@elytracms/studio 0.0.27 → 0.0.29

package/convex/references.ts

@@ -1,6 +1,6 @@
 import { v } from 'convex/values'
 import { mutation, query } from './functions'
-import { requireRole } from './guard'
+import { requireCapability } from './guard'
 import type { MutationCtx } from './functions'
 
 /**
@@ -61,7 +61,7 @@ export const replaceForSource = mutation({
     references: v.array(outboundReferenceValidator),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     await deleteForSource(ctx, args.variant, args.sourceType, args.sourceId)
     for (const reference of args.references) {
       await ctx.db.insert('referenceEntries', {
@@ -81,7 +81,7 @@ export const replaceForSourceTypes = mutation({
     entries: v.array(entryValidator),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     for (const sourceType of args.sourceTypes) {
       await deleteForSource(ctx, args.variant, sourceType)
     }
@@ -101,7 +101,7 @@ export const removeForSource = mutation({
     variant: v.optional(variantValidator),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const variants = args.variant ? [args.variant] : (['draft', 'published'] as const)
     for (const variant of variants) {
       await deleteForSource(ctx, variant, args.sourceType, args.sourceId)
@@ -112,7 +112,7 @@ export const removeForSource = mutation({
 export const clearProject = mutation({
   args: {},
   handler: async (ctx) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const existing = await ctx.db.query('referenceEntries').collect()
     for (const doc of existing) await ctx.db.delete(doc._id)
     // EC-269: a cleared index is no longer "built" — drop the marker so the next
@@ -126,7 +126,7 @@ export const clearProject = mutation({
 export const buildMarker = query({
   args: {},
   handler: async (ctx) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     const marker = await ctx.db.query('referenceIndexMarker').first()
     return marker ? { entryCount: marker.entryCount } : null
   },
@@ -135,7 +135,7 @@ export const buildMarker = query({
 export const setBuildMarker = mutation({
   args: { entryCount: v.number() },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'editor') // EC-150
+    await requireCapability(ctx, 'content.write') // EC-150
     const existing = await ctx.db.query('referenceIndexMarker').first()
     if (existing) {
       await ctx.db.patch(existing._id, { entryCount: args.entryCount })
@@ -152,7 +152,7 @@ export const outbound = query({
     variant: v.optional(variantValidator),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     const variants = args.variant ? [args.variant] : (['draft', 'published'] as const)
     const out = []
     for (const variant of variants) {
@@ -176,7 +176,7 @@ export const inbound = query({
     variant: v.optional(variantValidator),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     return ctx.db
       .query('referenceEntries')
       .withIndex('by_target', (q) => {
@@ -193,7 +193,7 @@ export const inboundMany = query({
     variant: v.optional(variantValidator),
   },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     // EC-308: inbound entries for many targets in ONE round-trip — loop the
     // `by_target` index server-side instead of the client issuing one `inbound`
     // query per target (the bulk delete/unpublish pre-flight fan-out). One result
@@ -216,7 +216,7 @@ export const inboundMany = query({
 export const list = query({
   args: { variant: v.optional(variantValidator) },
   handler: async (ctx, args) => {
-    await requireRole(ctx, 'viewer') // EC-150
+    await requireCapability(ctx, 'content.read') // EC-150
     // EC-302: `by_source` leads with `variant`, so a variant filter is an index
     // prefix — push it into the query instead of collecting the whole table and
     // filtering in JS. Callers treat the result as an unordered set, so the shift

package/convex/schema.ts

@@ -54,7 +54,20 @@ export default defineSchema({
    */
   members: defineTable({
     userId: v.string(),
-    role: v.union(v.literal('admin'), v.literal('editor'), v.literal('viewer')),
+    // A config-driven role string (EC-240c, schema-as-lens): the store is agnostic
+    // about WHICH roles exist so a project's custom role set round-trips. Validity
+    // against the active policy is enforced on write (operations + guard.ts), not
+    // by this column — the same "DB is data, structure is code" split as documents.
+    role: v.string(),
+    /**
+     * Studio-user custom fields (EC-240, 240a): an open bag whose lens is the
+     * project-declared `kind:'user'` field set. Single-tenant means a `members`
+     * row is 1:1 with a studio user, so this is the natural home for their custom
+     * data — the row WE own, alongside the auth-owned `users` identity. Mirrors
+     * the asset `meta` bag; the users rail joins it to identity for the Users
+     * module. Optional (absent for members created before EC-240).
+     */
+    meta: v.optional(v.any()),
     createdAt: v.string(),
     updatedAt: v.string(),
   }).index('by_user', ['userId']),
@@ -137,6 +150,22 @@ export default defineSchema({
     updatedAt: v.string(),
   }).index('by_asset', ['assetId']),
 
