject_owner, default_action, subject)
-            end
-            out << name.to_s if allowed
-          end
-        end
-
-        def build_policy_set(auth:, subject_owner:, subject:, context:)
-          base = {
-            allowed_actions: allowed_base_actions(auth: auth, subject_owner: subject_owner, subject: subject, context: context),
-            allowed_member_actions: [],
-            allowed_collection_actions: [],
-            allowed_batch_actions: []
-          }
-
-          if subject_owner.is_a?(ActiveAdmin::Resource)
-            class_subject = subject_owner.resource_class
-            if subject.is_a?(Class)
-              if auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, class_subject)
-                base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
-                base[:allowed_collection_actions] = subject_owner.collection_actions.map { |a| a.name.to_s }
-                base[:allowed_batch_actions] = subject_owner.batch_actions.map { |a| a.sym.to_s }
-              end
-            elsif auth.authorized?(subject_owner, ActiveAdmin::Authorization::READ, subject)
-              base[:allowed_member_actions] = subject_owner.member_actions.map { |a| a.name.to_s }
-            end
-          end
-
-          if (extra = @namespace.graphql_policy_extra).respond_to?(:call)
-            out = extra.call(context, subject_owner, subject, base)
-            base = out if out.is_a?(Hash)
-          end
-          if (transform = @namespace.graphql_policy_transform).respond_to?(:call)
-            out = transform.call(context, subject_owner, subject, base)
-            base = out if out.is_a?(Hash)
-          end
-          base
-        end
       end
     end
   end

data/lib/active_admin/graphql/schema_builder/resolvers.rb

@@ -4,22 +4,29 @@ module ActiveAdmin
   module GraphQL
     class SchemaBuilder
       module Resolvers
-        def mutation_extra_keyword_params(aa_res, kw)
+        def mutation_extra_keyword_params(aa_res, kw, allowlist: nil)
           skip =
             if (btc = aa_res.belongs_to_config)
               [btc.to_param.to_s]
             else
               []
             end
+          skip << "id"
+          skip << "dry_run"
+          allow = allowlist&.map(&:to_s)
+
           kw.each_with_object({}) do |(key, val), h|
             ks = key.to_s
             next if skip.include?(ks)
+            next if allow && !allow.include?(ks)
 
             h[ks] = val
           end
         end
 
         def graphql_resolve_index(aa_res, proxy:, context:, graph_params:, **field_kwargs)
+          invoke_collection_query_policy!(aa_res, context, field_kwargs)
+
           proc_ = aa_res.graphql_config.resolve_index_proc
           base_kwargs = {graph_params: graph_params}.merge(field_kwargs)
           if proc_
@@ -57,9 +64,26 @@ module ActiveAdmin
         end
 
         def graphql_resolve_member_action(aa_res, proxy:, context:, action:, id:, params: nil, **kw)
-          extras = mutation_extra_keyword_params(aa_res, kw)
-          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
           per = aa_res.graphql_config.member_action_mutations[action.to_s]
+          dry_run = !!kw[:dry_run]
+          extras = mutation_extra_keyword_params(aa_res, kw, allowlist: per&.extra_param_keys)
+          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
+          params_h.delete("id")
+
+          if per&.dry_run
+            return MemberActionDryRun.resolve(
+              aa_res,
+              proxy: proxy,
+              context: context,
+              action: action,
+              id: id,
+              params_h: params_h,
+              extras: extras.transform_keys(&:to_sym),
+              per: per,
+              dry_run: dry_run
+            )
+          end
+
           resolve = per&.resolve_proc || aa_res.graphql_config.member_run_action.resolve_proc
           if resolve
             resolve.call(
@@ -70,7 +94,7 @@ module ActiveAdmin
               action: action,
               id: id,
               params: params_h,
-              **extras
+              **extras.transform_keys(&:to_sym)
             )
           else
             proxy.run_member_action(action, id, extra_params: params_h)
@@ -78,9 +102,10 @@ module ActiveAdmin
         end
 
