@odla-ai/chapter 0.39.0 → 0.39.2

package/README.md

@@ -510,6 +510,68 @@ producer process. The value is never accepted as an argument. `project` is the
 server-disclosure proof and omits locked bodies; `compose` is a local operator
 authoring view and contains the supplied content.
 
+### Private Builder Library
+
+Builder source material is deliberately separate from member publishing. Enable
+it on both the Built Not Found hub and each participating Chapter:
+
+```ts
+// Built Not Found
+network: {
+  targets: [
+    { id: "oakland", url: "https://oakland.example", binding: "OAKLAND" },
+    { id: "denver", url: "https://denver.example", binding: "DENVER" },
+  ],
+},
+builderLibrary: {
+  sources: [{ sourceId: "oakland" }, { sourceId: "denver" }],
+},
+
+// Oakland
+network: {
+  readers: [{ id: "built-not-found", fields: { person: ["name"] } }],
+},
+builderLibrary: {
+  sources: [{ sourceId: "built-not-found" }],
+},
+```
+
+Every resource has exactly one scope: `{ kind: "chapter", chapterId }`,
+`{ kind: "built_not_found" }`, or `{ kind: "global" }`. There are no groups or
+audience arrays. A Chapter can author only its own scope. Its admins and agents
+see its own published material plus global material, never a sibling Chapter or
+Built Not Found-only material. Built Not Found admins see every configured
+Chapter source and can promote a Chapter resource to a global copy; the server
+records the source Chapter, source resource/document revisions, actor, and time.
+
+Resources are bounded documents/notes, HTTPS links/inspiration, or canonical
+Brand `{ bookId, assetId }` references. Asset URLs, bytes, storage credentials,
+HTML, and executable content are not part of the contract. The standard admin
+adds a visibly private **Builder Library** tab separate from **Member content**.
+Saving a library item never creates or changes a member page.
+
+An authenticated admin or site-building agent reads the bounded, published-only
+manifest from `/api/admin/builder-library/manifest`. On Built Not Found, pass a
+configured `chapterId` query parameter; on a Chapter, the server fixes the
+viewer to that Chapter. Every Builder source must already be the corresponding
+`network.target` (on Built Not Found) or `network.reader` (on a Chapter). Signed
+delivery reuses that Chapter network edge: the Chapter's existing
+`network_share_secret` is the same value Built Not Found already stores as
+`network_share_<chapter_id>`. Builder Library declares and provisions no secret
+of its own.
+
+```bash
+odla-ai chapter builder-library validate --file oakland-library.json --source-type chapter --source oakland --json
+odla-ai chapter builder-library manifest --file oakland-library.json --chapter oakland --json
+odla-ai chapter builder-library deliver --file oakland-library.json \
+  --url https://builtnotfoundcapital.com --from-env NETWORK_SHARE_SECRET --json
+```
+
+The existing network share secret is accepted only from a named environment
+variable or stdin; it is never copied into Builder Library config or argv.
+For a Built Not Found local document, add `--target oakland --environment dev`;
+the CLI signs only its global resources for that Chapter, never BNF-only items.
+
 ### Hub-authoritative live signup control
 
 When a hub must control the live membership page as well as preview it, use the