@kaddo/mcp 3.115.0 → 3.116.0

package/dist/index.js

@@ -371,6 +371,9 @@ function exists(p) {
 function readFile(p) {
   return fs2.readFileSync(p, "utf-8");
 }
+function ensureDir(dirPath) {
+  fs2.mkdirSync(dirPath, { recursive: true });
+}
 function readDir(dirPath) {
   if (!exists(dirPath)) return [];
   return fs2.readdirSync(dirPath);
@@ -485,8 +488,8 @@ function loadConfig(dir) {
   const parsed = configSchema.safeParse(raw ?? {});
   if (!parsed.success) {
     const issues = parsed.error.issues.map((i) => {
-      const path7 = i.path.join(".");
-      return path7 ? `  - ${path7}: ${i.message}` : `  - ${i.message}`;
+      const path9 = i.path.join(".");
+      return path9 ? `  - ${path9}: ${i.message}` : `  - ${i.message}`;
     }).join("\n");
     throw new ConfigError(`Invalid .kaddo/config.yml:
 ${issues}`);
@@ -927,11 +930,11 @@ function moduleArtifactCoverage(dir, id) {
   };
 }
 function loadMappedModules(dir) {
-  const path7 = join(dir, DESCRIPTOR_PATH);
-  if (!exists(path7)) return [];
+  const path9 = join(dir, DESCRIPTOR_PATH);
+  if (!exists(path9)) return [];
   let parsed;
   try {
-    parsed = parseYaml4(readFile(path7));
+    parsed = parseYaml4(readFile(path9));
   } catch {
     return [];
   }
@@ -2438,7 +2441,7 @@ function sectionParagraph2(md, title) {
   }
   return "";
 }
-function parseCapsule(id, path7, md) {
+function parseCapsule(id, path9, md) {
   const { data } = matter4(md);
   const updatedAt = data.updated_at ? String(data.updated_at) : void 0;
   let ageDays = null;
@@ -2448,7 +2451,7 @@ function parseCapsule(id, path7, md) {
   }
   return {
     id,
-    path: path7,
+    path: path9,
     system: data.system ? String(data.system) : id,
     owner: data.owner ? String(data.owner) : void 0,
     updatedAt,
@@ -2593,6 +2596,18 @@ function discoverInitiatives(dir) {
 // ../cli/src/core/resources.ts
 import matter6 from "gray-matter";
 var RESOURCE_ARTIFACT_TYPE = "project-resource";
+var RESOURCE_TYPES = [
+  "database",
+  "cloud",
+  "api",
+  "queue",
+  "storage",
+  "repository",
+  "platform",
+  "service",
+  "other"
+];
+var INTERFACE_TYPES = ["cli", "mcp", "api", "sql", "sdk", "iac", "console", "other"];
 function str(v) {
   return typeof v === "string" && v.trim() ? v.trim() : null;
 }
@@ -2636,6 +2651,18 @@ function parseAuth(v) {
   const refs = strArray(o2.refs).filter((r2) => !r2.includes("=") && /^[A-Za-z0-9_.-]+$/.test(r2));
   return { mode: str(o2.mode), refs };
 }
+function parseScope(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return null;
+  const o2 = v;
+  const type = str(o2.type);
+  if (!type) return null;
+  return { type, module: str(o2.module) };
+}
+function purposeFromBody(body) {
+  const m2 = body.match(/^#{1,2}\s+Purpose\s*\n+([\s\S]*?)(?=\n#{1,2}\s|\s*$)/m);
+  const text3 = m2 ? m2[1].trim() : "";
+  return text3 || null;
+}
 function toDetail(filePath, relPath, raw) {
   const parsed = matter6(raw);
   const fm = parsed.data ?? {};
@@ -2647,8 +2674,10 @@ function toDetail(filePath, relPath, raw) {
     resourceType: str(fm.resource_type),
     provider: str(fm.provider),
     environments: strArray(fm.environments),
+    scope: parseScope(fm.scope),
+    modules: strArray(fm.modules),
     path: relPath,
-    purpose: str(fm.purpose),
+    purpose: str(fm.purpose) ?? purposeFromBody(body),
     interfaces: parseInterfaces(fm.access_interfaces),
     boundaries: parseBoundaries(fm.access_boundaries),
     ...(() => {
@@ -2667,6 +2696,8 @@ function getResources(dir) {
       resourceType: str(fm.resource_type),
       provider: str(fm.provider),
       environments: strArray(fm.environments),
+      scope: parseScope(fm.scope),
+      modules: strArray(fm.modules),
       path: a2.relPath
     };
   }).sort((x2, y) => x2.id.localeCompare(y.id));
@@ -2737,9 +2768,9 @@ function buildGraph(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
   ];
   const presentLayers = [];
   for (const layer2 of layerDocs) {
-    const path7 = layer2.files.map((f3) => `${KNOWLEDGE3}/${f3}`).find((rel) => exists(join(dir, rel)));
-    if (path7) {
-      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path7 });
+    const path9 = layer2.files.map((f3) => `${KNOWLEDGE3}/${f3}`).find((rel) => exists(join(dir, rel)));
+    if (path9) {
+      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path9 });
       presentLayers.push(layer2.id);
     }
   }
@@ -2782,12 +2813,20 @@ function buildGraph(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
   const resourceTitleById = /* @__PURE__ */ new Map();
   for (const r2 of getResources(dir)) {
     resourceTitleById.set(r2.id, r2.title);
+    const resId = `resource:${r2.id}`;
     addNode({
-      id: `resource:${r2.id}`,
+      id: resId,
       type: "project-resource",
       label: r2.title ? `${r2.id} ${r2.title}`.trim() : r2.id,
       path: r2.path
     });
+    const depModules = new Set(r2.modules);
+    if (r2.scope?.type === "module" && r2.scope.module) depModules.add(r2.scope.module);
+    for (const mod of depModules) {
+      const modId = `module:${mod}`;
+      addNode({ id: modId, type: "module", label: mod });
+      addEdge(modId, resId, "depends_on");
+    }
   }
   for (const wi of selectedWIs) {
     const id = wi.id || wi.title;
@@ -4363,10 +4402,10 @@ function resolveNextStep(dir, now = /* @__PURE__ */ new Date()) {
   const q3 = (rel) => analyzeKnowledgeArtifact(dir, rel);
   const resolveAgent = (agent) => {
     const file = agent.endsWith(".md") ? agent : `${agent}.md`;
-    const path7 = agentInstallPath(file);
-    const installed = isFile(join(dir, path7));
+    const path9 = agentInstallPath(file);
+    const installed = isFile(join(dir, path9));
     const group = agentGroupOf(file);
-    return { agentPath: path7, agentInstalled: installed, installCommand: installed ? void 0 : `kaddo add agents --group ${group}` };
+    return { agentPath: path9, agentInstalled: installed, installCommand: installed ? void 0 : `kaddo add agents --group ${group}` };
   };
   const moduleRepo = isModule(config);
   const coreRepo = isCore(config);
@@ -6121,6 +6160,16 @@ supporting notes as \`knowledge/tech/discovery/architecture-notes.md\` and decis
 under \`knowledge/tech/decisions/\`. Kaddo still reads the legacy root locations for backward
 compatibility, but new output should use \`discovery/\`.
 
