@kaddo/mcp 3.114.0 → 3.116.0

package/dist/index.js

@@ -371,6 +371,9 @@ function exists(p) {
 function readFile(p) {
   return fs2.readFileSync(p, "utf-8");
 }
+function ensureDir(dirPath) {
+  fs2.mkdirSync(dirPath, { recursive: true });
+}
 function readDir(dirPath) {
   if (!exists(dirPath)) return [];
   return fs2.readdirSync(dirPath);
@@ -386,7 +389,7 @@ function join(...parts) {
 }
 
 // ../cli/src/core/impact-report.ts
-import matter9 from "gray-matter";
+import matter10 from "gray-matter";
 
 // ../cli/src/core/config.ts
 import { z } from "zod";
@@ -485,8 +488,8 @@ function loadConfig(dir) {
   const parsed = configSchema.safeParse(raw ?? {});
   if (!parsed.success) {
     const issues = parsed.error.issues.map((i) => {
-      const path7 = i.path.join(".");
-      return path7 ? `  - ${path7}: ${i.message}` : `  - ${i.message}`;
+      const path9 = i.path.join(".");
+      return path9 ? `  - ${path9}: ${i.message}` : `  - ${i.message}`;
     }).join("\n");
     throw new ConfigError(`Invalid .kaddo/config.yml:
 ${issues}`);
@@ -927,11 +930,11 @@ function moduleArtifactCoverage(dir, id) {
   };
 }
 function loadMappedModules(dir) {
-  const path7 = join(dir, DESCRIPTOR_PATH);
-  if (!exists(path7)) return [];
+  const path9 = join(dir, DESCRIPTOR_PATH);
+  if (!exists(path9)) return [];
   let parsed;
   try {
-    parsed = parseYaml4(readFile(path7));
+    parsed = parseYaml4(readFile(path9));
   } catch {
     return [];
   }
@@ -2438,7 +2441,7 @@ function sectionParagraph2(md, title) {
   }
   return "";
 }
-function parseCapsule(id, path7, md) {
+function parseCapsule(id, path9, md) {
   const { data } = matter4(md);
   const updatedAt = data.updated_at ? String(data.updated_at) : void 0;
   let ageDays = null;
@@ -2448,7 +2451,7 @@ function parseCapsule(id, path7, md) {
   }
   return {
     id,
-    path: path7,
+    path: path9,
     system: data.system ? String(data.system) : id,
     owner: data.owner ? String(data.owner) : void 0,
     updatedAt,
@@ -2590,8 +2593,145 @@ function discoverInitiatives(dir) {
   return out.sort((a2, b2) => a2.id.localeCompare(b2.id));
 }
 
+// ../cli/src/core/resources.ts
+import matter6 from "gray-matter";
+var RESOURCE_ARTIFACT_TYPE = "project-resource";
+var RESOURCE_TYPES = [
+  "database",
+  "cloud",
+  "api",
+  "queue",
+  "storage",
+  "repository",
+  "platform",
+  "service",
+  "other"
+];
+var INTERFACE_TYPES = ["cli", "mcp", "api", "sql", "sdk", "iac", "console", "other"];
+function str(v) {
+  return typeof v === "string" && v.trim() ? v.trim() : null;
+}
+function strArray(v) {
+  if (Array.isArray(v)) return v.map((x2) => String(x2).trim()).filter(Boolean);
+  if (typeof v === "string" && v.trim()) return [v.trim()];
+  return [];
+}
+function parseInterfaces(v) {
+  if (!Array.isArray(v)) return [];
+  const out = [];
+  for (const raw of v) {
+    if (!raw || typeof raw !== "object") continue;
+    const o2 = raw;
+    const type = str(o2.type);
+    if (!type) continue;
+    out.push({
+      type,
+      tool: str(o2.tool),
+      provider: str(o2.provider),
+      purpose: str(o2.purpose),
+      operations: strArray(o2.operations),
+      environments: strArray(o2.environments),
+      constraints: str(o2.constraints)
+    });
+  }
+  return out;
+}
+function parseBoundaries(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return {};
+  const out = {};
+  for (const [env, val] of Object.entries(v)) {
+    const list3 = strArray(val);
+    if (list3.length > 0) out[env] = list3;
+  }
+  return out;
+}
+function parseAuth(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return { mode: null, refs: [] };
+  const o2 = v;
+  const refs = strArray(o2.refs).filter((r2) => !r2.includes("=") && /^[A-Za-z0-9_.-]+$/.test(r2));
+  return { mode: str(o2.mode), refs };
+}
+function parseScope(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return null;
+  const o2 = v;
+  const type = str(o2.type);
+  if (!type) return null;
+  return { type, module: str(o2.module) };
+}
+function purposeFromBody(body) {
+  const m2 = body.match(/^#{1,2}\s+Purpose\s*\n+([\s\S]*?)(?=\n#{1,2}\s|\s*$)/m);
+  const text3 = m2 ? m2[1].trim() : "";
+  return text3 || null;
+}
+function toDetail(filePath, relPath, raw) {
+  const parsed = matter6(raw);
+  const fm = parsed.data ?? {};
+  const body = parsed.content.trim();
+  const id = str(fm.id) ?? "";
+  return {
+    id,
+    title: str(fm.title) ?? id,
+    resourceType: str(fm.resource_type),
+    provider: str(fm.provider),
+    environments: strArray(fm.environments),
+    scope: parseScope(fm.scope),
+    modules: strArray(fm.modules),
+    path: relPath,
+    purpose: str(fm.purpose) ?? purposeFromBody(body),
+    interfaces: parseInterfaces(fm.access_interfaces),
+    boundaries: parseBoundaries(fm.access_boundaries),
+    ...(() => {
+      const a2 = parseAuth(fm.authentication);
+      return { authRefs: a2.refs, authMode: a2.mode };
+    })(),
+    markdownBody: body
+  };
+}
+function getResources(dir) {
+  return discoverKnowledge(dir).filter((a2) => a2.type === RESOURCE_ARTIFACT_TYPE).map((a2) => {
+    const fm = a2.rawFrontmatter;
+    return {
+      id: a2.id || str(fm.id) || a2.title,
+      title: a2.title || str(fm.title) || a2.id,
+      resourceType: str(fm.resource_type),
+      provider: str(fm.provider),
+      environments: strArray(fm.environments),
+      scope: parseScope(fm.scope),
+      modules: strArray(fm.modules),
+      path: a2.relPath
+    };
+  }).sort((x2, y) => x2.id.localeCompare(y.id));
+}
+function getResource(dir, id) {
+  const match = discoverKnowledge(dir).find(
+    (a2) => a2.type === RESOURCE_ARTIFACT_TYPE && (a2.id === id || a2.title === id)
+  );
+  if (!match) return null;
+  const raw = readFile(match.filePath);
+  return toDetail(match.filePath, match.relPath, raw);
+}
+function parseWorkItemResources(fm) {
+  const v = fm.resources;
+  if (!Array.isArray(v)) return [];
+  const out = [];
+  for (const raw of v) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const o2 = raw;
+    const id = str(o2.id);
+    if (!id) continue;
+    out.push({ id, role: str(o2.role) ?? "affected" });
+  }
+  return out;
+}
+
 // ../cli/src/core/graph.ts
 var KNOWLEDGE3 = "knowledge";
+var RESOURCE_ROLE_EDGE = {
+  affected: "affects",
+  implementation: "uses",
+  validation: "validates_with",
+  delivery: "delivers_through"
+};
 var ACTIVE_STATUSES = ["draft", "ready", "in-progress", "blocked"];
 var ALL_STATUSES = ["draft", "ready", "in-progress", "blocked", "completed"];
 function scopeStatuses(scope) {
@@ -2628,9 +2768,9 @@ function buildGraph(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
   ];
   const presentLayers = [];
   for (const layer2 of layerDocs) {
-    const path7 = layer2.files.map((f3) => `${KNOWLEDGE3}/${f3}`).find((rel) => exists(join(dir, rel)));
-    if (path7) {
-      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path7 });
+    const path9 = layer2.files.map((f3) => `${KNOWLEDGE3}/${f3}`).find((rel) => exists(join(dir, rel)));
+    if (path9) {
+      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path9 });
       presentLayers.push(layer2.id);
     }
   }
@@ -2670,6 +2810,24 @@ function buildGraph(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
       if (cand.materializedAs) addEdge(candId, `wi:${cand.materializedAs}`, "materialized_as");
     }
   }
+  const resourceTitleById = /* @__PURE__ */ new Map();
+  for (const r2 of getResources(dir)) {
+    resourceTitleById.set(r2.id, r2.title);
+    const resId = `resource:${r2.id}`;
+    addNode({
+      id: resId,
+      type: "project-resource",
+      label: r2.title ? `${r2.id} ${r2.title}`.trim() : r2.id,
+      path: r2.path
+    });
+    const depModules = new Set(r2.modules);
+    if (r2.scope?.type === "module" && r2.scope.module) depModules.add(r2.scope.module);
+    for (const mod of depModules) {
+      const modId = `module:${mod}`;
+      addNode({ id: modId, type: "module", label: mod });
+      addEdge(modId, resId, "depends_on");
+    }
+  }
   for (const wi of selectedWIs) {
     const id = wi.id || wi.title;
     if (!id || !id.trim()) continue;
@@ -2694,6 +2852,12 @@ function buildGraph(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
       addNode({ id: capId, type: "capability", label: cap });
       addEdge(wiNodeId, capId, "implements");
     }
+    for (const rel of parseWorkItemResources(wi.rawFrontmatter)) {
+      const resId = `resource:${rel.id}`;
+      const title = resourceTitleById.get(rel.id);
+      addNode({ id: resId, type: "project-resource", label: title ? `${rel.id} ${title}`.trim() : rel.id });
+      addEdge(wiNodeId, resId, RESOURCE_ROLE_EDGE[rel.role] ?? "uses");
+    }
     for (const dec of wi.decisions) {
       if (!dec || !dec.trim()) continue;
       const adrId = `adr:${dec}`;
@@ -3072,7 +3236,7 @@ function loadGraphHints(dir) {
 }
 
