ue-mcp 1.2.1 → 1.2.2

package/dist/context-cli.js

@@ -21,20 +21,20 @@ const CYAN = "\x1b[36m";
 const YELLOW = "\x1b[33m";
 const ACTIONS = new Set(["full", "lean", "micro", "status"]);
 function printHelp() {
-    console.log(`
-  ${BOLD}${CYAN}ue-mcp context${RESET} - control the context seeding strategy
-
-  ${BOLD}Usage:${RESET}
-    ue-mcp context                 show the current strategy
-    ue-mcp context status          show the current strategy
-    ue-mcp context full            every action inline (largest seed, default)
-    ue-mcp context lean            action names visible, descriptions on demand
-    ue-mcp context micro           one gateway tool fronts everything (smallest)
-
-  A project path may be passed as the last argument, or an editor named with
-  --editor <name-or-path>; otherwise the .uproject in the current directory is
-  used. Restart your MCP client (/mcp in Claude Code) after changing the
-  strategy.
+    console.log(`
+  ${BOLD}${CYAN}ue-mcp context${RESET} - control the context seeding strategy
+
+  ${BOLD}Usage:${RESET}
+    ue-mcp context                 show the current strategy
+    ue-mcp context status          show the current strategy
+    ue-mcp context full            every action inline (largest seed, default)
+    ue-mcp context lean            action names visible, descriptions on demand
+    ue-mcp context micro           one gateway tool fronts everything (smallest)
+
+  A project path may be passed as the last argument, or an editor named with
+  --editor <name-or-path>; otherwise the .uproject in the current directory is
+  used. Restart your MCP client (/mcp in Claude Code) after changing the
+  strategy.
 `);
 }
 function parseArgs() {
@@ -50,8 +50,8 @@ function parseArgs() {
         target = takeEditorTarget(argv);
     }
     catch (e) {
-        console.log(`
-  ${RED}${e instanceof EditorFlagError ? e.message : String(e)}${RESET}
+        console.log(`
+  ${RED}${e instanceof EditorFlagError ? e.message : String(e)}${RESET}
 `);
         process.exit(1);
     }

