ecoportal-api-graphql 2.2.0 → 2.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 371133ecd295f75aacb3e34c85f4cc93c5561cc0b12452091fb19d73fb32adda
-  data.tar.gz: 422e949c1544c1d94dc0bd3f7f2825d5a747449976cda7eef04c51ca9da4d523
+  metadata.gz: 128e83d1aa8d0fa5b9e4ce95f8bbd5f8bd4f219ea7d7a94dd18ec31225ac3ce9
+  data.tar.gz: 7d79138b320e6ba09221bd79a4c341ef9dc039f4ccf6923567f3f4b36f657c27
 SHA512:
-  metadata.gz: 9627606e555d1fcbff9bede5d611d34fc2274c4566bae93b67e9c1821a730bbef6b8831f46061e1557f7123302c70a022af77228c2c69297a87a46bb0ee2db33
-  data.tar.gz: 291a7b865d87ec744bd23d97916808105a8cad7bad525af5862d19f7c21e367760930aa49e67af5991a181ab406cadc298b5a33ca354677fe0cc27d772ce4718
+  metadata.gz: 04cb9487e78e2f11b4c71572bc17915570a8638da67df94cfa27f0dfb3400d2c9f67bcaf25ac1b5bb61f86f1884f5af88b3adf961528ef8d3e5567607fcc1140
+  data.tar.gz: 3036e3e2295a5a2eb5876e66b145d09f3fd1a96fc174234f77621b0cd553ad2e501dc4d9c1baf74077990d9ed03c77e9bb8c8858cec97005e7dbefbeb05bda45

data/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.2.1] - 2026-09-30
+
+### Security
+
+- Security republish of `2.2.0` -- backwards-compatible: removes customer and internal identifiers
+  from shipped comments and this changelog. Packaging is unchanged: `2.2.0` already shipped only
+  allowlisted files (`lib/**/*.rb` plus the named root docs).
+
+### Fixed
+
+- **Fixed:** `api.permissions` (`Query::Permissions`) failed against live after the 2026-09-29
+  platform release, which removed `Permissions.pageSmartAssistantCanChat` and
+  `Permissions.registerAssistantCanChat` (smart-assistant consolidation). `Fragment::Permissions` no
+  longer selects them. The model accessors are kept, deprecated, and now always return `nil`, so
+  callers do not break. Affects every earlier version, including 2.2.0.
+
+### Added
+
+- **Added:** `WorkflowCommand` builder for `moveSectionToStage` (new in the 2026-09-29 live schema):
+  `build(:moveSectionToStage, source_stage_id:, target_stage_id:, section_id:, anchorId:, anchorPosition:)`,
+  moving an existing section to another stage. `anchorPosition` is validated like the other anchor commands.
+
 ## [2.2.0] - 2026-09-02
 
 ★ **This release supersedes 2.1.0, which was version-bumped and changelogged on 2026-08-21 but never
@@ -51,7 +73,7 @@ caller adapting to this is changing working-looking code.
   `ximport` tooltip guard: fields marked exclude-from-import are counted and protected, never
   treated as overwritable. `Delta.call`'s `reviewer:` seam is now wired to `Review.method(:call)`,
   so `review_findings` appears in the delta payload. Gated by `tools/template_yaml/compare_gate.rb`
-  against the 18 M&S templates -- refusal set matches the Python exactly.
+  against a customer's 18 templates -- refusal set matches the Python exactly.
 
