@odla-ai/chapter 0.39.1 → 0.39.2

package/README.md

@@ -517,11 +517,20 @@ it on both the Built Not Found hub and each participating Chapter:
 
 ```ts
 // Built Not Found
+network: {
+  targets: [
+    { id: "oakland", url: "https://oakland.example", binding: "OAKLAND" },
+    { id: "denver", url: "https://denver.example", binding: "DENVER" },
+  ],
+},
 builderLibrary: {
   sources: [{ sourceId: "oakland" }, { sourceId: "denver" }],
 },
 
 // Oakland
+network: {
+  readers: [{ id: "built-not-found", fields: { person: ["name"] } }],
+},
 builderLibrary: {
   sources: [{ sourceId: "built-not-found" }],
 },
@@ -544,18 +553,22 @@ Saving a library item never creates or changes a member page.
 An authenticated admin or site-building agent reads the bounded, published-only
 manifest from `/api/admin/builder-library/manifest`. On Built Not Found, pass a
 configured `chapterId` query parameter; on a Chapter, the server fixes the
-viewer to that Chapter. Signed delivery uses the dedicated
-`builder_library_control_secret` vault key and never reuses CRM, member-content,
-or signup-control credentials.
+viewer to that Chapter. Every Builder source must already be the corresponding
+`network.target` (on Built Not Found) or `network.reader` (on a Chapter). Signed
+delivery reuses that Chapter network edge: the Chapter's existing
+`network_share_secret` is the same value Built Not Found already stores as
+`network_share_<chapter_id>`. Builder Library declares and provisions no secret
+of its own.
 
 ```bash
 odla-ai chapter builder-library validate --file oakland-library.json --source-type chapter --source oakland --json
 odla-ai chapter builder-library manifest --file oakland-library.json --chapter oakland --json
 odla-ai chapter builder-library deliver --file oakland-library.json \
-  --url https://builtnotfoundcapital.com --from-env BUILDER_LIBRARY_SECRET --json
+  --url https://builtnotfoundcapital.com --from-env NETWORK_SHARE_SECRET --json
 ```
 
-The signing secret is accepted only from a named environment variable or stdin.
+The existing network share secret is accepted only from a named environment
+variable or stdin; it is never copied into Builder Library config or argv.
 For a Built Not Found local document, add `--target oakland --environment dev`;
 the CLI signs only its global resources for that Chapter, never BNF-only items.
 

package/dist/{copy-context-Buz_27Ed.d.ts → copy-context-Dbu9Bbq1.d.ts}

@@ -118,16 +118,14 @@ interface ResolvedMemberContent {
 interface ChapterBuilderLibrary {
     /** Keep local admin authoring enabled. Defaults to true. */
     localAuthoring?: boolean;
-    /** Signed sources this app accepts. Hub sources are Chapters; Chapter sources are Built Not Found. */
+    /** Existing Chapter-network peers this app accepts. Hub sources must be
+     * configured network targets; a Chapter source must be a configured reader. */
     sources?: readonly {
         sourceId: string;
-        /** Vault key holding the dedicated Builder Library edge secret. */
-        secretName?: string;
     }[];
 }
 interface ResolvedBuilderLibrarySource {
     sourceId: string;
-    secretName: string;
 }
 /** Validated Builder Library settings carried on a resolved Chapter. */
 interface ResolvedBuilderLibrary {

package/dist/index.cjs

@@ -1710,8 +1710,7 @@ function resolveMemberContent(input) {
 
 // src/config-builder-library.ts
 var SLUG4 = /^[a-z0-9][a-z0-9-]{1,62}$/;
-var SECRET_NAME3 = /^[a-z][a-z0-9_]{1,127}$/;
-function resolveBuilderLibrary(mode, input) {
+function resolveBuilderLibrary(mode, input, network = { targets: [], readers: [] }) {
   if (!input) return null;
   if (input.sources !== void 0 && !Array.isArray(input.sources)) {
     throw new Error("defineChapter.builderLibrary.sources: must be an array");
@@ -1731,11 +1730,19 @@ function resolveBuilderLibrary(mode, input) {
       throw new Error(`defineChapter.builderLibrary.sources: duplicate source "${source.sourceId}"`);
     }
     seen.add(source.sourceId);
-    const secretName = source.secretName?.trim() || "builder_library_control_secret";
-    if (!SECRET_NAME3.test(secretName)) {
-      throw new Error(`defineChapter.builderLibrary.sources[${index}].secretName: must be a vault-key identifier`);
+    if ("secretName" in source) {
+      throw new Error(
+        `defineChapter.builderLibrary.sources[${index}].secretName: remove this field; Builder Library reuses the Chapter network edge`
+      );
     }
-    return { sourceId: source.sourceId, secretName };
+    const networkPeer = mode === "hub" ? network.targets.some((target) => target.id === source.sourceId) : network.readers.some((reader) => reader.id === source.sourceId);
+    if (!networkPeer) {
+      const side = mode === "hub" ? "targets" : "readers";
+      throw new Error(
+        `defineChapter.builderLibrary.sources[${index}]: "${source.sourceId}" must already be configured in network.${side}`
+      );
+    }
+    return { sourceId: source.sourceId };
   });
   return { enabled: true, localAuthoring: input.localAuthoring !== false, sources };
 }
@@ -1774,7 +1781,7 @@ function defineChapter(config) {
   const network = resolveNetwork(config, crm);
   const signupControl = resolveSignupControl(config.signupControl);
   const memberContent = resolveMemberContent(config.memberContent);
-  const builderLibrary = resolveBuilderLibrary(mode, config.builderLibrary);
+  const builderLibrary = resolveBuilderLibrary(mode, config.builderLibrary, network);
   const formation = resolveLeaderFormation(config.formation, crm);
   if (signupControl && mode !== "chapter") {
     throw new Error("defineChapter.signupControl: only chapter-mode followers can receive signup control");
@@ -2098,13 +2105,6 @@ function createChapterIntegration(chapter, options = {}) {
     ...emails?.debugEmail ? { debugEmail: emails.debugEmail } : {}
   });
   const seeds = [...crmDesc.seeds ?? []];
-  const builderLibrarySecrets = [...new Set(
-    chapter.builderLibrary?.sources.map((source) => source.secretName) ?? []
-  )].map((name) => ({
-    name,
-    description: "Signing secret for private Builder Library delivery from a configured source.",
-    required: true
-  }));
   const group = chapter.groupSeed();
   if (group) {
     seeds.push({ id: "group", ns: "groups", key: { attr: "id", value: chapter.id }, attrs: { ...group, createdAt: now } });
@@ -2137,7 +2137,7 @@ function createChapterIntegration(chapter, options = {}) {
     },
     rules: { ...crmDesc.rules, ...chapter.rules },
     seeds,
-    secrets: builderLibrarySecrets,
+    secrets: [],
     probes: [
       ...crmDesc.probes ?? [],
       // The snapshot route is deliberately private. A credential-free smoke