package/dist/engine-observer.js

@@ -65,19 +65,19 @@ function classify(pid, commandLine, responding, windowTitle) {
 // seconds (interpreter start ~1.5s, CIM ~4s, and `tasklist` is no cheaper), so
 // the whole probe is a single script and callers reach it only when the fast
 // signal - the bridge socket itself - has already failed.
-const WINDOWS_PROCESS_SCRIPT = `
-$ErrorActionPreference = 'SilentlyContinue'
-$procs = Get-CimInstance Win32_Process -Filter "Name LIKE 'UnrealEditor%'"
-$out = foreach ($p in $procs) {
-  $ps = Get-Process -Id $p.ProcessId -ErrorAction SilentlyContinue
-  [pscustomobject]@{
-    pid = $p.ProcessId
-    cmd = $p.CommandLine
-    responding = $(if ($ps) { [bool]$ps.Responding } else { $true })
-    title = $(if ($ps) { $ps.MainWindowTitle } else { '' })
-  }
-}
-@($out) | ConvertTo-Json -Compress -Depth 3
+const WINDOWS_PROCESS_SCRIPT = `
+$ErrorActionPreference = 'SilentlyContinue'
+$procs = Get-CimInstance Win32_Process -Filter "Name LIKE 'UnrealEditor%'"
+$out = foreach ($p in $procs) {
+  $ps = Get-Process -Id $p.ProcessId -ErrorAction SilentlyContinue
+  [pscustomobject]@{
+    pid = $p.ProcessId
+    cmd = $p.CommandLine
+    responding = $(if ($ps) { [bool]$ps.Responding } else { $true })
+    title = $(if ($ps) { $ps.MainWindowTitle } else { '' })
+  }
+}
+@($out) | ConvertTo-Json -Compress -Depth 3
 `;
 // The process table is polled from wait loops and status calls; a short TTL
 // keeps a burst of callers from paying for the same query repeatedly, while
@@ -297,61 +297,61 @@ export function readLogState(projectPath, tailLines = 25) {
  * so it can be read from outside even when the process is not pumping. This is
  * the only way to see a dialog that appears before the plugin loads.
  */
-const WINDOWS_DIALOG_SCRIPT = `
-$ErrorActionPreference = 'SilentlyContinue'
-$sig = @'
-using System;
-using System.Text;
-using System.Runtime.InteropServices;
-public class UeMcpWin {
-  public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
-  [DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc cb, IntPtr p);
-  [DllImport("user32.dll")] public static extern bool EnumChildWindows(IntPtr h, EnumProc cb, IntPtr p);
-  [DllImport("user32.dll", CharSet=CharSet.Unicode)] public static extern int GetWindowTextW(IntPtr h, StringBuilder s, int n);
-  [DllImport("user32.dll", CharSet=CharSet.Unicode)] public static extern int GetClassNameW(IntPtr h, StringBuilder s, int n);
-  [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);
-  [DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr h);
-  [DllImport("user32.dll")] public static extern bool IsHungAppWindow(IntPtr h);
-  public static string Text(IntPtr h) {
-    StringBuilder sb = new StringBuilder(1024);
-    GetWindowTextW(h, sb, sb.Capacity);
-    return sb.ToString();
-  }
-  public static string Cls(IntPtr h) {
-    StringBuilder sb = new StringBuilder(256);
-    GetClassNameW(h, sb, sb.Capacity);
-    return sb.ToString();
-  }
-}
-'@
-Add-Type -TypeDefinition $sig -Language CSharp | Out-Null
-$targetPids = @(__PIDS__)
-$results = New-Object System.Collections.ArrayList
-$top = [UeMcpWin+EnumProc]{
-  param($h, $l)
-  $procId = 0
-  [void][UeMcpWin]::GetWindowThreadProcessId($h, [ref]$procId)
-  if ($targetPids -contains [int]$procId -and [UeMcpWin]::IsWindowVisible($h)) {
-    $children = New-Object System.Collections.ArrayList
-    $child = [UeMcpWin+EnumProc]{
-      param($c, $cl)
-      $t = [UeMcpWin]::Text($c)
-      if ($t -and $t.Trim().Length -gt 0) { [void]$children.Add($t) }
-      return $true
-    }
-    [void][UeMcpWin]::EnumChildWindows($h, $child, [IntPtr]::Zero)
-    [void]$results.Add([pscustomobject]@{
-      handle = $h.ToString()
-      className = [UeMcpWin]::Cls($h)
-      title = [UeMcpWin]::Text($h)
-      text = @($children)
-      hung = [bool][UeMcpWin]::IsHungAppWindow($h)
-    })
-  }
-  return $true
-}
-[void][UeMcpWin]::EnumWindows($top, [IntPtr]::Zero)
-@($results) | ConvertTo-Json -Compress -Depth 4
+const WINDOWS_DIALOG_SCRIPT = `
+$ErrorActionPreference = 'SilentlyContinue'
+$sig = @'
+using System;
+using System.Text;
+using System.Runtime.InteropServices;
+public class UeMcpWin {
+  public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
+  [DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc cb, IntPtr p);
+  [DllImport("user32.dll")] public static extern bool EnumChildWindows(IntPtr h, EnumProc cb, IntPtr p);
+  [DllImport("user32.dll", CharSet=CharSet.Unicode)] public static extern int GetWindowTextW(IntPtr h, StringBuilder s, int n);
+  [DllImport("user32.dll", CharSet=CharSet.Unicode)] public static extern int GetClassNameW(IntPtr h, StringBuilder s, int n);
+  [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);
+  [DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr h);
+  [DllImport("user32.dll")] public static extern bool IsHungAppWindow(IntPtr h);
+  public static string Text(IntPtr h) {
+    StringBuilder sb = new StringBuilder(1024);
+    GetWindowTextW(h, sb, sb.Capacity);
+    return sb.ToString();
+  }
+  public static string Cls(IntPtr h) {
+    StringBuilder sb = new StringBuilder(256);
+    GetClassNameW(h, sb, sb.Capacity);
+    return sb.ToString();
+  }
+}
+'@
+Add-Type -TypeDefinition $sig -Language CSharp | Out-Null
+$targetPids = @(__PIDS__)
+$results = New-Object System.Collections.ArrayList
+$top = [UeMcpWin+EnumProc]{
+  param($h, $l)
+  $procId = 0
+  [void][UeMcpWin]::GetWindowThreadProcessId($h, [ref]$procId)
+  if ($targetPids -contains [int]$procId -and [UeMcpWin]::IsWindowVisible($h)) {
+    $children = New-Object System.Collections.ArrayList
+    $child = [UeMcpWin+EnumProc]{
+      param($c, $cl)
+      $t = [UeMcpWin]::Text($c)
+      if ($t -and $t.Trim().Length -gt 0) { [void]$children.Add($t) }
+      return $true
+    }
+    [void][UeMcpWin]::EnumChildWindows($h, $child, [IntPtr]::Zero)
+    [void]$results.Add([pscustomobject]@{
+      handle = $h.ToString()
+      className = [UeMcpWin]::Cls($h)
+      title = [UeMcpWin]::Text($h)
+      text = @($children)
+      hung = [bool][UeMcpWin]::IsHungAppWindow($h)
+    })
+  }
+  return $true
+}
+[void][UeMcpWin]::EnumWindows($top, [IntPtr]::Zero)
+@($results) | ConvertTo-Json -Compress -Depth 4
 `;
 /**
  * Visible top-level windows belonging to the given PIDs, with their child text.