 - `tools/template_yaml/model.rb`: Ruby port of the template projector's `project(doc, source)` 
   (P3's IR assembly), composing field and force walks into a compact IR dict with key order
@@ -73,7 +95,7 @@ caller adapting to this is changing working-looking code.
   -> `UpdateGate`) over the `*.json` corpus, Python via a single batched subprocess (direct
   import of `ep_template_yaml.py`, not its CLI) over the `*.yaml` corpus -- and diffs the ENTIRE
   IR: every template attribute, every field, every force (incl. bindings), every review finding,
-  and the `update_gate` refusal set. Live run over the 18 M&S templates: **`P8 GATE: PASS`**,
+  and the `update_gate` refusal set. Live run over a customer's 18 templates: **`P8 GATE: PASS`**,
   0 unexpected divergences, 12 expected (the six known-corrected ObjectIds, each seen twice --
   once as a field id, once as a binding `reference_id`).
 - `tools/template_yaml/known_divergences.rb`: the six-id whitelist and its `corrupted_id?` rule,
@@ -116,9 +138,9 @@ caller adapting to this is changing working-looking code.
 - **Fixed** `Common::GraphQL::ResponseError` discarding `errors[].extensions`. It now carries the
   raw error entries and exposes `#errors`, `#extensions`, `#codes`, `#details`, `#full_messages`
   and `#unauthorized?`. This is what makes a permission problem distinguishable from a request
-  problem in Ruby — the diagnosis the M&S pack tells customers to perform, which until now no tool
+  problem in Ruby — the diagnosis a customer integration pack tells customers to perform, which until now no tool
   built on this gem could actually follow. The message still LEADS with the joined server messages
-  (existing matchers keep working) and appends `code:` / `details:` after them. `tools/mns/cli.rb`
+  (existing matchers keep working) and appends `code:` / `details:` after them. `tools/<customer>/cli.rb`
   now reports the server's own classification instead of sniffing the message for `/unauthoriz/i` —
   a sniff that could not tell a policy refusal from a FIELD-level gate. Tracked as Q-27.
 
@@ -212,30 +234,30 @@ closes.
   `include` / `enforce`) for copy-page behaviour. Closes the last gap in the command bus --
   `validate-queries` now reports 106/106 commands wired.
 
-- `tools/mns/collection.rb` -- a pure-Ruby, stdlib-only read interface over the MnS Postman "ALL
+- `tools/<customer>/collection.rb` -- a pure-Ruby, stdlib-only read interface over a customer's Postman "ALL
   CASES" master collection (the sibling `ep-api-collections` repo masters it; this gem never
   hand-copies its knowledge). Walks the folder tree, exposes each GraphQL request's full path,
   name, query, parsed variables, and `{{placeholder}}` inventory, with a name/path lookup that
   tolerates a folder-path prefix and raises a named error listing near-matches when nothing
-  resolves. `spec/tools/mns/collection_sync_spec.rb` pins the webhook-admin and build/update-page
+  resolves. `spec/tools/<customer>/collection_sync_spec.rb` pins the webhook-admin and build/update-page
   request paths plus the placeholders the tooling depends on, and fails -- naming exactly what
   disappeared -- if the collection renames or removes one of them; it skips cleanly (not fails)
-  when no sibling checkout is present. See `tools/mns/README.md`.
+  when no sibling checkout is present. See `tools/<customer>/README.md`.
 
 - `tools/template_yaml/mns_review.py` -- cross-template audit over a directory of IR projections:
   identifier coverage, `templateContainerUid` uniqueness and name plausibility, findings by code,
   authoring-maturity signal, and classification of orphaned force bindings into projector gaps
   versus real defects (checked against the source dumps). First run recorded in
-  `tools/template_yaml/reviews/2026-08-09-mns-18-templates.md`.
+  `tools/template_yaml/reviews/2026-08-09-<customer>-18-templates.md`.
 
-- **`tools/mns/cli.rb`** -- a Ruby CLI that creates/lists/destroys the M&S webhook
+- **`tools/<customer>/cli.rb`** -- a Ruby CLI that creates/lists/destroys a customer's webhook
   subscription and verifies the setup read-only, runnable from a support server with nothing
-  but `USER_EMAIL`/`USER_PASS` supplied (every other value defaults to the M&S UAT org, EU
+  but `USER_EMAIL`/`USER_PASS` supplied (every other value defaults to a customer UAT org, EU
   instance). `webhook create` is idempotent in practice: it lists first and reports the
   existing subscription instead of creating a duplicate when one already matches the URL and
   template(s). `--dry-run` prints the GraphQL document and variables with no network call.
-  Document builders live in `tools/mns/webhooks.rb` (`MnsWebhooks::Documents`) as pure
-  functions, spec'd in `spec/tools/mns/webhooks_spec.rb` with no network involved.
+  Document builders live in `tools/<customer>/webhooks.rb` (`<Customer>Webhooks::Documents`) as pure
+  functions, spec'd in `spec/tools/<customer>/webhooks_spec.rb` with no network involved.
 