 // ../cli/src/services/installed-skills.ts
-import matter6 from "gray-matter";
+import matter7 from "gray-matter";
 var SKILLS_DIR = join("knowledge", "skills");
 function discoverInstalledSkills(dir) {
   const base = join(dir, SKILLS_DIR);
@@ -3082,7 +3246,7 @@ function discoverInstalledSkills(dir) {
     const skillFile = join(base, entry, "skill.md");
     if (!isFile(skillFile)) continue;
     try {
-      const { data } = matter6(readFile(skillFile));
+      const { data } = matter7(readFile(skillFile));
       if (data.type && String(data.type) !== "skill") continue;
       const id = String(data.id ?? entry);
       out.push({
@@ -4238,10 +4402,10 @@ function resolveNextStep(dir, now = /* @__PURE__ */ new Date()) {
   const q3 = (rel) => analyzeKnowledgeArtifact(dir, rel);
   const resolveAgent = (agent) => {
     const file = agent.endsWith(".md") ? agent : `${agent}.md`;
-    const path7 = agentInstallPath(file);
-    const installed = isFile(join(dir, path7));
+    const path9 = agentInstallPath(file);
+    const installed = isFile(join(dir, path9));
     const group = agentGroupOf(file);
-    return { agentPath: path7, agentInstalled: installed, installCommand: installed ? void 0 : `kaddo add agents --group ${group}` };
+    return { agentPath: path9, agentInstalled: installed, installCommand: installed ? void 0 : `kaddo add agents --group ${group}` };
   };
   const moduleRepo = isModule(config);
   const coreRepo = isCore(config);
@@ -4671,7 +4835,7 @@ function deriveDeliveryCompletedStatus(dir) {
 }
 
 // ../cli/src/core/assets.ts
-import matter7 from "gray-matter";
+import matter8 from "gray-matter";
 
 // ../cli/src/core/version.ts
 import { fileURLToPath } from "url";
@@ -4826,8 +4990,13 @@ dependencies.
    flags, content/copy, authentication/authorization, notifications, analytics, documentation,
    operations/release \u2014 as affected, reviewed-not-affected, unknown, or not-applicable.
 4. **Module review** \u2014 for multirepo, evaluate each mapped module with the same statuses.
-5. **Completeness review** \u2014 confirm: outcome covered, journey covered, modules assessed, unknowns
-   visible, acceptance criteria end-to-end, scope and out-of-scope coherent.
+5. **Resource review** \u2014 ask: does this change need to observe, modify, validate or deliver against a
+   known external resource of the project (a Project Resource under \`knowledge/tech/resources/\` \u2014
+   database, cloud, API, queue, storage\u2026)? If so, declare it in the WI front matter \`resources:\` with
+   a role (\`affected\`, \`implementation\`, \`validation\`, \`delivery\`). Resources are external systems,
+   distinct from \`affected_modules\` (code). Not every WI needs resources (e.g. a CSS change does not).
+6. **Completeness review** \u2014 confirm: outcome covered, journey covered, modules assessed, resources
+   assessed, unknowns visible, acceptance criteria end-to-end, scope and out-of-scope coherent.
 
 ## Rules
 
@@ -4838,6 +5007,8 @@ dependencies.
 - Include at least one end-to-end acceptance criterion for user-facing changes.
 - Do not reduce a product intent to the first technical implementation found.
 - Evaluate surfaces and modules before proposing files.
+- Consider Project Resources when the scope justifies it; never invent resources not backed by
+  project knowledge, and keep \`resources\` (external systems) separate from \`affected_modules\` (code).
 - This skill refines scope and acceptance criteria but does not approve implementation readiness.
   Readiness requires human confirmation through \`kaddo ready\` or the MCP \`mark_work_item_ready\` action.
 
@@ -5989,6 +6160,16 @@ supporting notes as \`knowledge/tech/discovery/architecture-notes.md\` and decis
 under \`knowledge/tech/decisions/\`. Kaddo still reads the legacy root locations for backward
 compatibility, but new output should use \`discovery/\`.
 
+## Project Resource candidates
+
+When the knowledge describes an external system the project depends on (a database, cloud account,
+API, queue, storage, service\u2026), you may propose it as a **candidate** Project Resource \u2014 never create
+it silently. Discovery \u2260 creation: present candidates for human review and materialize only through
+\`kaddo_create_resource\` / \`kaddo resources create\` with explicit confirmation. Ground every
+candidate in the knowledge (no guessing from ambiguous names). Model the stable system, not its access
+interface (CLI/MCP/SQL/API are interfaces); keep \`resources\` separate from \`affected_modules\`; and
+never include secret values \u2014 only reference names.
+
 ## Quality Checklist
 
 - Every component is backed by evidence from the context pack.
@@ -7877,7 +8058,7 @@ function canonicalSkills() {
 }
 function versionOf(content) {
   try {
-    const v = matter7(content).data.version;
+    const v = matter8(content).data.version;
     return v === void 0 || v === null ? null : String(v);
   } catch {
     return null;
@@ -8649,7 +8830,7 @@ function renderRouteCompact(route) {
 }
 
 // ../cli/src/core/metadata-health.ts
-import matter8 from "gray-matter";
+import matter9 from "gray-matter";
 var KNOWLEDGE_FILES2 = [
   "knowledge/business/business.md",
   "knowledge/product/product.md",
@@ -8669,7 +8850,7 @@ function analyzeMetadataHealth(dir) {
     let data;
     try {
       const raw = readFile(p);
-      data = matter8(raw).data;
+      data = matter9(raw).data;
     } catch {
       continue;
     }
@@ -8701,7 +8882,7 @@ function analyzeMetadataHealth(dir) {
         if (isFile(p) && entry.endsWith(".md")) {
           try {
             const raw = readFile(p);
-            const fm = matter8(raw).data;
+            const fm = matter9(raw).data;
             if (fm.status === "done") {
               const rel = p.replace(dir + "/", "").replace(dir + "\\", "").replace(/\\/g, "/");
               findings.push({
@@ -9569,7 +9750,7 @@ function buildGuardHistory(dir) {
     const d3 = hotspotDir(t.code_path);
     hotspotMap.set(d3, (hotspotMap.get(d3) ?? 0) + 1);
   }
-  const hotspots = [...hotspotMap.entries()].map(([path7, warnings]) => ({ path: path7, warnings })).sort((a2, b2) => b2.warnings - a2.warnings);
+  const hotspots = [...hotspotMap.entries()].map(([path9, warnings]) => ({ path: path9, warnings })).sort((a2, b2) => b2.warnings - a2.warnings);
   return {
     available: true,
     total_runs: sorted.length,
@@ -9656,7 +9837,7 @@ function buildImpactReport(dir, opts = {}, now = /* @__PURE__ */ new Date()) {
       }
     }
     try {
-      const body = matter9(readFile(wi.filePath)).content;
+      const body = matter10(readFile(wi.filePath)).content;
       if (hasSection(body, /acceptance|criterios de aceptaci/i)) withAcceptance++;
       else gaps.missing_acceptance_criteria.push(gapItem(wi, "Add an `## Acceptance Criteria` section."));
       if (hasSection(body, /definition of done|^#{1,6}\s*dod\b|definici[oó]n de (terminado|hecho)/i)) withDoD++;
@@ -10369,7 +10550,7 @@ function serializeDriftJson(r2) {
 }
 
 // src/workitems.ts
-import matter10 from "gray-matter";
+import matter11 from "gray-matter";
 var VALID_SOURCES2 = /* @__PURE__ */ new Set(["manual", "roadmap", "jira", "github", "notion", "xlsx", "csv", "api", "external", "unknown"]);
 function optStr3(v) {
   return typeof v === "string" && v.trim() ? v.trim() : void 0;
@@ -10392,7 +10573,7 @@ function parseSource(data) {
   return { type: "unknown", inferred: true };
 }
 var ACTIVE_STATES2 = /* @__PURE__ */ new Set(["draft", "ready", "in-progress", "blocked"]);
-function strArray(v) {
+function strArray2(v) {
   return Array.isArray(v) ? v.map((x2) => String(x2)).filter(Boolean) : [];
 }
 function lifecycleOf(data, relPath) {
@@ -10460,15 +10641,15 @@ function listWorkItems(root) {
     if (raw === null) continue;
     let parsed;
     try {
-      parsed = matter10(raw);
+      parsed = matter11(raw);
     } catch {
       continue;
     }
     const data = parsed.data;
     if (!data.type) continue;
     const status = lifecycleOf(data, rel);
-    const code = strArray(data.code);
-    const domains = strArray(data.domains);
+    const code = strArray2(data.code);
+    const domains = strArray2(data.domains);
     const source = parseSource(data);
     const readiness = status === "draft" ? assessReadiness(data, parsed.content, code, domains, source) : void 0;
     items.push({
@@ -10480,9 +10661,9 @@ function listWorkItems(root) {
       path: rel,
       summary: String(data.summary ?? "") || firstParagraph2(parsed.content),
       code,
-      capabilities: strArray(data.capabilities),
-      decisions: strArray(data.decisions),
-      capsules: strArray(data.capsules),
+      capabilities: strArray2(data.capabilities),
+      decisions: strArray2(data.decisions),
+      capsules: strArray2(data.capsules),
       source,
       domains,
       readiness,
@@ -10928,14 +11109,14 @@ function getPrompt(root, name) {
 }
 