package/dist/flow/guard.d.ts

@@ -1,26 +1,26 @@
 /**
- * A general guard pipeline around the editor bridge, in the shape of NestJS
- * guards/interceptors but agnostic to what any guard does.
+ * The bridge's binding of flowkit's guard pipeline.
  *
- * Every mutating and non-mutating action crosses `IBridge.call`. A `GuardedBridge`
- * runs a registry of `BridgeGuard`s on that seam: each guard may inspect the call,
- * run a `before` hook that can veto it (throw) or act on it (e.g. check a file
- * out), and an optional `after` hook that can observe or replace the result
- * (audit, transform). The chain itself knows nothing about source control,
- * policy, rate limiting, or any concrete concern - those are guards.
+ * Every mutating and non-mutating action crosses `IBridge.call`. That seam is
+ * guarded: each guard may inspect the call, run a `before` hook that can veto
+ * it (throw) or act on it (e.g. check a file out), and an `after` hook that can
+ * observe or replace the result. The chain itself knows nothing about source
+ * control, policy, rate limiting, or any concrete concern - those are guards.
  *
- * `CallContext` is the per-call execution context handed to guards. It carries
- * the raw method/params and a lazy enrichment layer (`write()` / `writeFiles()`)
- * that write-oriented guards may consult, computed on demand and cached so a
- * guard that ignores writes pays nothing.
+ * The pipeline, its ordering, and the `guard.<name>.<phase>` task convention
+ * live in `@db-lyon/flowkit/guard`, because none of that is about Unreal. What
+ * stays here is what is: the shape of a bridge call, and the write
+ * classification in `write-methods.ts` that decides which content paths a call
+ * is about to modify.
  */
+import { GuardRegistry as FlowkitGuardRegistry, type Guard, type GuardContext } from "@db-lyon/flowkit/guard";
 import type { IBridge } from "../bridge.js";
 import type { EditorSession } from "../session.js";
 import { type WriteClassification } from "./write-methods.js";
 /** Resolve a UE content path to an absolute on-disk file, or null if it does not exist. */
 export type ResolveExistingFile = (contentPath: string) => string | null;
-/** Per-call execution context passed to every guard. Analogous to a NestJS ExecutionContext. */
-export interface CallContext {
+/** Per-call execution context passed to every guard. */
+export interface CallContext extends GuardContext {
     readonly method: string;
     readonly params: Record<string, unknown>;
     readonly timeoutMs?: number;
@@ -28,36 +28,25 @@ export interface CallContext {
     readonly bridge: IBridge;
     /** The editor this call is bound to. Absent only for a bridge built outside a session. */
     readonly session?: EditorSession;
-    /** Scratch space shared across guards for the life of one call. */
-    readonly meta: Map<string, unknown>;
     /** Lazy: how this call classifies as a write (which content paths it touches). Cached. */
     write(): WriteClassification;
     /** Lazy: absolute, existing on-disk files this call will modify (subset of write paths). Cached. */
     writeFiles(): string[];
 }
 /**
- * A guard on the bridge pipeline. Any of the hooks is optional. Guards are
- * agnostic: source control, access policy, audit, rate limiting, and approval
- * gating are all just guards.
+ * A guard on the bridge pipeline. Guards are agnostic: source control, access
+ * policy, audit, rate limiting, and approval gating are all just guards.
  */
-export interface BridgeGuard {
-    /** Stable identifier, for logging and ordering ties. */
-    readonly name: string;
-    /** Lower runs first in `before` and last in `after`. Default 0. */
-    readonly order?: number;
-    /** Whether this guard participates for a given call. Default: always. */
-    appliesTo?(ctx: CallContext): boolean | Promise<boolean>;
-    /** Runs before the call. Throw to DENY the call; side effects are allowed. */
-    before?(ctx: CallContext): Promise<void>;
-    /** Runs after a successful call. Return a value to replace the result; return nothing to leave it. */
-    after?(ctx: CallContext, result: unknown): Promise<unknown | void>;
-}
-/** An ordered set of guards. Built-in guards register directly; plugin guards are discovered. */
-export declare class GuardRegistry {
-    private guards;
-    register(guard: BridgeGuard): this;
-    list(): readonly BridgeGuard[];
-    get size(): number;
+export type BridgeGuard = Guard<CallContext, unknown>;
+/** The bridge's guard set. Built-in guards register directly; plugin guards are discovered. */
+export declare class GuardRegistry extends FlowkitGuardRegistry<CallContext, unknown> {
 }
+/**
+ * The scope a `guard.<name>.<phase>Write` task binds to: the call resolves to
+ * existing on-disk files it is about to modify. Declared here rather than in
+ * the task layer so the hand-written and task-backed guards agree on what
+ * "write" means.
+ */
+export declare function writeScope(ctx: CallContext): boolean;
 /** Build the per-call context, wiring the lazy write-enrichment helpers. */
 export declare function makeCallContext(method: string, params: Record<string, unknown>, timeoutMs: number | undefined, rawBridge: IBridge, resolveExistingFile: ResolveExistingFile, session?: EditorSession): CallContext;

