@elytracms/studio 0.0.27 → 0.0.29

package/convex/assets.ts

@@ -1,7 +1,7 @@
 import { v } from 'convex/values'
 import type { GenericId } from 'convex/values'
 import { mutation, query } from './functions'
-import { requireRole, requireUserId } from './guard'
+import { requireCapability } from './guard'
 
 /**
  * Asset metadata persistence (EC-044) + byte storage (EC-151). Bytes live in
@@ -32,7 +32,7 @@ export const upsert = mutation({
     updatedAt: v.string(),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const existing = await ctx.db
       .query('assets')
       .withIndex('by_asset', (q) => q.eq('assetId', args.assetId))
@@ -49,7 +49,7 @@ export const upsert = mutation({
 export const get = query({
   args: { assetId: v.string() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     return ctx.db
       .query('assets')
       .withIndex('by_asset', (q) => q.eq('assetId', args.assetId))
@@ -60,7 +60,7 @@ export const get = query({
 export const list = query({
   args: {},
   handler: async (ctx) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     return ctx.db.query('assets').withIndex('by_asset').collect()
   },
 })
@@ -68,7 +68,7 @@ export const list = query({
 export const remove = mutation({
   args: { assetId: v.string() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const existing = await ctx.db
       .query('assets')
       .withIndex('by_asset', (q) => q.eq('assetId', args.assetId))
@@ -83,9 +83,11 @@ export const remove = mutation({
 export const generateUploadUrl = mutation({
   args: {},
   handler: async (ctx) => {
-    // EC-150: any authenticated user may mint an upload URL; the metadata write
-    // (`assets:upsert`) is what enforces the deployment role.
-    await requireUserId(ctx)
+    // EC-150 / EC-304: minting an upload URL lets the caller push bytes into
+    // deployment storage (orphaned blobs even without a metadata write), so gate
+    // it at the same `editor` role as `assets:upsert`/`remove`. `requireUserId`
+    // admits an authenticated NON-member (open Password sign-up) — not enough.
+    await requireCapability(ctx, 'content.write')
     return ctx.storage.generateUploadUrl()
   },
 })
@@ -94,7 +96,10 @@ export const generateUploadUrl = mutation({
 export const getServeUrl = query({
   args: { storageKey: v.string() },
   handler: async (ctx, { storageKey }) => {
-    await requireUserId(ctx) // EC-150: storage keys are unguessable; auth is the gate.
+    // EC-150 / EC-304: members only, matching the `assets:get`/`list` read gate.
+    // Storage keys are NOT unguessable — the public delivery snapshot ships them
+    // for every published asset — so authentication alone is not the gate.
+    await requireCapability(ctx, 'content.read')
     return ctx.storage.getUrl(asStorageId(storageKey))
   },
 })
@@ -103,7 +108,11 @@ export const getServeUrl = query({
 export const deleteBlob = mutation({
   args: { storageKey: v.string() },
   handler: async (ctx, { storageKey }) => {
-    await requireUserId(ctx) // EC-150
+    // EC-150 / EC-304: destructive — gate at `editor`, matching `assets:remove`.
+    // Under the old `requireUserId` an authenticated non-member could delete the
+    // bytes of any published asset (storageKeys are harvestable from the public
+    // `delivery:snapshot`), knocking every image off the live site.
+    await requireCapability(ctx, 'content.write')
     await ctx.storage.delete(asStorageId(storageKey))
   },
 })