 // src/tools.ts
-import matter12 from "gray-matter";
+import matter15 from "gray-matter";
 
 // ../cli/dist/core.js
 import fs3 from "fs";
 import path3 from "path";
 import { z as z3 } from "zod";
 import { parse as parseYaml10 } from "yaml";
-import matter11 from "gray-matter";
+import matter12 from "gray-matter";
 import matter22 from "gray-matter";
 import { parse as parseYaml62, stringify as stringifyYaml32 } from "yaml";
 import { parse as parseYaml22 } from "yaml";
@@ -10944,25 +11125,27 @@ import { parse as parseYaml52, stringify as stringifyYaml22 } from "yaml";
 import { parse as parseYaml42, stringify as stringifyYaml4 } from "yaml";
 import matter32 from "gray-matter";
 import matter42 from "gray-matter";
-import { parse as parseYaml72 } from "yaml";
 import matter52 from "gray-matter";
+import { parse as parseYaml72 } from "yaml";
+import matter62 from "gray-matter";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname2, join as join22, parse as parse2 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import matter62 from "gray-matter";
 import matter72 from "gray-matter";
-import { parse as parseYaml82, stringify as stringifyYaml42 } from "yaml";
-import fs32 from "fs";
-import path32 from "path";
-import crypto2 from "crypto";
 import matter82 from "gray-matter";
-import crypto3 from "crypto";
-import fs4 from "fs";
 import matter92 from "gray-matter";
+import { parse as parseYaml82, stringify as stringifyYaml42 } from "yaml";
+import fs4 from "fs";
+import path4 from "path";
+import crypto2 from "crypto";
 import matter102 from "gray-matter";
+import crypto3 from "crypto";
+import fs5 from "fs";
+import matter112 from "gray-matter";
+import matter122 from "gray-matter";
 import { parse as parseYaml92, stringify as stringifyYaml5 } from "yaml";
 import { parse as parseYaml102, stringify as stringifyYaml6 } from "yaml";
-import matter112 from "gray-matter";
+import matter13 from "gray-matter";
 function exists2(p) {
   return fs3.existsSync(p);
 }
@@ -11073,8 +11256,8 @@ function loadConfig2(dir) {
   const parsed = configSchema2.safeParse(raw ?? {});
   if (!parsed.success) {
     const issues = parsed.error.issues.map((i) => {
-      const path42 = i.path.join(".");
-      return path42 ? `  - ${path42}: ${i.message}` : `  - ${i.message}`;
+      const path52 = i.path.join(".");
+      return path52 ? `  - ${path52}: ${i.message}` : `  - ${i.message}`;
     }).join("\n");
     throw new ConfigError2(`Invalid .kaddo/config.yml:
 ${issues}`);
@@ -11130,7 +11313,7 @@ function parseImpactAnalysis2(data) {
 }
 function parseArtifact2(filePath, raw) {
   try {
-    const { data } = matter11(raw);
+    const { data } = matter12(raw);
     const globs = Array.isArray(data.code) ? data.code.filter(Boolean) : [];
     return {
       filePath,
@@ -11278,11 +11461,11 @@ function moduleArtifactCoverage2(dir, id) {
   };
 }
 function loadMappedModules2(dir) {
-  const path42 = join3(dir, DESCRIPTOR_PATH2);
-  if (!exists2(path42)) return [];
+  const path52 = join3(dir, DESCRIPTOR_PATH2);
+  if (!exists2(path52)) return [];
   let parsed;
   try {
-    parsed = parseYaml32(readFile2(path42));
+    parsed = parseYaml32(readFile2(path52));
   } catch {
     return [];
   }
@@ -12684,7 +12867,129 @@ function suggestInitiativesForExternalItem(dir, integration, externalId) {
     )
   );
 }
+var RESOURCE_ARTIFACT_TYPE2 = "project-resource";
+function str2(v) {
+  return typeof v === "string" && v.trim() ? v.trim() : null;
+}
+function strArray3(v) {
+  if (Array.isArray(v)) return v.map((x2) => String(x2).trim()).filter(Boolean);
+  if (typeof v === "string" && v.trim()) return [v.trim()];
+  return [];
+}
+function parseInterfaces2(v) {
+  if (!Array.isArray(v)) return [];
+  const out = [];
+  for (const raw of v) {
+    if (!raw || typeof raw !== "object") continue;
+    const o2 = raw;
+    const type = str2(o2.type);
+    if (!type) continue;
+    out.push({
+      type,
+      tool: str2(o2.tool),
+      provider: str2(o2.provider),
+      purpose: str2(o2.purpose),
+      operations: strArray3(o2.operations),
+      environments: strArray3(o2.environments),
+      constraints: str2(o2.constraints)
+    });
+  }
+  return out;
+}
+function parseBoundaries2(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return {};
+  const out = {};
+  for (const [env, val] of Object.entries(v)) {
+    const list22 = strArray3(val);
+    if (list22.length > 0) out[env] = list22;
+  }
+  return out;
+}
+function parseAuth2(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return { mode: null, refs: [] };
+  const o2 = v;
+  const refs = strArray3(o2.refs).filter((r2) => !r2.includes("=") && /^[A-Za-z0-9_.-]+$/.test(r2));
+  return { mode: str2(o2.mode), refs };
+}
+function parseScope2(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return null;
+  const o2 = v;
+  const type = str2(o2.type);
+  if (!type) return null;
+  return { type, module: str2(o2.module) };
+}
+function purposeFromBody2(body) {
+  const m2 = body.match(/^#{1,2}\s+Purpose\s*\n+([\s\S]*?)(?=\n#{1,2}\s|\s*$)/m);
+  const text22 = m2 ? m2[1].trim() : "";
+  return text22 || null;
+}
+function toDetail2(filePath, relPath, raw) {
+  const parsed = matter42(raw);
+  const fm = parsed.data ?? {};
+  const body = parsed.content.trim();
+  const id = str2(fm.id) ?? "";
+  return {
+    id,
+    title: str2(fm.title) ?? id,
+    resourceType: str2(fm.resource_type),
+    provider: str2(fm.provider),
+    environments: strArray3(fm.environments),
+    scope: parseScope2(fm.scope),
+    modules: strArray3(fm.modules),
+    path: relPath,
+    purpose: str2(fm.purpose) ?? purposeFromBody2(body),
+    interfaces: parseInterfaces2(fm.access_interfaces),
+    boundaries: parseBoundaries2(fm.access_boundaries),
+    ...(() => {
+      const a2 = parseAuth2(fm.authentication);
+      return { authRefs: a2.refs, authMode: a2.mode };
+    })(),
+    markdownBody: body
+  };
+}
+function getResources2(dir) {
+  return discoverKnowledge2(dir).filter((a2) => a2.type === RESOURCE_ARTIFACT_TYPE2).map((a2) => {
+    const fm = a2.rawFrontmatter;
+    return {
+      id: a2.id || str2(fm.id) || a2.title,
+      title: a2.title || str2(fm.title) || a2.id,
+      resourceType: str2(fm.resource_type),
+      provider: str2(fm.provider),
+      environments: strArray3(fm.environments),
+      scope: parseScope2(fm.scope),
+      modules: strArray3(fm.modules),
+      path: a2.relPath
+    };
+  }).sort((x2, y) => x2.id.localeCompare(y.id));
+}
+function getResource2(dir, id) {
+  const match = discoverKnowledge2(dir).find(
+    (a2) => a2.type === RESOURCE_ARTIFACT_TYPE2 && (a2.id === id || a2.title === id)
+  );
+  if (!match) return null;
+  const raw = readFile2(match.filePath);
+  return toDetail2(match.filePath, match.relPath, raw);
+}
+function parseWorkItemResources2(fm) {
+  const v = fm.resources;
+  if (!Array.isArray(v)) return [];
+  const out = [];
+  for (const raw of v) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const o2 = raw;
+    const id = str2(o2.id);
+    if (!id) continue;
+    out.push({ id, role: str2(o2.role) ?? "affected" });
+  }
+  return out;
+}
 var KNOWLEDGE22 = "knowledge";
+var RESOURCE_ROLE_EDGE2 = {
+  affected: "affects",
+  implementation: "uses",
+  validation: "validates_with",
+  delivery: "delivers_through"
+};
 var ACTIVE_STATUSES2 = ["draft", "ready", "in-progress", "blocked"];
 var ALL_STATUSES2 = ["draft", "ready", "in-progress", "blocked", "completed"];
 function scopeStatuses2(scope) {
@@ -12721,9 +13026,9 @@ function buildGraph2(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
   ];
   const presentLayers = [];
   for (const layer2 of layerDocs) {
-    const path42 = layer2.files.map((f3) => `${KNOWLEDGE22}/${f3}`).find((rel) => exists2(join3(dir, rel)));
-    if (path42) {
-      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path42 });
+    const path52 = layer2.files.map((f3) => `${KNOWLEDGE22}/${f3}`).find((rel) => exists2(join3(dir, rel)));
+    if (path52) {
+      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path52 });
       presentLayers.push(layer2.id);
     }
   }
@@ -12763,6 +13068,24 @@ function buildGraph2(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
       if (cand.materializedAs) addEdge(candId, `wi:${cand.materializedAs}`, "materialized_as");
     }
   }
+  const resourceTitleById = /* @__PURE__ */ new Map();
+  for (const r2 of getResources2(dir)) {
+    resourceTitleById.set(r2.id, r2.title);
+    const resId = `resource:${r2.id}`;
+    addNode({
+      id: resId,
+      type: "project-resource",
+      label: r2.title ? `${r2.id} ${r2.title}`.trim() : r2.id,
+      path: r2.path
+    });
+    const depModules = new Set(r2.modules);
+    if (r2.scope?.type === "module" && r2.scope.module) depModules.add(r2.scope.module);
+    for (const mod of depModules) {
+      const modId = `module:${mod}`;
+      addNode({ id: modId, type: "module", label: mod });
+      addEdge(modId, resId, "depends_on");
+    }
+  }
   for (const wi of selectedWIs) {
     const id = wi.id || wi.title;
     if (!id || !id.trim()) continue;
@@ -12787,6 +13110,12 @@ function buildGraph2(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
       addNode({ id: capId, type: "capability", label: cap });
       addEdge(wiNodeId, capId, "implements");
     }
+    for (const rel of parseWorkItemResources2(wi.rawFrontmatter)) {
+      const resId = `resource:${rel.id}`;
+      const title = resourceTitleById.get(rel.id);
+      addNode({ id: resId, type: "project-resource", label: title ? `${rel.id} ${title}`.trim() : rel.id });
+      addEdge(wiNodeId, resId, RESOURCE_ROLE_EDGE2[rel.role] ?? "uses");
+    }
     for (const dec of wi.decisions) {
       if (!dec || !dec.trim()) continue;
       const adrId = `adr:${dec}`;
@@ -13280,8 +13609,13 @@ dependencies.
    flags, content/copy, authentication/authorization, notifications, analytics, documentation,
    operations/release \u2014 as affected, reviewed-not-affected, unknown, or not-applicable.
 4. **Module review** \u2014 for multirepo, evaluate each mapped module with the same statuses.
-5. **Completeness review** \u2014 confirm: outcome covered, journey covered, modules assessed, unknowns
-   visible, acceptance criteria end-to-end, scope and out-of-scope coherent.
+5. **Resource review** \u2014 ask: does this change need to observe, modify, validate or deliver against a
+   known external resource of the project (a Project Resource under \`knowledge/tech/resources/\` \u2014
+   database, cloud, API, queue, storage\u2026)? If so, declare it in the WI front matter \`resources:\` with
+   a role (\`affected\`, \`implementation\`, \`validation\`, \`delivery\`). Resources are external systems,
+   distinct from \`affected_modules\` (code). Not every WI needs resources (e.g. a CSS change does not).
+6. **Completeness review** \u2014 confirm: outcome covered, journey covered, modules assessed, resources
+   assessed, unknowns visible, acceptance criteria end-to-end, scope and out-of-scope coherent.
 