 - **`Query::PersonMembers`** — the GraphQL-native people-directory path over
   `organization.personMembers`, filling the gap flagged in `model/organization.rb`. Salvaged
@@ -286,7 +308,7 @@ closes.
   bumping **neither `patchVer` nor `updatedAt`** — any watermark-polling change tracker is blind to
   force-driven change, whereas the command log is per-change. (Open: whether forces run against
   templates specifically is not confirmed.)
-  Also documented in `.ai-assistance/code/template_change_log.md`.
+  Also documented in the repo's internal docs.
 
 - **New tool `tools/template_yaml/delta.rb`** (P6 of the template-YAML-tooling Ruby port): the
   deterministic before/after difference between two `project()` snapshots, shaped for the Rovo
@@ -318,9 +340,9 @@ closes.
   LAYOUT order -- `flow_nodes` by `weight`, then `membrane_ids` / `left_membrane_ids` /
   `right_membrane_ids`, then each id list in stored order -- porting the Python projector's
   `walk_fields` against the contract frozen in `P1-CONTRACT.md`.
-  **Verified against the real 18-template M&S dump set: 2,714 fields, ids and ordering match the
+  **Verified against the real 18-template customer dump set: 2,714 fields, ids and ordering match the
   Python projector exactly, with 0 unexpected divergences.** The only 6 differences are the
-  `ActionsList` ids the Python's YAML path corrupts (`6a4c4f12316577006e210b7a`..`..b7f`), where
+  `ActionsList` ids the Python's YAML path corrupts (a contiguous run of `ActionsList` ids), where
   the Ruby is correct and the Python is not; `compare_fields.rb` whitelists those six BY VALUE,
   so a seventh divergence -- or any ordering defect on that same template -- still fails.
 - **`FieldWalker` distinguishes "no fields" from "could not see the fields"**, which the Python
@@ -341,11 +363,11 @@ closes.
   Reading JSON instead of YAML is deliberate: the Python projector's YAML path decodes
   `!ruby/object:BSON::ObjectId` via a step with a silent-failure mode (confirmed unchanged on
   the canonical post-!86 surface in `P1-CONTRACT.md`) that corrupts 6 of 2,432 fields on one
-  M&S template without affecting counts. The JSON export carries identical data with plain hex
+  customer template without affecting counts. The JSON export carries identical data with plain hex
   ids already, so the whole decode-bug class is structurally impossible on this path rather
-  than reimplemented. Verified against the real 18-template M&S JSON dump set, including the 6
+  than reimplemented. Verified against the real 18-template customer JSON dump set, including the 6
   previously-corrupted `ActionsList` ids on "Yard 5S Site Standard"
-  (`6a4c4f12316577006e210b7a`..`..b7f`), which load and validate correctly.
+  (a contiguous run of `ActionsList` ids), which load and validate correctly.
 
 ### Changed
 
@@ -372,8 +394,7 @@ Major release: everything accumulated on `main` since `v1.3.14` — the 2026-07-
 schema syncs, command-bus completion (105/105 commands), native file upload, and a long run of
 correctness fixes. **Breaking, but narrowly:** every removed or reshaped surface either targeted
 a mutation the live schema never had (so it could never have worked) or was a dead accessor with
-no consumer — a 2026-07-30 sweep of `eco-helpers`, `integration-training`, `multi_org_api` and
-`multi-org-idle` found no consumer of any breaking surface (re-confirmed 2026-08-12). The major
+no consumer — a 2026-07-30 sweep of `eco-helpers` and three internal script repos found no consumer of any breaking surface (re-confirmed 2026-08-12). The major
 bump is deliberate: consumer repos declare `~> 1.3` (which allows 1.4.x), so a minor would have
 been adopted silently on the next `bundle update`; 2.0.0 makes adoption a per-repo decision.
 
@@ -387,7 +408,7 @@ Note: this release does not descend from `v1.3.15`, which shipped from the `rele
 branch forked at 1.3.14 — do not expect a linear tag history.
 
