@codapult/guard 0.2.0 → 0.4.0

package/dist/core/guard.js

@@ -1,9 +1,11 @@
 import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, writeFileSync, } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { dirname, extname, relative, resolve, sep } from 'node:path';
 import { Project, SyntaxKind } from 'ts-morph';
-import { discoverProject, discoverProjectWithMetrics, findGuardRoot, } from './discovery/discovery.js';
+import { buildModuleTargetGraph } from './discovery/discovery.js';
+import { clearDiscoveryCache, discoverProject, discoverProjectWithMetrics, findGuardRoot, } from './discovery/discovery.js';
 import { config } from './config.js';
 import { assessGuardPacks, detectGuardPacks } from './analysis/packs.js';
 import { analyzeProjectImpact } from './analysis/impact.js';
@@ -28,10 +30,20 @@ export const GUARD_CONVENTIONS_FILE = `${GUARD_DIR}/conventions.json`;
 export const GUARD_AGENT_FILE = `${GUARD_DIR}/agent.json`;
 export const GUARD_CONTRACTS_FILE = `${GUARD_DIR}/contracts.json`;
 export const GUARD_PROPOSALS_FILE = `${GUARD_DIR}/proposals.json`;
+export const GUARD_STATE_DIR = `${GUARD_DIR}/state`;
+export const GUARD_STATE_GENERATIONS_DIR = `${GUARD_STATE_DIR}/generations`;
+export const GUARD_STATE_CURRENT_FILE = `${GUARD_STATE_DIR}/current.json`;
+const GUARD_POLICY_TRANSACTION_FILE = `${GUARD_STATE_DIR}/policy-transaction.json`;
+const GUARD_STATE_LOCK_FILE = `${GUARD_DIR}/.state.lock`;
 export const defaultGuardConfig = {
     version: 1,
     rules: [],
     contracts: [],
+    approval: {
+        mode: 'local',
+        allowMcpApproval: true,
+        requireDistinctActor: false,
+    },
 };
 export const defaultGuardAgentConfig = {
     version: 1,
@@ -50,6 +62,154 @@ export class GuardAlreadyInitializedError extends Error {
         this.name = 'GuardAlreadyInitializedError';
     }
 }
+export class GuardConfigError extends Error {
+    constructor(path) {
+        super(`Guard configuration is invalid or unsupported: ${path}`);
+        this.name = 'GuardConfigError';
+    }
+}
+export class GuardStateBusyError extends Error {
+    constructor(path) {
+        super(`Guard state is being updated by another process: ${path}`);
+        this.name = 'GuardStateBusyError';
+    }
+}
+export class GuardStateStaleError extends Error {
+    constructor() {
+        super('Guard state changed while this operation was running.');
+        this.name = 'GuardStateStaleError';
+    }
+}
+export class GuardBaselineReasonError extends Error {
+    constructor() {
+        super('A reason is required when changing the Guard baseline.');
+        this.name = 'GuardBaselineReasonError';
+    }
+}
+const activeStateLocks = new Map();
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function sleepSync(milliseconds) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+function removeLockFile(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        // Lock cleanup is best effort. A later invocation can recover an orphaned lock by PID.
+    }
+}
+function readStateLock(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, 'utf8'));
+        const hasValidDate = (candidate) => typeof candidate === 'string' && Number.isFinite(Date.parse(candidate));
+        return Number.isInteger(value.pid) &&
+            value.pid > 0 &&
+            typeof value.hostname === 'string' &&
+            value.hostname.length > 0 &&
+            typeof value.command === 'string' &&
+            typeof value.token === 'string' &&
+            value.token.length > 0 &&
+            hasValidDate(value.createdAt) &&
+            hasValidDate(value.expiresAt)
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function getActiveStateRoot(path) {
+    const normalizedPath = resolve(path);
+    return [...activeStateLocks.keys()]
+        .filter((root) => normalizedPath === root || normalizedPath.startsWith(`${root}${sep}`))
+        .sort((left, right) => right.length - left.length)[0];
+}
+function safeGeneration(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9._-]+$/.test(value);
+}
+export function withGuardStateLock(root, callback, options = {}) {
+    const normalizedRoot = resolve(root);
+    const activeDepth = activeStateLocks.get(normalizedRoot);
+    if (activeDepth !== undefined) {
+        activeStateLocks.set(normalizedRoot, activeDepth + 1);
+        try {
+            return callback();
+        }
+        finally {
+            activeStateLocks.set(normalizedRoot, activeDepth);
+        }
+    }
+    const lockPath = resolve(normalizedRoot, GUARD_STATE_LOCK_FILE);
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const startedAt = Date.now();
+    const waitMs = options.noWait ? 0 : (options.waitMs ?? 30_000);
+    let lock;
+    let delay = 25;
+    while (!lock) {
+        const now = new Date();
+        const candidate = {
+            pid: process.pid,
+            hostname: hostname(),
+            command: process.argv.join(' '),
+            token: randomUUID(),
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + 300_000).toISOString(),
+        };
+        try {
+            writeFileSync(lockPath, `${JSON.stringify(candidate)}\n`, { encoding: 'utf8', flag: 'wx' });
+            lock = candidate;
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            const owner = readStateLock(lockPath);
+            const ownerDead = owner?.hostname === hostname() && !processIsAlive(owner.pid);
+            let malformedStale = false;
+            if (owner === undefined) {
+                try {
+                    malformedStale = Date.now() - statSync(lockPath).mtimeMs > 60_000;
+                }
+                catch {
+                    // The lock disappeared between the failed create and stat.
+                }
+            }
+            if (ownerDead || malformedStale) {
+                try {
+                    unlinkSync(lockPath);
+                    continue;
+                }
+                catch {
+                    // The owner or another waiter changed the lock; retry normally.