 ## Rules
 
@@ -13292,6 +13626,8 @@ dependencies.
 - Include at least one end-to-end acceptance criterion for user-facing changes.
 - Do not reduce a product intent to the first technical implementation found.
 - Evaluate surfaces and modules before proposing files.
+- Consider Project Resources when the scope justifies it; never invent resources not backed by
+  project knowledge, and keep \`resources\` (external systems) separate from \`affected_modules\` (code).
 - This skill refines scope and acceptance criteria but does not approve implementation readiness.
   Readiness requires human confirmation through \`kaddo ready\` or the MCP \`mark_work_item_ready\` action.
 
@@ -14436,6 +14772,16 @@ supporting notes as \`knowledge/tech/discovery/architecture-notes.md\` and decis
 under \`knowledge/tech/decisions/\`. Kaddo still reads the legacy root locations for backward
 compatibility, but new output should use \`discovery/\`.
 
+## Project Resource candidates
+
+When the knowledge describes an external system the project depends on (a database, cloud account,
+API, queue, storage, service\u2026), you may propose it as a **candidate** Project Resource \u2014 never create
+it silently. Discovery \u2260 creation: present candidates for human review and materialize only through
+\`kaddo_create_resource\` / \`kaddo resources create\` with explicit confirmation. Ground every
+candidate in the knowledge (no guessing from ambiguous names). Model the stable system, not its access
+interface (CLI/MCP/SQL/API are interfaces); keep \`resources\` separate from \`affected_modules\`; and
+never include secret values \u2014 only reference names.
+
 ## Quality Checklist
 
 - Every component is backed by evidence from the context pack.
@@ -16979,6 +17325,8 @@ function getWorkItem(dir, workItemId) {
     path: match.relPath,
     // Faithful source of truth: the artifact body already read above, not reconstructed (WI-025).
     markdownBody: body.trim(),
+    // External systems this WI relates to (WI-030), separate from affectedModules (code).
+    resources: parseWorkItemResources2(fm),
     ...parseSystemImpact(dir, fm)
   };
   return { ...detail, refinement: computeRefinementStatus(detail) };
@@ -16987,8 +17335,8 @@ function parseGraphReason(v) {
   if (!v || typeof v !== "object") return null;
   const o2 = v;
   const relationship = typeof o2.relationship === "string" && o2.relationship.trim() ? o2.relationship.trim() : null;
-  const path42 = Array.isArray(o2.path) ? o2.path.map(String).filter(Boolean) : [];
-  return relationship || path42.length ? { relationship, path: path42 } : null;
+  const path52 = Array.isArray(o2.path) ? o2.path.map(String).filter(Boolean) : [];
+  return relationship || path52.length ? { relationship, path: path52 } : null;
 }
 function parseExplain(o2) {
   const refs = Array.isArray(o2.evidence) ? o2.evidence : Array.isArray(o2.evidence_refs) ? o2.evidence_refs : [];
@@ -17043,7 +17391,7 @@ function parseOriginalSnapshot(fm) {
 function readBody(filePath) {
   try {
     const raw = readFile2(filePath);
-    return matter72(raw).content;
+    return matter92(raw).content;
   } catch {
     return "";
   }
@@ -17245,7 +17593,7 @@ function nextWorkItemId(dir) {
   let max = 0;
   const walk = (d3) => {
     if (!exists2(d3)) return;
-    for (const entry of fs32.readdirSync(d3)) {
+    for (const entry of fs4.readdirSync(d3)) {
       const full = join3(d3, entry);
       if (isFile2(full)) {
         const m2 = entry.match(/WI-(\d+)/);
@@ -17258,15 +17606,15 @@ function nextWorkItemId(dir) {
   walk(wiDir);
   return `WI-${String(max + 1).padStart(3, "0")}`;
 }
-function atomicWrite2(filePath, content) {
-  fs32.mkdirSync(path32.dirname(filePath), { recursive: true });
+function atomicWrite3(filePath, content) {
+  fs4.mkdirSync(path4.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  fs32.writeFileSync(tmp, content, "utf-8");
+  fs4.writeFileSync(tmp, content, "utf-8");
   try {
-    fs32.renameSync(tmp, filePath);
+    fs4.renameSync(tmp, filePath);
   } catch (err) {
     try {
-      fs32.rmSync(tmp, { force: true });
+      fs4.rmSync(tmp, { force: true });
     } catch {
     }
     throw err;
@@ -17327,8 +17675,8 @@ function ensureH1(body, title) {
 