         def graphql_resolve_collection_action(aa_res, proxy:, context:, action:, params: nil, **kw)
-          extras = mutation_extra_keyword_params(aa_res, kw)
-          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
           per = aa_res.graphql_config.collection_action_mutations[action.to_s]
+          extras = mutation_extra_keyword_params(aa_res, kw, allowlist: per&.extra_param_keys)
+          params_h = coerce_action_param_map(params).merge(extras.transform_keys(&:to_s))
+          params_h.delete("id")
           resolve = per&.resolve_proc || aa_res.graphql_config.collection_run_action.resolve_proc
           if resolve
             resolve.call(
@@ -90,7 +115,7 @@ module ActiveAdmin
               auth: context[:auth],
               action: action,
               params: params_h,
-              **extras
+              **extras.transform_keys(&:to_sym)
             )
           else
             proxy.run_collection_action(action, extra_params: params_h)
@@ -105,6 +130,20 @@ module ActiveAdmin
           h.stringify_keys
         end
 
+        def invoke_collection_query_policy!(aa_res, context, field_kwargs)
+          hook = context[:namespace]&.graphql_collection_query_policy
+          return if hook.nil?
+
+          meta = field_kwargs.merge(
+            aa_resource: aa_res,
+            q: field_kwargs[:q],
+            scope: field_kwargs[:scope],
+            order: field_kwargs[:order],
+            filter: field_kwargs[:filter]
+          )
+          hook.call(context, meta)
+        end
+
         public :graphql_resolve_index,
           :graphql_resolve_show,
           :graphql_resolve_batch_action,

data/lib/active_admin/graphql/schema_builder/resources.rb

@@ -28,6 +28,40 @@ module ActiveAdmin
           aa_res.attributes_for_graphql
         end
 
+        # +nil+ when policy fields are off (+graphql_policies_enabled+ false).
+        def policy_adapter
+          return @policy_adapter if defined?(@policy_adapter)
+
+          unless @namespace.graphql_policies_enabled
+            @policy_adapter = nil
+            return @policy_adapter
+          end
+
+          raw = @namespace.graphql_policy_adapter
+          klass = case raw
+          when nil, true, :default
+            PolicyAdapter
+          when String
+            raw.constantize
+          when Class
+            raw
+          else
+            raise ActiveAdmin::DependencyError,
+              "graphql_policy_adapter must be a Class, String, or nil (got #{raw.inspect})"
+          end
+          @policy_adapter = klass.new(namespace: @namespace)
+        end
+
+        def queryable_resources
+          active_resources.select { |r| r.graphql_config.queries_enabled }
+        end
+
+        def aa_by_graphql_type_name_for_queries
+          queryable_resources.each_with_object({}) do |aa_res, map|
+            map[graphql_type_name_for(aa_res)] = aa_res
+          end
+        end
+
         def configure_schema_plugins(schema)
           if (c = @namespace.graphql_max_complexity)
             schema.max_complexity(c)

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -113,18 +113,29 @@ module ActiveAdmin
             next unless col
 
             gql_t = graphql_scalar_for_column(aa_res, model, col)
-            type_class.field(name.to_sym, gql_t, null: true, camelize: false, authorize: false)
+            type_class.field(
+              name.to_sym,
+              gql_t,
+              null: true,
+              camelize: false,
+              authorize: false,
+              capability: aa_res.graphql_config.capability_for_field(name),
+              capability_mode: aa_res.graphql_config.capability_mode_for_field(name)
+            )
 
             type_class.define_method(name.to_sym) { object.public_send(name) }
           end
 
-          type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
-          type_class.define_method(:activeadmin_policies) do
-            ActiveAdmin::GraphQL::PolicySetCache.fetch(
-              context,
-              subject_owner: aa_res,
-              subject: object
-            )
+          adapter = policy_adapter
+          if adapter&.include_resource?(aa_res)
+            type_class.field :activeadmin_policies, policy_set_type, null: false, camelize: false, authorize: false
+            type_class.define_method(:activeadmin_policies) do
+              ActiveAdmin::GraphQL::PolicySetCache.fetch(
+                context,
+                subject_owner: aa_res,
+                subject: object
+              )
+            end
           end
 
           if (ext = aa_res.graphql_config.extension_block)

data/lib/active_admin/graphql/schema_builder/visibility.rb

@@ -10,14 +10,29 @@ module ActiveAdmin
           vis = @namespace.graphql_visibility
           return if vis.nil?
 