+                }
+            }
+            if (Date.now() - startedAt >= waitMs)
+                throw new GuardStateBusyError(lockPath);
+            sleepSync(Math.min(delay, Math.max(1, waitMs - (Date.now() - startedAt))));
+            delay = Math.min(delay * 2, 500);
+        }
+    }
+    activeStateLocks.set(normalizedRoot, 1);
+    try {
+        return callback();
+    }
+    finally {
+        activeStateLocks.delete(normalizedRoot);
+        const current = readStateLock(lockPath);
+        if (current?.token === lock.token) {
+            removeLockFile(lockPath);
+        }
+    }
+}
 function isGuardConfig(value) {
     return guardConfigSchema.safeParse(value).success;
 }
@@ -62,14 +222,52 @@ function readJson(filePath) {
     }
 }
 function atomicWriteFile(path, content) {
-    const temporaryPath = `${path}.tmp-${process.pid}`;
-    writeFileSync(temporaryPath, content, 'utf8');
-    renameSync(temporaryPath, path);
+    if (getActiveStateRoot(path) !== undefined) {
+        const temporaryPath = `${path}.tmp-${process.pid}-${randomUUID()}`;
+        writeFileSync(temporaryPath, content, 'utf8');
+        renameSync(temporaryPath, path);
+        return;
+    }
+    const lockPath = `${path}.lock`;
+    let lockAcquired = false;
+    try {
+        try {
+            writeFileSync(lockPath, `${process.pid}\n`, { encoding: 'utf8', flag: 'wx' });
+            lockAcquired = true;
+        }
+        catch (error) {
+            if (error.code === 'EEXIST') {
+                try {
+                    if (Date.now() - statSync(lockPath).mtimeMs > 60_000) {
+                        unlinkSync(lockPath);
+                        writeFileSync(lockPath, `${process.pid}\n`, { encoding: 'utf8', flag: 'wx' });
+                        lockAcquired = true;
+                    }
+                }
+                catch {
+                    // Another writer may have replaced or removed the lock.
+                }
+            }
+            if (!lockAcquired)
+                throw new GuardStateBusyError(path);
+        }
+        const temporaryPath = `${path}.tmp-${process.pid}-${randomUUID()}`;
+        writeFileSync(temporaryPath, content, 'utf8');
+        renameSync(temporaryPath, path);
+    }
+    finally {
+        if (lockAcquired) {
+            removeLockFile(lockPath);
+        }
+    }
 }
-function writeGuardArtifact(root, relativePath, value) {
+function writeGuardArtifactUnlocked(root, relativePath, value) {
     mkdirSync(resolve(root, GUARD_DIR), { recursive: true });
     atomicWriteFile(resolve(root, relativePath), `${JSON.stringify(value, null, 2)}\n`);
 }
+function writeGuardArtifact(root, relativePath, value) {
+    withGuardStateLock(root, () => writeGuardArtifactUnlocked(root, relativePath, value));
+}
 function hasProjectTool(model, name) {
     return (Object.keys({ ...model.project.dependencies, ...model.project.devDependencies }).some((dependency) => dependency === name || dependency.endsWith(`/${name}`)) || Object.values(model.project.scripts).some((script) => script.includes(name)));
 }
@@ -102,106 +300,270 @@ export function isGuardProposalFile(value) {
 export function fingerprintProjectModel(model) {
     return createHash('sha256').update(JSON.stringify(model)).digest('hex');
 }
+export function fingerprintGuardConfig(guardConfig) {
+    return createHash('sha256')
+        .update(JSON.stringify({
+        rules: guardConfig.rules,
+        contracts: guardConfig.contracts ?? [],
+        budgets: guardConfig.budgets ?? [],
+        approval: guardConfig.approval ?? defaultGuardConfig.approval,
+    }))
+        .digest('hex');
+}
 export function getGuardProposalFreshness(model, proposals) {
     if (!proposals?.projectFingerprint)
         return 'unknown';
     return proposals.projectFingerprint === fingerprintProjectModel(model) ? 'current' : 'stale';
 }
-export function loadGuardConfig(root) {
-    const value = readJson(resolve(root, GUARD_RULES_FILE));
-    if (!isGuardConfig(value))
+function readGuardConfigFilesUnlocked(root) {
+    const rulesPath = resolve(root, GUARD_RULES_FILE);
+    if (!existsSync(rulesPath))
         return undefined;
+    const value = readJson(rulesPath);
+    if (!isGuardConfig(value))
+        throw new GuardConfigError(GUARD_RULES_FILE);
     const contractsPath = resolve(root, GUARD_CONTRACTS_FILE);
     if (existsSync(contractsPath)) {
         const contractFile = readJson(contractsPath);
         if (!isGuardContractsFile(contractFile))
-            return undefined;
-        return { ...value, contracts: contractFile.contracts };
+            throw new GuardConfigError(GUARD_CONTRACTS_FILE);
+        return {
+            ...value,
+            contracts: contractFile.contracts,
+            budgets: value.budgets ?? [],
+            approval: value.approval ?? defaultGuardConfig.approval,
+        };
     }
     return {
         ...value,
         contracts: value.contracts ?? [],
+        budgets: value.budgets ?? [],
+        approval: value.approval ?? defaultGuardConfig.approval,
     };
 }
+function isGuardPolicyTransaction(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const transaction = value;
+    return (transaction.version === 1 &&
+        typeof transaction.createdAt === 'string' &&
+        isGuardConfig(transaction.config) &&
+        (transaction.proposals === undefined || isGuardProposalFile(transaction.proposals)));
+}
+function writeGuardConfigUnlocked(root, guardConfig, options = {}) {
+    mkdirSync(resolve(root, GUARD_DIR), { recursive: true });
+    const current = readGuardConfigFilesUnlocked(root);
+    const currentRevision = current?.revision ?? 0;
+    const expectedRevision = options.expectedRevision ?? guardConfig.revision;
+    if (expectedRevision !== undefined && expectedRevision !== currentRevision) {
+        throw new GuardStateStaleError();
+    }
+    const nextRevision = currentRevision + 1;
+    const contentFingerprint = fingerprintGuardConfig(guardConfig);
+    const { contracts = [], ...rulesConfig } = guardConfig;