+  /**
+   * Editorial redirects (EC-303) — 301/302 forwards an editor owns, stored as
+   * DATA (not config) so they change dynamically without a deploy. The delivery
+   * snapshot projects enabled entries onto the routing `RedirectRecord` the
+   * catch-all resolves; static/infra redirects stay native (next.config/vercel).
+   */
+  redirects: defineTable({
+    redirectId: v.string(),
+    from: v.string(),
+    to: v.string(),
+    permanent: v.boolean(),
+    enabled: v.boolean(),
+    createdAt: v.string(),
+    updatedAt: v.string(),
+  }).index('by_redirect', ['redirectId']),
+
   /**
    * Reference index entries (EC-155, vision AD-6) — derived data, recomputed
    * replace-all-for-source on every write. Indexed for efficient lookup in both

package/convex/sync.ts

@@ -3,9 +3,13 @@ import type { GenericActionCtx, GenericDataModel } from 'convex/server'
 import { v } from 'convex/values'
 import { verifyCliToken } from '@elytracms/core/operations'
 import type { VerifiedCliToken } from '@elytracms/core/operations'
-import type { CliTokenRepository, PersistenceAdapter } from '@elytracms/core/persistence'
+import { roleGrantsCapability } from '@elytracms/core/persistence'
+import type {
+  CliTokenRepository,
+  OperationCapabilityId,
+  PersistenceAdapter,
+} from '@elytracms/core/persistence'
 import { httpAction, internalQuery } from './functions'
-import type { ProjectRole } from './guard'
 
 /**
  * EC-157 — the builder-sync HTTP endpoint. Serves the contract fixed in
@@ -123,11 +127,14 @@ function parseSyncRoute(method: string, pathname: string): SyncRoute | undefined
 
 // --- Token auth (EC-150) -------------------------------------------------------
 
-const ROLE_RANK: Record<ProjectRole, number> = { viewer: 0, editor: 1, admin: 2 }
-
-/** What each endpoint requires; the snapshot read is `viewer`-level (EC-150). */
-const REQUIRED_ROLE: Record<SyncEndpoint, ProjectRole> = {
-  snapshot: 'viewer',
+/**
+ * The capability each endpoint requires; the snapshot read needs `content.read`
+ * (EC-240c). Capability grants come from the ONE canonical role policy
+ * (`roleGrantsCapability`), so a token's role is checked the same way handlers
+ * check members — no role literal at the boundary.
+ */
+const REQUIRED_CAPABILITY: Record<SyncEndpoint, OperationCapabilityId> = {
+  snapshot: 'content.read',
 }
 
 /**
@@ -158,7 +165,7 @@ function cliTokenRepository(ctx: ActionCtx): CliTokenRepository {
 
 type AuthResult = { ok: true; verified: VerifiedCliToken } | { ok: false; response: Response }
 
-/** Resolve and verify the Bearer CLI token, then check it grants the required role. */
+/** Resolve and verify the Bearer CLI token, then check it grants the required capability. */
 async function authorize(
   ctx: ActionCtx,
   request: Request,
@@ -186,13 +193,13 @@ async function authorize(
       response: errorResponse(401, 'unauthorized', 'Unknown, malformed, or revoked CLI token.'),
     }
   }
-  if (ROLE_RANK[verified.role] < ROLE_RANK[REQUIRED_ROLE[route.endpoint]]) {
+  if (!roleGrantsCapability(verified.role, REQUIRED_CAPABILITY[route.endpoint])) {
     return {
       ok: false,
       response: errorResponse(
         403,
         'forbidden',
-        `This endpoint requires the "${REQUIRED_ROLE[route.endpoint]}" role (token grants "${verified.role}").`,
+        `This endpoint requires the "${REQUIRED_CAPABILITY[route.endpoint]}" capability (token role "${verified.role}" does not grant it).`,
       ),
     }
   }

package/convex/users.ts

@@ -1,5 +1,8 @@
 import { getAuthUserId } from '@convex-dev/auth/server'
+import { v } from 'convex/values'
 import { query } from './functions'
+import type { QueryCtx } from './functions'
+import { requireCapability } from './guard'
 