 ${trimmed}`;
 }
-function serialize(data, body) {
-  return matter82.stringify(`
+function serialize2(data, body) {
+  return matter102.stringify(`
 ${body.trim()}
 `, data);
 }
@@ -17396,8 +17744,8 @@ function createWorkItem(dir, opts) {
   const relPath = `${WORK_ITEMS_DIR}/draft/${id}-${slugify22(title)}.md`;
   const filePath = join3(dir, relPath);
   if (exists2(filePath)) throw new WorkItemWriteError("INVALID_INPUT", `Work Item file already exists: ${relPath}`);
-  const raw = serialize(data, body);
-  atomicWrite2(filePath, raw);
+  const raw = serialize2(data, body);
+  atomicWrite3(filePath, raw);
   return { id, path: relPath, revision: revisionOf(raw) };
 }
 function dimensionOf(type) {
@@ -17722,6 +18070,7 @@ function buildImplementationHandoff(dir, workItemId) {
   const affectedModules = match.affectedModules;
   const domains = match.domains;
   const scopeConfidence = match.scopeConfidence;
+  const wiResources = parseWorkItemResources2(match.rawFrontmatter);
   const lines = [
     `Implement Work Item ${wiId} \u2014 "${wiTitle}" \u2014 in project "${projectName}" using Kaddo.`,
     "",
@@ -17811,6 +18160,41 @@ function buildImplementationHandoff(dir, workItemId) {
       "Do not copy all legacy knowledge \u2014 assemble proportionally to scope."
     );
   }
+  if (wiResources.length > 0) {
+    lines.push(
+      "",
+      "--- Relevant Resources ---",
+      "",
+      "This Work Item relates to external project resources. The handoff INFORMS you about them \u2014 it",
+      "never connects to them, runs any interface, or reveals credential values. Respect each boundary."
+    );
+    for (const rel of wiResources) {
+      const res = getResource2(dir, rel.id);
+      if (!res) {
+        lines.push("", `- ${rel.id} (role: ${rel.role}) \u2014 definition not found under knowledge/tech/resources/.`);
+        continue;
+      }
+      lines.push("", `- ${res.id} \u2014 ${res.title} (role: ${rel.role})`);
+      if (res.resourceType || res.provider) {
+        lines.push(`    type: ${res.resourceType ?? "\u2014"}${res.provider ? ` \xB7 provider: ${res.provider}` : ""}`);
+      }
+      if (res.purpose) lines.push(`    purpose: ${res.purpose}`);
+      if (res.environments.length > 0) lines.push(`    environments: ${res.environments.join(", ")}`);
+      if (res.interfaces.length > 0) {
+        const ifaces = res.interfaces.map((i) => i.tool || i.provider ? `${i.type} (${i.tool ?? i.provider})` : i.type);
+        lines.push(`    interfaces: ${ifaces.join(", ")}`);
+      }
+      for (const [env, ops] of Object.entries(res.boundaries)) {
+        lines.push(`    boundary (${env}): ${ops.join(", ")}`);
+      }
+      if (res.authRefs.length > 0) lines.push(`    auth references (names only): ${res.authRefs.join(", ")}`);
+    }
+    lines.push(
+      "",
+      "Treat these as knowledge, not availability: an interface being declared does not mean it is",
+      "installed or connected. Do not execute any interface or migration without explicit human confirmation."
+    );
+  }
   lines.push(
     "",
     "--- Implementation Plan ---",
@@ -17831,6 +18215,7 @@ function buildImplementationHandoff(dir, workItemId) {
     projectName,
     lifecycle,
     affectedModules,
+    resources: wiResources,
     domains,
     scopeConfidence,
     hasUnmaterializedDecisions: unmaterialized,
@@ -18082,7 +18467,7 @@ function detectFormat(raw) {
   if (!trimmed) throw new ImportError("EMPTY_INPUT", "Import content is empty.");
   if (trimmed.startsWith("---")) {
     try {
-      const { data } = matter92(trimmed);
+      const { data } = matter112(trimmed);
       if (data && typeof data === "object" && Object.keys(data).length > 0) {
         const d3 = data;
         if (d3.type === "work-item" || d3.id && typeof d3.id === "string" && /^WI-\d+/.test(d3.id)) {
@@ -18104,7 +18489,7 @@ function parseContent(raw) {
   let bodyText = trimmed;
   if (format === "kaddo-frontmatter" || format === "markdown-frontmatter") {
     try {
-      const parsed = matter92(trimmed);
+      const parsed = matter112(trimmed);
       frontmatterFields = parsed.data ?? {};
       bodyText = parsed.content.trim();
     } catch {
@@ -18201,7 +18586,7 @@ function findDuplicateByHash(dir, hash) {
     const raw = readFile2(item.filePath);
     if (!raw) continue;
     try {
-      const { data } = matter92(raw);
+      const { data } = matter112(raw);
       const source = data?.source;
       if (source && typeof source === "object" && !Array.isArray(source)) {
         const s = source;
@@ -18268,7 +18653,7 @@ function importWorkItem(dir, opts) {
         };
       }
       if (opts.onConflict === "replace") {
-        fs4.rmSync(existing.filePath, { force: true });
+        fs5.rmSync(existing.filePath, { force: true });
         replacedWorkItem = existing.workItemId;
       }
     }
@@ -18710,8 +19095,8 @@ async function handleJiraResponse(res) {
   }
   return await res.json();
 }
-async function jiraFetch(baseUrl, path42, auth, timeoutMs, params) {
-  const url = new URL(path42, baseUrl + "/");
+async function jiraFetch(baseUrl, path52, auth, timeoutMs, params) {
+  const url = new URL(path52, baseUrl + "/");
   if (params) for (const [k2, v] of Object.entries(params)) url.searchParams.set(k2, v);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -18729,8 +19114,8 @@ async function jiraFetch(baseUrl, path42, auth, timeoutMs, params) {
     clearTimeout(timer);
   }
 }
-async function jiraPost(baseUrl, path42, auth, timeoutMs, body) {
-  const url = new URL(path42, baseUrl + "/");
+async function jiraPost(baseUrl, path52, auth, timeoutMs, body) {
+  const url = new URL(path52, baseUrl + "/");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -19096,7 +19481,7 @@ function buildInitiativeContent(id, input) {
   if (input.priority) data.priority = input.priority;
   if (input.source) data.source = input.source;
   if (input.sourceId) data.source_id = input.sourceId;
-  return matter112.stringify("\n" + (input.body ?? defaultBody(input.title.trim())), data);
+  return matter13.stringify("\n" + (input.body ?? defaultBody(input.title.trim())), data);
 }
 function createInitiative(dir, input) {
   if (!input.title?.trim()) throw new InitiativeWriteError("Initiative title is required.");
@@ -19120,10 +19505,10 @@ function transitionInitiative(dir, id, to) {
     throw new InitiativeWriteError(`Invalid transition ${ini.status} \u2192 ${to}.`);
   }
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter112(raw, {});
+  const { data, content } = matter13(raw, {});
   data.status = to;
   if (to === "completed") data.completed_at = today2();
-  const newContent = matter112.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after transition.");
@@ -19133,7 +19518,7 @@ function addCandidate(dir, id, candidate) {
   const ini = getInitiative(dir, id);
   if (!ini) throw new InitiativeWriteError(`Initiative ${id} not found.`);
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter112(raw, {});
+  const { data, content } = matter13(raw, {});
   const existing = Array.isArray(data.candidates) ? data.candidates : [];
   const fallbackId = `WI-CANDIDATE-${String(existing.length + 1).padStart(3, "0")}`;
   const normalized = normalizeCandidate(candidate, fallbackId);
@@ -19141,7 +19526,7 @@ function addCandidate(dir, id, candidate) {
     throw new InitiativeWriteError(`Candidate ${normalized.id} already exists in ${id}.`);
   }
   data.candidates = [...existing, candidateToData(normalized)];
-  const newContent = matter112.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after adding a candidate.");
@@ -19151,7 +19536,7 @@ function updateInitiative(dir, id, patch) {
   const ini = getInitiative(dir, id);
   if (!ini) throw new InitiativeWriteError(`Initiative ${id} not found.`);
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter112(raw, {});
+  const { data, content } = matter13(raw, {});
   if (patch.title !== void 0) {
     if (!patch.title.trim()) throw new InitiativeWriteError("Initiative title cannot be empty.");
     data.title = patch.title.trim();
@@ -19161,7 +19546,7 @@ function updateInitiative(dir, id, patch) {
   if (patch.knowledgeLevel !== void 0) data.knowledge_level = patch.knowledgeLevel;
   if (patch.domains !== void 0) data.domains = patch.domains;
   if (patch.relatedCapabilities !== void 0) data.related_capabilities = patch.relatedCapabilities;
-  const newContent = matter112.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after update.");
@@ -19179,10 +19564,10 @@ function addExternalLink(dir, id, link) {
     throw new InitiativeWriteError(`External link ${link.integration}:${link.externalId} already exists on ${id}.`);
   }
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter112(raw, {});
+  const { data, content } = matter13(raw, {});
   const existing = Array.isArray(data.external_links) ? data.external_links : [];
   data.external_links = [...existing, externalLinkToData(link)];
-  const newContent = matter112.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after adding an external link.");
@@ -19251,7 +19636,7 @@ function buildWorkItemContent(wiId, iniId, candidate) {
     "_What did we learn? Update after completion._",
     ""
   ].join("\n");
-  return matter112.stringify("\n" + body, data);
+  return matter13.stringify("\n" + body, data);
 }
 function materializeCandidate(dir, id, candidateId) {
   const ini = getInitiative(dir, id);
@@ -19268,13 +19653,13 @@ function materializeCandidate(dir, id, candidateId) {
   ensureDir2(join3(dir, DRAFT_DIR));
   writeFile2(join3(dir, DRAFT_DIR, fileName), buildWorkItemContent(wiId, ini.id, candidate));
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter112(raw, {});
+  const { data, content } = matter13(raw, {});
   const cands = Array.isArray(data.candidates) ? data.candidates : [];
   for (const c of cands) {
     if (c && typeof c === "object" && String(c.id) === candidateId) c.materialized_as = wiId;
   }
   data.candidates = cands;
-  const newContent = matter112.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after materialization.");
@@ -19385,6 +19770,164 @@ function evaluateInitiativeCompletion(dir, ini) {
   };
 }
 