+    atomicWriteFile(resolve(root, GUARD_RULES_FILE), `${JSON.stringify({ ...rulesConfig, revision: nextRevision, contentFingerprint }, null, 2)}\n`);
+    atomicWriteFile(resolve(root, GUARD_CONTRACTS_FILE), `${JSON.stringify({ version: 1, contracts }, null, 2)}\n`);
+}
+function recoverGuardPolicyTransaction(root) {
+    const path = resolve(root, GUARD_POLICY_TRANSACTION_FILE);
+    if (!existsSync(path))
+        return;
+    const value = readJson(path);
+    if (!isGuardPolicyTransaction(value)) {
+        throw new GuardConfigError(GUARD_POLICY_TRANSACTION_FILE);
+    }
+    writeGuardConfigUnlocked(root, value.config);
+    if (value.proposals) {
+        writeGuardArtifactUnlocked(root, GUARD_PROPOSALS_FILE, value.proposals);
+    }
+    unlinkSync(path);
+}
+function loadGuardConfigUnlocked(root) {
+    recoverGuardPolicyTransaction(root);
+    return readGuardConfigFilesUnlocked(root);
+}
+export function loadGuardConfig(root) {
+    if (!existsSync(resolve(root, GUARD_DIR)))
+        return loadGuardConfigUnlocked(root);
+    return withGuardStateLock(root, () => loadGuardConfigUnlocked(root));
+}
+function loadGuardProposalsUnlocked(root) {
+    const path = resolve(root, GUARD_PROPOSALS_FILE);
+    if (!existsSync(path))
+        return undefined;
+    const value = readJson(path);
+    if (value === undefined || !isGuardProposalFile(value)) {
+        throw new GuardConfigError(GUARD_PROPOSALS_FILE);
+    }
+    return value;
+}
 export function loadGuardProposals(root) {
-    const value = readJson(resolve(root, GUARD_PROPOSALS_FILE));
-    return isGuardProposalFile(value) ? value : undefined;
+    if (!existsSync(resolve(root, GUARD_DIR)))
+        return loadGuardProposalsUnlocked(root);
+    return withGuardStateLock(root, () => {
+        recoverGuardPolicyTransaction(root);
+        return loadGuardProposalsUnlocked(root);
+    });
 }
 export function isGuardAgentConfig(value) {
     return guardAgentConfigSchema.safeParse(value).success;
 }
 export function loadGuardAgentConfig(root) {
-    const value = readJson(resolve(root, GUARD_AGENT_FILE));
-    return isGuardAgentConfig(value) ? value : defaultGuardAgentConfig;
+    const path = resolve(root, GUARD_AGENT_FILE);
+    if (!existsSync(path))
+        return defaultGuardAgentConfig;
+    const value = readJson(path);
+    if (!isGuardAgentConfig(value))
+        throw new GuardConfigError(GUARD_AGENT_FILE);
+    return value;
 }
 export function writeGuardAgentConfig(root, agentConfig = defaultGuardAgentConfig) {
     writeGuardArtifact(root, GUARD_AGENT_FILE, agentConfig);
 }
-export function loadGuardArtifact(root, relativePath) {
-    return readJson(resolve(root, relativePath));
-}
 export function loadBaseline(root) {
-    const value = readJson(resolve(root, GUARD_BASELINE_FILE));
-    if (!Array.isArray(value))
+    const path = resolve(root, GUARD_BASELINE_FILE);
+    if (!existsSync(path))
         return new Set();
+    const value = readJson(path);
+    if (!Array.isArray(value))
+        throw new GuardConfigError(GUARD_BASELINE_FILE);
     return new Set(value.filter((item) => typeof item === 'string'));
 }
 export function updateBaseline(root, options = {}) {
-    const next = loadBaseline(root);
-    for (const fingerprint of options.add ?? [])
-        next.add(fingerprint);
-    for (const fingerprint of options.remove ?? [])
-        next.delete(fingerprint);
-    const fingerprints = [...next].sort();
-    const metadataPath = resolve(root, GUARD_BASELINE_META_FILE);
-    const previous = readJson(metadataPath);
-    const history = previous !== null &&
-        typeof previous === 'object' &&
-        Array.isArray(previous.decisions)
-        ? previous.decisions
-        : [];
-    const decision = {
-        at: new Date().toISOString(),
-        action: (options.add?.length ?? 0) > 0 ? 'accept' : 'remove',
-        fingerprints: [...(options.add ?? []), ...(options.remove ?? [])],
-        ...(options.reason?.trim() ? { reason: options.reason.trim() } : {}),
-    };
-    atomicWriteFile(resolve(root, GUARD_BASELINE_FILE), `${JSON.stringify(fingerprints, null, 2)}\n`);
-    atomicWriteFile(metadataPath, `${JSON.stringify({
-        ...(previous !== null && typeof previous === 'object' ? previous : {}),
-        version: 1,
-        generatedAt: new Date().toISOString(),
-        findings: fingerprints.length,
-        decisions: [...history, decision],
-    }, null, 2)}\n`);
-    return next;
+    if ((options.add?.length ?? 0) > 0 || (options.remove?.length ?? 0) > 0) {
+        if (!options.reason?.trim())
+            throw new GuardBaselineReasonError();
+    }
+    return withGuardStateLock(root, () => {
+        const next = loadBaseline(root);
+        for (const fingerprint of options.add ?? [])
+            next.add(fingerprint);
+        for (const fingerprint of options.remove ?? [])
+            next.delete(fingerprint);
+        const fingerprints = [...next].sort();
+        const metadataPath = resolve(root, GUARD_BASELINE_META_FILE);
+        const previous = readJson(metadataPath);
+        const history = previous !== null &&
+            typeof previous === 'object' &&
+            Array.isArray(previous.decisions)
+            ? previous.decisions
+            : [];
+        const decision = {
+            at: new Date().toISOString(),
+            action: (options.add?.length ?? 0) > 0 ? 'accept' : 'remove',
+            fingerprints: [...(options.add ?? []), ...(options.remove ?? [])],
+            ...(options.reason?.trim() ? { reason: options.reason.trim() } : {}),
+        };
+        atomicWriteFile(resolve(root, GUARD_BASELINE_FILE), `${JSON.stringify(fingerprints, null, 2)}\n`);
+        atomicWriteFile(metadataPath, `${JSON.stringify({
+            ...(previous !== null && typeof previous === 'object' ? previous : {}),
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            findings: fingerprints.length,
+            decisions: [...history, decision],
+        }, null, 2)}\n`);
+        return next;
+    });
 }
-export function writeGuardConfig(root, guardConfig) {