+## Project Resource candidates
+
+When the knowledge describes an external system the project depends on (a database, cloud account,
+API, queue, storage, service\u2026), you may propose it as a **candidate** Project Resource \u2014 never create
+it silently. Discovery \u2260 creation: present candidates for human review and materialize only through
+\`kaddo_create_resource\` / \`kaddo resources create\` with explicit confirmation. Ground every
+candidate in the knowledge (no guessing from ambiguous names). Model the stable system, not its access
+interface (CLI/MCP/SQL/API are interfaces); keep \`resources\` separate from \`affected_modules\`; and
+never include secret values \u2014 only reference names.
+
 ## Quality Checklist
 
 - Every component is backed by evidence from the context pack.
@@ -9701,7 +9750,7 @@ function buildGuardHistory(dir) {
     const d3 = hotspotDir(t.code_path);
     hotspotMap.set(d3, (hotspotMap.get(d3) ?? 0) + 1);
   }
-  const hotspots = [...hotspotMap.entries()].map(([path7, warnings]) => ({ path: path7, warnings })).sort((a2, b2) => b2.warnings - a2.warnings);
+  const hotspots = [...hotspotMap.entries()].map(([path9, warnings]) => ({ path: path9, warnings })).sort((a2, b2) => b2.warnings - a2.warnings);
   return {
     available: true,
     total_runs: sorted.length,
@@ -11060,7 +11109,7 @@ function getPrompt(root, name) {
 }
 
 // src/tools.ts
-import matter13 from "gray-matter";
+import matter15 from "gray-matter";
 
 // ../cli/dist/core.js
 import fs3 from "fs";
@@ -11084,18 +11133,19 @@ import { dirname as dirname2, join as join22, parse as parse2 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import matter72 from "gray-matter";
 import matter82 from "gray-matter";
-import { parse as parseYaml82, stringify as stringifyYaml42 } from "yaml";
-import fs32 from "fs";
-import path32 from "path";
-import crypto2 from "crypto";
 import matter92 from "gray-matter";
-import crypto3 from "crypto";
+import { parse as parseYaml82, stringify as stringifyYaml42 } from "yaml";
 import fs4 from "fs";
+import path4 from "path";
+import crypto2 from "crypto";
 import matter102 from "gray-matter";
+import crypto3 from "crypto";
+import fs5 from "fs";
 import matter112 from "gray-matter";
+import matter122 from "gray-matter";
 import { parse as parseYaml92, stringify as stringifyYaml5 } from "yaml";
 import { parse as parseYaml102, stringify as stringifyYaml6 } from "yaml";
-import matter122 from "gray-matter";
+import matter13 from "gray-matter";
 function exists2(p) {
   return fs3.existsSync(p);
 }
@@ -11206,8 +11256,8 @@ function loadConfig2(dir) {
   const parsed = configSchema2.safeParse(raw ?? {});
   if (!parsed.success) {
     const issues = parsed.error.issues.map((i) => {
-      const path42 = i.path.join(".");
-      return path42 ? `  - ${path42}: ${i.message}` : `  - ${i.message}`;
+      const path52 = i.path.join(".");
+      return path52 ? `  - ${path52}: ${i.message}` : `  - ${i.message}`;
     }).join("\n");
     throw new ConfigError2(`Invalid .kaddo/config.yml:
 ${issues}`);
@@ -11411,11 +11461,11 @@ function moduleArtifactCoverage2(dir, id) {
   };
 }
 function loadMappedModules2(dir) {
-  const path42 = join3(dir, DESCRIPTOR_PATH2);
-  if (!exists2(path42)) return [];
+  const path52 = join3(dir, DESCRIPTOR_PATH2);
+  if (!exists2(path52)) return [];
   let parsed;
   try {
-    parsed = parseYaml32(readFile2(path42));
+    parsed = parseYaml32(readFile2(path52));
   } catch {
     return [];
   }
@@ -12861,6 +12911,18 @@ function parseAuth2(v) {
   const refs = strArray3(o2.refs).filter((r2) => !r2.includes("=") && /^[A-Za-z0-9_.-]+$/.test(r2));
   return { mode: str2(o2.mode), refs };
 }
+function parseScope2(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return null;
+  const o2 = v;
+  const type = str2(o2.type);
+  if (!type) return null;
+  return { type, module: str2(o2.module) };
+}
+function purposeFromBody2(body) {
+  const m2 = body.match(/^#{1,2}\s+Purpose\s*\n+([\s\S]*?)(?=\n#{1,2}\s|\s*$)/m);
+  const text22 = m2 ? m2[1].trim() : "";
+  return text22 || null;
+}
 function toDetail2(filePath, relPath, raw) {
   const parsed = matter42(raw);
   const fm = parsed.data ?? {};
@@ -12872,8 +12934,10 @@ function toDetail2(filePath, relPath, raw) {
     resourceType: str2(fm.resource_type),
     provider: str2(fm.provider),
     environments: strArray3(fm.environments),
+    scope: parseScope2(fm.scope),
+    modules: strArray3(fm.modules),
     path: relPath,
-    purpose: str2(fm.purpose),
+    purpose: str2(fm.purpose) ?? purposeFromBody2(body),
     interfaces: parseInterfaces2(fm.access_interfaces),
     boundaries: parseBoundaries2(fm.access_boundaries),
     ...(() => {
@@ -12892,6 +12956,8 @@ function getResources2(dir) {
       resourceType: str2(fm.resource_type),
       provider: str2(fm.provider),
       environments: strArray3(fm.environments),
+      scope: parseScope2(fm.scope),
+      modules: strArray3(fm.modules),
       path: a2.relPath
     };
   }).sort((x2, y) => x2.id.localeCompare(y.id));
@@ -12960,9 +13026,9 @@ function buildGraph2(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
   ];
   const presentLayers = [];
   for (const layer2 of layerDocs) {
-    const path42 = layer2.files.map((f3) => `${KNOWLEDGE22}/${f3}`).find((rel) => exists2(join3(dir, rel)));
-    if (path42) {
-      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path42 });
+    const path52 = layer2.files.map((f3) => `${KNOWLEDGE22}/${f3}`).find((rel) => exists2(join3(dir, rel)));
+    if (path52) {
+      addNode({ id: layer2.id, type: layer2.type, label: layer2.label, path: path52 });
       presentLayers.push(layer2.id);
     }
   }
@@ -13005,12 +13071,20 @@ function buildGraph2(dir, config, opts = {}, now = /* @__PURE__ */ new Date()) {
   const resourceTitleById = /* @__PURE__ */ new Map();
   for (const r2 of getResources2(dir)) {
     resourceTitleById.set(r2.id, r2.title);
+    const resId = `resource:${r2.id}`;
     addNode({
-      id: `resource:${r2.id}`,
+      id: resId,
       type: "project-resource",
       label: r2.title ? `${r2.id} ${r2.title}`.trim() : r2.id,
       path: r2.path
     });
+    const depModules = new Set(r2.modules);
+    if (r2.scope?.type === "module" && r2.scope.module) depModules.add(r2.scope.module);
+    for (const mod of depModules) {
+      const modId = `module:${mod}`;
+      addNode({ id: modId, type: "module", label: mod });
+      addEdge(modId, resId, "depends_on");
+    }
   }
   for (const wi of selectedWIs) {
     const id = wi.id || wi.title;
@@ -14698,6 +14772,16 @@ supporting notes as \`knowledge/tech/discovery/architecture-notes.md\` and decis
 under \`knowledge/tech/decisions/\`. Kaddo still reads the legacy root locations for backward
 compatibility, but new output should use \`discovery/\`.
 