-          if vis == true
-            schema.use(::GraphQL::Schema::Visibility)
-          elsif vis.is_a?(Hash)
-            schema.use(::GraphQL::Schema::Visibility, **vis.symbolize_keys)
-          else
-            raise ActiveAdmin::DependencyError,
-              "namespace graphql_visibility must be nil, true, or a Hash of GraphQL::Schema::Visibility options"
+          options =
+            case vis
+            when true
+              {}
+            when Hash
+              vis.symbolize_keys
+            else
+              raise ActiveAdmin::DependencyError,
+                "namespace graphql_visibility must be nil, true, or a Hash of GraphQL::Schema::Visibility options"
+            end
+
+          if @namespace.graphql_capabilities.respond_to?(:call)
+            profiles = options[:profiles]
+            if profiles.respond_to?(:any?) && profiles.any?
+              raise ActiveAdmin::DependencyError,
+                "graphql_capabilities cannot be combined with named GraphQL visibility profiles " \
+                "(named profiles cache a fixed context and ignore per-request capabilities). " \
+                "Omit profiles: and use dynamic visibility, or drop graphql_capabilities."
+            end
+            options = options.merge(dynamic: true)
           end
+
+          schema.use(::GraphQL::Schema::Visibility, **options)
         end
 
         def attach_registered_resource_union_visibility!(union_class)

data/lib/active_admin/graphql/schema_builder/wire.rb

@@ -20,7 +20,10 @@ module ActiveAdmin
               field_name = ref.name.to_sym
               fk = ref.foreign_key.to_s
 
-              type_class.field field_name, @object_types[target], null: true, camelize: false
+              type_class.field field_name, @object_types[target], null: true, camelize: false,
+                authorize: false,
+                capability: aa_res.graphql_config.capability_for_field(field_name),
+                capability_mode: aa_res.graphql_config.capability_mode_for_field(field_name)
 
               type_class.define_method(field_name) do
                 fk_val = object.public_send(fk)

data/lib/active_admin/graphql/schema_field.rb

@@ -2,22 +2,70 @@
 
 module ActiveAdmin
   module GraphQL
-    # Subclass of {::GraphQL::Schema::Field} for namespace +Query+ / +Mutation+ fields.
+    # Subclass of {::GraphQL::Schema::Field} for namespace +Query+ / +Mutation+ fields
+    # and resource object fields.
     #
     # The +visibility:+ keyword accepts an optional Hash of metadata forwarded to
     # +graphql_schema_visible+ (second argument) when {GraphQL::Schema::Visibility} is enabled.
-    # That hook runs from {#visible?}; it does not replace graphql-ruby's visibility system—it
-    # composes with +super+ like any custom +Field+ class.
+    #
+    # +capability:+ (RFC 0008) and +capability_mode:+ (RFC 0009) gate +visible?+ /
+    # +authorized?+ via +context[:capabilities]+. +graphql_field_visible+ may omit fields.
+    # +dry_run:+ / +confirm:+ / +preview:+ (RFC 0013) control custom run-action fields.
     class SchemaField < ::GraphQL::Schema::Field
-      def initialize(visibility: nil, authorize: nil, authorize_action: nil, **kwargs, &block)
-        @visibility = visibility
+      CAPABILITY_MODES = %i[omit null].freeze
+
+      def initialize(
+        visibility: nil,
+        authorize: nil,
+        authorize_action: nil,
+        capability: nil,
+        capability_mode: nil,
+        dry_run: false,
+        confirm: false,
+        preview: nil,
+        extensions: ::GraphQL::EmptyObjects::EMPTY_ARRAY,
+        **kwargs,
+        &block
+      )
+        @capability = capability&.to_sym
+        @capability_mode = normalize_capability_mode(capability_mode)
+        @inject_dry_run = dry_run
+        @inject_confirm = confirm
+        @preview_proc = preview
+        @visibility =
+          if @capability && visibility.is_a?(Hash) && !visibility.key?(:capability)
+            visibility.merge(capability: @capability)
+          else
+            visibility
+          end
         @authorize = authorize
         @authorize_action = authorize_action
-        super(**kwargs, &block)
+        field_extensions = Array(extensions)
+        if @inject_confirm || @preview_proc
+          field_extensions += [{
+            RunActionControlExtension => {confirm: @inject_confirm, preview: @preview_proc}
+          }]
+        end
+        if @inject_dry_run || @inject_confirm || @preview_proc || block
+          super(extensions: field_extensions, **kwargs) do
+            inject_run_action_control_arguments!
+            instance_exec(&block) if block
+          end
+        else
+          super(extensions: field_extensions, **kwargs)
+        end
       end
 