 ★ **The published gem is now `lib/` only.** `spec.files` excluded just `test|spec|features`, so
-every top-level directory added since shipped by default — 244 files of internal `.ai-assistance/`
+every top-level directory added since shipped by default — 244 files of internal AI-tooling
 notes, `docs/` (including the rolling worklog), and `.claude/`. `spec.files` is now an allowlist
 (`lib/`, `exe/`, README, LICENSE, CHANGELOG), which also drops the package from 959 KB to 195 KB.
 All 568 `lib/` files are unchanged; nothing outside `lib/` was ever loaded at runtime.
@@ -430,7 +451,7 @@ All 568 `lib/` files are unchanged; nothing outside `lib/` was ever loaded at ru
   but only one may be published (`active: true`) per organization at a time — publishing another
   with the same uid unpublishes the incumbent. Previously the value was fetchable from the API but
   unreachable through the gem (the embed was commented out and no fragment selected it).
-  Semantics documented in `.ai-assistance/code/ecoPortal_architecture/02_data_model.md`.
+  Semantics documented in the repo's internal docs.
 - **`editTemplateContainerUid` workflow command** — `Input::WorkflowCommand::EditTemplateContainerUid`,
   registered on the command bus. Unlike its `editTemplate*` siblings it raises on a nil value rather
   than emitting an empty command (the schema argument is `String!`) and validates the backend's
@@ -458,7 +479,7 @@ All 568 `lib/` files are unchanged; nothing outside `lib/` was ever loaded at ru
   diff (adds/removes/changes/reorders, bookkeeping noise hidden by default, nil≡empty-container
   lenience for document-age drift). Detects a foreign id-space and points at
   `Diff::CrossObjectDiff` instead of emitting a misleading add/remove-everything report.
-- Scoping project `.ai-assistance/projects/data-toolset/` — coordination of the data
+- Scoping project the repo's internal docs — coordination of the data
   import/extract/migration tool-set (legacy imports, template and register metadata table
   definitions, BI warehouse extracts, spreadsheet and back-end imports, register-to-register and
   org-to-org migrations, register-revamp mapping and readiness reporting). Capability map C1-C8,
@@ -525,7 +546,7 @@ The web "System Access Logs" page and page "history changelog" are driven by
 
 - `ecoportal-api` dependency floor raised to `0.10.17`: inherits the `WithRetry` fix that
   makes `HTTP::TimeoutError` (connect/read/write timeouts) retryable — previously a single
-  transient timeout killed whole batch loops (live-confirmed on Farmers, 2026-07-30).
+  transient timeout killed whole batch loops (live-confirmed on a customer org, 2026-07-30).
 - **`graphlient` dependency now points at the published `0.9.0` release** instead of the fork's
   frozen git branch (`rellampec/graphlient@pre-v0.0.9`). `0.9.0` ships the same DSL/directive
   work the gem already relied on (`#115` `to_query_string`/`spread`, `#116` directives DSL,
@@ -648,7 +669,7 @@ The web "System Access Logs" page and page "history changelog" are driven by
   `people{id}` nodes on both sides), not the raw `peopleIds` key — the backend can return
   `peopleIds: null` on reads while still populating `people`/`cachedPeople`, so restating an
   already-attached person id no longer registers as a change. Live-confirmed 2026-07-16
-  (act-gov TOOCS dry-run reported "Updated 6/6" for a no-op). Mirrors the `CrossReference`
+  (a customer dry-run reported "Updated 6/6" for a no-op). Mirrors the `CrossReference`
   fix for the identical disease; `as_input` now serialises the fallback-aware `people_ids`
   reader instead of the raw doc key.
 - `ContractorEntities` field: the reader read the staged write key (`contractors`), which read
@@ -720,7 +741,7 @@ The web "System Access Logs" page and page "history changelog" are driven by
   **Migrate to:** `editTemplateBasicSettings` (name/icon/settings/counter/tags/folders/creator
   perms), `editTemplateDescriptions` (`description`), `editTemplateCreatorPermissions` (creator
   perms). The old `editPage` `addOtherTags`/`removeOtherTags` keys have no `editTemplate*`
-  equivalent (dropped from schema). No downstream callers existed (eco-helpers / multi_org_api /
+  equivalent (dropped from schema). No downstream callers existed (eco-helpers / internal script repos /
   gem swept) so the removal is clean. See DECISIONS.md in the workflow-space project.
 - **`Mutation::SmartFill::Generate` / `Mutation::SmartFill::SubmitFeedback` and
   `Builder::Page#generate_smart_fill` / `#submit_smart_fill_feedback`** (breaking, but dead
@@ -742,13 +763,13 @@ The web "System Access Logs" page and page "history changelog" are driven by
   to measure coverage — only the QUESTION carries one; its satellites (comment, image, document,
   recommended action) do not and are not expected to. The denominator is workbook questions
   (`question_ref`), never the field count; measuring against all fields yields a meaningless ~16%.
-- `.ai-assistance/projects/mns-template-lifecycle/WORKBOOK-FIELD-MAPPING.md` — the authoritative
+- the repo's internal docs — the authoritative
   workbook-to-template contract recovered verbatim from the 2026-08-08 session transcript:
   `QuestionSetReference` → template_container_id (UI "UNIQUE IDENTIFIER"), `QuestionReference` →
   field `description` (CONFIRMED), `QuestionInformation` → field tooltip (strip HTML entities),
   scores ignored, section-vs-stage left ambiguous, plus the template-pairing procedure and the
   DEV-site targeting note.
-- `.ai-assistance/conventions/recovering-prior-context.md` — past sessions are greppable JSONL
+- the repo's internal docs — past sessions are greppable JSONL
   transcripts on disk (35 sessions, 85 MB); search them before asking the developer something he may
   already have answered.
 
