@jini-ai/platform 0.6.16 → 0.6.19

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @jini-ai/platform
 
+## 0.6.19
+
+- File locks: a dead holder recorded on this machine under another hostname spelling (macOS `name.lan` / `name.local` / `name`) is reclaimed when it was taken in this same kernel boot (its recorded boot id, or for a record without one, an `acquiredAt` after this boot began), so a never-ageing (`staleMs: Infinity`) lock a killed process left no longer wedges every later acquisition. Other hosts, unrecorded boots and live owners are still never evicted. `@jini-ai/platform/fs/file-lock` re-exports `readBootIdentity` and `BootIdentity` for host process ports.
+
+## 0.6.17
+
+### Patch Changes
+
+- Version bump only.
+
 ## 0.6.15
 
 ### Minor Changes

package/dist/fs/boot-identity.d.ts

@@ -19,4 +19,14 @@ export declare function fromEarlierBoot({ boot, bootId, atMs }: {
     bootId: string | undefined;
     atMs: number;
 }, _options?: {}): boolean;
+/** True only when a recorded holder provably ran in THIS boot: a Linux boot_id compared exactly, or two
+ * time-derived (numeric) ids within {@link BOOT_CLOCK_TOLERANCE_MS}, since Darwin/Windows re-derive them
+ * from a wall clock the OS may step. A legacy record with no boot id counts only when its own
+ * timestamp `atMs` falls after this boot began (same tolerance). No boot is never proof. @complexity O(1).
+ */
+export declare function fromThisBoot({ boot, bootId, atMs }: {
+    boot: BootIdentity | undefined;
+    bootId: string | undefined;
+    atMs: number;
+}, _options?: {}): boolean;
 //# sourceMappingURL=boot-identity.d.ts.map

package/dist/fs/boot-identity.js

@@ -58,4 +58,18 @@ export function fromEarlierBoot({ boot, bootId, atMs }, _options = {}) {
     const recordedAtMs = recordedBootTimeMs({ bootId, atMs });
     return recordedAtMs === undefined ? bootId !== boot.id : recordedAtMs < boot.startedAtMs - BOOT_CLOCK_TOLERANCE_MS;
 }
+/** True only when a recorded holder provably ran in THIS boot: a Linux boot_id compared exactly, or two
+ * time-derived (numeric) ids within {@link BOOT_CLOCK_TOLERANCE_MS}, since Darwin/Windows re-derive them
+ * from a wall clock the OS may step. A legacy record with no boot id counts only when its own
+ * timestamp `atMs` falls after this boot began (same tolerance). No boot is never proof. @complexity O(1).
+ */
+export function fromThisBoot({ boot, bootId, atMs }, _options = {}) {
+    if (!boot)
+        return false;
+    if (bootId === undefined)
+        return Number.isFinite(atMs) && atMs >= boot.startedAtMs - BOOT_CLOCK_TOLERANCE_MS;
+    if (bootId === boot.id)
+        return true;
+    return /^\d+$/.test(bootId) && /^\d+$/.test(boot.id) && Math.abs(Number(bootId) - Number(boot.id)) <= BOOT_CLOCK_TOLERANCE_MS;
+}
 //# sourceMappingURL=boot-identity.js.map