       def visible?(ctx)
         return false unless super
+        return false unless field_visible_by_hook?(ctx)
+
+        if ctx[:namespace]&.graphql_visibility &&
+            @capability &&
+            !Capability.granted?(ctx, @capability) &&
+            capability_mode_for(ctx) == :omit
+          return false
+        end
 
         return true unless @visibility
 
@@ -29,6 +77,7 @@ module ActiveAdmin
 
       def authorized?(object, args, ctx)
         return false unless super
+        return false unless Capability.granted?(ctx, @capability)
 
         owner = self.owner
         aa_resource = owner.respond_to?(:activeadmin_graphql_resource) ? owner.activeadmin_graphql_resource : nil
@@ -44,6 +93,48 @@ module ActiveAdmin
         action = @authorize_action || ActiveAdmin::Authorization::READ
         !!ctx[:auth]&.authorized?(aa_resource, action, object)
       end
+
+      private
+
+      def inject_run_action_control_arguments!
+        if @inject_dry_run
+          argument :dry_run, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+            description: "When true, preview without performing the side-effecting action."
+        end
+        if @inject_confirm
+          argument :confirm, ::GraphQL::Types::Boolean, required: false, default_value: false, camelize: false,
+            description: "When false and dry_run is false, refuse with body confirm_required."
+        end
+      end
+
+      def normalize_capability_mode(mode)
+        return nil if mode.nil?
+
+        sym = mode.to_sym
+        unless CAPABILITY_MODES.include?(sym)
+          raise ArgumentError, "capability_mode must be :omit or :null, got #{mode.inspect}"
+        end
+        sym
+      end
+
+      def capability_mode_for(ctx)
+        mode = @capability_mode || ctx[:namespace]&.graphql_field_capability_mode_default || :omit
+        mode.to_sym
+      end
+
+      def field_visible_by_hook?(ctx)
+        hook = ctx[:namespace]&.graphql_field_visible
+        return true if hook.nil?
+
+        owner = self.owner
+        meta = {
+          graphql_type_name: owner.respond_to?(:graphql_name) ? owner.graphql_name : nil,
+          field_name: graphql_name,
+          resource: owner.respond_to?(:activeadmin_graphql_resource) ? owner.activeadmin_graphql_resource : nil
+        }
+        meta = meta.merge(@visibility) if @visibility.is_a?(Hash)
+        !!hook.call(ctx, meta)
+      end
     end
   end
 end

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.3.2"
+    VERSION = "0.4.0"
   end
 end

data/lib/active_admin/graphql.rb

@@ -68,6 +68,9 @@ module ActiveAdmin
       def require_active_admin_graphql_components!
         %w[
           graphql/resource_interface
+          graphql/capability
+          graphql/run_action_preview
+          graphql/run_action_control_extension
           graphql/schema_field
           graphql/auth_context
           graphql/record_source
@@ -76,7 +79,13 @@ module ActiveAdmin
           graphql/run_action_payload
           graphql/run_action_mutation_config
           graphql/run_action_mutation_dsl
+          graphql/run_action_field
+          graphql/member_action_dry_run
+          graphql/run_action_capability
+          graphql/member_action_capability
+          graphql/collection_query_policy
           graphql/key_value_pair_input
+          graphql/policy_adapter
           graphql/policy_set_cache
           graphql/mutation_execution_error
           graphql/schema_builder