-    mkdirSync(resolve(root, GUARD_DIR), { recursive: true });
-    const { contracts = [], ...rulesConfig } = guardConfig;
-    atomicWriteFile(resolve(root, GUARD_RULES_FILE), `${JSON.stringify(rulesConfig, null, 2)}\n`);
-    atomicWriteFile(resolve(root, GUARD_CONTRACTS_FILE), `${JSON.stringify({ version: 1, contracts }, null, 2)}\n`);
+export function writeGuardConfig(root, guardConfig, options = {}) {
+    withGuardStateLock(root, () => writeGuardConfigUnlocked(root, guardConfig, options), options);
 }
 export function writeGuardProposals(root, proposals) {
     writeGuardArtifact(root, GUARD_PROPOSALS_FILE, proposals);
 }
-export function recordGuardProposalDecision(root, decisions) {
-    const proposals = loadGuardProposals(root);
+function buildGuardProposalWithDecisionsUnlocked(root, decisions, options) {
+    const proposals = loadGuardProposalsUnlocked(root);
     if (!proposals || decisions.length === 0)
         return;
     const decidedAt = new Date().toISOString();
+    const commit = (() => {
+        try {
+            return execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, stdio: 'pipe' })
+                .toString()
+                .trim();
+        }
+        catch {
+            return undefined;
+        }
+    })();
     const nextDecisions = decisions.map((decision) => ({
         ...decision,
         decidedAt,
+        source: options.source,
+        ...(process.env.GUARD_APPROVER?.trim() ? { actor: process.env.GUARD_APPROVER.trim() } : {}),
+        ...(commit ? { commit } : {}),
         ...(proposals.proposalId ? { proposalId: proposals.proposalId } : {}),
         ...(proposals.contentFingerprint ? { proposalFingerprint: proposals.contentFingerprint } : {}),
         ...(typeof proposals.revision === 'number' ? { revision: proposals.revision } : {}),
     }));
-    writeGuardProposals(root, {
+    return {
         ...proposals,
         decisions: [...(proposals.decisions ?? []), ...nextDecisions],
+    };
+}
+function appendGuardProposalDecisionsUnlocked(root, decisions, options) {
+    const proposals = buildGuardProposalWithDecisionsUnlocked(root, decisions, options);
+    if (!proposals)
+        return;
+    writeGuardArtifactUnlocked(root, GUARD_PROPOSALS_FILE, proposals);
+}
+export function recordGuardProposalDecision(root, decisions, options = { source: 'external' }) {
+    withGuardStateLock(root, () => {
+        appendGuardProposalDecisionsUnlocked(root, decisions, options);
+    });
+}
+export function applyGuardProposalDecision(root, guardConfig, decisions, options) {
+    withGuardStateLock(root, () => {
+        const proposals = buildGuardProposalWithDecisionsUnlocked(root, decisions, options);
+        writeGuardArtifactUnlocked(root, GUARD_POLICY_TRANSACTION_FILE, {
+            version: 1,
+            createdAt: new Date().toISOString(),
+            config: guardConfig,
+            ...(proposals ? { proposals } : {}),
+        });
+        writeGuardConfigUnlocked(root, guardConfig);
+        if (proposals)
+            writeGuardArtifactUnlocked(root, GUARD_PROPOSALS_FILE, proposals);
+        unlinkSync(resolve(root, GUARD_POLICY_TRANSACTION_FILE));
     });
 }
+export function validateGuardProposalApproval(policy, proposals) {
+    if (policy?.mode !== 'protected' || !policy.requireDistinctActor)
+        return undefined;
+    const actor = process.env.GUARD_APPROVER?.trim();
+    if (!actor) {
+        return 'Protected Guard policy requires GUARD_APPROVER for a distinct approval actor.';
+    }
+    if (proposals?.generatedBy && proposals.generatedBy === actor) {
+        return 'The proposal author and approval actor must be different.';
+    }
+    return undefined;
+}
+export function getPendingGuardProposals(proposals) {
+    if (!proposals)
+        return [];
+    const decisions = new Map();
+    for (const decision of proposals.decisions ?? []) {
+        const current = decisions.get(`${decision.type}:${decision.id}`);
+        if (!current || decision.decidedAt >= current.decidedAt) {
+            decisions.set(`${decision.type}:${decision.id}`, decision);
+        }
+    }
+    const matchesCurrentProposal = (decision) => decision !== undefined &&
+        (proposals.proposalId === undefined || decision.proposalId === proposals.proposalId) &&
+        (proposals.contentFingerprint === undefined ||
+            decision.proposalFingerprint === proposals.contentFingerprint) &&
+        (proposals.revision === undefined || decision.revision === proposals.revision);
+    return [
+        ...proposals.rules
+            .filter((rule) => rule.status === 'proposed' && !matchesCurrentProposal(decisions.get(`rule:${rule.id}`)))
+            .map((rule) => ({ id: rule.id, type: 'rule' })),
+        ...proposals.contracts
+            .filter((contract) => contract.status === 'proposed' &&
+            !matchesCurrentProposal(decisions.get(`contract:${contract.id}`)))
+            .map((contract) => ({ id: contract.id, type: 'contract' })),
+    ];
+}
 export function buildGuardProposals(model, guardConfig) {
     const capabilities = Object.keys(model.capabilities);
     const questions = [];
@@ -249,6 +611,9 @@ export function buildGuardProposals(model, guardConfig) {
     const proposal = {
         version: 1,
         generatedAt: new Date().toISOString(),
+        ...(process.env.GUARD_PROPOSER?.trim()
+            ? { generatedBy: process.env.GUARD_PROPOSER.trim() }
+            : {}),
         rules: guardConfig.rules.filter((rule) => rule.status === 'proposed'),
         contracts: [
             ...(guardConfig.contracts ?? []).filter((contract) => contract.status === 'proposed'),
@@ -347,14 +712,19 @@ export function buildConventionsMemory(model) {
 }
 export function buildGeneratedGuardConfig(model) {
     const isPersistenceImport = (importPath) => /(?:^|\/)(?:database|db)(?:\/|$)/i.test(importPath) ||
-        /^(?:@prisma\codapult-guardent|prisma|drizzle-orm|drizzle-kit|typeorm|sequelize|mongoose|knex)(?:\/|$)/i.test(importPath);
+        /^(?:@prisma\/client|prisma|drizzle-orm|drizzle-kit|typeorm|sequelize|mongoose|knex)(?:\/|$)/i.test(importPath);