package/dist/fs/directory-running-lock.js

@@ -5,25 +5,37 @@ import { fromEarlierBoot } from "./boot-identity.js";
  * @complexity O(1) bounded JSON I/O and one liveness probe, plus the file lock wait.
  */
 export function createDirectoryRunningLock({ file, isAlive, remove }, { bootIdentity } = {}) {
-    /** Validate before any mutation; corrupt or unreadable records fail closed. O(1) JSON I/O. */
-    function readRecord() {
+    /** Validate the holder before probing liveness; unreadable/unknown identities fail closed.
+     * A malformed address is recoverable only after proving this holder cannot own the DB. O(1).
+     */
+    function readOwner() {
         const result = file.read({});
         if (result.state === "missing")
             return null;
         if (result.state !== "ok")
             throw new Error("The running lock is unreadable; refusing to open this directory's database.");
         const record = result.value;
-        if (!validRunningRecord(record))
+        if (!validRunningOwner(record))
+            throw new Error("The running lock is invalid; refusing to open this directory's database.");
+        return record;
+    }
+    /** Release still requires a complete valid record and its token, even for a dead holder. O(1). */
+    function readRecord() {
+        const record = readOwner();
+        if (record && !validRunningRecord(record))
             throw new Error("The running lock is invalid; refusing to open this directory's database.");
         return record;
     }
     function readLive(cleanup = true) {
-        const record = readRecord();
+        const record = readOwner();
         if (!record)
             return null;
         const earlierBoot = fromEarlierBoot({ boot: bootIdentity?.(), bootId: record.bootId, atMs: Date.parse(record.started) });
-        if (!earlierBoot && isAlive({ pid: record.pid }))
+        if (!earlierBoot && isAlive({ pid: record.pid })) {
+            if (!validRunningRecord(record))
+                throw new Error("The running lock is invalid; refusing to open this directory's database.");
             return record;
+        }
         if (cleanup)
             remove();
         return null;
@@ -64,12 +76,18 @@ export function createDirectoryRunningLock({ file, isAlive, remove }, { bootIden
     };
 }
 function validRunningRecord(value) {
+    if (!validRunningOwner(value))
+        return false;
+    const validPort = Number.isInteger(value.port) && typeof value.port === "number" && value.port >= 0 && value.port <= 65535;
+    return validPort && (value.scheme === "http" || value.scheme === "https");
+}
+/** Address corruption must not prevent dead-holder recovery, but never guess a holder. O(1). */
+function validRunningOwner(value) {
     if (!value || typeof value !== "object")
         return false;
     const record = value;
     const validPid = Number.isSafeInteger(record.pid) && record.pid > 0;
-    const validPort = Number.isInteger(record.port) && record.port >= 0 && record.port <= 65535;
-    return validPid && validPort && validRunningIdentity({ record }) && ["http", "https"].includes(record.scheme);
+    return validPid && validRunningIdentity({ record });
 }
 function validRunningIdentity({ record }, _options = {}) {
     const validBootId = record.bootId === undefined || typeof record.bootId === "string";

package/dist/fs/file-lock.d.ts

@@ -8,13 +8,16 @@
  * Stale removal rechecks inode, bytes and mtime immediately before unlink. There is still a residual
  * check-to-unlink race on filesystems without conditional unlink; rename/restore chains create wider
  * multi-process races and are deliberately avoided. Atomic file replacement independently prevents
- * torn content. Hosts whose operations can legitimately exceed the stale budget use staleMs: Infinity.
+ * torn content. Proven live owners are never age-evicted; staleMs: Infinity also disables age
+ * recovery for owners whose liveness is unknown.
  */
 import { type BootIdentity } from "./boot-identity.js";
 import fs from "node:fs";
 import * as asyncFs from "node:fs/promises";
 import { type Clock } from "@jini-ai/core/primitives";
 import { type PlatformMessages } from "../messages.js";
+/** Re-exported so a host's own process port can record the boot its locks were taken in. */
+export { readBootIdentity, type BootIdentity } from "./boot-identity.js";
 export declare const DEFAULT_LOCK_TIMEOUT_MS = 15000;
 export declare const DEFAULT_LOCK_STALE_AFTER_MS = 10000;
 export interface FileLockHolder {
@@ -37,7 +40,7 @@ export type FileLockAsyncFilesystem = Pick<typeof asyncFs, "mkdir" | "open" | "s
 export interface FileLockOptions {
     /** Infinity follows an operation with its own deadline; dead local owners remain reclaimable. */
     timeoutMs?: number;
-    /** Infinity disables age stealing; dead local owners remain reclaimable. */
+    /** Age threshold for unknown owners. Proven live owners are never evicted; Infinity disables age recovery. */
     staleMs?: number;
     pollMs?: number;
     clock?: Clock;
@@ -98,7 +101,10 @@ export declare function isContendedLockError({ code, platform }: {
     platform: NodeJS.Platform;
 }): boolean;
 /** One pure stale decision serves both I/O adapters. Invalid/foreign pids have unknown liveness,
- * never false liveness; otherwise kill(0/negative, 0) would address a process group. */
+ * never false liveness; otherwise kill(0/negative, 0) would address a process group.
+ * @returns Whether a dead or aged unknown owner may be reclaimed on the unchanged identity.
+ * @complexity O(1) time and space; no I/O.
+ */
 export declare function isLockStale(required: {
     nowMs: number;
     mtimeMs: number;
@@ -108,7 +114,7 @@ export declare function isLockStale(required: {
     currentInode: number;
     observedDevice: number;
     currentDevice: number;
-}): boolean;
+}, _options?: Record<string, never>): boolean;
 /** Synchronous read-modify-write guard. Durable stores pass their former 5s/30s/10ms values.
  * Release never evicts a later owner, even when the old owner reaches finally after a steal. */
 export declare function withFileLockSync<T>({ lockPath, run }: {