package/dist/flow/guard.js

@@ -1,34 +1,49 @@
+/**
+ * The bridge's binding of flowkit's guard pipeline.
+ *
+ * Every mutating and non-mutating action crosses `IBridge.call`. That seam is
+ * guarded: each guard may inspect the call, run a `before` hook that can veto
+ * it (throw) or act on it (e.g. check a file out), and an `after` hook that can
+ * observe or replace the result. The chain itself knows nothing about source
+ * control, policy, rate limiting, or any concrete concern - those are guards.
+ *
+ * The pipeline, its ordering, and the `guard.<name>.<phase>` task convention
+ * live in `@db-lyon/flowkit/guard`, because none of that is about Unreal. What
+ * stays here is what is: the shape of a bridge call, and the write
+ * classification in `write-methods.ts` that decides which content paths a call
+ * is about to modify.
+ */
+import { GuardRegistry as FlowkitGuardRegistry, guardContextBase, lazy, } from "@db-lyon/flowkit/guard";
 import { classifyWrite } from "./write-methods.js";
-/** An ordered set of guards. Built-in guards register directly; plugin guards are discovered. */
-export class GuardRegistry {
-    guards = [];
-    register(guard) {
-        this.guards.push(guard);
-        // Stable order: by `order`, then by name for determinism.
-        this.guards.sort((a, b) => (a.order ?? 0) - (b.order ?? 0) || a.name.localeCompare(b.name));
-        return this;
-    }
-    list() {
-        return this.guards;
-    }
-    get size() {
-        return this.guards.length;
-    }
+/** The bridge's guard set. Built-in guards register directly; plugin guards are discovered. */
+export class GuardRegistry extends FlowkitGuardRegistry {
+}
+/**
+ * The scope a `guard.<name>.<phase>Write` task binds to: the call resolves to
+ * existing on-disk files it is about to modify. Declared here rather than in
+ * the task layer so the hand-written and task-backed guards agree on what
+ * "write" means.
+ */
+export function writeScope(ctx) {
+    return ctx.writeFiles().length > 0;
 }
 /** Build the per-call context, wiring the lazy write-enrichment helpers. */
 export function makeCallContext(method, params, timeoutMs, rawBridge, resolveExistingFile, session) {
-    let writeCache;
-    let filesCache;
-    const write = () => (writeCache ??= classifyWrite(method, params));
-    const writeFiles = () => {
-        if (filesCache)
-            return filesCache;
+    const ctx = {
+        ...guardContextBase(),
+        method,
+        params,
+        timeoutMs,
+        bridge: rawBridge,
+        session,
+    };
+    const write = lazy(ctx, "write", () => classifyWrite(method, params));
+    const writeFiles = lazy(ctx, "writeFiles", () => {
         const c = write();
-        filesCache = c.writes
+        return c.writes
             ? c.contentPaths.map(resolveExistingFile).filter((f) => f !== null)
             : [];
-        return filesCache;
-    };
-    return { method, params, timeoutMs, bridge: rawBridge, session, meta: new Map(), write, writeFiles };
+    });
+    return Object.assign(ctx, { write, writeFiles });
 }
 //# sourceMappingURL=guard.js.map