+    const moduleReferences = (module) => [
+        ...module.imports,
+        ...module.exports,
+        ...module.dynamicImports,
+    ];
     const persistenceImports = [
-        ...new Set(model.modules.flatMap((module) => module.imports).filter(isPersistenceImport)),
+        ...new Set(model.modules.flatMap((module) => moduleReferences(module)).filter(isPersistenceImport)),
     ].sort();
     const clientPersistenceFiles = model.insights.boundaries
         .find((boundary) => boundary.kind === 'client')
         ?.files.filter((file) => model.modules.some((module) => module.path === file &&
-        module.imports.some((importPath) => persistenceImports.includes(importPath)))) ?? [];
+        moduleReferences(module).some((importPath) => persistenceImports.includes(importPath)))) ?? [];
     const proposedRules = clientPersistenceFiles.length > 0
         ? [
             {
@@ -372,23 +742,37 @@ export function buildGeneratedGuardConfig(model) {
     return { ...defaultGuardConfig, rules: proposedRules };
 }
 export function writeGuardMemory(root, model) {
-    writeGuardArtifact(root, GUARD_ARCHITECTURE_FILE, buildArchitectureMemory(model));
-    writeGuardArtifact(root, GUARD_CONVENTIONS_FILE, buildConventionsMemory(model));
+    withGuardStateLock(root, () => {
+        writeGuardArtifact(root, GUARD_ARCHITECTURE_FILE, buildArchitectureMemory(model));
+        writeGuardArtifact(root, GUARD_CONVENTIONS_FILE, buildConventionsMemory(model));
+    });
 }
 export function writeBaseline(root, findings, model) {
-    mkdirSync(resolve(root, GUARD_DIR), { recursive: true });
-    const fingerprints = [...new Set(findings.map((finding) => finding.fingerprint))].sort();
-    atomicWriteFile(resolve(root, GUARD_BASELINE_FILE), `${JSON.stringify(fingerprints, null, 2)}\n`);
-    atomicWriteFile(resolve(root, GUARD_BASELINE_META_FILE), `${JSON.stringify({
-        version: 1,
-        generatedAt: new Date().toISOString(),
-        findings: fingerprints.length,
-        ...(model ? { projectFingerprint: fingerprintProjectModel(model) } : {}),
-        guardSchemaVersion: 1,
-        purpose: 'Initial Guard state; findings are suppressed unless they change fingerprint.',
-    }, null, 2)}\n`);
+    withGuardStateLock(root, () => {
+        mkdirSync(resolve(root, GUARD_DIR), { recursive: true });
+        const fingerprints = [...new Set(findings.map((finding) => finding.fingerprint))].sort();
+        atomicWriteFile(resolve(root, GUARD_BASELINE_FILE), `${JSON.stringify(fingerprints, null, 2)}\n`);
+        atomicWriteFile(resolve(root, GUARD_BASELINE_META_FILE), `${JSON.stringify({
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            findings: fingerprints.length,
+            ...(model ? { projectFingerprint: fingerprintProjectModel(model) } : {}),
+            guardSchemaVersion: 1,
+            purpose: 'Initial Guard state; findings are suppressed unless they change fingerprint.',
+        }, null, 2)}\n`);
+    });
 }
 export function loadProjectModel(root) {
+    const current = readJson(resolve(root, GUARD_STATE_CURRENT_FILE));
+    if (current !== undefined &&
+        typeof current === 'object' &&
+        safeGeneration(current.generation)) {
+        const generated = readJson(resolve(root, GUARD_STATE_GENERATIONS_DIR, current.generation, 'project.json'));
+        if (generated !== undefined &&
+            typeof generated === 'object' &&
+            generated.version === 1)
+            return generated;
+    }
     const value = readJson(resolve(root, GUARD_PROJECT_FILE));
     if (value === null ||
         typeof value !== 'object' ||
@@ -398,8 +782,40 @@ export function loadProjectModel(root) {
     return value;
 }
 export function writeProjectModel(root, model) {
-    mkdirSync(resolve(root, GUARD_DIR), { recursive: true });
-    atomicWriteFile(resolve(root, GUARD_PROJECT_FILE), `${JSON.stringify(model, null, 2)}\n`);
+    withGuardStateLock(root, () => {
+        mkdirSync(resolve(root, GUARD_DIR), { recursive: true });
+        atomicWriteFile(resolve(root, GUARD_PROJECT_FILE), `${JSON.stringify(model, null, 2)}\n`);
+    });
+}
+/**
+ * Persist all derived project facts as one generation. Legacy root-level files remain as
+ * compatibility mirrors, while readers that understand generations always see a coherent set.
+ */
+export function writeProjectState(root, model, options = {}) {
+    return withGuardStateLock(root, () => {
+        const generationsRoot = resolve(root, GUARD_STATE_GENERATIONS_DIR);
+        mkdirSync(generationsRoot, { recursive: true });
+        const generation = `${Date.now()}-${randomUUID()}`;
+        const temporaryRoot = resolve(generationsRoot, `.tmp-${process.pid}-${randomUUID()}`);
+        mkdirSync(temporaryRoot, { recursive: true });
+        const derived = {
+            project: model,
+            architecture: buildArchitectureMemory(model),
+            conventions: buildConventionsMemory(model),
+        };
+        for (const [name, value] of Object.entries(derived)) {
+            writeFileSync(resolve(temporaryRoot, `${name}.json`), `${JSON.stringify(value, null, 2)}\n`);
+        }
+        writeFileSync(resolve(temporaryRoot, 'manifest.json'), `${JSON.stringify({ version: 1, generation, projectFingerprint: fingerprintProjectModel(model) }, null, 2)}\n`);
+        renameSync(temporaryRoot, resolve(generationsRoot, generation));
+        atomicWriteFile(resolve(root, GUARD_STATE_CURRENT_FILE), `${JSON.stringify({ version: 1, generation, projectFingerprint: fingerprintProjectModel(model) }, null, 2)}\n`);
+        atomicWriteFile(resolve(root, GUARD_PROJECT_FILE), `${JSON.stringify(model, null, 2)}\n`);
+        atomicWriteFile(resolve(root, GUARD_ARCHITECTURE_FILE), `${JSON.stringify(derived.architecture, null, 2)}\n`);
+        atomicWriteFile(resolve(root, GUARD_CONVENTIONS_FILE), `${JSON.stringify(derived.conventions, null, 2)}\n`);
+        // Snapshot persistence is defined below the generation writer to keep the public API grouped.