 /**
  * Current-user lookup (EC-150). The Convex `AuthAdapter` implementation calls
@@ -21,3 +24,63 @@ export const me = query({
     }
   },
 })
+
+/**
+ * The studio users rail (EC-240, 240a). A user is a **projection** joining a
+ * `members` row (role + the custom-field `meta` bag WE own) to the auth-owned
+ * `users` identity (email / name / image). The `ConvexUserRepository` maps these
+ * onto `@elytracms/core/persistence` `UserRecord`s.
+ *
+ * Admin-only, server-side: the list exposes every member's email + role — an
+ * administration concern (like `cliTokens:list`), not a content read. UI gating
+ * alone is never trusted.
+ */
+
+type MemberDoc = {
+  userId: string
+  // A config-driven role string (EC-240c) — the store is policy-agnostic; validity
+  // is enforced on write, not by this shape.
+  role: string
+  meta?: unknown
+  createdAt: string
+  updatedAt: string
+}
+
+/** Join one member row to its auth identity, producing the rail's wire shape. */
+async function joinUser(ctx: QueryCtx, member: MemberDoc) {
+  const authId = ctx.db.normalizeId('users', member.userId)
+  const user = authId ? await ctx.db.get(authId) : null
+  return {
+    id: member.userId,
+    email: user?.email ?? '',
+    ...(user?.name ? { name: user.name } : {}),
+    ...(user?.image ? { avatar: user.image } : {}),
+    role: member.role,
+    ...(member.meta !== undefined ? { meta: member.meta } : {}),
+    createdAt: member.createdAt,
+    updatedAt: member.updatedAt,
+  }
+}
+
+export const list = query({
+  args: {},
+  handler: async (ctx) => {
+    await requireCapability(ctx, 'project.administer')
+    const members = await ctx.db.query('members').collect()
+    const rows = await Promise.all(members.map((m) => joinUser(ctx, m)))
+    return rows.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
+  },
+})
+
+export const get = query({
+  args: { userId: v.string() },
+  handler: async (ctx, { userId }) => {
+    await requireCapability(ctx, 'project.administer')
+    const member = await ctx.db
+      .query('members')
+      .withIndex('by_user', (q) => q.eq('userId', userId))
+      .first()
+    if (!member) return null
+    return joinUser(ctx, member)
+  },
+})