package/dist/flow/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/flow/guard.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,aAAa,EAA4B,MAAM,oBAAoB,CAAC;AAwC7E,iGAAiG;AACjG,MAAM,OAAO,aAAa;IAChB,MAAM,GAAkB,EAAE,CAAC;IAEnC,QAAQ,CAAC,KAAkB;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,0DAA0D;QAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,MAA+B,EAC/B,SAA6B,EAC7B,SAAkB,EAClB,mBAAwC,EACxC,OAAuB;IAEvB,IAAI,UAA2C,CAAC;IAChD,IAAI,UAAgC,CAAC;IAErC,MAAM,KAAK,GAAG,GAAwB,EAAE,CAAC,CAAC,UAAU,KAAK,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,GAAa,EAAE;QAChC,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,UAAU,GAAG,CAAC,CAAC,MAAM;YACnB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YAChF,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/flow/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,aAAa,IAAI,oBAAoB,EACrC,gBAAgB,EAChB,IAAI,GAGL,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAA4B,MAAM,oBAAoB,CAAC;AA0B7E,+FAA+F;AAC/F,MAAM,OAAO,aAAc,SAAQ,oBAA0C;CAAG;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB;IACzC,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,MAA+B,EAC/B,SAA6B,EAC7B,SAAkB,EAClB,mBAAwC,EACxC,OAAuB;IAEvB,MAAM,GAAG,GAAG;QACV,GAAG,gBAAgB,EAAE;QACrB,MAAM;QACN,MAAM;QACN,SAAS;QACT,MAAM,EAAE,SAAS;QACjB,OAAO;KACO,CAAC;IAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,MAAM;YACb,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YAChF,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/flow/guarded-bridge.d.ts

@@ -1,13 +1,3 @@
-/**
- * GuardedBridge - runs a `GuardRegistry` pipeline around the editor bridge.
- *
- * Before a call reaches Unreal, each applicable guard's `before` hook runs in
- * order (any may throw to deny). After a successful call, each guard's `after`
- * hook runs in reverse order and may replace the result. With an empty registry
- * this is a pure pass-through, so it is always safe to install.
- *
- * Only `call` is gated; connection lifecycle delegates straight through.
- */
 import type { BridgeTarget, IBridge } from "../bridge.js";
 import type { EditorSession } from "../session.js";
 import { GuardRegistry, type ResolveExistingFile } from "./guard.js";