+        // eslint-disable-next-line @typescript-eslint/no-use-before-define
+        return writeProjectSnapshot(root, model);
+    }, options);
 }
 function projectRevision(root) {
     try {
@@ -413,16 +829,61 @@ function projectRevision(root) {
     }
 }
 export function writeProjectSnapshot(root, model) {
-    const baseRevision = projectRevision(root);
-    const revision = model.git.dirty && baseRevision !== 'working-tree'
-        ? `${baseRevision}-working-tree-${createHash('sha256')
-            .update(JSON.stringify(model))
-            .digest('hex')
-            .slice(0, 12)}`
-        : baseRevision;
-    mkdirSync(resolve(root, GUARD_HISTORY_DIR), { recursive: true });
-    atomicWriteFile(resolve(root, GUARD_HISTORY_DIR, `${revision}.json`), `${JSON.stringify(model, null, 2)}\n`);
-    return revision;
+    return withGuardStateLock(root, () => {
+        const baseRevision = projectRevision(root);
+        const revision = model.git.dirty && baseRevision !== 'working-tree'
+            ? `${baseRevision}-working-tree-${createHash('sha256')
+                .update(JSON.stringify(model))
+                .digest('hex')
+                .slice(0, 12)}`
+            : baseRevision;
+        mkdirSync(resolve(root, GUARD_HISTORY_DIR), { recursive: true });
+        atomicWriteFile(resolve(root, GUARD_HISTORY_DIR, `${revision}.json`), `${JSON.stringify(model, null, 2)}\n`);
+        return revision;
+    });
+}
+function isProjectPath(root, value) {
+    const normalized = value.replace(/\\/g, '/');
+    if (!normalized || normalized.startsWith('/') || normalized.split('/').includes('..')) {
+        return false;
+    }
+    try {
+        const projectRoot = `${realpathSync(root)}${sep}`;
+        const targetPath = resolve(root, normalized);
+        let target;
+        try {
+            target = realpathSync(targetPath);
+        }
+        catch {
+            target = realpathSync(dirname(targetPath));
+        }
+        return target === projectRoot.slice(0, -1) || target.startsWith(projectRoot);
+    }
+    catch {
+        return false;
+    }
+}
+export function loadGuardArtifact(root, relativePath) {
+    if (!isProjectPath(root, relativePath))
+        return undefined;
+    const generatedName = relativePath === GUARD_PROJECT_FILE
+        ? 'project.json'
+        : relativePath === GUARD_ARCHITECTURE_FILE
+            ? 'architecture.json'
+            : relativePath === GUARD_CONVENTIONS_FILE
+                ? 'conventions.json'
+                : undefined;
+    if (generatedName) {
+        const current = readJson(resolve(root, GUARD_STATE_CURRENT_FILE));
+        if (current !== undefined &&
+            typeof current === 'object' &&
+            safeGeneration(current.generation)) {
+            const generated = readJson(resolve(root, GUARD_STATE_GENERATIONS_DIR, current.generation, generatedName));
+            if (generated !== undefined)
+                return generated;
+        }
+    }
+    return readJson(resolve(root, relativePath));
 }
 export function validateGuardContracts(root, contracts = []) {
     const issues = [];
@@ -445,8 +906,18 @@ export function validateGuardContracts(root, contracts = []) {
                 message: 'Required-call contracts need at least one mustCall pattern.',
             });
         }
+        if (contract.kind === 'package-boundary' &&
+            ((contract.fromPackages?.length ?? 0) === 0 ||
+                (contract.mustNotImportPackages?.length ?? 0) === 0)) {
+            issues.push({
+                contractId: contract.id,
+                field: 'definition',
+                value: contract.kind,
+                message: 'Package-boundary contracts need fromPackages and mustNotImportPackages patterns.',
+            });
+        }
         for (const scope of contract.scope ?? []) {
-            if (!existsSync(resolve(root, scope))) {
+            if (!isProjectPath(root, scope) || !existsSync(resolve(root, scope))) {
                 issues.push({
                     contractId: contract.id,
                     field: 'scope',
@@ -456,7 +927,7 @@ export function validateGuardContracts(root, contracts = []) {
             }
         }
         for (const entrypoint of contract.entrypoints ?? []) {
-            if (!existsSync(resolve(root, entrypoint))) {
+            if (!isProjectPath(root, entrypoint) || !existsSync(resolve(root, entrypoint))) {
                 issues.push({
                     contractId: contract.id,
                     field: 'scope',
@@ -466,7 +937,7 @@ export function validateGuardContracts(root, contracts = []) {
             }
         }
         for (const excluded of contract.exclude ?? []) {
-            if (!existsSync(resolve(root, excluded))) {
+            if (!isProjectPath(root, excluded) || !existsSync(resolve(root, excluded))) {
                 issues.push({
                     contractId: contract.id,
                     field: 'scope',
@@ -476,7 +947,7 @@ export function validateGuardContracts(root, contracts = []) {
             }
         }
         for (const reference of contract.references ?? []) {
-            if (!existsSync(resolve(root, reference))) {
+            if (!isProjectPath(root, reference) || !existsSync(resolve(root, reference))) {
                 issues.push({
                     contractId: contract.id,
                     field: 'reference',
@@ -488,6 +959,51 @@ export function validateGuardContracts(root, contracts = []) {
     }
     return issues;
 }
+export function validateGuardBudgets(root, budgets = []) {
+    const issues = [];
+    for (const budget of budgets) {
+        if (!budget.reason.trim()) {
+            issues.push({
+                contractId: `budget:${budget.id}`,
+                field: 'definition',
+                value: budget.id,
+                message: 'Budgets require a written reason.',
+            });
+        }
+        for (const rawScope of budget.scope) {
+            const scope = rawScope.replace(/\*+$/, '') || '.';
+            if (!isProjectPath(root, scope) || !existsSync(resolve(root, scope))) {
+                issues.push({
+                    contractId: `budget:${budget.id}`,
+                    field: 'scope',
+                    value: rawScope,
+                    message: `Budget scope does not exist inside the project: ${rawScope}`,
+                });
+            }
+        }
+    }
+    return issues;
+}
+export function validateGuardPolicy(root, guardConfig) {
+    const issues = [];
+    for (const rule of guardConfig.rules) {
+        for (const file of rule.files ?? []) {
+            if (!isProjectPath(root, file)) {
+                issues.push({
+                    contractId: `rule:${rule.id}`,
+                    field: 'files',
+                    value: file,
+                    message: `Rule file scope must stay inside the project: ${file}`,
+                });
+            }
+        }
+    }
+    return [
+        ...issues,
+        ...validateGuardContracts(root, guardConfig.contracts ?? []),
+        ...validateGuardBudgets(root, guardConfig.budgets ?? []),
+    ];
+}
 function isSourceFile(file) {
     return /\.(?:ts|tsx|js|jsx)$/.test(file) && !/\.(?:test|spec)\.(?:ts|tsx|js|jsx)$/.test(file);
 }
@@ -541,6 +1057,32 @@ function importLine(sourceFile, importPath) {
     });
     return dynamicImport?.getStartLineNumber() ?? 1;
 }
+function moduleImportReferences(module) {
+    const sources = [...new Set([...module.imports, ...module.exports, ...module.dynamicImports])];
+    return sources.map((source) => ({ source, resolved: module.resolvedImportMap?.[source] }));
+}
+function packageSelectorMatches(value, selector) {
+    if (!value)
+        return false;
+    return selector.endsWith('*') ? value.startsWith(selector.slice(0, -1)) : value === selector;
+}
+function packageForFile(model, file) {
+    const packageInfo = model.project.workspacePackages
+        .filter((workspace) => workspace.path === '.' ||
+        file === `${workspace.path}/package.json` ||
+        file.startsWith(`${workspace.path}/`))
+        .sort((left, right) => right.path.length - left.path.length)[0] ?? null;
+    return packageInfo === null ? undefined : (packageInfo.name ?? packageInfo.path);
+}
+function packageForImport(model, reference) {
+    const resolvedPackage = reference.resolved
+        ? packageForFile(model, reference.resolved)
+        : undefined;
+    if (resolvedPackage)
+        return resolvedPackage;
+    return model.project.workspacePackages.find((workspace) => workspace.name === reference.source ||
+        (workspace.name !== undefined && reference.source.startsWith(`${workspace.name}/`)))?.name;
+}
 function scanFile(root, file, rules, module, astProject) {
     if (!module)
         return [];
@@ -555,26 +1097,25 @@ function scanFile(root, file, rules, module, astProject) {
         }
     }
     const findings = [];