@@ -876,7 +897,7 @@ signed-off future decision.)
     (`external_id`/`id`/`state`) — a spurious path produced term `membranes.external_id.external_id`
     → 0 results (silent miss → dup-on-upsert). Register FIELD keys still get the nested path.
   - Verified against the backend filter definitions; catalogued in
-    `.ai-assistance/code/filter_contract_matrix.md`.
+    the repo's internal docs.
 
 ### Added
 
@@ -948,7 +969,7 @@ shapes checked against the live schema dump); the live UAT→PROD round trip is
   longer exists (fragments are a registry now) → `uninitialized constant … Fragment::… (NameError)` at
   render time. Now `spread :Action` / `spread :ContractorEntity`, matching the already-migrated queries.
   (The sibling breakage in eco-helpers' location-command optimizations is fixed in eco-helpers 3.2.17;
-  it crashed the live act-gov locations sync.)
+  it crashed a customer's live locations sync.)
 - **Kickstand workflow mutations — bare `DateTime` selection.** `Kickstand::{Start,Stop,Fail}Workflow`
   selected `startedAt`/`stoppedAt`/`failedAt` bare → "Field must have selections". Now
   `{ dateTime timeZone }` (same class as the 1.3.10 LocationStructure fix).
@@ -976,7 +997,7 @@ shapes checked against the live schema dump); the live UAT→PROD round trip is
 
 ## [1.3.10] - 2026-07-03
 
-Hotfix (backwards-compatible). Resolves a live failure on the Turners & Growers users sync.
+Hotfix (backwards-compatible). Resolves a live failure on a customer's users sync.
 
 ### Fixed
 

data/lib/ecoportal/api/common/graphql/model/diffable/leaf_diff_service.rb

@@ -15,7 +15,7 @@ module Ecoportal::API::Common::GraphQL::Model::Diffable
   # `CollectionModel` — neither is a `GraphQL::Model`, so the re-add never happens and
   # the array change becomes **invisible to `as_update`** (scalar `passthrough` fields
   # are unaffected). This is the systemic "array/leaf fields don't diff" root cause
-  # (see `.ai-assistance/code/model_input_mapping/SYNTHESIS.md` §3.1).
+  # (see the repo's internal docs §3.1).
   #
   # This service fixes it for leaf models by:
   #   1. keeping cascaded keys in the flat classic diff (`doc_with_non_cascaded_attributes`

