@odla-ai/chapter 0.38.1 → 0.39.1

package/README.md

@@ -510,6 +510,55 @@ producer process. The value is never accepted as an argument. `project` is the
 server-disclosure proof and omits locked bodies; `compose` is a local operator
 authoring view and contains the supplied content.
 
+### Private Builder Library
+
+Builder source material is deliberately separate from member publishing. Enable
+it on both the Built Not Found hub and each participating Chapter:
+
+```ts
+// Built Not Found
+builderLibrary: {
+  sources: [{ sourceId: "oakland" }, { sourceId: "denver" }],
+},
+
+// Oakland
+builderLibrary: {
+  sources: [{ sourceId: "built-not-found" }],
+},
+```
+
+Every resource has exactly one scope: `{ kind: "chapter", chapterId }`,
+`{ kind: "built_not_found" }`, or `{ kind: "global" }`. There are no groups or
+audience arrays. A Chapter can author only its own scope. Its admins and agents
+see its own published material plus global material, never a sibling Chapter or
+Built Not Found-only material. Built Not Found admins see every configured
+Chapter source and can promote a Chapter resource to a global copy; the server
+records the source Chapter, source resource/document revisions, actor, and time.
+
+Resources are bounded documents/notes, HTTPS links/inspiration, or canonical
+Brand `{ bookId, assetId }` references. Asset URLs, bytes, storage credentials,
+HTML, and executable content are not part of the contract. The standard admin
+adds a visibly private **Builder Library** tab separate from **Member content**.
+Saving a library item never creates or changes a member page.
+
+An authenticated admin or site-building agent reads the bounded, published-only
+manifest from `/api/admin/builder-library/manifest`. On Built Not Found, pass a
+configured `chapterId` query parameter; on a Chapter, the server fixes the
+viewer to that Chapter. Signed delivery uses the dedicated
+`builder_library_control_secret` vault key and never reuses CRM, member-content,
+or signup-control credentials.
+
+```bash
+odla-ai chapter builder-library validate --file oakland-library.json --source-type chapter --source oakland --json
+odla-ai chapter builder-library manifest --file oakland-library.json --chapter oakland --json
+odla-ai chapter builder-library deliver --file oakland-library.json \
+  --url https://builtnotfoundcapital.com --from-env BUILDER_LIBRARY_SECRET --json
+```
+
+The signing secret is accepted only from a named environment variable or stdin.
+For a Built Not Found local document, add `--target oakland --environment dev`;
+the CLI signs only its global resources for that Chapter, never BNF-only items.
+
 ### Hub-authoritative live signup control
 
 When a hub must control the live membership page as well as preview it, use the