+## Project Resource candidates
+
+When the knowledge describes an external system the project depends on (a database, cloud account,
+API, queue, storage, service\u2026), you may propose it as a **candidate** Project Resource \u2014 never create
+it silently. Discovery \u2260 creation: present candidates for human review and materialize only through
+\`kaddo_create_resource\` / \`kaddo resources create\` with explicit confirmation. Ground every
+candidate in the knowledge (no guessing from ambiguous names). Model the stable system, not its access
+interface (CLI/MCP/SQL/API are interfaces); keep \`resources\` separate from \`affected_modules\`; and
+never include secret values \u2014 only reference names.
+
 ## Quality Checklist
 
 - Every component is backed by evidence from the context pack.
@@ -17251,8 +17335,8 @@ function parseGraphReason(v) {
   if (!v || typeof v !== "object") return null;
   const o2 = v;
   const relationship = typeof o2.relationship === "string" && o2.relationship.trim() ? o2.relationship.trim() : null;
-  const path42 = Array.isArray(o2.path) ? o2.path.map(String).filter(Boolean) : [];
-  return relationship || path42.length ? { relationship, path: path42 } : null;
+  const path52 = Array.isArray(o2.path) ? o2.path.map(String).filter(Boolean) : [];
+  return relationship || path52.length ? { relationship, path: path52 } : null;
 }
 function parseExplain(o2) {
   const refs = Array.isArray(o2.evidence) ? o2.evidence : Array.isArray(o2.evidence_refs) ? o2.evidence_refs : [];
@@ -17307,7 +17391,7 @@ function parseOriginalSnapshot(fm) {
 function readBody(filePath) {
   try {
     const raw = readFile2(filePath);
-    return matter82(raw).content;
+    return matter92(raw).content;
   } catch {
     return "";
   }
@@ -17509,7 +17593,7 @@ function nextWorkItemId(dir) {
   let max = 0;
   const walk = (d3) => {
     if (!exists2(d3)) return;
-    for (const entry of fs32.readdirSync(d3)) {
+    for (const entry of fs4.readdirSync(d3)) {
       const full = join3(d3, entry);
       if (isFile2(full)) {
         const m2 = entry.match(/WI-(\d+)/);
@@ -17522,15 +17606,15 @@ function nextWorkItemId(dir) {
   walk(wiDir);
   return `WI-${String(max + 1).padStart(3, "0")}`;
 }
-function atomicWrite2(filePath, content) {
-  fs32.mkdirSync(path32.dirname(filePath), { recursive: true });
+function atomicWrite3(filePath, content) {
+  fs4.mkdirSync(path4.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  fs32.writeFileSync(tmp, content, "utf-8");
+  fs4.writeFileSync(tmp, content, "utf-8");
   try {
-    fs32.renameSync(tmp, filePath);
+    fs4.renameSync(tmp, filePath);
   } catch (err) {
     try {
-      fs32.rmSync(tmp, { force: true });
+      fs4.rmSync(tmp, { force: true });
     } catch {
     }
     throw err;
@@ -17591,8 +17675,8 @@ function ensureH1(body, title) {
 