data/lib/ecoportal/api/graphql/base/page/data_field/collection.rb

@@ -31,7 +31,7 @@ module Ecoportal::API::GraphQL::Base::Page
 
       # Find first field matching label (case-insensitive). Optional type: restricts to
       # that field type first (v2 compat: components.get_by_name(name, type:) — used by
-      # the farmers cutover use case which calls it directly, not via OozeRedirect).
+      # a customer cutover use case which calls it directly, not via OozeRedirect).
       def get_by_name(label, type: nil)
         pool = type ? get_by_type(type) : @fields
         pool.find { |f| f.label.to_s.downcase == label.to_s.downcase }

data/lib/ecoportal/api/graphql/compat/filter_translator.rb

@@ -18,7 +18,7 @@ module Ecoportal
         #   tag_filter      passed through (same ES backend, same format)
         #   register_filter passed through
         #   and_filter / or_filter  passed through
-        # Operation/param shapes per .ai-assistance/code/search_filters.md.
+        # Operation/param shapes per the repo's internal docs.
         class FilterTranslator
           class << self
             def to_graphql(filter)

data/lib/ecoportal/api/graphql/fragment/pages/common_page_union.rb

@@ -99,7 +99,7 @@ module Ecoportal
               # `templateContainerUid` is the SERIES key: many versions may carry the same uid,
               # but only one may be published (`active: true`) per organization at a time —
               # publishing another with the same uid unpublishes the incumbent. See
-              # `.ai-assistance/code/ecoPortal_architecture/02_data_model.md`.
+              # the repo's internal docs.
               template @skip(if: $only_content) {
                 templateContainerUid
                 active
@@ -137,7 +137,7 @@ module Ecoportal
               # per-type members carry no description, so `updatePage` cannot set it.
               #
               # Integrations use it as a pseudo external-id on fields (we do so on templates;
-              # M&S do so on page instances — confirmed working on instances with a
+              # customers do so on page instances — confirmed working on instances with a
               # non-superuser service account, 2026-07-31). Fetched by default so those
               # integrations can read it back.
               description       @skip(if: $only_content)

data/lib/ecoportal/api/graphql/fragment/permissions.rb

@@ -58,13 +58,11 @@ module Ecoportal
             pageCanListDrafts { ...AuthorizationResult }
             pageCanRestore { ...AuthorizationResult }
             pageCanUseDrafts { ...AuthorizationResult }
-            pageSmartAssistantCanChat { ...AuthorizationResult }
             personSchemaCanAccessManager { ...AuthorizationResult }
             publicTemplatesCanCopyLink { ...AuthorizationResult }
             publicTemplatesCanIndex { ...AuthorizationResult }
             publicTemplatesCanListEntries { ...AuthorizationResult }
             publicTemplatesCanManage { ...AuthorizationResult }
-            registerAssistantCanChat { ...AuthorizationResult }
             registerCanAccessRegisterTools { ...AuthorizationResult }
             registerCanCreate { ...AuthorizationResult }
             registerCanLimitTemplates { ...AuthorizationResult }

data/lib/ecoportal/api/graphql/input/page/update.rb

@@ -70,8 +70,8 @@ module Ecoportal
               # Page tasks (and the people-field permissions scoped to them) apply to ONE
               # stage; without a stageId the server cannot route the submit to the stage the
               # work was done on. Fail loudly here rather than silently omit stageId (the
-              # nil-guard in build_input would otherwise drop it — the exact bug that let an
-              # act-gov TOOCS submit go out stage-less). A plain field update or publish
+              # nil-guard in build_input would otherwise drop it — the exact bug that let a
+              # customer submission go out stage-less). A plain field update or publish
               # needs no stage and is unaffected.
               def require_stage!(stage_id, submit, task)
                 return unless stage_id.nil?

data/lib/ecoportal/api/graphql/input/search_conf.rb

@@ -96,7 +96,7 @@ module Ecoportal
           # A register FIELD key carries a `<type>.<hash>` shape (e.g. 'date.zab1bddc3');
           # system/top-level keys (created_at, external_id, state) have no such prefix.
           # Field filters need the nested `membranes.<type>` path — see
-          # .ai-assistance/code/filter_contract_matrix.md.
+          # the repo's internal docs.
           # ---------------------------------------------------------------------------
           module MembranePath
             module_function

data/lib/ecoportal/api/graphql/input/workflow_command/edit_template_container_uid.rb