package/convex/authority.ts

@@ -0,0 +1,60 @@
+import { checkAuthorityFloor } from '@elytracms/core/operations'
+import { defaultRolePolicy, roleGrantsCapability } from '@elytracms/core/persistence'
+import type { ProjectRole } from '@elytracms/core/persistence'
+import { memberRole, type GuardCtx } from './guard'
+
+/**
+ * The engine integrity FLOOR at the Convex trust boundary (EC-240 / AD-18 tenet
+ * 6). Member/role management is capability-gated by
+ * `requireCapability('project.administer')`, but that alone would still let an
+ * administrator lock the project out. This asserts the two non-overridable
+ * invariants on authority-mutating handlers (`members:set`, `members:remove` —
+ * and therefore `users.save`/`users.remove`, which delegate to them):
+ *
+ * - **(a) assign only roles you hold** — future-proofs the boundary for when
+ *   policy opens member-management to non-admins; today an administrator can
+ *   grant any role, so this never fires under the default policy.
+ * - **(b) the last admin can't be removed or demoted** — the hole this closes:
+ *   before EC-240 the handlers did a blind upsert/delete, so an admin could
+ *   remove the sole admin and lock everyone out (the empty-table bootstrap in
+ *   `auth.ts` only self-heals a FULLY empty members table).
+ *
+ * The decision logic is the ONE shared `checkAuthorityFloor` primitive that the
+ * engine resolver also calls — this file only supplies the primitives it reads
+ * from `ctx.db`, so client and server can never drift. Denials throw
+ * `unauthorized: …`, matching the guard convention.
+ */
+export async function assertAuthorityFloor(
+  ctx: GuardCtx,
+  params: {
+    /** The caller (already `requireCapability('project.administer')`-checked). */
+    readonly callerId: string
+    /** The member whose role/membership this op changes. */
+    readonly targetUserId: string
+    /** Roles this op grants the target (empty for a pure removal). */
+    readonly rolesGranted: readonly ProjectRole[]
+    /** True when the op removes the membership entirely. */
+    readonly removesMembership: boolean
+  },
+): Promise<void> {
+  const callerRole = await memberRole(ctx, params.callerId)
+  const targetRole = await memberRole(ctx, params.targetUserId)
+  const members = await ctx.db.query('members').collect()
+  // "admin" generalizes to "grants project.administer" (EC-240c) — the same
+  // policy the engine resolver uses, so client and server can never drift.
+  const isAdministrator = (role: string) =>
+    roleGrantsCapability(role, 'project.administer', defaultRolePolicy)
+  const adminCount = members.filter((m) => isAdministrator(m.role)).length
+
+  const decision = checkAuthorityFloor(
+    {
+      callerRoles: callerRole ? [callerRole] : [],
+      rolesGranted: params.rolesGranted,
+      targetIsAdmin: targetRole !== null && isAdministrator(targetRole),
+      removesMembership: params.removesMembership,
+      adminCount,
+    },
+    defaultRolePolicy,
+  )
+  if (!decision.allow) throw new Error(`unauthorized: ${decision.reason}`)
+}

package/convex/cliTokens.ts

@@ -1,6 +1,6 @@
 import { v } from 'convex/values'
 import { mutation, query } from './functions'
-import { requireRole } from './guard'
+import { requireCapability } from './guard'
 
 /**
  * CLI token persistence (EC-150). Only SHA-256 hashes are stored — hashing and
@@ -17,7 +17,7 @@ export const create = mutation({
     createdAt: v.string(),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'admin')
+    await requireCapability(ctx, 'project.administer')
     const id = await ctx.db.insert('cliTokens', args)
     return ctx.db.get(id)
   },
@@ -26,7 +26,7 @@ export const create = mutation({
 export const list = query({
   args: {},
   handler: async (ctx) => {
-    await requireRole(ctx, 'admin')
+    await requireCapability(ctx, 'project.administer')
     const rows = await ctx.db.query('cliTokens').collect()
     return rows.sort((a, b) => (a.tokenId < b.tokenId ? -1 : a.tokenId > b.tokenId ? 1 : 0))
   },
@@ -35,7 +35,7 @@ export const list = query({
 export const revoke = mutation({
   args: { tokenId: v.string(), revokedAt: v.string() },
   handler: async (ctx, { tokenId, revokedAt }) => {
-    await requireRole(ctx, 'admin')
+    await requireCapability(ctx, 'project.administer')
     const existing = await ctx.db
       .query('cliTokens')
       .withIndex('by_token', (q) => q.eq('tokenId', tokenId))

package/convex/cms.ts

@@ -1,6 +1,6 @@
 import { v } from 'convex/values'
 import { mutation, query } from './functions'
-import { requireRole } from './guard'
+import { requireCapability } from './guard'
 