-    const importPaths = [
-        ...new Set([...module.imports, ...module.exports, ...module.dynamicImports]),
-    ];
-    for (const importPath of importPaths) {
-        const line = sourceFile ? importLine(sourceFile, importPath) : 1;
+    for (const reference of moduleImportReferences(module)) {
+        const line = sourceFile ? importLine(sourceFile, reference.source) : 1;
         for (const rule of rules) {
             if (rule.status === 'proposed' || !ruleAppliesToFile(rule, file))
                 continue;
             if (rule.kind === 'client-forbidden-import' && !isClient)
                 continue;
-            if (!rule.patterns.some((pattern) => patternMatches(importPath, pattern)))
+            if (!rule.patterns.some((pattern) => patternMatches(reference.source, pattern) ||
+                (reference.resolved !== undefined && patternMatches(reference.resolved, pattern))))
                 continue;
             findings.push({
                 ruleId: rule.id,
                 severity: rule.severity,
                 file,
                 line,
-                importPath,
+                importPath: reference.source,
+                ...(reference.resolved ? { resolvedPath: reference.resolved } : {}),
                 message: rule.description,
-                fingerprint: `${rule.id}|${file}|${importPath}`,
+                fingerprint: `${rule.id}|${file}|${reference.source}|${reference.resolved ?? ''}`,
             });
         }
     }
@@ -589,22 +1130,25 @@ function scanContracts(root, contracts, changed) {
         const severity = contract.severity ?? 'error';
         for (const module of model.modules.filter((item) => (!changed || changed.has(item.path)) && contractAppliesToFile(contract, item.path))) {
             if (contract.kind === 'import-boundary') {
-                for (const importPath of module.imports) {
-                    if (contract.mustNotImport?.some((pattern) => patternMatches(importPath, pattern))) {
+                for (const reference of moduleImportReferences(module)) {
+                    if (contract.mustNotImport?.some((pattern) => patternMatches(reference.source, pattern) ||
+                        (reference.resolved !== undefined && patternMatches(reference.resolved, pattern)))) {
                         findings.push({
                             ruleId: `contract:${contract.id}`,
                             severity,
                             file: module.path,
                             line: 1,
-                            importPath,
+                            importPath: reference.source,
+                            ...(reference.resolved ? { resolvedPath: reference.resolved } : {}),
                             message: contract.statement,
-                            fingerprint: `contract-import|${contract.id}|${module.path}|${importPath}`,
+                            fingerprint: `contract-import|${contract.id}|${module.path}|${reference.source}|${reference.resolved ?? ''}`,
                         });
                     }
                 }
                 if (contract.mustImport !== undefined &&
                     contract.mustImport.length > 0 &&
-                    !module.imports.some((importPath) => contract.mustImport?.some((pattern) => patternMatches(importPath, pattern)))) {
+                    !moduleImportReferences(module).some((reference) => contract.mustImport?.some((pattern) => patternMatches(reference.source, pattern) ||
+                        (reference.resolved !== undefined && patternMatches(reference.resolved, pattern))))) {
                     findings.push({
                         ruleId: `contract:${contract.id}`,
                         severity,
@@ -630,6 +1174,28 @@ function scanContracts(root, contracts, changed) {
                     fingerprint: `contract-required-call|${contract.id}|${module.path}`,
                 });
             }
+            if (contract.kind === 'package-boundary') {
+                const sourcePackage = packageForFile(model, module.path);
+                if (!contract.fromPackages?.some((selector) => packageSelectorMatches(sourcePackage, selector))) {
+                    continue;
+                }
+                for (const reference of moduleImportReferences(module)) {
+                    const targetPackage = packageForImport(model, reference);
+                    if (!contract.mustNotImportPackages?.some((selector) => packageSelectorMatches(targetPackage, selector))) {
+                        continue;
+                    }
+                    findings.push({
+                        ruleId: `contract:${contract.id}`,
+                        severity,
+                        file: module.path,
+                        line: 1,
+                        importPath: reference.source,
+                        ...(reference.resolved ? { resolvedPath: reference.resolved } : {}),
+                        message: contract.statement,
+                        fingerprint: `contract-package|${contract.id}|${module.path}|${reference.source}|${targetPackage ?? ''}`,
+                    });
+                }
+            }
         }
     }
     return findings;
@@ -657,6 +1223,30 @@ function changedFiles(root) {
         return undefined;
     }
 }
+function changedImpactScope(model, changed) {
+    if (!changed)
+        return undefined;
+    const graph = buildModuleTargetGraph(model.modules);
+    const reverse = new Map();
+    for (const [from, targets] of graph) {
+        for (const target of targets)
+            reverse.set(target, [...(reverse.get(target) ?? []), from]);
+    }
+    const scope = new Set(changed);
+    const queue = [...changed];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current)
+            continue;
+        for (const dependent of reverse.get(current) ?? []) {
+            if (!scope.has(dependent)) {
+                scope.add(dependent);
+                queue.push(dependent);
+            }
+        }
+    }
+    return scope;
+}
 function architectureInsightFindings(root, changed) {
     const model = discoverProject(root);
     const findings = model.insights.cycles
@@ -677,7 +1267,9 @@ function architectureInsightFindings(root, changed) {
     for (const module of model.modules) {
         if (!clientFiles.has(module.path))
             continue;
-        for (const importPath of module.imports.filter((value) => serverOnlyImports.test(value))) {
+        for (const importPath of [
+            ...new Set([...module.imports, ...module.exports, ...module.dynamicImports]),
+        ].filter((value) => serverOnlyImports.test(value))) {
             if (changed && !changed.has(module.path))
                 continue;
             findings.push({
@@ -709,6 +1301,49 @@ function architectureInsightFindings(root, changed) {
     }
     return findings;
 }
+function budgetMatchesFile(budget, file) {
+    return budget.scope.some((scope) => scope.endsWith('*')
+        ? file.startsWith(scope.slice(0, -1))
+        : file === scope || file.startsWith(`${scope}/`));
+}
+function budgetValue(root, metric, file, module) {
+    if (metric === 'bytes')
+        return file.bytes;
+    if (metric === 'imports') {
+        return module
+            ? new Set([...module.imports, ...module.exports, ...module.dynamicImports]).size
+            : 0;
+    }
+    try {
+        return readFileSync(resolve(root, file.path), 'utf8').split(/\r?\n/).length;
+    }
+    catch {
+        return 0;
+    }
+}
+function scanBudgets(root, model, budgets, changed) {
+    const modules = new Map(model.modules.map((module) => [module.path, module]));
+    return budgets
+        .filter((budget) => budget.status !== 'proposed')
+        .flatMap((budget) => model.files
+        .filter((file) => budgetMatchesFile(budget, file.path) && (!changed || changed.has(file.path)))
+        .flatMap((file) => {
+        const value = budgetValue(root, budget.metric, file, modules.get(file.path));
+        if (value <= budget.limit)
+            return [];
+        return [
+            {
+                ruleId: `budget:${budget.id}`,
+                severity: budget.severity,
+                file: file.path,
+                line: 1,
+                importPath: `budget:${budget.metric}`,
+                message: `${budget.description} (${value} ${budget.metric}; limit ${budget.limit}).`,
+                fingerprint: `budget|${budget.id}|${file.path}|${budget.metric}`,
+            },
+        ];
+    }));
+}
 function isSafeReviewFile(file) {
     return !(file === '.env' ||
         file.startsWith('.env.') ||
@@ -716,25 +1351,7 @@ function isSafeReviewFile(file) {
         /\.(?:pem|key|p12|pfx)$/i.test(file));
 }
 function isSafeReviewPath(root, file) {
-    const normalizedFile = file.replace(/\\/g, '/');
-    if (normalizedFile.startsWith('/') || normalizedFile.split('/').includes('..'))