package/dist/components/app-views/default-modules.d.ts

@@ -1,7 +1,8 @@
 import type { ReactNode } from 'react';
 import type { LucideIcon } from 'lucide-react';
+import type { CollectionFieldOverride, CollectionFormMeta } from '@elytracms/core/cms-core';
 import type { SectionId } from '@elytracms/core/studio-core';
-import { type AppViewContext, type AppViewDeepLink, type AppViewModule, type SidebarViewNode } from './module';
+import { type AppViewContext, type AppViewDeepLink, type AppViewModule, type NavPermission, type SidebarViewNode } from './module';
 /**
  * EC-237/239 — the studio's BUILT-IN views + the consumer-facing `nav` namespace,
  * an instance of the EC-236 customization seam.
@@ -36,11 +37,34 @@ export interface CmsViewConfig {
     children?: SidebarViewNode[];
     /** The availability section this view rides on (EC-221); defaults to `cms`. */
     availabilitySection?: SectionId;
+    /** OPTIONAL, default-open nav-permission predicate (EC-240 / AD-18). See {@link BuiltinViewConfig.visible}. */
+    visible?: NavPermission;
 }
-/** Common label/icon overrides for a built-in view (`nav.routes({ label: 'URLs' })`). */
+/** Common label/icon overrides for a built-in view (`nav.redirects({ label: 'URLs' })`). */
 export interface BuiltinViewConfig {
     label?: string;
     icon?: LucideIcon;
+    /**
+     * OPTIONAL, default-open nav-permission predicate (EC-240 / AD-18): hide this
+     * rail item for principals it returns `false` for; absent → always visible. The
+     * policy (which roles) lives in the consuming project, never the engine. E.g.
+     * `nav.users({ visible: ({ role }) => role === 'admin' })`.
+     */
+    visible?: NavPermission;
+}
+/**
+ * Config for the **redirects** rail (EC-311) — a built-in view whose engine-owned
+ * schema is customizable. Beyond the shared label/icon/visible, a mount may rename
+ * the rail (`form`) and **override built-in fields by equal name** (`fields`):
+ * naming, permissions (`form.readOnly`), rendering (`form.control` → `fieldRenderers`)
+ * and validation. The canonical `from`/`to`/`permanent`/`enabled` names+types are
+ * contract-locked; a type change or a net-new field is a loud config error.
+ */
+export interface RedirectsViewConfig extends BuiltinViewConfig {
+    /** Rename the rail (e.g. `{ label: 'URLs' }`). */
+    form?: Partial<CollectionFormMeta>;
+    /** Override built-in redirect fields, matched by `name`. */
+    fields?: readonly CollectionFieldOverride[];
 }
 /** Config for a fully custom view (`nav.view({...})`) — the net-new surface escape hatch. */
 export interface CustomViewConfig {
@@ -52,6 +76,8 @@ export interface CustomViewConfig {
     render: (ctx: AppViewContext) => ReactNode;
     parsePath?: (segments: string[]) => AppViewDeepLink | null;
     availabilitySection?: SectionId;
+    /** OPTIONAL, default-open nav-permission predicate (EC-240 / AD-18). See {@link BuiltinViewConfig.visible}. */
+    visible?: NavPermission;
 }
 /**
  * Build a CMS view — the default `cms` view, or a focused instance. Every instance
@@ -63,10 +89,24 @@ export interface CustomViewConfig {
 export declare function cmsView(config?: CmsViewConfig): AppViewModule;
 /** The components registry browser view. */
 export declare function componentsView(config?: BuiltinViewConfig): AppViewModule;
-/** The resolved routes & redirects view (read-only; routing is config-as-code). */
-export declare function routesView(config?: BuiltinViewConfig): AppViewModule;
+/**
+ * The Redirects view (EC-303) — editorial redirects as DATA, an editor-owned CRUD
+ * surface (create/edit/delete) over the portable list/edit surfaces. Routes are no
+ * longer shown in the admin (they're code; native `next.config`/`vercel` own static
+ * forwards, evaluated before these). Rides on the CMS availability (a content/
+ * routing concern). `[]` is the list; `[redirectId]` opens that redirect's detail.
+ */
+export declare function redirectsView(config?: RedirectsViewConfig): AppViewModule;
 /** The asset library view. */
 export declare function assetsView(config?: BuiltinViewConfig): AppViewModule;
+/**
+ * The studio Users view (EC-240) — an admin-only roster of who has access to this
+ * deployment and their role. A first-class section (its own rail entry), modeled
+ * like the Assets library; the surface itself gates to admins and renders a
+ * "restricted" state otherwise. Rides on the `settings` availability (an
+ * admin/config concern, so it appears/hides with a project's settings surface).
+ */
+export declare function usersView(config?: BuiltinViewConfig): AppViewModule;
 /** The extensions marketplace view. */
 export declare function extensionsView(config?: BuiltinViewConfig): AppViewModule;
 /** The project settings view. */
@@ -83,14 +123,6 @@ export declare function customView(config: CustomViewConfig): AppViewModule;
  * when a consumer's rail omits one.
  */
 export declare const DEFAULT_VIEWS: readonly AppViewModule[];
-/**
- * The `nav` namespace — the single typed builder for `studio.config.tsx`'s section
- * rail. Each call returns a {@link SidebarViewNode} (or a group / separator) that
- * carries its view DIRECTLY: `nav.cms({ collection })` is a focused CMS view,
- * `nav.view({ render })` a net-new surface, `nav.group(label, [...])` a header with
- * sub-views, `nav.separator()` a divider. No string ids, no `moduleId` — the rail
- * is the views.
- */
 export declare const nav: {
     /**
      * The CMS view. `nav.cms()` / `nav.cms({ collections })` is a PARENT that nests its
@@ -102,12 +134,14 @@ export declare const nav: {
     readonly components: (config?: BuiltinViewConfig) => SidebarViewNode;
     /** The asset library. */
     readonly assets: (config?: BuiltinViewConfig) => SidebarViewNode;
-    /** The resolved routes & redirects. */
-    readonly routes: (config?: BuiltinViewConfig) => SidebarViewNode;
+    /** Editorial redirects (EC-303); built-in fields customizable by name (EC-311). */
+    readonly redirects: (config?: RedirectsViewConfig) => SidebarViewNode;
     /** Project settings. */
     readonly settings: (config?: BuiltinViewConfig) => SidebarViewNode;
     /** The extensions marketplace. */
     readonly extensions: (config?: BuiltinViewConfig) => SidebarViewNode;
+    /** The admin users roster (EC-240). */
+    readonly users: (config?: BuiltinViewConfig) => SidebarViewNode;
     /** A fully custom view — pass your own `render` (and optional `parsePath`). */
     readonly view: (config: CustomViewConfig) => SidebarViewNode;
     /** A labelled group of views (a header with sub-entries). */