 /**
  * CMS document persistence (EC-043). The backend stores **documents only**
@@ -20,7 +20,7 @@ export const upsertDocument = mutation({
     updatedAt: v.string(),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const existing = await ctx.db
       .query('cmsDocuments')
       .withIndex('by_doc', (q) => q.eq('collection', args.collection).eq('docId', args.docId))
@@ -39,7 +39,7 @@ export const upsertDocument = mutation({
 export const getDocument = query({
   args: { collection: v.string(), docId: v.string() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     return ctx.db
       .query('cmsDocuments')
       .withIndex('by_doc', (q) => q.eq('collection', args.collection).eq('docId', args.docId))
@@ -50,7 +50,7 @@ export const getDocument = query({
 export const listDocuments = query({
   args: { collection: v.optional(v.string()) },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     if (args.collection) {
       const collection = args.collection
       return ctx.db
@@ -65,7 +65,7 @@ export const listDocuments = query({
 export const deleteDocument = mutation({
   args: { collection: v.string(), docId: v.string() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const existing = await ctx.db
       .query('cmsDocuments')
       .withIndex('by_doc', (q) => q.eq('collection', args.collection).eq('docId', args.docId))
@@ -97,7 +97,7 @@ export const saveDocumentVersion = mutation({
     createdAt: v.string(),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     // EC-302: versions are appended monotonically, so the latest-created row holds
     // the highest version. Read just that one (index-ordered, newest first) instead
     // of collecting the whole — unbounded — history to compute `max+1`.
@@ -115,7 +115,7 @@ export const saveDocumentVersion = mutation({
 export const listDocumentVersions = query({
   args: { collection: v.string(), docId: v.string() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     const rows = await ctx.db
       .query('documentVersions')
       .withIndex('by_doc', (q) => q.eq('collection', args.collection).eq('docId', args.docId))
@@ -128,7 +128,7 @@ export const listDocumentVersions = query({
 export const getDocumentVersion = query({
   args: { collection: v.string(), docId: v.string(), version: v.number() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     // EC-307: address the row directly via `by_doc_version` instead of collecting
     // the whole — unbounded — per-document history and finding in JS. `version` is
     // unique per (collection, docId), so `.unique()` both fetches and asserts that.
@@ -151,7 +151,7 @@ export const getDocumentVersion = query({
 export const listPublishedDocuments = query({
   args: { collection: v.optional(v.string()) },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     const collection = args.collection
     const docs = collection
       ? await ctx.db
@@ -179,7 +179,7 @@ export const listPublishedDocuments = query({
 export const listAllDocumentVersions = query({
   args: {},
   handler: async (ctx) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     return ctx.db.query('documentVersions').collect()
   },
 })
@@ -192,7 +192,7 @@ export const publishDocumentVersion = mutation({
     updatedAt: v.string(),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const doc = await ctx.db
       .query('cmsDocuments')
       .withIndex('by_doc', (q) => q.eq('collection', args.collection).eq('docId', args.docId))
@@ -209,7 +209,7 @@ export const publishDocumentVersion = mutation({
 export const unpublishDocument = mutation({
   args: { collection: v.string(), docId: v.string(), updatedAt: v.string() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const doc = await ctx.db
       .query('cmsDocuments')
       .withIndex('by_doc', (q) => q.eq('collection', args.collection).eq('docId', args.docId))

package/convex/content.ts

@@ -90,8 +90,8 @@ export interface CreateContentOptions {
   collections?: readonly CollectionDef[]
   /** Route records served by `resolvePage` (EC-019). */
   routes?: readonly RouteRecord[]
-  /** Redirect records served by `resolvePage` (EC-019/020). */
-  redirects?: readonly RedirectRecord[]
+  // Redirects are no longer an option (EC-303): they are editorial DATA, read from
+  // the `redirects` table inside `createContent`, not passed by the caller.
 }
 
 export interface ContentKit {
@@ -130,9 +130,16 @@ export async function createContent(
 ): Promise<ContentKit> {
   const { projectId, perspective } = options
   const routes = options.routes ?? []
-  const redirects = options.redirects ?? []
   const loadIssues: ContentKitIssue[] = []
 
+  // Redirects are editorial DATA now (EC-303), read from the `redirects` table —
+  // only ENABLED entries resolve. (Config redirects are retired; static infra
+  // redirects stay native.) Projected to the routing `RedirectRecord` shape.
+  const redirectRows = await ctx.db.query('redirects').withIndex('by_redirect').collect()
+  const redirects: RedirectRecord[] = redirectRows
+    .filter((row) => row.enabled)
+    .map((row) => ({ id: row.redirectId, from: row.from, to: row.to, permanent: row.permanent }))
+
   // --- Prefetch (the only async part; everything below is synchronous) -----
 
   // Config-first identity (EC-182/EC-183, AD-11): locales AND collections are

package/convex/delivery.ts

@@ -2,7 +2,7 @@ import { v } from 'convex/values'
 import { dataSourceSchema } from '@elytracms/core/data-binding'
 import { query } from './functions'
 import type { QueryCtx } from './functions'
-import { requireUserId } from './guard'
+import { requireCapability } from './guard'
 