@@ -6,7 +6,7 @@ module Ecoportal
           # `WorkflowEditTemplateContainerUidInput { templateContainerUid: String! }`.
           #
           # Sets the template's CROSS-VERSION identity key. Semantics (verified against the
-          # backend on 2026-07-31 — see `.ai-assistance/code/ecoPortal_architecture/02_data_model.md`):
+          # backend on 2026-07-31 — see the repo's internal docs):
           #
           # - Format `/\A[a-zA-Z0-9\-_.]{3,20}\z/` — org-scoped, human-authored.
           # - Many versions of a template may share one uid, but only ONE may be published

data/lib/ecoportal/api/graphql/input/workflow_command/manage_copy_page_configuration.rb

@@ -17,7 +17,7 @@ module Ecoportal
           # included in a copy (`include`) and whether the choice is locked against per-copy
           # override (`enforce`). `enforce` is the least certain of these.
           # Confirm against platform behaviour before relying on any of it; see
-          # `.ai-assistance/code/ecoPortal_architecture/10_forces_workflow_builder.md`.
+          # the repo's internal docs.
           module ManageCopyPageConfiguration
             SCHEMA_VERSION = '20260819'.freeze
             VALID_KEYS = %i[overridePageCreatorPermissions autoIncludeNewContent inclusionSettingsChanges].freeze

data/lib/ecoportal/api/graphql/input/workflow_command/move_section_to_stage.rb

@@ -0,0 +1,33 @@
+module Ecoportal
+  module API
+    class GraphQL
+      module Input
+        class WorkflowCommand
+          # `WorkflowMoveSectionToStageInput` (20260929) -- moves an existing section from one
+          # stage to another, optionally placed relative to an anchor section. Unlike
+          # `reorderSection` (same stage), the source and target stages are both required.
+          module MoveSectionToStage
+            SCHEMA_VERSION = '20260929'.freeze
+            VALID_KEYS = %i[sourceStageId targetStageId sectionId anchorId anchorPosition].freeze
+            ANCHOR_POSITIONS = AddViewableField::ANCHOR_POSITIONS
+
+            def self.build(source_stage_id:, target_stage_id:, section_id:, **kwargs)
+              position = kwargs[:anchorPosition]
+              unless position.nil? || ANCHOR_POSITIONS.include?(position.to_s)
+                raise ArgumentError,
+                      "Invalid anchorPosition #{position.inspect}: " \
+                      "expected one of #{ANCHOR_POSITIONS.join(', ')}"
+              end
+
+              {
+                sourceStageId: source_stage_id,
+                targetStageId: target_stage_id,
+                sectionId:     section_id
+              }.merge(kwargs.slice(:anchorId, :anchorPosition).compact)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ecoportal/api/graphql/input/workflow_command.rb

@@ -43,6 +43,7 @@ module Ecoportal
             collapseSection:                   'Ecoportal::API::GraphQL::Input::WorkflowCommand::CollapseSection',
             expandSection:                     'Ecoportal::API::GraphQL::Input::WorkflowCommand::ExpandSection',
             reorderSection:                    'Ecoportal::API::GraphQL::Input::WorkflowCommand::ReorderSection',
+            moveSectionToStage:                'Ecoportal::API::GraphQL::Input::WorkflowCommand::MoveSectionToStage',
             # Task
             addTask:                           'Ecoportal::API::GraphQL::Input::WorkflowCommand::AddTask',
             removeTask:                        'Ecoportal::API::GraphQL::Input::WorkflowCommand::RemoveTask',
@@ -275,6 +276,7 @@ require_relative 'workflow_command/edit_linked_helper'
 require_relative 'workflow_command/remove_linked_helper'
 require_relative 'workflow_command/add_viewable_field'
 require_relative 'workflow_command/move_viewable_field'
+require_relative 'workflow_command/move_section_to_stage'
 require_relative 'workflow_command/remove_viewable_field'
 require_relative 'workflow_command/field_config/action_list'
 require_relative 'workflow_command/field_config/contractor_entities'