package/dist/flow/guarded-bridge.js

@@ -1,4 +1,17 @@
-import { makeCallContext, } from "./guard.js";
+/**
+ * GuardedBridge - runs a `GuardRegistry` pipeline around the editor bridge.
+ *
+ * Before a call reaches Unreal, each applicable guard's `before` hook runs in
+ * order (any may throw to deny). After a successful call, each guard's `after`
+ * hook runs in reverse order and may replace the result. With an empty registry
+ * this is a pure pass-through, so it is always safe to install.
+ *
+ * The pipeline itself is `runGuarded` from flowkit; what this class adds is the
+ * `IBridge` shape. Only `call` is gated; connection lifecycle delegates
+ * straight through.
+ */
+import { runGuarded } from "@db-lyon/flowkit/guard";
+import { makeCallContext } from "./guard.js";
 export class GuardedBridge {
     inner;
     registry;
@@ -26,32 +39,14 @@ export class GuardedBridge {
         return this.inner.getTarget();
     }
     async call(method, params, timeoutMs) {
+        // `runGuarded` is already a pass-through on an empty registry, but building
+        // the context is not free and every bridge call lands here. Most servers run
+        // with no guards at all, so skip the allocation outright.
         if (this.registry.size === 0) {
             return this.inner.call(method, params, timeoutMs);
         }
         const ctx = makeCallContext(method, params ?? {}, timeoutMs, this.inner, this.resolveExistingFile, this.session);
-        // Resolve applicability once so `before`/`after` see a consistent set.
-        const applicable = [];
-        for (const g of this.registry.list()) {
-            if (!g.appliesTo || (await g.appliesTo(ctx)))
-                applicable.push(g);
-        }
-        // before: in order. A throw denies the call and propagates unchanged.
-        for (const g of applicable) {
-            if (g.before)
-                await g.before(ctx);
-        }
-        let result = await this.inner.call(method, params, timeoutMs);
-        // after: in reverse order. A returned value replaces the result.
-        for (let i = applicable.length - 1; i >= 0; i--) {
-            const g = applicable[i];
-            if (g.after) {
-                const replaced = await g.after(ctx, result);
-                if (replaced !== undefined)
-                    result = replaced;
-            }
-        }
-        return result;
+        return runGuarded(ctx, this.registry, () => this.inner.call(method, params, timeoutMs));
     }
 }
 //# sourceMappingURL=guarded-bridge.js.map

package/dist/flow/guarded-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"guarded-bridge.js","sourceRoot":"","sources":["../../src/flow/guarded-bridge.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,eAAe,GAGhB,MAAM,YAAY,CAAC;AAIpB,MAAM,OAAO,aAAa;IAEL;IACA;IACA;IAGA;IANnB,YACmB,KAAc,EACd,QAAuB,EACvB,mBAAwC;IACzD;2EACuE;IACtD,OAAuB;QALvB,UAAK,GAAL,KAAK,CAAS;QACd,aAAQ,GAAR,QAAQ,CAAe;QACvB,wBAAmB,GAAnB,mBAAmB,CAAqB;QAGxC,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAEJ,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,SAAkB;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,eAAe,CAAC,YAAoB,EAAE,UAAmB;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAAc,EACd,MAAgC,EAChC,SAAkB;QAElB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEjH,uEAAuE;QACvE,MAAM,UAAU,GAAkB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,sEAAsE;QACtE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAE9D,iEAAiE;QACjE,KAAK,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC5C,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,GAAG,QAAQ,CAAC;YAChD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"guarded-bridge.js","sourceRoot":"","sources":["../../src/flow/guarded-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,OAAO,EAAiB,eAAe,EAA4B,MAAM,YAAY,CAAC;AAItF,MAAM,OAAO,aAAa;IAEL;IACA;IACA;IAGA;IANnB,YACmB,KAAc,EACd,QAAuB,EACvB,mBAAwC;IACzD;2EACuE;IACtD,OAAuB;QALvB,UAAK,GAAL,KAAK,CAAS;QACd,aAAQ,GAAR,QAAQ,CAAe;QACvB,wBAAmB,GAAnB,mBAAmB,CAAqB;QAGxC,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAEJ,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,SAAkB;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,eAAe,CAAC,YAAoB,EAAE,UAAmB;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAAc,EACd,MAAgC,EAChC,SAAkB;QAElB,4EAA4E;QAC5E,6EAA6E;QAC7E,0DAA0D;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,CACzB,MAAM,EACN,MAAM,IAAI,EAAE,EACZ,SAAS,EACT,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,OAAO,CACb,CAAC;QACF,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,CAAC;CACF"}