 ${trimmed}`;
 }
-function serialize(data, body) {
-  return matter92.stringify(`
+function serialize2(data, body) {
+  return matter102.stringify(`
 ${body.trim()}
 `, data);
 }
@@ -17660,8 +17744,8 @@ function createWorkItem(dir, opts) {
   const relPath = `${WORK_ITEMS_DIR}/draft/${id}-${slugify22(title)}.md`;
   const filePath = join3(dir, relPath);
   if (exists2(filePath)) throw new WorkItemWriteError("INVALID_INPUT", `Work Item file already exists: ${relPath}`);
-  const raw = serialize(data, body);
-  atomicWrite2(filePath, raw);
+  const raw = serialize2(data, body);
+  atomicWrite3(filePath, raw);
   return { id, path: relPath, revision: revisionOf(raw) };
 }
 function dimensionOf(type) {
@@ -18383,7 +18467,7 @@ function detectFormat(raw) {
   if (!trimmed) throw new ImportError("EMPTY_INPUT", "Import content is empty.");
   if (trimmed.startsWith("---")) {
     try {
-      const { data } = matter102(trimmed);
+      const { data } = matter112(trimmed);
       if (data && typeof data === "object" && Object.keys(data).length > 0) {
         const d3 = data;
         if (d3.type === "work-item" || d3.id && typeof d3.id === "string" && /^WI-\d+/.test(d3.id)) {
@@ -18405,7 +18489,7 @@ function parseContent(raw) {
   let bodyText = trimmed;
   if (format === "kaddo-frontmatter" || format === "markdown-frontmatter") {
     try {
-      const parsed = matter102(trimmed);
+      const parsed = matter112(trimmed);
       frontmatterFields = parsed.data ?? {};
       bodyText = parsed.content.trim();
     } catch {
@@ -18502,7 +18586,7 @@ function findDuplicateByHash(dir, hash) {
     const raw = readFile2(item.filePath);
     if (!raw) continue;
     try {
-      const { data } = matter102(raw);
+      const { data } = matter112(raw);
       const source = data?.source;
       if (source && typeof source === "object" && !Array.isArray(source)) {
         const s = source;
@@ -18569,7 +18653,7 @@ function importWorkItem(dir, opts) {
         };
       }
       if (opts.onConflict === "replace") {
-        fs4.rmSync(existing.filePath, { force: true });
+        fs5.rmSync(existing.filePath, { force: true });
         replacedWorkItem = existing.workItemId;
       }
     }
@@ -19011,8 +19095,8 @@ async function handleJiraResponse(res) {
   }
   return await res.json();
 }
-async function jiraFetch(baseUrl, path42, auth, timeoutMs, params) {
-  const url = new URL(path42, baseUrl + "/");
+async function jiraFetch(baseUrl, path52, auth, timeoutMs, params) {
+  const url = new URL(path52, baseUrl + "/");
   if (params) for (const [k2, v] of Object.entries(params)) url.searchParams.set(k2, v);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -19030,8 +19114,8 @@ async function jiraFetch(baseUrl, path42, auth, timeoutMs, params) {
     clearTimeout(timer);
   }
 }
-async function jiraPost(baseUrl, path42, auth, timeoutMs, body) {
-  const url = new URL(path42, baseUrl + "/");
+async function jiraPost(baseUrl, path52, auth, timeoutMs, body) {
+  const url = new URL(path52, baseUrl + "/");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -19397,7 +19481,7 @@ function buildInitiativeContent(id, input) {
   if (input.priority) data.priority = input.priority;
   if (input.source) data.source = input.source;
   if (input.sourceId) data.source_id = input.sourceId;
-  return matter122.stringify("\n" + (input.body ?? defaultBody(input.title.trim())), data);
+  return matter13.stringify("\n" + (input.body ?? defaultBody(input.title.trim())), data);
 }
 function createInitiative(dir, input) {
   if (!input.title?.trim()) throw new InitiativeWriteError("Initiative title is required.");
@@ -19421,10 +19505,10 @@ function transitionInitiative(dir, id, to) {
     throw new InitiativeWriteError(`Invalid transition ${ini.status} \u2192 ${to}.`);
   }
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter122(raw, {});
+  const { data, content } = matter13(raw, {});
   data.status = to;
   if (to === "completed") data.completed_at = today2();
-  const newContent = matter122.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after transition.");
@@ -19434,7 +19518,7 @@ function addCandidate(dir, id, candidate) {
   const ini = getInitiative(dir, id);
   if (!ini) throw new InitiativeWriteError(`Initiative ${id} not found.`);
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter122(raw, {});
+  const { data, content } = matter13(raw, {});
   const existing = Array.isArray(data.candidates) ? data.candidates : [];
   const fallbackId = `WI-CANDIDATE-${String(existing.length + 1).padStart(3, "0")}`;
   const normalized = normalizeCandidate(candidate, fallbackId);
@@ -19442,7 +19526,7 @@ function addCandidate(dir, id, candidate) {
     throw new InitiativeWriteError(`Candidate ${normalized.id} already exists in ${id}.`);
   }
   data.candidates = [...existing, candidateToData(normalized)];
-  const newContent = matter122.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after adding a candidate.");
@@ -19452,7 +19536,7 @@ function updateInitiative(dir, id, patch) {
   const ini = getInitiative(dir, id);
   if (!ini) throw new InitiativeWriteError(`Initiative ${id} not found.`);
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter122(raw, {});
+  const { data, content } = matter13(raw, {});
   if (patch.title !== void 0) {
     if (!patch.title.trim()) throw new InitiativeWriteError("Initiative title cannot be empty.");
     data.title = patch.title.trim();
@@ -19462,7 +19546,7 @@ function updateInitiative(dir, id, patch) {
   if (patch.knowledgeLevel !== void 0) data.knowledge_level = patch.knowledgeLevel;
   if (patch.domains !== void 0) data.domains = patch.domains;
   if (patch.relatedCapabilities !== void 0) data.related_capabilities = patch.relatedCapabilities;
-  const newContent = matter122.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after update.");
@@ -19480,10 +19564,10 @@ function addExternalLink(dir, id, link) {
     throw new InitiativeWriteError(`External link ${link.integration}:${link.externalId} already exists on ${id}.`);
   }
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter122(raw, {});
+  const { data, content } = matter13(raw, {});
   const existing = Array.isArray(data.external_links) ? data.external_links : [];
   data.external_links = [...existing, externalLinkToData(link)];
-  const newContent = matter122.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after adding an external link.");
@@ -19552,7 +19636,7 @@ function buildWorkItemContent(wiId, iniId, candidate) {
     "_What did we learn? Update after completion._",
     ""
   ].join("\n");
-  return matter122.stringify("\n" + body, data);
+  return matter13.stringify("\n" + body, data);
 }
 function materializeCandidate(dir, id, candidateId) {
   const ini = getInitiative(dir, id);
@@ -19569,13 +19653,13 @@ function materializeCandidate(dir, id, candidateId) {
   ensureDir2(join3(dir, DRAFT_DIR));
   writeFile2(join3(dir, DRAFT_DIR, fileName), buildWorkItemContent(wiId, ini.id, candidate));
   const raw = readFile2(ini.filePath);
-  const { data, content } = matter122(raw, {});
+  const { data, content } = matter13(raw, {});
   const cands = Array.isArray(data.candidates) ? data.candidates : [];
   for (const c of cands) {
     if (c && typeof c === "object" && String(c.id) === candidateId) c.materialized_as = wiId;
   }
   data.candidates = cands;
-  const newContent = matter122.stringify(content, data);
+  const newContent = matter13.stringify(content, data);
   writeFile2(ini.filePath, newContent);
   const updated = parseInitiative2(dir, ini.filePath, newContent);
   if (!updated) throw new InitiativeWriteError("Failed to parse the Initiative after materialization.");
@@ -19686,6 +19770,164 @@ function evaluateInitiativeCompletion(dir, ini) {
   };
 }
 