package/dist/components/app-views/default-modules.js

@@ -1,16 +1,18 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect } from 'react';
-import { Blocks, Database, FileCog, Image, LayoutGrid, Puzzle, Settings as SettingsIcon, Signpost, } from 'lucide-react';
-import { isSingleton, resolveSingletonDocument } from '@elytracms/core/cms-core';
+import { Blocks, Database, FileCog, Image, LayoutGrid, Puzzle, Settings as SettingsIcon, Signpost, Users, } from 'lucide-react';
+import { extendCollectionDef, isSingleton, resolveSingletonDocument } from '@elytracms/core/cms-core';
 import { Navigate, STUDIO_PROJECT_ROUTE, studioPath } from '@elytracms/studio/router';
 import { Text } from '@elytracms/studio/ui';
 import { getInstantiatedKit } from '@elytracms/studio/lib/starters/kit-session';
-import { cmsDeepLink, componentsDeepLink, groupNode, separatorNode, viewNode, } from './module';
+import { cmsDeepLink, componentsDeepLink, usersDeepLink, redirectsDeepLink, groupNode, separatorNode, viewNode, } from './module';
 import { SectionSurface } from '../section-surface';
 import { SectionStateView } from '../section-state';
 import { SettingsForm } from '../settings-form';
 import { AssetLibrary } from '../assets/asset-library';
-import { RoutesShell } from '../routes/routes-shell';
+import { UsersModule } from '../users/users-module';
+import { RedirectsModule } from '../redirects/redirects-module';
+import { redirectsCollectionDef } from '../redirects/redirects-schema';
 import { ExtensionsView } from '../extensions/extensions-view';
 import { RegistryBrowser } from '../components/registry-browser';
 import { ComponentsIndex } from '../components/components-index';
@@ -90,16 +92,25 @@ export function componentsView(config = {}) {
         render: (ctx) => (_jsx(ComponentsScreen, { projectId: ctx.projectId, componentId: ctx.deepLink.componentId ?? null, state: ctx.search.state })),
     };
 }
-/** The resolved routes & redirects view (read-only; routing is config-as-code). */
-export function routesView(config = {}) {
+/**
+ * The Redirects view (EC-303) — editorial redirects as DATA, an editor-owned CRUD
+ * surface (create/edit/delete) over the portable list/edit surfaces. Routes are no
+ * longer shown in the admin (they're code; native `next.config`/`vercel` own static
+ * forwards, evaluated before these). Rides on the CMS availability (a content/
+ * routing concern). `[]` is the list; `[redirectId]` opens that redirect's detail.
+ */
+export function redirectsView(config = {}) {
+    // EC-311: merge any field/label overrides over the engine-owned def ONCE, at config
+    // build (config-as-code — a locked violation throws here, at `defineStudio` mount).
+    const schema = extendCollectionDef(redirectsCollectionDef, config, { additiveFields: 'reject' });
     return {
-        id: 'routes',
-        label: config.label ?? 'Routes',
-        description: 'View the resolved URL routes & redirects (defined in elytra.config.ts).',
+        id: 'redirects',
+        label: config.label ?? schema.form?.label ?? 'Redirects',
+        description: 'Create and manage URL redirects (301/302) for this site.',
         icon: config.icon ?? Signpost,
-        // Routes/redirects are CMS routing concerns, so the surface rides on the CMS availability.
         availabilitySection: 'cms',
-        render: (ctx) => ctx.search.state && ctx.search.state !== 'working' ? (_jsx(SectionStateView, { state: ctx.search.state, title: "Routes" })) : (_jsx(RoutesShell, { project: ctx.project })),
+        parsePath: redirectsDeepLink,
+        render: (ctx) => ctx.search.state && ctx.search.state !== 'working' ? (_jsx(SectionStateView, { state: ctx.search.state, title: "Redirects" })) : (_jsx(RedirectsModule, { projectId: ctx.projectId, redirectId: ctx.deepLink.redirectId ?? null, schema: schema })),
     };
 }
 /** The asset library view. */
@@ -113,6 +124,26 @@ export function assetsView(config = {}) {
         render: (ctx) => (_jsx(SectionSurface, { project: ctx.project, section: "assets", forcedState: ctx.search.state, children: _jsx(AssetLibrary, { projectId: ctx.projectId, focusAssetId: ctx.search.asset }) })),
     };
 }
+/**
+ * The studio Users view (EC-240) — an admin-only roster of who has access to this
+ * deployment and their role. A first-class section (its own rail entry), modeled