 // EC-207: routes/redirects are config-sourced (authored in elytra.config.ts and
 // resolved by studio-core), NOT backend data. The delivery snapshot no longer
@@ -20,7 +20,7 @@ import { requireUserId } from './guard'
  * ## Why `snapshot` is PUBLIC (deliberate, EC-150 exception)
  *
  * Every other project-scoped function in this deployment is guarded by
- * `requireRole`. This one is not, on purpose: it serves **published content
+ * `requireCapability`. This one is not, on purpose: it serves **published content
  * only** — the exact data the production website renders to every anonymous
  * visitor. Publishing IS the act of making it public. The invariants that
  * keep this safe are enforced server-side in this module:
@@ -62,6 +62,14 @@ interface DeliverySnapshot {
   documents: unknown[]
   /** Asset metadata in the delivery `AssetRecord` shape (with serve URLs). */
   assets: unknown[]
+  /**
+   * Enabled editorial redirects (EC-303) in the routing `RedirectRecord` shape,
+   * served by `resolvePage`. Redirects are DATA now (not config), so they ship in
+   * the snapshot and change DYNAMICALLY (no redeploy) — the host fetches the
+   * snapshot per request. Disabled redirects never leave the deployment. Static
+   * infra redirects stay native (`next.config`/`vercel`), evaluated before these.
+   */
+  redirects: unknown[]
 }
 
 /** One document per persisted source — must match the studio's sources-store. */
@@ -198,12 +206,21 @@ export async function loadSnapshot(
     documentRows.map((row) => row.document as unknown),
   )
 
+  // Editorial redirects (EC-303): only ENABLED entries serve — a disabled redirect
+  // is stored but never live, in either perspective. Projected to the routing
+  // `RedirectRecord` shape the router/`resolvePage` consume.
+  const redirectRows = await ctx.db.query('redirects').withIndex('by_redirect').collect()
+  const redirects = redirectRows
+    .filter((row) => row.enabled)
+    .map((row) => ({ id: row.redirectId, from: row.from, to: row.to, permanent: row.permanent }))
+
   return {
     projectId,
     perspective,
     sources,
     documents,
     assets,
+    redirects,
   }
 }
 
@@ -243,14 +260,15 @@ export const draftSnapshot = query({
  * trigger's `scheduleRevalidate`, `triggers.ts`), and the webhook only fires when
  * `CANVAS_REVALIDATE_ENDPOINT` + `CANVAS_REVALIDATE_SECRET` are set
  * (`webhooks.ts` `deliver`). A future `elytra doctor` (EC-259) can read the same
- * query. Gated to authenticated users — config state is not public.
+ * query. Gated to deployment members (EC-304) — config state is not public, and
+ * an authenticated non-member (open Password sign-up) is not a member.
  */
 export const deliveryConfig = query({
   args: {},
   handler: async (
     ctx,
   ): Promise<{ projectScope: boolean; revalidateEndpoint: boolean; revalidateSecret: boolean }> => {
-    await requireUserId(ctx)
+    await requireCapability(ctx, 'content.read')
     const env = process.env as Record<string, string | undefined>
     const isSet = (key: string): boolean => {
       const value = env[key]

package/convex/guard.ts

@@ -1,4 +1,6 @@
 import { getAuthUserId } from '@convex-dev/auth/server'
+import { defaultRolePolicy, roleGrantsCapability } from '@elytracms/core/persistence'
+import type { OperationCapabilityId, ProjectRole, RolePolicy } from '@elytracms/core/persistence'
 import type { QueryCtx } from './functions'
 
 /**
@@ -11,8 +13,14 @@ import type { QueryCtx } from './functions'
  * deployment-scoped — a `members` row grants a user a role on this deployment.
  * No `projectId` is threaded.
  *
- * Role ranks mirror `@elytracms/core/persistence`'s `roleAtLeast`:
- * viewer (0) < editor (1) < admin (2).
+ * The role model + permission policy are the ONE canonical source
+ * (`@elytracms/core/persistence` — the `RolePolicy` + `roleGrantsCapability`),
+ * imported here rather than re-declared. Handlers gate on CAPABILITIES
+ * (`content.read` / `content.write` / `project.administer`), not literal roles
+ * (EC-240c), so a project's custom role set enforces server-side by the same
+ * policy the operations layer uses. The Convex trust boundary reads the shipped
+ * {@link defaultRolePolicy}; a project overriding roles injects its policy (the
+ * documented follow-up seam).
  *
  * Failures throw plain `Error('unauthorized: …')` — Convex transports the
  * message; the app's adapters normalize thrown backend errors onto the
@@ -20,9 +28,8 @@ import type { QueryCtx } from './functions'
  * structured `OperationError`s (never crashes).
  */
 