+// ../cli/src/core/resource-write.ts
+import fs6 from "fs";
+import path5 from "path";
+import matter14 from "gray-matter";
+var RESOURCES_DIR = "knowledge/tech/resources";
+var ResourceWriteError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ResourceWriteError";
+  }
+  code;
+};
+function slug4(s) {
+  return s.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+}
+function atomicWrite(filePath, content) {
+  const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  fs6.writeFileSync(tmp, content, "utf-8");
+  fs6.renameSync(tmp, filePath);
+}
+function sanitizeRefs(refs) {
+  if (!Array.isArray(refs)) return [];
+  return refs.map((r2) => String(r2).trim()).filter((r2) => r2 && !r2.includes("=") && /^[A-Za-z0-9_.-]+$/.test(r2));
+}
+function allResourceArtifacts(dir) {
+  return discoverKnowledge(dir).filter((a2) => a2.type === RESOURCE_ARTIFACT_TYPE);
+}
+function nextResourceId(dir, title, explicit) {
+  const existing = new Set(allResourceArtifacts(dir).map((a2) => (a2.id || "").toUpperCase()));
+  if (explicit && explicit.trim()) return explicit.trim();
+  const base = `RES-${slug4(title) || "resource"}`;
+  if (!existing.has(base.toUpperCase())) return base;
+  for (let i = 2; i < 1e3; i++) {
+    const candidate = `${base}-${i}`;
+    if (!existing.has(candidate.toUpperCase())) return candidate;
+  }
+  throw new ResourceWriteError("ID_EXHAUSTED", `Could not derive a unique id for "${title}".`);
+}
+function validateResource(dir, input) {
+  const findings = [];
+  if (input.resourceType && !RESOURCE_TYPES.includes(input.resourceType)) {
+    findings.push({ level: "warning", message: `Unknown resource_type "${input.resourceType}" (not in the known set).` });
+  }
+  for (const i of input.accessInterfaces ?? []) {
+    if (i.type && !INTERFACE_TYPES.includes(i.type)) {
+      findings.push({ level: "warning", message: `Unknown access interface type "${i.type}".` });
+    }
+  }
+  const mapped = loadMappedModules(dir).map((m2) => m2.id);
+  if (mapped.length > 0) {
+    const refs = /* @__PURE__ */ new Set();
+    if (input.scope?.type === "module" && input.scope.module) refs.add(input.scope.module);
+    for (const m2 of input.modules ?? []) refs.add(m2);
+    for (const m2 of refs) {
+      if (!mapped.includes(m2)) findings.push({ level: "warning", message: `Module "${m2}" is not in .kaddo/modules.yml.` });
+    }
+  }
+  if (input.scope && input.scope.type === "module" && !input.scope.module) {
+    findings.push({ level: "error", message: 'scope.type "module" requires a module id.' });
+  }
+  return findings;
+}
+function buildFrontmatter(id, input, base = {}) {
+  const data = { ...base };
+  data.type = RESOURCE_ARTIFACT_TYPE;
+  data.id = id;
+  if (input.title != null) data.title = input.title;
+  if (input.resourceType != null) data.resource_type = input.resourceType;
+  if (input.provider != null) data.provider = input.provider;
+  if (input.environments != null) data.environments = input.environments;
+  if (input.scope != null) data.scope = input.scope.module ? { type: input.scope.type, module: input.scope.module } : { type: input.scope.type };
+  if (input.modules != null) data.modules = input.modules;
+  if (input.accessInterfaces != null) data.access_interfaces = input.accessInterfaces;
+  if (input.accessBoundaries != null) data.access_boundaries = input.accessBoundaries;
+  if (input.authentication != null) {
+    const mode = input.authentication.mode;
+    const refs = sanitizeRefs(input.authentication.refs);
+    data.authentication = { ...mode ? { mode } : {}, ...refs.length ? { refs } : {} };
+  }
+  return data;
+}
+function serialize(data, body) {
+  return matter14.stringify(`
+${body.trim()}
+`, data);
+}
+function createResource(dir, input) {
+  const title = (input.title ?? "").trim();
+  if (!title) throw new ResourceWriteError("INVALID_INPUT", "A resource title is required.");
+  const resourceType = (input.resourceType ?? "").trim();
+  if (!resourceType) throw new ResourceWriteError("INVALID_INPUT", "A resource_type is required.");
+  const findings = validateResource(dir, input);
+  if (findings.some((f3) => f3.level === "error")) {
+    throw new ResourceWriteError("VALIDATION_FAILED", findings.filter((f3) => f3.level === "error").map((f3) => f3.message).join("; "));
+  }
+  const existing = allResourceArtifacts(dir);
+  if (input.id && existing.some((a2) => (a2.id || "").toUpperCase() === input.id.toUpperCase())) {
+    throw new ResourceWriteError("DUPLICATE", `A resource with id "${input.id}" already exists.`);
+  }
+  if (existing.some((a2) => (a2.title || "").toLowerCase() === title.toLowerCase())) {
+    throw new ResourceWriteError("DUPLICATE", `A resource titled "${title}" already exists.`);
+  }
+  const id = nextResourceId(dir, title, input.id);
+  const data = buildFrontmatter(id, input);
+  const body = `# Purpose
+
+${(input.purpose ?? "").trim() || "TODO: describe what this resource is for."}`;
+  const relPath = `${RESOURCES_DIR}/${slug4(title) || slug4(id)}.md`;
+  const filePath = join(dir, relPath);
+  if (exists(filePath)) throw new ResourceWriteError("DUPLICATE", `Resource file already exists: ${relPath}`);
+  ensureDir(path5.dirname(filePath));
+  atomicWrite(filePath, serialize(data, body));
+  return { id, path: relPath, findings };
+}
+function updateResource(dir, id, input) {
+  const match = allResourceArtifacts(dir).find((a2) => a2.id === id || a2.title === id);
+  if (!match) throw new ResourceWriteError("NOT_FOUND", `Project Resource "${id}" not found.`);
+  const findings = validateResource(dir, input);
+  if (findings.some((f3) => f3.level === "error")) {
+    throw new ResourceWriteError("VALIDATION_FAILED", findings.filter((f3) => f3.level === "error").map((f3) => f3.message).join("; "));
+  }
+  const raw = readFile(match.filePath);
+  const parsed = matter14(raw);
+  const base = parsed.data ?? {};
+  const data = buildFrontmatter(match.id || id, input, base);
+  let body = parsed.content.trim();
+  if (input.purpose != null) {
+    const purpose = `# Purpose
+
+${input.purpose.trim()}`;
+    body = /^#\s+Purpose/m.test(body) ? body.replace(/#\s+Purpose[\s\S]*?(?=\n#\s|\n*$)/, purpose + "\n") : `${purpose}
+
+${body}`.trim();
+  }
+  atomicWrite(match.filePath, serialize(data, body));
+  return { id: match.id || id, path: match.relPath, findings };
+}
+function getResourceReferences(dir, id) {
+  const refs = [];
+  for (const wi of discoverWorkItems(dir)) {
+    for (const rel of parseWorkItemResources(wi.rawFrontmatter)) {
+      if (rel.id === id) refs.push({ kind: "work-item", id: wi.id || wi.title, role: rel.role, path: wi.relPath });
+    }
+  }
+  return refs;
+}
+function deleteResource(dir, id, opts = {}) {
+  const match = allResourceArtifacts(dir).find((a2) => a2.id === id || a2.title === id);
+  if (!match) throw new ResourceWriteError("NOT_FOUND", `Project Resource "${id}" not found.`);
+  const references = getResourceReferences(dir, match.id || id);
+  if (!opts.confirm) {
+    return { deleted: false, preview: { id: match.id || id, references } };
+  }
+  fs6.rmSync(match.filePath, { force: true });
+  return { deleted: true, path: match.relPath };
+}
+
 // src/tools.ts
 var ok = (data) => ({ ok: true, data });
 var fail = (message) => ({ ok: false, message });
@@ -19480,12 +20023,12 @@ function markWorkItemReady(root, id, confirm2) {
   }
   const raw = readText(root, item.path);
   if (!raw) return fail(`Could not read Work Item file: ${item.path}`);
-  const parsed = matter12(raw);
+  const parsed = matter15(raw);
   const data = { ...parsed.data };
   const today3 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   data.status = "ready";
   data.ready_at = today3;
-  const newContent = matter12.stringify(parsed.content, data);
+  const newContent = matter15.stringify(parsed.content, data);
   const posixPath = item.path.replace(/\\/g, "/");
   let newRelPath = item.path;
   if (posixPath.includes("/work-items/draft/")) {
@@ -19648,11 +20191,72 @@ function setTelemetryConsentTool(root, args) {
   persistConsent(root, consent);
   return ok({ applied: true, consent, message: `Telemetry ${consent}.` });
 }
+function listResourcesTool(root) {
+  return ok(getResources(root));
+}
+function getResourceTool(root, id) {
+  const resource = getResource(root, id);
+  if (!resource) return fail(`Project Resource "${id}" not found.`);
+  return ok(resource);
+}
+function toResourceInput(args) {
+  const input = {};
+  if (args.title != null) input.title = args.title;
+  if (args.resource_type != null) input.resourceType = args.resource_type;
+  if (args.provider != null) input.provider = args.provider;
+  if (args.environments != null) input.environments = args.environments;
+  if (args.scope != null || args.module != null) {
+    const type = args.scope || (args.module ? "module" : "system");
+    input.scope = type === "module" ? { type: "module", module: args.module ?? null } : { type: "system" };
+  }
+  if (args.modules != null) input.modules = args.modules;
+  if (args.purpose != null) input.purpose = args.purpose;
+  if (args.access_interfaces != null) input.accessInterfaces = args.access_interfaces;
+  if (args.authentication != null) input.authentication = args.authentication;
+  return input;
+}
+function createResourceTool(root, args, confirm2) {
+  const input = toResourceInput(args);
+  const findings = validateResource(root, input);
+  if (!confirm2) {
+    return ok({ status: "needs_confirmation", action: "create", proposal: input, findings, message: "Re-call with confirm=true to create this resource." });
+  }
+  try {
+    return ok({ status: "created", ...createResource(root, input) });
+  } catch (e) {
+    return fail(e instanceof ResourceWriteError ? e.message : String(e));
+  }
+}
+function updateResourceTool(root, id, args, confirm2) {
+  if (!getResource(root, id)) return fail(`Project Resource "${id}" not found.`);
+  const input = toResourceInput(args);
+  const findings = validateResource(root, input);
+  if (!confirm2) {
+    return ok({ status: "needs_confirmation", action: "update", id, changes: input, findings, message: "Re-call with confirm=true to apply this update." });
+  }
+  try {
+    return ok({ status: "updated", ...updateResource(root, id, input) });
+  } catch (e) {
+    return fail(e instanceof ResourceWriteError ? e.message : String(e));
+  }
+}
+function deleteResourceTool(root, id, confirm2) {
+  if (!getResource(root, id)) return fail(`Project Resource "${id}" not found.`);
+  if (!confirm2) {
+    const references = getResourceReferences(root, id);
+    return ok({ status: "needs_confirmation", action: "delete", id, references, message: "Re-call with confirm=true to delete. References in other artifacts are NOT removed." });
+  }
+  try {
+    return ok({ status: "deleted", ...deleteResource(root, id, { confirm: true }) });
+  } catch (e) {
+    return fail(e instanceof ResourceWriteError ? e.message : String(e));
+  }
+}
 