+ * like the Assets library; the surface itself gates to admins and renders a
+ * "restricted" state otherwise. Rides on the `settings` availability (an
+ * admin/config concern, so it appears/hides with a project's settings surface).
+ */
+export function usersView(config = {}) {
+    return {
+        id: 'users',
+        label: config.label ?? 'Users',
+        description: 'Manage who has access to this deployment and their role.',
+        icon: config.icon ?? Users,
+        availabilitySection: 'users',
+        // EC-240: `[]` is the roster; `[userId]` opens that member in the portable edit
+        // shell (AD-19 reuse — the same `DetailEditor` body over the users source).
+        parsePath: usersDeepLink,
+        render: (ctx) => ctx.search.state && ctx.search.state !== 'working' ? (_jsx(SectionStateView, { state: ctx.search.state, title: "Users" })) : (_jsx(UsersModule, { projectId: ctx.projectId, userId: ctx.deepLink.userId ?? null })),
+    };
+}
 /** The extensions marketplace view. */
 export function extensionsView(config = {}) {
     return {
@@ -176,9 +207,10 @@ export function customView(config) {
 export const DEFAULT_VIEWS = [
     componentsView(),
     cmsView(),
-    routesView(),
+    redirectsView(),
     assetsView(),
     extensionsView(),
+    usersView(),
     settingsView(),
     builderView(),
 ];
@@ -190,6 +222,14 @@ export const DEFAULT_VIEWS = [
  * sub-views, `nav.separator()` a divider. No string ids, no `moduleId` — the rail
  * is the views.
  */
+/**
+ * Forward the OPTIONAL, default-open nav-permission predicate (EC-240 / AD-18)
+ * from a `nav.*` config onto the built view, so gating is settable on EVERY nav
+ * item — not just Users. Absent → the view is unchanged (always visible).
+ */
+function withNavPermission(view, config) {
+    return config.visible ? { ...view, visible: config.visible } : view;
+}
 export const nav = {
     /**
      * The CMS view. `nav.cms()` / `nav.cms({ collections })` is a PARENT that nests its
@@ -197,11 +237,12 @@ export const nav = {
      * is a single-collection LEAF; `nav.cms({ children })` supplies explicit children.
      */
     cms: (config = {}) => {
+        const view = withNavPermission(cmsView(config), config);
         // A single-collection lens is a leaf — it opens that collection directly.
         if (config.collection)
-            return viewNode(cmsView(config));
+            return viewNode(view);
         // Otherwise a parent that expands its collections as nested rail children (EC-293).
-        const node = { kind: 'view', view: cmsView(config) };
+        const node = { kind: 'view', view };
         if (config.children)
             node.children = config.children;
         else
@@ -209,17 +250,19 @@ export const nav = {
         return node;
     },
     /** The component registry browser. */
-    components: (config = {}) => viewNode(componentsView(config)),
+    components: (config = {}) => viewNode(withNavPermission(componentsView(config), config)),
     /** The asset library. */
-    assets: (config = {}) => viewNode(assetsView(config)),
-    /** The resolved routes & redirects. */
-    routes: (config = {}) => viewNode(routesView(config)),
+    assets: (config = {}) => viewNode(withNavPermission(assetsView(config), config)),
+    /** Editorial redirects (EC-303); built-in fields customizable by name (EC-311). */
+    redirects: (config = {}) => viewNode(withNavPermission(redirectsView(config), config)),
     /** Project settings. */
-    settings: (config = {}) => viewNode(settingsView(config)),
+    settings: (config = {}) => viewNode(withNavPermission(settingsView(config), config)),
     /** The extensions marketplace. */
-    extensions: (config = {}) => viewNode(extensionsView(config)),
+    extensions: (config = {}) => viewNode(withNavPermission(extensionsView(config), config)),
+    /** The admin users roster (EC-240). */
+    users: (config = {}) => viewNode(withNavPermission(usersView(config), config)),
     /** A fully custom view — pass your own `render` (and optional `parsePath`). */
-    view: (config) => viewNode(customView(config)),
+    view: (config) => viewNode(withNavPermission(customView(config), config)),
     /** A labelled group of views (a header with sub-entries). */
     group: (label, children) => groupNode(label, children),
     /** A divider between rail sections. */