+// ../cli/src/core/resource-write.ts
+import fs6 from "fs";
+import path5 from "path";
+import matter14 from "gray-matter";
+var RESOURCES_DIR = "knowledge/tech/resources";
+var ResourceWriteError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ResourceWriteError";
+  }
+  code;
+};
+function slug4(s) {
+  return s.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+}
+function atomicWrite(filePath, content) {
+  const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  fs6.writeFileSync(tmp, content, "utf-8");
+  fs6.renameSync(tmp, filePath);
+}
+function sanitizeRefs(refs) {
+  if (!Array.isArray(refs)) return [];
+  return refs.map((r2) => String(r2).trim()).filter((r2) => r2 && !r2.includes("=") && /^[A-Za-z0-9_.-]+$/.test(r2));
+}
+function allResourceArtifacts(dir) {
+  return discoverKnowledge(dir).filter((a2) => a2.type === RESOURCE_ARTIFACT_TYPE);
+}
+function nextResourceId(dir, title, explicit) {
+  const existing = new Set(allResourceArtifacts(dir).map((a2) => (a2.id || "").toUpperCase()));
+  if (explicit && explicit.trim()) return explicit.trim();
+  const base = `RES-${slug4(title) || "resource"}`;
+  if (!existing.has(base.toUpperCase())) return base;
+  for (let i = 2; i < 1e3; i++) {
+    const candidate = `${base}-${i}`;
+    if (!existing.has(candidate.toUpperCase())) return candidate;
+  }
+  throw new ResourceWriteError("ID_EXHAUSTED", `Could not derive a unique id for "${title}".`);
+}
+function validateResource(dir, input) {
+  const findings = [];
+  if (input.resourceType && !RESOURCE_TYPES.includes(input.resourceType)) {
+    findings.push({ level: "warning", message: `Unknown resource_type "${input.resourceType}" (not in the known set).` });
+  }
+  for (const i of input.accessInterfaces ?? []) {
+    if (i.type && !INTERFACE_TYPES.includes(i.type)) {
+      findings.push({ level: "warning", message: `Unknown access interface type "${i.type}".` });
+    }
+  }
+  const mapped = loadMappedModules(dir).map((m2) => m2.id);
+  if (mapped.length > 0) {
+    const refs = /* @__PURE__ */ new Set();
+    if (input.scope?.type === "module" && input.scope.module) refs.add(input.scope.module);
+    for (const m2 of input.modules ?? []) refs.add(m2);
+    for (const m2 of refs) {
+      if (!mapped.includes(m2)) findings.push({ level: "warning", message: `Module "${m2}" is not in .kaddo/modules.yml.` });
+    }
+  }
+  if (input.scope && input.scope.type === "module" && !input.scope.module) {
+    findings.push({ level: "error", message: 'scope.type "module" requires a module id.' });
+  }
+  return findings;
+}
+function buildFrontmatter(id, input, base = {}) {
+  const data = { ...base };
+  data.type = RESOURCE_ARTIFACT_TYPE;
+  data.id = id;
+  if (input.title != null) data.title = input.title;
+  if (input.resourceType != null) data.resource_type = input.resourceType;
+  if (input.provider != null) data.provider = input.provider;
+  if (input.environments != null) data.environments = input.environments;
+  if (input.scope != null) data.scope = input.scope.module ? { type: input.scope.type, module: input.scope.module } : { type: input.scope.type };
+  if (input.modules != null) data.modules = input.modules;
+  if (input.accessInterfaces != null) data.access_interfaces = input.accessInterfaces;
+  if (input.accessBoundaries != null) data.access_boundaries = input.accessBoundaries;
+  if (input.authentication != null) {
+    const mode = input.authentication.mode;
+    const refs = sanitizeRefs(input.authentication.refs);
+    data.authentication = { ...mode ? { mode } : {}, ...refs.length ? { refs } : {} };
+  }
+  return data;
+}
+function serialize(data, body) {
+  return matter14.stringify(`
+${body.trim()}
+`, data);
+}
+function createResource(dir, input) {
+  const title = (input.title ?? "").trim();
+  if (!title) throw new ResourceWriteError("INVALID_INPUT", "A resource title is required.");
+  const resourceType = (input.resourceType ?? "").trim();
+  if (!resourceType) throw new ResourceWriteError("INVALID_INPUT", "A resource_type is required.");
+  const findings = validateResource(dir, input);
+  if (findings.some((f3) => f3.level === "error")) {
+    throw new ResourceWriteError("VALIDATION_FAILED", findings.filter((f3) => f3.level === "error").map((f3) => f3.message).join("; "));
+  }
+  const existing = allResourceArtifacts(dir);
+  if (input.id && existing.some((a2) => (a2.id || "").toUpperCase() === input.id.toUpperCase())) {
+    throw new ResourceWriteError("DUPLICATE", `A resource with id "${input.id}" already exists.`);
+  }
+  if (existing.some((a2) => (a2.title || "").toLowerCase() === title.toLowerCase())) {
+    throw new ResourceWriteError("DUPLICATE", `A resource titled "${title}" already exists.`);
+  }
+  const id = nextResourceId(dir, title, input.id);
+  const data = buildFrontmatter(id, input);
+  const body = `# Purpose
+
+${(input.purpose ?? "").trim() || "TODO: describe what this resource is for."}`;
+  const relPath = `${RESOURCES_DIR}/${slug4(title) || slug4(id)}.md`;
+  const filePath = join(dir, relPath);
+  if (exists(filePath)) throw new ResourceWriteError("DUPLICATE", `Resource file already exists: ${relPath}`);
+  ensureDir(path5.dirname(filePath));
+  atomicWrite(filePath, serialize(data, body));
+  return { id, path: relPath, findings };
+}
+function updateResource(dir, id, input) {
+  const match = allResourceArtifacts(dir).find((a2) => a2.id === id || a2.title === id);
+  if (!match) throw new ResourceWriteError("NOT_FOUND", `Project Resource "${id}" not found.`);
+  const findings = validateResource(dir, input);
+  if (findings.some((f3) => f3.level === "error")) {
+    throw new ResourceWriteError("VALIDATION_FAILED", findings.filter((f3) => f3.level === "error").map((f3) => f3.message).join("; "));
+  }
+  const raw = readFile(match.filePath);
+  const parsed = matter14(raw);
+  const base = parsed.data ?? {};
+  const data = buildFrontmatter(match.id || id, input, base);
+  let body = parsed.content.trim();
+  if (input.purpose != null) {
+    const purpose = `# Purpose
+
+${input.purpose.trim()}`;
+    body = /^#\s+Purpose/m.test(body) ? body.replace(/#\s+Purpose[\s\S]*?(?=\n#\s|\n*$)/, purpose + "\n") : `${purpose}
+
+${body}`.trim();
+  }
+  atomicWrite(match.filePath, serialize(data, body));
+  return { id: match.id || id, path: match.relPath, findings };
+}
+function getResourceReferences(dir, id) {
+  const refs = [];
+  for (const wi of discoverWorkItems(dir)) {
+    for (const rel of parseWorkItemResources(wi.rawFrontmatter)) {
+      if (rel.id === id) refs.push({ kind: "work-item", id: wi.id || wi.title, role: rel.role, path: wi.relPath });
+    }
+  }
+  return refs;
+}
+function deleteResource(dir, id, opts = {}) {
+  const match = allResourceArtifacts(dir).find((a2) => a2.id === id || a2.title === id);
+  if (!match) throw new ResourceWriteError("NOT_FOUND", `Project Resource "${id}" not found.`);
+  const references = getResourceReferences(dir, match.id || id);
+  if (!opts.confirm) {
+    return { deleted: false, preview: { id: match.id || id, references } };
+  }
+  fs6.rmSync(match.filePath, { force: true });
+  return { deleted: true, path: match.relPath };
+}
+
 // src/tools.ts
 var ok = (data) => ({ ok: true, data });
 var fail = (message) => ({ ok: false, message });
@@ -19781,12 +20023,12 @@ function markWorkItemReady(root, id, confirm2) {
   }
   const raw = readText(root, item.path);
   if (!raw) return fail(`Could not read Work Item file: ${item.path}`);
-  const parsed = matter13(raw);
+  const parsed = matter15(raw);
   const data = { ...parsed.data };
   const today3 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   data.status = "ready";
   data.ready_at = today3;
-  const newContent = matter13.stringify(parsed.content, data);
+  const newContent = matter15.stringify(parsed.content, data);
   const posixPath = item.path.replace(/\\/g, "/");
   let newRelPath = item.path;
   if (posixPath.includes("/work-items/draft/")) {
@@ -19957,11 +20199,64 @@ function getResourceTool(root, id) {
   if (!resource) return fail(`Project Resource "${id}" not found.`);
   return ok(resource);
 }
+function toResourceInput(args) {
+  const input = {};
+  if (args.title != null) input.title = args.title;
+  if (args.resource_type != null) input.resourceType = args.resource_type;
+  if (args.provider != null) input.provider = args.provider;
+  if (args.environments != null) input.environments = args.environments;
+  if (args.scope != null || args.module != null) {
+    const type = args.scope || (args.module ? "module" : "system");
+    input.scope = type === "module" ? { type: "module", module: args.module ?? null } : { type: "system" };
+  }
+  if (args.modules != null) input.modules = args.modules;
+  if (args.purpose != null) input.purpose = args.purpose;
+  if (args.access_interfaces != null) input.accessInterfaces = args.access_interfaces;
+  if (args.authentication != null) input.authentication = args.authentication;
+  return input;
+}
+function createResourceTool(root, args, confirm2) {
+  const input = toResourceInput(args);
+  const findings = validateResource(root, input);
+  if (!confirm2) {
+    return ok({ status: "needs_confirmation", action: "create", proposal: input, findings, message: "Re-call with confirm=true to create this resource." });
+  }
+  try {
+    return ok({ status: "created", ...createResource(root, input) });
+  } catch (e) {
+    return fail(e instanceof ResourceWriteError ? e.message : String(e));
+  }
+}
+function updateResourceTool(root, id, args, confirm2) {
+  if (!getResource(root, id)) return fail(`Project Resource "${id}" not found.`);
+  const input = toResourceInput(args);
+  const findings = validateResource(root, input);
+  if (!confirm2) {
+    return ok({ status: "needs_confirmation", action: "update", id, changes: input, findings, message: "Re-call with confirm=true to apply this update." });
+  }
+  try {
+    return ok({ status: "updated", ...updateResource(root, id, input) });
+  } catch (e) {
+    return fail(e instanceof ResourceWriteError ? e.message : String(e));
+  }
+}
+function deleteResourceTool(root, id, confirm2) {
+  if (!getResource(root, id)) return fail(`Project Resource "${id}" not found.`);
+  if (!confirm2) {
+    const references = getResourceReferences(root, id);
+    return ok({ status: "needs_confirmation", action: "delete", id, references, message: "Re-call with confirm=true to delete. References in other artifacts are NOT removed." });
+  }
+  try {
+    return ok({ status: "deleted", ...deleteResource(root, id, { confirm: true }) });
+  } catch (e) {
+    return fail(e instanceof ResourceWriteError ? e.message : String(e));
+  }
+}
 