 // src/multirepo.ts
-import fs5 from "fs";
-import path4 from "path";
-import matter13 from "gray-matter";
+import fs7 from "fs";
+import path6 from "path";
+import matter16 from "gray-matter";
 import { parse as parseYaml11, stringify as stringifyYaml7 } from "yaml";
 var ok2 = (data) => ({ ok: true, data });
 var fail2 = (message) => ({ ok: false, message });
@@ -19672,24 +20276,24 @@ function isCore2(config) {
   return projectRole2(config) === "core";
 }
 function readModuleFile(root, repoPath, relFile) {
-  const moduleDir = path4.resolve(root, repoPath);
-  const abs = path4.resolve(moduleDir, relFile);
+  const moduleDir = path6.resolve(root, repoPath);
+  const abs = path6.resolve(moduleDir, relFile);
   if (!abs.startsWith(moduleDir)) return null;
-  if (!fs5.existsSync(abs) || !fs5.statSync(abs).isFile()) return null;
-  return fs5.readFileSync(abs, "utf-8");
+  if (!fs7.existsSync(abs) || !fs7.statSync(abs).isFile()) return null;
+  return fs7.readFileSync(abs, "utf-8");
 }
 function detectModuleStatus2(root, repoPath) {
-  const moduleDir = path4.resolve(root, repoPath);
-  if (!fs5.existsSync(moduleDir)) {
+  const moduleDir = path6.resolve(root, repoPath);
+  if (!fs7.existsSync(moduleDir)) {
     return { status: "missing", configured: false, moduleContext: false, currentState: false, codebase: false, warning: `Directory \`${repoPath}\` does not exist.` };
   }
-  const configPath = path4.join(moduleDir, ".kaddo", "config.yml");
-  if (!fs5.existsSync(configPath)) {
+  const configPath = path6.join(moduleDir, ".kaddo", "config.yml");
+  if (!fs7.existsSync(configPath)) {
     return { status: "not_configured", configured: false, moduleContext: false, currentState: false, codebase: false, warning: `Run \`kaddo init\` inside \`${repoPath}\` and select multirepo \u2192 module.` };
   }
   let parsed = null;
   try {
-    parsed = parseYaml11(fs5.readFileSync(configPath, "utf-8"));
+    parsed = parseYaml11(fs7.readFileSync(configPath, "utf-8"));
   } catch {
   }
   const role = parsed?.project?.role ?? parsed?.multirepo?.role;
@@ -19700,14 +20304,14 @@ function detectModuleStatus2(root, repoPath) {
     status: "configured",
     configured: true,
     role: "module",
-    moduleContext: fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "module", "module-context.md")) || fs5.existsSync(path4.join(moduleDir, "knowledge", "module", "module-context.md")),
-    currentState: fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "current-state.md")),
-    codebase: fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "codebase.md"))
+    moduleContext: fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "module", "module-context.md")) || fs7.existsSync(path6.join(moduleDir, "knowledge", "module", "module-context.md")),
+    currentState: fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "current-state.md")),
+    codebase: fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "codebase.md"))
   };
 }
 function resolveModuleContextPath(root, repoPath) {
-  const moduleDir = path4.resolve(root, repoPath);
-  if (fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "module", "module-context.md"))) {
+  const moduleDir = path6.resolve(root, repoPath);
+  if (fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "module", "module-context.md"))) {
     return "knowledge/tech/module/module-context.md";
   }
   return "knowledge/module/module-context.md";
@@ -19804,7 +20408,7 @@ function validateWorkItemModulesTool(root, args) {
   if (!wi) return fail2(`Work Item "${args.workItemId}" not found.`);
   const raw = readText(root, wi.path);
   if (!raw) return fail2(`Could not read Work Item file.`);
-  const parsed = matter13(raw);
+  const parsed = matter16(raw);
   const data = parsed.data;
   const affectedModules = Array.isArray(data.affected_modules) ? data.affected_modules.map(String) : [];
   const codeEntries = Array.isArray(data.code) ? data.code.filter((c) => typeof c === "object" && c !== null).map((c) => ({ repo: typeof c.repo === "string" ? c.repo : void 0, paths: Array.isArray(c.paths) ? c.paths.map(String) : [] })) : [];
@@ -19857,7 +20461,7 @@ function getWorkItemContextTool(root, args) {
   if (!wi) return fail2(`Work Item "${args.workItemId}" not found.`);
   const raw = readText(root, wi.path);
   if (!raw) return fail2(`Could not read Work Item file.`);
-  const parsed = matter13(raw);
+  const parsed = matter16(raw);
   const data = parsed.data;
   const affectedModules = Array.isArray(data.affected_modules) ? data.affected_modules.map(String) : [];
   const codeEntries = Array.isArray(data.code) ? data.code.filter((c) => typeof c === "object" && c !== null).map((c) => ({ repo: typeof c.repo === "string" ? c.repo : void 0, paths: Array.isArray(c.paths) ? c.paths.map(String) : [] })) : [];
@@ -19911,15 +20515,15 @@ function extractSection(content, heading) {
   return out;
 }
 function buildBranchStrategy(wi, affectedModules, codeEntries, descriptor) {
-  const slug5 = slugify4(wi.title);
+  const slug6 = slugify4(wi.title);
   const wiLower = wi.id.toLowerCase();
-  const coreBranch = `feature/${wiLower}-${slug5}`;
+  const coreBranch = `feature/${wiLower}-${slug6}`;
   const moduleBranches = {};
   const commitMessages = {};
   for (const modId of affectedModules) {
     const mod = (descriptor.modules ?? []).find((m2) => m2.id === modId);
     const repo = mod ? moduleRepoPath(mod) || modId : modId;
-    moduleBranches[repo] = `feature/${wiLower}-${modId}-${slug5.slice(0, 20)}`;
+    moduleBranches[repo] = `feature/${wiLower}-${modId}-${slug6.slice(0, 20)}`;
     commitMessages[repo] = `fix(${wiLower}): update ${modId}`;
   }
   commitMessages["core"] = `docs(${wiLower}): capture cross-repo implementation summary`;
@@ -19943,7 +20547,7 @@ function suggestBranchStrategyTool(root, args) {
   if (!wi) return fail2(`Work Item "${args.workItemId}" not found.`);
   const raw = readText(root, wi.path);
   if (!raw) return fail2(`Could not read Work Item file.`);
-  const parsed = matter13(raw);
+  const parsed = matter16(raw);
   const data = parsed.data;
   const affectedModules = Array.isArray(data.affected_modules) ? data.affected_modules.map(String) : [];
   const codeEntries = Array.isArray(data.code) ? data.code.filter((c) => typeof c === "object" && c !== null).map((c) => ({ repo: typeof c.repo === "string" ? c.repo : void 0, paths: Array.isArray(c.paths) ? c.paths.map(String) : [] })) : [];
@@ -20092,31 +20696,31 @@ function modulesDiscoverTool(root, args) {
   const sysName = config.system?.name ?? config.project?.name ?? "";
   const workspaceRoots2 = config.multirepo?.workspace_roots ?? [".."];
   const IGNORED = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "coverage", "vendor", ".next", "out", "tmp", "temp", ".kaddo"]);
-  const coreAbs = path4.resolve(root);
+  const coreAbs = path6.resolve(root);
   const discovered = [];
   for (const wr of workspaceRoots2) {
-    const rootAbs = path4.resolve(root, wr);
-    if (!fs5.existsSync(rootAbs) || !fs5.statSync(rootAbs).isDirectory()) continue;
+    const rootAbs = path6.resolve(root, wr);
+    if (!fs7.existsSync(rootAbs) || !fs7.statSync(rootAbs).isDirectory()) continue;
     let entries;
     try {
-      entries = fs5.readdirSync(rootAbs);
+      entries = fs7.readdirSync(rootAbs);
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (IGNORED.has(entry)) continue;
-      const candidateAbs = path4.resolve(rootAbs, entry);
-      if (!fs5.statSync(candidateAbs).isDirectory()) continue;
+      const candidateAbs = path6.resolve(rootAbs, entry);
+      if (!fs7.statSync(candidateAbs).isDirectory()) continue;
       if (candidateAbs === coreAbs) continue;
-      const relPath = path4.relative(root, candidateAbs).replace(/\\/g, "/");
-      const cfgPath = path4.join(candidateAbs, ".kaddo", "config.yml");
-      if (!fs5.existsSync(cfgPath)) {
+      const relPath = path6.relative(root, candidateAbs).replace(/\\/g, "/");
+      const cfgPath = path6.join(candidateAbs, ".kaddo", "config.yml");
+      if (!fs7.existsSync(cfgPath)) {
         discovered.push({ id: entry, path: relPath, status: "not_configured", eligibleForMapping: false });
         continue;
       }
       let parsed = null;
       try {
-        parsed = parseYaml11(fs5.readFileSync(cfgPath, "utf-8"));
+        parsed = parseYaml11(fs7.readFileSync(cfgPath, "utf-8"));
       } catch {
       }
       const role = parsed?.project?.role ?? parsed?.multirepo?.role;
@@ -20190,8 +20794,8 @@ ${list3(data.owners)}
 
