@odla-ai/chapter 0.39.1 → 0.39.2

package/dist/index.d.cts

@@ -207,16 +207,14 @@ interface ResolvedMemberContent {
 interface ChapterBuilderLibrary {
     /** Keep local admin authoring enabled. Defaults to true. */
     localAuthoring?: boolean;
-    /** Signed sources this app accepts. Hub sources are Chapters; Chapter sources are Built Not Found. */
+    /** Existing Chapter-network peers this app accepts. Hub sources must be
+     * configured network targets; a Chapter source must be a configured reader. */
     sources?: readonly {
         sourceId: string;
-        /** Vault key holding the dedicated Builder Library edge secret. */
-        secretName?: string;
     }[];
 }
 interface ResolvedBuilderLibrarySource {
     sourceId: string;
-    secretName: string;
 }
 /** Validated Builder Library settings carried on a resolved Chapter. */
 interface ResolvedBuilderLibrary {
@@ -796,8 +794,9 @@ declare function resolveSignupControl(input: ChapterSignupControl | undefined):
 /** Validate the deliberately separate member-content authoring boundary. */
 declare function resolveMemberContent(input: ChapterMemberContent | undefined): ResolvedMemberContent | null;
 
-/** Validate the private Builder Library federation boundary. */
-declare function resolveBuilderLibrary(mode: ChapterMode, input: ChapterBuilderLibrary | undefined): ResolvedBuilderLibrary | null;
+/** Validate the private Builder Library boundary against Chapter's existing
+ * network peers. Builder Library never introduces a second edge credential. */
+declare function resolveBuilderLibrary(mode: ChapterMode, input: ChapterBuilderLibrary | undefined, network?: ResolvedNetwork): ResolvedBuilderLibrary | null;
 
 /** Options for {@link leaderCrmConfig}. */
 interface LeaderCrmOptions {

package/dist/index.d.ts

@@ -207,16 +207,14 @@ interface ResolvedMemberContent {
 interface ChapterBuilderLibrary {
     /** Keep local admin authoring enabled. Defaults to true. */
     localAuthoring?: boolean;
-    /** Signed sources this app accepts. Hub sources are Chapters; Chapter sources are Built Not Found. */
+    /** Existing Chapter-network peers this app accepts. Hub sources must be
+     * configured network targets; a Chapter source must be a configured reader. */
     sources?: readonly {
         sourceId: string;
-        /** Vault key holding the dedicated Builder Library edge secret. */
-        secretName?: string;
     }[];
 }
 interface ResolvedBuilderLibrarySource {
     sourceId: string;
-    secretName: string;
 }
 /** Validated Builder Library settings carried on a resolved Chapter. */
 interface ResolvedBuilderLibrary {
@@ -796,8 +794,9 @@ declare function resolveSignupControl(input: ChapterSignupControl | undefined):
 /** Validate the deliberately separate member-content authoring boundary. */
 declare function resolveMemberContent(input: ChapterMemberContent | undefined): ResolvedMemberContent | null;
 
-/** Validate the private Builder Library federation boundary. */
-declare function resolveBuilderLibrary(mode: ChapterMode, input: ChapterBuilderLibrary | undefined): ResolvedBuilderLibrary | null;
+/** Validate the private Builder Library boundary against Chapter's existing
+ * network peers. Builder Library never introduces a second edge credential. */
+declare function resolveBuilderLibrary(mode: ChapterMode, input: ChapterBuilderLibrary | undefined, network?: ResolvedNetwork): ResolvedBuilderLibrary | null;
 
 /** Options for {@link leaderCrmConfig}. */
 interface LeaderCrmOptions {

package/dist/index.js

@@ -1523,8 +1523,7 @@ function resolveMemberContent(input) {
 
 // src/config-builder-library.ts
 var SLUG4 = /^[a-z0-9][a-z0-9-]{1,62}$/;
-var SECRET_NAME3 = /^[a-z][a-z0-9_]{1,127}$/;
-function resolveBuilderLibrary(mode, input) {
+function resolveBuilderLibrary(mode, input, network = { targets: [], readers: [] }) {
   if (!input) return null;
   if (input.sources !== void 0 && !Array.isArray(input.sources)) {
     throw new Error("defineChapter.builderLibrary.sources: must be an array");
@@ -1544,11 +1543,19 @@ function resolveBuilderLibrary(mode, input) {
       throw new Error(`defineChapter.builderLibrary.sources: duplicate source "${source.sourceId}"`);
     }
     seen.add(source.sourceId);
-    const secretName = source.secretName?.trim() || "builder_library_control_secret";
-    if (!SECRET_NAME3.test(secretName)) {
-      throw new Error(`defineChapter.builderLibrary.sources[${index}].secretName: must be a vault-key identifier`);
+    if ("secretName" in source) {
+      throw new Error(
+        `defineChapter.builderLibrary.sources[${index}].secretName: remove this field; Builder Library reuses the Chapter network edge`
+      );
     }
-    return { sourceId: source.sourceId, secretName };
+    const networkPeer = mode === "hub" ? network.targets.some((target) => target.id === source.sourceId) : network.readers.some((reader) => reader.id === source.sourceId);
+    if (!networkPeer) {
+      const side = mode === "hub" ? "targets" : "readers";
+      throw new Error(
+        `defineChapter.builderLibrary.sources[${index}]: "${source.sourceId}" must already be configured in network.${side}`
+      );
+    }
+    return { sourceId: source.sourceId };
   });
   return { enabled: true, localAuthoring: input.localAuthoring !== false, sources };
 }
@@ -1587,7 +1594,7 @@ function defineChapter(config) {
   const network = resolveNetwork(config, crm);
   const signupControl = resolveSignupControl(config.signupControl);
   const memberContent = resolveMemberContent(config.memberContent);
-  const builderLibrary = resolveBuilderLibrary(mode, config.builderLibrary);
+  const builderLibrary = resolveBuilderLibrary(mode, config.builderLibrary, network);
   const formation = resolveLeaderFormation(config.formation, crm);
   if (signupControl && mode !== "chapter") {
     throw new Error("defineChapter.signupControl: only chapter-mode followers can receive signup control");
@@ -1911,13 +1918,6 @@ function createChapterIntegration(chapter, options = {}) {
     ...emails?.debugEmail ? { debugEmail: emails.debugEmail } : {}
   });
   const seeds = [...crmDesc.seeds ?? []];
-  const builderLibrarySecrets = [...new Set(
-    chapter.builderLibrary?.sources.map((source) => source.secretName) ?? []
-  )].map((name) => ({
-    name,
-    description: "Signing secret for private Builder Library delivery from a configured source.",
-    required: true
-  }));
   const group = chapter.groupSeed();
   if (group) {
     seeds.push({ id: "group", ns: "groups", key: { attr: "id", value: chapter.id }, attrs: { ...group, createdAt: now } });
@@ -1950,7 +1950,7 @@ function createChapterIntegration(chapter, options = {}) {
     },
     rules: { ...crmDesc.rules, ...chapter.rules },
     seeds,
-    secrets: builderLibrarySecrets,
+    secrets: [],
     probes: [
       ...crmDesc.probes ?? [],
       // The snapshot route is deliberately private. A credential-free smoke