-export type ProjectRole = 'admin' | 'editor' | 'viewer'
-
-const ROLE_RANK: Record<ProjectRole, number> = { viewer: 0, editor: 1, admin: 2 }
+// Re-exported so peer Convex modules (e.g. `sync.ts`) keep one import site.
+export type { ProjectRole }
 
 /**
  * The ctx slice the guards need: identity + a readable `members` table.
@@ -48,7 +55,7 @@ export async function requireUserId(ctx: GuardCtx): Promise<string> {
  * instead of throwing. A thrown handler is logged by Convex as an
  * `Uncaught Error` even though the client catches it — noise that an autonomous
  * agent (Milestone J) reads as a real failure. Writes and protected reads keep
- * using {@link requireUserId} / {@link requireRole} so genuine unauthorized
+ * using {@link requireUserId} / {@link requireCapability} so genuine unauthorized
  * access stays loud.
  */
 export async function getOptionalUserId(ctx: GuardCtx): Promise<string | null> {
@@ -65,18 +72,28 @@ export async function memberRole(ctx: GuardCtx, userId: string): Promise<Project
 }
 
 /**
- * Require an authenticated caller with at least `role` on this deployment.
- * Returns the user id so handlers can attribute writes.
+ * Require an authenticated member whose role grants `capability` on this
+ * deployment (EC-240c). Returns the user id so handlers can attribute writes.
+ *
+ * This is the ONE role-enforcement primitive at the trust boundary — every
+ * handler gates on a capability rather than a literal role, so a project's
+ * custom role set is honoured by the shared policy. `policy` defaults to the
+ * shipped {@link defaultRolePolicy}; the override seam (a project injecting its
+ * own policy) is the documented follow-up.
  */
-export async function requireRole(ctx: GuardCtx, role: ProjectRole): Promise<string> {
+export async function requireCapability(
+  ctx: GuardCtx,
+  capability: OperationCapabilityId,
+  policy: RolePolicy = defaultRolePolicy,
+): Promise<string> {
   const userId = await requireUserId(ctx)
   const actual = await memberRole(ctx, userId)
   if (actual === null) {
     throw new Error('unauthorized: not a member of this deployment')
   }
-  if (ROLE_RANK[actual] < ROLE_RANK[role]) {
+  if (!roleGrantsCapability(actual, capability, policy)) {
     throw new Error(
-      `unauthorized: this deployment requires the "${role}" role (caller is "${actual}")`,
+      `unauthorized: this operation requires the "${capability}" capability (caller role "${actual}" does not grant it)`,
     )
   }
   return userId

package/convex/members.ts

@@ -1,6 +1,7 @@
 import { v } from 'convex/values'
 import { mutation, query } from './functions'
-import { getOptionalUserId, requireRole, requireUserId } from './guard'
+import { getOptionalUserId, requireCapability, requireUserId } from './guard'
+import { assertAuthorityFloor } from './authority'
 