 // src/multirepo.ts
-import fs5 from "fs";
-import path4 from "path";
-import matter14 from "gray-matter";
+import fs7 from "fs";
+import path6 from "path";
+import matter16 from "gray-matter";
 import { parse as parseYaml11, stringify as stringifyYaml7 } from "yaml";
 var ok2 = (data) => ({ ok: true, data });
 var fail2 = (message) => ({ ok: false, message });
@@ -19981,24 +20276,24 @@ function isCore2(config) {
   return projectRole2(config) === "core";
 }
 function readModuleFile(root, repoPath, relFile) {
-  const moduleDir = path4.resolve(root, repoPath);
-  const abs = path4.resolve(moduleDir, relFile);
+  const moduleDir = path6.resolve(root, repoPath);
+  const abs = path6.resolve(moduleDir, relFile);
   if (!abs.startsWith(moduleDir)) return null;
-  if (!fs5.existsSync(abs) || !fs5.statSync(abs).isFile()) return null;
-  return fs5.readFileSync(abs, "utf-8");
+  if (!fs7.existsSync(abs) || !fs7.statSync(abs).isFile()) return null;
+  return fs7.readFileSync(abs, "utf-8");
 }
 function detectModuleStatus2(root, repoPath) {
-  const moduleDir = path4.resolve(root, repoPath);
-  if (!fs5.existsSync(moduleDir)) {
+  const moduleDir = path6.resolve(root, repoPath);
+  if (!fs7.existsSync(moduleDir)) {
     return { status: "missing", configured: false, moduleContext: false, currentState: false, codebase: false, warning: `Directory \`${repoPath}\` does not exist.` };
   }
-  const configPath = path4.join(moduleDir, ".kaddo", "config.yml");
-  if (!fs5.existsSync(configPath)) {
+  const configPath = path6.join(moduleDir, ".kaddo", "config.yml");
+  if (!fs7.existsSync(configPath)) {
     return { status: "not_configured", configured: false, moduleContext: false, currentState: false, codebase: false, warning: `Run \`kaddo init\` inside \`${repoPath}\` and select multirepo \u2192 module.` };
   }
   let parsed = null;
   try {
-    parsed = parseYaml11(fs5.readFileSync(configPath, "utf-8"));
+    parsed = parseYaml11(fs7.readFileSync(configPath, "utf-8"));
   } catch {
   }
   const role = parsed?.project?.role ?? parsed?.multirepo?.role;
@@ -20009,14 +20304,14 @@ function detectModuleStatus2(root, repoPath) {
     status: "configured",
     configured: true,
     role: "module",
-    moduleContext: fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "module", "module-context.md")) || fs5.existsSync(path4.join(moduleDir, "knowledge", "module", "module-context.md")),
-    currentState: fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "current-state.md")),
-    codebase: fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "codebase.md"))
+    moduleContext: fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "module", "module-context.md")) || fs7.existsSync(path6.join(moduleDir, "knowledge", "module", "module-context.md")),
+    currentState: fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "current-state.md")),
+    codebase: fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "codebase.md"))
   };
 }
 function resolveModuleContextPath(root, repoPath) {
-  const moduleDir = path4.resolve(root, repoPath);
-  if (fs5.existsSync(path4.join(moduleDir, "knowledge", "tech", "module", "module-context.md"))) {
+  const moduleDir = path6.resolve(root, repoPath);
+  if (fs7.existsSync(path6.join(moduleDir, "knowledge", "tech", "module", "module-context.md"))) {
     return "knowledge/tech/module/module-context.md";
   }
   return "knowledge/module/module-context.md";
@@ -20113,7 +20408,7 @@ function validateWorkItemModulesTool(root, args) {
   if (!wi) return fail2(`Work Item "${args.workItemId}" not found.`);
   const raw = readText(root, wi.path);
   if (!raw) return fail2(`Could not read Work Item file.`);
-  const parsed = matter14(raw);
+  const parsed = matter16(raw);
   const data = parsed.data;
   const affectedModules = Array.isArray(data.affected_modules) ? data.affected_modules.map(String) : [];
   const codeEntries = Array.isArray(data.code) ? data.code.filter((c) => typeof c === "object" && c !== null).map((c) => ({ repo: typeof c.repo === "string" ? c.repo : void 0, paths: Array.isArray(c.paths) ? c.paths.map(String) : [] })) : [];
@@ -20166,7 +20461,7 @@ function getWorkItemContextTool(root, args) {
   if (!wi) return fail2(`Work Item "${args.workItemId}" not found.`);
   const raw = readText(root, wi.path);
   if (!raw) return fail2(`Could not read Work Item file.`);
-  const parsed = matter14(raw);
+  const parsed = matter16(raw);
   const data = parsed.data;
   const affectedModules = Array.isArray(data.affected_modules) ? data.affected_modules.map(String) : [];
   const codeEntries = Array.isArray(data.code) ? data.code.filter((c) => typeof c === "object" && c !== null).map((c) => ({ repo: typeof c.repo === "string" ? c.repo : void 0, paths: Array.isArray(c.paths) ? c.paths.map(String) : [] })) : [];
@@ -20220,15 +20515,15 @@ function extractSection(content, heading) {
   return out;
 }
 function buildBranchStrategy(wi, affectedModules, codeEntries, descriptor) {
-  const slug5 = slugify4(wi.title);
+  const slug6 = slugify4(wi.title);
   const wiLower = wi.id.toLowerCase();
-  const coreBranch = `feature/${wiLower}-${slug5}`;
+  const coreBranch = `feature/${wiLower}-${slug6}`;
   const moduleBranches = {};
   const commitMessages = {};
   for (const modId of affectedModules) {
     const mod = (descriptor.modules ?? []).find((m2) => m2.id === modId);
     const repo = mod ? moduleRepoPath(mod) || modId : modId;
-    moduleBranches[repo] = `feature/${wiLower}-${modId}-${slug5.slice(0, 20)}`;
+    moduleBranches[repo] = `feature/${wiLower}-${modId}-${slug6.slice(0, 20)}`;
     commitMessages[repo] = `fix(${wiLower}): update ${modId}`;
   }
   commitMessages["core"] = `docs(${wiLower}): capture cross-repo implementation summary`;
@@ -20252,7 +20547,7 @@ function suggestBranchStrategyTool(root, args) {
   if (!wi) return fail2(`Work Item "${args.workItemId}" not found.`);
   const raw = readText(root, wi.path);
   if (!raw) return fail2(`Could not read Work Item file.`);
-  const parsed = matter14(raw);
+  const parsed = matter16(raw);
   const data = parsed.data;
   const affectedModules = Array.isArray(data.affected_modules) ? data.affected_modules.map(String) : [];
   const codeEntries = Array.isArray(data.code) ? data.code.filter((c) => typeof c === "object" && c !== null).map((c) => ({ repo: typeof c.repo === "string" ? c.repo : void 0, paths: Array.isArray(c.paths) ? c.paths.map(String) : [] })) : [];
@@ -20401,31 +20696,31 @@ function modulesDiscoverTool(root, args) {
   const sysName = config.system?.name ?? config.project?.name ?? "";
   const workspaceRoots2 = config.multirepo?.workspace_roots ?? [".."];
   const IGNORED = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "coverage", "vendor", ".next", "out", "tmp", "temp", ".kaddo"]);
-  const coreAbs = path4.resolve(root);
+  const coreAbs = path6.resolve(root);
   const discovered = [];
   for (const wr of workspaceRoots2) {
-    const rootAbs = path4.resolve(root, wr);
-    if (!fs5.existsSync(rootAbs) || !fs5.statSync(rootAbs).isDirectory()) continue;
+    const rootAbs = path6.resolve(root, wr);
+    if (!fs7.existsSync(rootAbs) || !fs7.statSync(rootAbs).isDirectory()) continue;
     let entries;
     try {
-      entries = fs5.readdirSync(rootAbs);
+      entries = fs7.readdirSync(rootAbs);
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (IGNORED.has(entry)) continue;
-      const candidateAbs = path4.resolve(rootAbs, entry);
-      if (!fs5.statSync(candidateAbs).isDirectory()) continue;
+      const candidateAbs = path6.resolve(rootAbs, entry);
+      if (!fs7.statSync(candidateAbs).isDirectory()) continue;
       if (candidateAbs === coreAbs) continue;
-      const relPath = path4.relative(root, candidateAbs).replace(/\\/g, "/");
-      const cfgPath = path4.join(candidateAbs, ".kaddo", "config.yml");
-      if (!fs5.existsSync(cfgPath)) {
+      const relPath = path6.relative(root, candidateAbs).replace(/\\/g, "/");
+      const cfgPath = path6.join(candidateAbs, ".kaddo", "config.yml");
+      if (!fs7.existsSync(cfgPath)) {
         discovered.push({ id: entry, path: relPath, status: "not_configured", eligibleForMapping: false });
         continue;
       }
       let parsed = null;
       try {
-        parsed = parseYaml11(fs5.readFileSync(cfgPath, "utf-8"));
+        parsed = parseYaml11(fs7.readFileSync(cfgPath, "utf-8"));
       } catch {
       }
       const role = parsed?.project?.role ?? parsed?.multirepo?.role;
@@ -20499,8 +20794,8 @@ ${list3(data.owners)}
 