 // ../cli/src/core/system-topology.ts
 import { parse as parseYaml12, stringify as stringifyYaml8 } from "yaml";
-import fs6 from "fs";
-import path5 from "path";
+import fs8 from "fs";
+import path7 from "path";
 import crypto from "crypto";
 var TOPOLOGY_FILE2 = "knowledge/tech/system-topology.yml";
 var SYSTEM_ENTITY_KINDS2 = /* @__PURE__ */ new Set([
@@ -20563,16 +21167,16 @@ function findSystemPaths(dir, source, target, opts = {}) {
     out.get(r2.source).push(r2.target);
   }
   const paths = [];
-  const walk = (node, path7) => {
+  const walk = (node, path9) => {
     if (paths.length >= 20) return;
-    if (node === target && path7.length > 1) {
-      paths.push([...path7]);
+    if (node === target && path9.length > 1) {
+      paths.push([...path9]);
       return;
     }
-    if (path7.length > maxDepth) return;
+    if (path9.length > maxDepth) return;
     for (const nxt of out.get(node) ?? []) {
-      if (path7.includes(nxt)) continue;
-      walk(nxt, [...path7, nxt]);
+      if (path9.includes(nxt)) continue;
+      walk(nxt, [...path9, nxt]);
     }
   };
   walk(source, [source]);
@@ -20597,14 +21201,14 @@ function getImpactCandidates(dir, seedIds, opts = {}) {
         existing.reason.push(reason);
         continue;
       }
-      const path7 = findSystemPaths(dir, seed, n.id, { maxDepth: opts.maxDepth ?? DEFAULT_MAX_DEPTH })[0];
+      const path9 = findSystemPaths(dir, seed, n.id, { maxDepth: opts.maxDepth ?? DEFAULT_MAX_DEPTH })[0];
       candidates.set(n.id, {
         nodeId: n.id,
         label: n.label,
         kind: n.type,
         ...n.moduleId ? { moduleId: n.moduleId } : {},
         reason: [reason],
-        ...path7 ? { graphPath: path7.map((id) => byId.get(id)?.label ?? id) } : {},
+        ...path9 ? { graphPath: path9.map((id) => byId.get(id)?.label ?? id) } : {},
         ...n.implementationRefs?.length ? { implementationRefs: n.implementationRefs } : {},
         ...n.knowledgeRefs?.length ? { knowledgeRefs: n.knowledgeRefs } : {},
         status: "candidate",
@@ -20703,14 +21307,14 @@ function systemImpactCandidatesTool(root, args) {
 }
 
 // ../cli/src/services/integrations.ts
-import matter15 from "gray-matter";
+import matter18 from "gray-matter";
 import { parse as parseYaml13, stringify as stringifyYaml9 } from "yaml";
 
 // ../cli/src/core/work-item-write.ts
-import fs7 from "fs";
-import path6 from "path";
+import fs9 from "fs";
+import path8 from "path";
 import crypto4 from "crypto";
-import matter14 from "gray-matter";
+import matter17 from "gray-matter";
 var SECTION_ORDER2 = [
   "Actor",
   "Outcome",
@@ -21378,8 +21982,8 @@ async function handleJiraResponse2(res) {
   }
   return await res.json();
 }
-async function jiraFetch2(baseUrl, path7, auth, timeoutMs, params) {
-  const url = new URL(path7, baseUrl + "/");
+async function jiraFetch2(baseUrl, path9, auth, timeoutMs, params) {
+  const url = new URL(path9, baseUrl + "/");
   if (params) for (const [k2, v] of Object.entries(params)) url.searchParams.set(k2, v);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -21397,8 +22001,8 @@ async function jiraFetch2(baseUrl, path7, auth, timeoutMs, params) {
     clearTimeout(timer);
   }
 }
-async function jiraPost2(baseUrl, path7, auth, timeoutMs, body) {
-  const url = new URL(path7, baseUrl + "/");
+async function jiraPost2(baseUrl, path9, auth, timeoutMs, body) {
+  const url = new URL(path9, baseUrl + "/");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -21758,7 +22362,7 @@ async function integrationsWorkItemTool(root, args) {
 }
 
 // ../cli/src/core/context-pack.ts
-import matter16 from "gray-matter";
+import matter19 from "gray-matter";
 var CONTEXT_PACK_VERSION = "1";
 var ARCH_DIR4 = "knowledge";
 function readScanJson(dir) {
@@ -21771,7 +22375,7 @@ function readScanJson(dir) {
   }
 }
 function firstParagraph4(markdown) {
-  const body = matter16(markdown).content.trim();
+  const body = matter19(markdown).content.trim();
   const para = body.split("\n\n").map((p) => p.trim()).find((p) => p && !p.startsWith("#"));
   return para ?? "";
 }
@@ -21825,6 +22429,8 @@ function toContextWorkItem(a2) {
   wi.validationStatus = a2.validationStatus || (isHistorical ? "not-assessed" : void 0);
   wi.releaseStatus = a2.releaseStatus || (isHistorical ? "not-assessed" : void 0);
   if (a2.affectedModules.length > 0) wi.affectedModules = a2.affectedModules;
+  const wiResources = parseWorkItemResources(a2.rawFrontmatter);
+  if (wiResources.length > 0) wi.resources = wiResources;
   if (a2.scopeConfidence) wi.scopeConfidence = a2.scopeConfidence;
   if (a2.moduleCoverage) wi.moduleCoverage = a2.moduleCoverage;
   if (a2.impactAnalysis) wi.impactAnalysis = a2.impactAnalysis;
@@ -22736,7 +23342,7 @@ function requireKnowledge(root) {
     throw new KaddoMcpError("Knowledge repository not found. Run `kaddo bootstrap` first.");
   }
 }
-function slug4(s) {
+function slug5(s) {
   return s.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
 }
 function generateContext(root) {
@@ -22869,7 +23475,7 @@ function generateCapsuleDraft(root) {
   const config = requireConfig(root);
   requireKnowledge(root);
   const capsule = buildCapsule(root, config);
-  const name = slug4(config.project.name);
+  const name = slug5(config.project.name);
   const md = `.kaddo/exports/${name}.capsule.md`;
   const json = `.kaddo/exports/${name}.capsule.json`;
   writeDerived(root, md, renderCapsuleMarkdown(capsule));
@@ -23157,6 +23763,63 @@ function createServer(root) {
     },
     async (args) => toolText(guarded(root, () => markWorkItemReady(root, args.id, args.confirm)))
   );
+  server.registerTool(
+    "kaddo_list_resources",
+    { title: "List Project Resources", description: "List external systems the project uses (databases, cloud, APIs\u2026), read-only, no secrets.", inputSchema: {} },
+    async () => toolText(guarded(root, () => listResourcesTool(root)))
+  );
+  server.registerTool(
+    "kaddo_get_resource",
+    { title: "Get Project Resource", description: "Get one Project Resource by ID: purpose, environments, access interfaces, boundaries and auth references (never values).", inputSchema: { id: z4.string() } },
+    async (args) => toolText(guarded(root, () => getResourceTool(root, args.id)))
+  );
+  const resourceFields = {
+    title: z4.string().optional(),
+    resource_type: z4.string().optional(),
+    provider: z4.string().optional(),
+    environments: z4.array(z4.string()).optional(),
+    scope: z4.string().optional(),
+    module: z4.string().optional(),
+    modules: z4.array(z4.string()).optional(),
+    purpose: z4.string().optional(),
+    access_interfaces: z4.array(z4.object({
+      type: z4.string(),
+      tool: z4.string().optional(),
+      provider: z4.string().optional(),
+      purpose: z4.string().optional(),
+      operations: z4.array(z4.string()).optional(),
+      environments: z4.array(z4.string()).optional(),
+      constraints: z4.string().optional()
+    })).optional(),
+    authentication: z4.object({ mode: z4.string().optional(), refs: z4.array(z4.string()).optional() }).optional()
+  };
+  server.registerTool(
+    "kaddo_create_resource",
+    {
+      title: "Create Project Resource",
+      description: "Propose creating a Project Resource. Without confirm, returns a preview + validation findings (writes nothing). With confirm=true, Core persists it as Markdown. Never include credential values \u2014 only reference names.",
+      inputSchema: { ...resourceFields, confirm: z4.boolean().optional() }
+    },
+    async (args) => toolText(guarded(root, () => createResourceTool(root, args, args.confirm)))
+  );
+  server.registerTool(
+    "kaddo_update_resource",
+    {
+      title: "Update Project Resource",
+      description: "Propose updating a Project Resource (no-lossy). Without confirm, returns a preview; with confirm=true, Core applies it. Never include credential values.",
+      inputSchema: { id: z4.string(), ...resourceFields, confirm: z4.boolean().optional() }
+    },
+    async (args) => toolText(guarded(root, () => updateResourceTool(root, args.id, args, args.confirm)))
+  );
+  server.registerTool(
+    "kaddo_delete_resource",
+    {
+      title: "Delete Project Resource",
+      description: "Delete a Project Resource. Without confirm, returns what references it (writes nothing); with confirm=true, Core removes only the resource \u2014 references in other artifacts are left intact.",
+      inputSchema: { id: z4.string(), confirm: z4.boolean().optional() }
+    },
+    async (args) => toolText(guarded(root, () => deleteResourceTool(root, args.id, args.confirm)))
+  );
   server.registerTool(
     "kaddo_list_capsules",
     { title: "List Knowledge Capsules", description: "List registered external Knowledge Capsules.", inputSchema: {} },