 /**
  * Deployment membership persistence (EC-150, single-tenant per EC-179). The
@@ -15,7 +16,7 @@ const roleValidator = v.union(v.literal('admin'), v.literal('editor'), v.literal
 export const list = query({
   args: {},
   handler: async (ctx) => {
-    await requireRole(ctx, 'viewer')
+    await requireCapability(ctx, 'content.read')
     const rows = await ctx.db.query('members').collect()
     return rows.sort((a, b) => (a.userId < b.userId ? -1 : a.userId > b.userId ? 1 : 0))
   },
@@ -27,7 +28,7 @@ export const get = query({
     // Members may look up memberships of this deployment; everyone may look up
     // their *own* membership (the studio needs it to render the role badge).
     const caller = await requireUserId(ctx)
-    if (caller !== userId) await requireRole(ctx, 'viewer')
+    if (caller !== userId) await requireCapability(ctx, 'content.read')
     return ctx.db
       .query('members')
       .withIndex('by_user', (q) => q.eq('userId', userId))
@@ -62,20 +63,45 @@ export const set = mutation({
   args: {
     userId: v.string(),
     role: roleValidator,
+    /**
+     * Studio-user custom fields (EC-240, 240a). Optional so the member-management
+     * path (`ConvexMembersRepository.setMember`) omits it; the users rail
+     * (`ConvexUserRepository.saveUser`) supplies it. When omitted on an update,
+     * the existing bag is preserved (a role change must not wipe custom fields).
+     */
+    meta: v.optional(v.any()),
     createdAt: v.string(),
     updatedAt: v.string(),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'admin')
+    const callerId = await requireCapability(ctx, 'project.administer')
+    // Integrity floor (EC-240): can't demote the last admin / assign above self.
+    await assertAuthorityFloor(ctx, {
+      callerId,
+      targetUserId: args.userId,
+      rolesGranted: [args.role],
+      removesMembership: false,
+    })
     const existing = await ctx.db
       .query('members')
       .withIndex('by_user', (q) => q.eq('userId', args.userId))
       .first()
     if (existing) {
-      await ctx.db.patch(existing._id, { role: args.role, updatedAt: args.updatedAt })
+      await ctx.db.patch(existing._id, {
+        role: args.role,
+        updatedAt: args.updatedAt,
+        // Only touch `meta` when supplied — a bare role change preserves it.
+        ...(args.meta !== undefined ? { meta: args.meta } : {}),
+      })
       return ctx.db.get(existing._id)
     }
-    const id = await ctx.db.insert('members', args)
+    const id = await ctx.db.insert('members', {
+      userId: args.userId,
+      role: args.role,
+      ...(args.meta !== undefined ? { meta: args.meta } : {}),
+      createdAt: args.createdAt,
+      updatedAt: args.updatedAt,
+    })
     return ctx.db.get(id)
   },
 })
@@ -83,7 +109,14 @@ export const set = mutation({
 export const remove = mutation({
   args: { userId: v.string() },
   handler: async (ctx, { userId }) => {
-    await requireRole(ctx, 'admin')
+    const callerId = await requireCapability(ctx, 'project.administer')
+    // Integrity floor (EC-240): the last admin cannot be removed.
+    await assertAuthorityFloor(ctx, {
+      callerId,
+      targetUserId: userId,
+      rolesGranted: [],
+      removesMembership: true,
+    })
     const existing = await ctx.db
       .query('members')
       .withIndex('by_user', (q) => q.eq('userId', userId))

package/convex/redirects.ts

@@ -0,0 +1,67 @@
+import { v } from 'convex/values'
+import { mutation, query } from './functions'
+import { requireCapability } from './guard'
+
+/**
+ * Editorial redirects persistence (EC-303). Redirects are data an editor owns —
+ * saved+enabled entries go live dynamically (no deploy) via the delivery
+ * snapshot. Reachable only through the app's `ConvexRedirectRepository` adapter.
+ * Content-gated (a viewer reads, an editor writes), NOT admin-only — redirects
+ * are content, not administration.
+ */
+
+export const save = mutation({
+  args: {
+    redirectId: v.string(),
+    from: v.string(),
+    to: v.string(),
+    permanent: v.boolean(),
+    enabled: v.boolean(),
+    createdAt: v.string(),
+    updatedAt: v.string(),
+  },
+  handler: async (ctx, args) => {
+    await requireCapability(ctx, 'content.write')
+    const existing = await ctx.db
+      .query('redirects')
+      .withIndex('by_redirect', (q) => q.eq('redirectId', args.redirectId))
+      .first()
+    if (existing) {
+      await ctx.db.patch(existing._id, { ...args, createdAt: existing.createdAt })
+      return ctx.db.get(existing._id)
+    }
+    const id = await ctx.db.insert('redirects', args)
+    return ctx.db.get(id)
+  },
+})
+
+export const get = query({
+  args: { redirectId: v.string() },
+  handler: async (ctx, args) => {
+    await requireCapability(ctx, 'content.read')
+    return ctx.db
+      .query('redirects')
+      .withIndex('by_redirect', (q) => q.eq('redirectId', args.redirectId))
+      .first()
+  },
+})
+
+export const list = query({
+  args: {},
+  handler: async (ctx) => {
+    await requireCapability(ctx, 'content.read')
+    return ctx.db.query('redirects').withIndex('by_redirect').collect()
+  },
+})
+
+export const remove = mutation({
+  args: { redirectId: v.string() },
+  handler: async (ctx, args) => {
+    await requireCapability(ctx, 'content.write')
+    const existing = await ctx.db
+      .query('redirects')
+      .withIndex('by_redirect', (q) => q.eq('redirectId', args.redirectId))
+      .first()
+    if (existing) await ctx.db.delete(existing._id)
+  },
+})