data/lib/ecoportal/api/graphql/logic/base_query.rb

@@ -155,7 +155,7 @@ module Ecoportal
           # location `graphql-client` deliberately sets via
           # `set_backtrace(["#{filename}:#{line}"])`. With that gone there was no other
           # way to see which query blew up. (Tracked upstream; see
-          # `.ai-assistance/code/refactoring/opportunities.md`.)
+          # the repo's internal docs.)
           #
           # But the location was never actually destroyed. Ruby populates `.cause`
           # automatically when you raise inside a rescue, so the original error — with the

data/lib/ecoportal/api/graphql/model/permissions.rb

@@ -108,6 +108,9 @@ module Ecoportal
                      klass: "Ecoportal::API::GraphQL::Model::AuthorizationResult", nullable: true
           embeds_one :pageCanUseDrafts,
                      klass: "Ecoportal::API::GraphQL::Model::AuthorizationResult", nullable: true
+          # DEPRECATED (20260929): removed from the live schema by the smart-assistant
+          # consolidation; no longer selected by Fragment::Permissions, so always nil. Kept so
+          # callers get nil instead of NoMethodError.
           embeds_one :pageSmartAssistantCanChat,
                      klass: "Ecoportal::API::GraphQL::Model::AuthorizationResult", nullable: true
           embeds_one :personSchemaCanAccessManager,
@@ -120,6 +123,9 @@ module Ecoportal
                      klass: "Ecoportal::API::GraphQL::Model::AuthorizationResult", nullable: true
           embeds_one :publicTemplatesCanManage,
                      klass: "Ecoportal::API::GraphQL::Model::AuthorizationResult", nullable: true
+          # DEPRECATED (20260929): removed from the live schema by the smart-assistant
+          # consolidation; no longer selected by Fragment::Permissions, so always nil. Kept so
+          # callers get nil instead of NoMethodError.
           embeds_one :registerAssistantCanChat,
                      klass: "Ecoportal::API::GraphQL::Model::AuthorizationResult", nullable: true
           embeds_one :registerCanAccessRegisterTools,

data/lib/ecoportal/api/graphql/query/pages.rb

@@ -4,7 +4,7 @@ module Ecoportal
       module Query
         # DB-backed full-data org search — returns PageUnion nodes with patchVer and field IDs.
         # Required pre-update fetch: always use this (not RegisterPreviewPages) before updatePage.
-        # See .ai-assistance/code/search_filters.md — "The Required Pattern: Find Before Mutate".
+        # See the repo's internal docs — "The Required Pattern: Find Before Mutate".
         class Pages < Logic::QueryConnection
           field_name :pages
           # Response nests under currentOrganization.pages; needed when instantiated

data/lib/ecoportal/api/graphql/query/permissions.rb

@@ -3,7 +3,7 @@ module Ecoportal
     class GraphQL
       module Query
         # Fetches the org-level permission set: currentOrganization.permissions.
-        # Returns a Model::Permissions whose ~83 canXXX fields are AuthorizationResult.
+        # Returns a Model::Permissions whose ~81 canXXX fields are AuthorizationResult.
         # Selects the :Permissions fragment (which spreads :AuthorizationResult per field).
         class Permissions < Logic::Query
           field_name :permissions

data/lib/ecoportal/api/graphql_version.rb

@@ -1,5 +1,5 @@
 module Ecoportal
   module API
-    GRAPQL_VERSION = '2.2.0'.freeze
+    GRAPQL_VERSION = '2.2.1'.freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ecoportal-api-graphql
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.2.1
 platform: ruby
 authors:
 - Oscar Segura
@@ -534,6 +534,7 @@ files:
 - lib/ecoportal/api/graphql/input/workflow_command/field_config/table.rb
 - lib/ecoportal/api/graphql/input/workflow_command/manage_copy_page_configuration.rb
 - lib/ecoportal/api/graphql/input/workflow_command/move_field.rb
+- lib/ecoportal/api/graphql/input/workflow_command/move_section_to_stage.rb
 - lib/ecoportal/api/graphql/input/workflow_command/move_stage.rb
 - lib/ecoportal/api/graphql/input/workflow_command/move_viewable_field.rb
 - lib/ecoportal/api/graphql/input/workflow_command/remove_action_tag.rb