-        return false;
-    try {
-        const projectRoot = `${realpathSync(root)}${sep}`;
-        const targetPath = resolve(root, normalizedFile);
-        let target;
-        try {
-            target = realpathSync(targetPath);
-        }
-        catch {
-            // Deleted files have no realpath. Validate their nearest existing parent instead.
-            target = realpathSync(dirname(targetPath));
-        }
-        return target === projectRoot.slice(0, -1) || target.startsWith(projectRoot);
-    }
-    catch {
-        return false;
-    }
+    return isProjectPath(root, file);
 }
 function parseGitChanges(root, args) {
     try {
@@ -780,6 +1397,9 @@ export function redactSensitiveText(value) {
     };
     replace(/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g, '[REDACTED PRIVATE KEY]');
     replace(/\b(?:sk_(?:live|test)_|pk_(?:live|test)_|AKIA|gh[pousr]_|github_pat_)[A-Za-z0-9_-]+/g, '[REDACTED TOKEN]');
+    replace(/\beyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, '[REDACTED JWT]');
+    replace(/\bhttps?:\/\/[^\s/@:]+:[^\s/@]+@/gi, '[REDACTED URL CREDENTIALS]@');
+    replace(/\b(?:AIza[0-9A-Za-z_-]{20,}|xox[baprs]-[0-9A-Za-z-]{10,})\b/g, '[REDACTED TOKEN]');
     replace(/((?:api[_-]?key|secret|token|password|authorization|database[_-]?url)\s*[:=]\s*["']?)[^\s"'`,}]+/gi, '$1[REDACTED]');
     return { value: redactedValue, redacted, redactionCount };
 }
@@ -898,9 +1518,10 @@ function reviewDiff(root, maxChars, base) {
     }
 }
 export function scanGuard(root, guardConfig, options = {}) {
-    const changed = options.changedOnly ? (options.changedFiles ?? changedFiles(root)) : undefined;
-    const files = listSourceFiles(root).filter((file) => !changed || changed.has(file));
     const model = discoverProject(root);
+    const changed = options.changedOnly ? (options.changedFiles ?? changedFiles(root)) : undefined;
+    const scope = changedImpactScope(model, changed);
+    const files = listSourceFiles(root).filter((file) => !scope || scope.has(file));
     const modules = new Map(model.modules.map((module) => [module.path, module]));
     const astProject = (() => {
         try {
@@ -912,8 +1533,9 @@ export function scanGuard(root, guardConfig, options = {}) {
     })();
     const allFindings = [
         ...files.flatMap((file) => scanFile(root, file, guardConfig.rules, modules.get(file), astProject)),
-        ...scanContracts(root, guardConfig.contracts ?? [], changed),
-        ...(options.includeArchitectureInsights ? architectureInsightFindings(root, changed) : []),
+        ...scanContracts(root, guardConfig.contracts ?? [], scope),
+        ...scanBudgets(root, model, guardConfig.budgets ?? [], scope),
+        ...(options.includeArchitectureInsights ? architectureInsightFindings(root, scope) : []),
     ];
     const baseline = options.baseline ?? new Set();
     const findings = allFindings.filter((finding) => !baseline.has(finding.fingerprint));
@@ -965,22 +1587,22 @@ export function buildGuardReviewPacket(root, guardConfig, baseline = new Set(),
     };
 }
 export function initializeGuard(root, options = {}) {
-    if (existsSync(resolve(root, GUARD_BASELINE_FILE)) && !options.force) {
-        throw new GuardAlreadyInitializedError();
-    }
-    const projectModel = discoverProject(root);
-    const guardConfig = loadGuardConfig(root) ?? buildGeneratedGuardConfig(projectModel);
-    ensureGeneratedStateIgnored(root, projectModel);
-    writeGuardConfig(root, guardConfig);
-    if (options.force || !existsSync(resolve(root, GUARD_AGENT_FILE))) {
-        writeGuardAgentConfig(root);
-    }
-    writeGuardMemory(root, projectModel);
-    writeProjectModel(root, projectModel);
-    writeProjectSnapshot(root, projectModel);
-    writeGuardProposals(root, buildGuardProposals(projectModel, guardConfig));
-    const initialReport = scanGuard(root, guardConfig, { includeArchitectureInsights: true });
-    writeBaseline(root, initialReport.findings, projectModel);
-    return { config: guardConfig, report: { ...initialReport, findings: [] } };
-}
-export { discoverProject, discoverProjectWithMetrics, findGuardRoot };
+    return withGuardStateLock(root, () => {
+        if (existsSync(resolve(root, GUARD_BASELINE_FILE)) && !options.force) {
+            throw new GuardAlreadyInitializedError();
+        }
+        const projectModel = discoverProject(root);
+        const guardConfig = loadGuardConfig(root) ?? buildGeneratedGuardConfig(projectModel);
+        ensureGeneratedStateIgnored(root, projectModel);
+        writeGuardConfig(root, guardConfig);
+        if (options.force || !existsSync(resolve(root, GUARD_AGENT_FILE))) {
+            writeGuardAgentConfig(root);
+        }
+        writeProjectState(root, projectModel);
+        writeGuardProposals(root, buildGuardProposals(projectModel, guardConfig));
+        const initialReport = scanGuard(root, guardConfig, { includeArchitectureInsights: true });
+        writeBaseline(root, initialReport.findings, projectModel);
+        return { config: guardConfig, report: { ...initialReport, findings: [] } };
+    }, options);
+}
+export { clearDiscoveryCache, discoverProject, discoverProjectWithMetrics, findGuardRoot };