 // ../cli/src/core/system-topology.ts
 import { parse as parseYaml12, stringify as stringifyYaml8 } from "yaml";
-import fs6 from "fs";
-import path5 from "path";
+import fs8 from "fs";
+import path7 from "path";
 import crypto from "crypto";
 var TOPOLOGY_FILE2 = "knowledge/tech/system-topology.yml";
 var SYSTEM_ENTITY_KINDS2 = /* @__PURE__ */ new Set([
@@ -20872,16 +21167,16 @@ function findSystemPaths(dir, source, target, opts = {}) {
     out.get(r2.source).push(r2.target);
   }
   const paths = [];
-  const walk = (node, path7) => {
+  const walk = (node, path9) => {
     if (paths.length >= 20) return;
-    if (node === target && path7.length > 1) {
-      paths.push([...path7]);
+    if (node === target && path9.length > 1) {
+      paths.push([...path9]);
       return;
     }
-    if (path7.length > maxDepth) return;
+    if (path9.length > maxDepth) return;
     for (const nxt of out.get(node) ?? []) {
-      if (path7.includes(nxt)) continue;
-      walk(nxt, [...path7, nxt]);
+      if (path9.includes(nxt)) continue;
+      walk(nxt, [...path9, nxt]);
     }
   };
   walk(source, [source]);
@@ -20906,14 +21201,14 @@ function getImpactCandidates(dir, seedIds, opts = {}) {
         existing.reason.push(reason);
         continue;
       }
-      const path7 = findSystemPaths(dir, seed, n.id, { maxDepth: opts.maxDepth ?? DEFAULT_MAX_DEPTH })[0];
+      const path9 = findSystemPaths(dir, seed, n.id, { maxDepth: opts.maxDepth ?? DEFAULT_MAX_DEPTH })[0];
       candidates.set(n.id, {
         nodeId: n.id,
         label: n.label,
         kind: n.type,
         ...n.moduleId ? { moduleId: n.moduleId } : {},
         reason: [reason],
-        ...path7 ? { graphPath: path7.map((id) => byId.get(id)?.label ?? id) } : {},
+        ...path9 ? { graphPath: path9.map((id) => byId.get(id)?.label ?? id) } : {},
         ...n.implementationRefs?.length ? { implementationRefs: n.implementationRefs } : {},
         ...n.knowledgeRefs?.length ? { knowledgeRefs: n.knowledgeRefs } : {},
         status: "candidate",
@@ -21012,14 +21307,14 @@ function systemImpactCandidatesTool(root, args) {
 }
 