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Andrei Makarov
@@ -374,10 +374,16 @@ files:
 - docs/changelogs/20260921111000_release-0-3-0.md
 - docs/changelogs/20260921112800_drop-standard-rubocop-direct.md
 - docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md
+- docs/changelogs/20261010091415_graphql-resource-enabled-default.md
 - docs/changelogs/20261010101500_nonconventional-id-fields.md
 - docs/changelogs/20261010103800_release-0-3-1.md
 - docs/changelogs/20261010110600_graphql-identity-dsl.md
 - docs/changelogs/20261010111800_release-0-3-2.md
+- docs/changelogs/20261012050051_graphql-surface-toggles.md
+- docs/changelogs/20261012064500_graphql-capabilities.md
+- docs/changelogs/20261012113500_release-0-3-3.md
+- docs/changelogs/20261012200000_host-customization-hooks.md
+- docs/changelogs/20261013080000_release-0-4-0.md
 - docs/dependencies/20260907141000_json-cve-2026-71847.md
 - docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
 - docs/dependencies/20260921114000_rails-json-parse-kwargs.md
@@ -393,18 +399,27 @@ files:
 - docs/issues/20261010111159_rails-composite-primary-keys-alignment.md
 - docs/issues/20261010111300_partitions-and-shards-support.md
 - docs/issues/20261010111500_graphql-federation-support.md
+- docs/issues/20261012200000_host-customization-gaps.md
 - docs/plan/20260817201500_rfc-starter.md
 - lib/active_admin/graphql.rb
 - lib/active_admin/graphql/auth_context.rb
+- lib/active_admin/graphql/capability.rb
+- lib/active_admin/graphql/capability_definition_dsl.rb
+- lib/active_admin/graphql/collection_query_policy.rb
 - lib/active_admin/graphql/engine.rb
 - lib/active_admin/graphql/integration.rb
 - lib/active_admin/graphql/key_value_pair_input.rb
+- lib/active_admin/graphql/member_action_capability.rb
+- lib/active_admin/graphql/member_action_dry_run.rb
 - lib/active_admin/graphql/mutation_execution_error.rb
 - lib/active_admin/graphql/mutation_input_config.rb
 - lib/active_admin/graphql/mutation_input_definition_dsl.rb
+- lib/active_admin/graphql/policy_adapter.rb
 - lib/active_admin/graphql/policy_set_cache.rb
 - lib/active_admin/graphql/railtie.rb
 - lib/active_admin/graphql/record_source.rb
+- lib/active_admin/graphql/resource_capability_dsl.rb
+- lib/active_admin/graphql/resource_capability_maps.rb
 - lib/active_admin/graphql/resource_config.rb
 - lib/active_admin/graphql/resource_definition_dsl.rb
 - lib/active_admin/graphql/resource_identity.rb
@@ -413,9 +428,14 @@ files:
 - lib/active_admin/graphql/resource_query_proxy.rb
 - lib/active_admin/graphql/resource_query_proxy/controller.rb
 - lib/active_admin/graphql/resource_query_proxy/identity.rb
+- lib/active_admin/graphql/resource_surface_dsl.rb
+- lib/active_admin/graphql/run_action_capability.rb
+- lib/active_admin/graphql/run_action_control_extension.rb
+- lib/active_admin/graphql/run_action_field.rb
 - lib/active_admin/graphql/run_action_mutation_config.rb
 - lib/active_admin/graphql/run_action_mutation_dsl.rb
 - lib/active_admin/graphql/run_action_payload.rb
+- lib/active_admin/graphql/run_action_preview.rb
 - lib/active_admin/graphql/schema_builder.rb
 - lib/active_admin/graphql/schema_builder/build.rb
 - lib/active_admin/graphql/schema_builder/graph_params.rb