 // ../cli/src/services/integrations.ts
-import matter16 from "gray-matter";
+import matter18 from "gray-matter";
 import { parse as parseYaml13, stringify as stringifyYaml9 } from "yaml";
 
 // ../cli/src/core/work-item-write.ts
-import fs7 from "fs";
-import path6 from "path";
+import fs9 from "fs";
+import path8 from "path";
 import crypto4 from "crypto";
-import matter15 from "gray-matter";
+import matter17 from "gray-matter";
 var SECTION_ORDER2 = [
   "Actor",
   "Outcome",
@@ -21687,8 +21982,8 @@ async function handleJiraResponse2(res) {
   }
   return await res.json();
 }
-async function jiraFetch2(baseUrl, path7, auth, timeoutMs, params) {
-  const url = new URL(path7, baseUrl + "/");
+async function jiraFetch2(baseUrl, path9, auth, timeoutMs, params) {
+  const url = new URL(path9, baseUrl + "/");
   if (params) for (const [k2, v] of Object.entries(params)) url.searchParams.set(k2, v);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -21706,8 +22001,8 @@ async function jiraFetch2(baseUrl, path7, auth, timeoutMs, params) {
     clearTimeout(timer);
   }
 }
-async function jiraPost2(baseUrl, path7, auth, timeoutMs, body) {
-  const url = new URL(path7, baseUrl + "/");
+async function jiraPost2(baseUrl, path9, auth, timeoutMs, body) {
+  const url = new URL(path9, baseUrl + "/");
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -22067,7 +22362,7 @@ async function integrationsWorkItemTool(root, args) {
 }
 
 // ../cli/src/core/context-pack.ts
-import matter17 from "gray-matter";
+import matter19 from "gray-matter";
 var CONTEXT_PACK_VERSION = "1";
 var ARCH_DIR4 = "knowledge";
 function readScanJson(dir) {
@@ -22080,7 +22375,7 @@ function readScanJson(dir) {
   }
 }
 function firstParagraph4(markdown) {
-  const body = matter17(markdown).content.trim();
+  const body = matter19(markdown).content.trim();
   const para = body.split("\n\n").map((p) => p.trim()).find((p) => p && !p.startsWith("#"));
   return para ?? "";
 }
@@ -23047,7 +23342,7 @@ function requireKnowledge(root) {
     throw new KaddoMcpError("Knowledge repository not found. Run `kaddo bootstrap` first.");
   }
 }
-function slug4(s) {
+function slug5(s) {
   return s.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
 }
 function generateContext(root) {
@@ -23180,7 +23475,7 @@ function generateCapsuleDraft(root) {
   const config = requireConfig(root);
   requireKnowledge(root);
   const capsule = buildCapsule(root, config);
-  const name = slug4(config.project.name);
+  const name = slug5(config.project.name);
   const md = `.kaddo/exports/${name}.capsule.md`;
   const json = `.kaddo/exports/${name}.capsule.json`;
   writeDerived(root, md, renderCapsuleMarkdown(capsule));
@@ -23478,6 +23773,53 @@ function createServer(root) {
     { title: "Get Project Resource", description: "Get one Project Resource by ID: purpose, environments, access interfaces, boundaries and auth references (never values).", inputSchema: { id: z4.string() } },
     async (args) => toolText(guarded(root, () => getResourceTool(root, args.id)))
   );
+  const resourceFields = {
+    title: z4.string().optional(),
+    resource_type: z4.string().optional(),
+    provider: z4.string().optional(),
+    environments: z4.array(z4.string()).optional(),
+    scope: z4.string().optional(),
+    module: z4.string().optional(),
+    modules: z4.array(z4.string()).optional(),
+    purpose: z4.string().optional(),
+    access_interfaces: z4.array(z4.object({
+      type: z4.string(),
+      tool: z4.string().optional(),
+      provider: z4.string().optional(),
+      purpose: z4.string().optional(),
+      operations: z4.array(z4.string()).optional(),
+      environments: z4.array(z4.string()).optional(),
+      constraints: z4.string().optional()
+    })).optional(),
+    authentication: z4.object({ mode: z4.string().optional(), refs: z4.array(z4.string()).optional() }).optional()
+  };
+  server.registerTool(
+    "kaddo_create_resource",
+    {
+      title: "Create Project Resource",
+      description: "Propose creating a Project Resource. Without confirm, returns a preview + validation findings (writes nothing). With confirm=true, Core persists it as Markdown. Never include credential values \u2014 only reference names.",
+      inputSchema: { ...resourceFields, confirm: z4.boolean().optional() }
+    },
+    async (args) => toolText(guarded(root, () => createResourceTool(root, args, args.confirm)))
+  );
+  server.registerTool(
+    "kaddo_update_resource",
+    {
+      title: "Update Project Resource",
+      description: "Propose updating a Project Resource (no-lossy). Without confirm, returns a preview; with confirm=true, Core applies it. Never include credential values.",
+      inputSchema: { id: z4.string(), ...resourceFields, confirm: z4.boolean().optional() }
+    },
+    async (args) => toolText(guarded(root, () => updateResourceTool(root, args.id, args, args.confirm)))
+  );
+  server.registerTool(
+    "kaddo_delete_resource",
+    {
+      title: "Delete Project Resource",
+      description: "Delete a Project Resource. Without confirm, returns what references it (writes nothing); with confirm=true, Core removes only the resource \u2014 references in other artifacts are left intact.",
+      inputSchema: { id: z4.string(), confirm: z4.boolean().optional() }
+    },
+    async (args) => toolText(guarded(root, () => deleteResourceTool(root, args.id, args.confirm)))
+  );
   server.registerTool(
     "kaddo_list_capsules",
     { title: "List Knowledge Capsules", description: "List registered external Knowledge Capsules.", inputSchema: {} },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaddo/mcp",
-  "version": "3.115.0",
+  "version": "3.116.0",
   "description": "MCP server for Kaddo project knowledge: read-only resources/tools/prompts plus safe derived generation under .kaddo/.",
   "license": "MIT",
   "repository": {