package/dist/fs/file-lock.js

@@ -8,9 +8,10 @@
  * Stale removal rechecks inode, bytes and mtime immediately before unlink. There is still a residual
  * check-to-unlink race on filesystems without conditional unlink; rename/restore chains create wider
  * multi-process races and are deliberately avoided. Atomic file replacement independently prevents
- * torn content. Hosts whose operations can legitimately exceed the stale budget use staleMs: Infinity.
+ * torn content. Proven live owners are never age-evicted; staleMs: Infinity also disables age
+ * recovery for owners whose liveness is unknown.
  */
-import { fromEarlierBoot, readBootIdentity } from "./boot-identity.js";
+import { fromEarlierBoot, fromThisBoot, readBootIdentity } from "./boot-identity.js";
 import fs from "node:fs";
 import * as asyncFs from "node:fs/promises";
 import { randomUUID } from "node:crypto";
@@ -19,6 +20,8 @@ import path from "node:path";
 import { createSystemClock } from "@jini-ai/core/primitives";
 import { defaultPlatformMessages } from "../messages.js";
 import { errorCodeOf, fallbackIf } from "./errno.js";
+/** Re-exported so a host's own process port can record the boot its locks were taken in. */
+export { readBootIdentity } from "./boot-identity.js";
 export const DEFAULT_LOCK_TIMEOUT_MS = 15_000;
 export const DEFAULT_LOCK_STALE_AFTER_MS = 10_000;
 export class FileLockTimeoutError extends Error {
@@ -73,8 +76,14 @@ function parseHolder(raw) {
     }
 }
 /** One pure stale decision serves both I/O adapters. Invalid/foreign pids have unknown liveness,
- * never false liveness; otherwise kill(0/negative, 0) would address a process group. */
-export function isLockStale(required) {
+ * never false liveness; otherwise kill(0/negative, 0) would address a process group.
+ * @returns Whether a dead or aged unknown owner may be reclaimed on the unchanged identity.
+ * @complexity O(1) time and space; no I/O.
+ */
+export function isLockStale(required, _options = {}) {
+    // A slow live operation still owns its critical section; elapsed age cannot prove death.
+    if (required.ownerAlive === true)
+        return false;
     return (required.ownerAlive === false || required.nowMs - required.mtimeMs > required.staleMs) && required.observedInode === required.currentInode && required.observedDevice === required.currentDevice;
 }
 function intervalsValid({ timeoutMs, staleMs, pollMs }) {
@@ -110,8 +119,21 @@ function ownership(s, options) {
         return `${s.processPort.pid}:${s.token}${s.boot ? ":" + s.boot.id : ""}`;
     return JSON.stringify({ pid: s.processPort.pid, hostname: s.hostname, token: s.token, acquiredAt: new Date(s.clock.nowMs()).toISOString(), ...(s.boot ? { bootId: s.boot.id } : {}) });
 }
+/** The first DNS label, case-folded: macOS reports one machine as `name.lan`, `name.local` or `name`
+ * as its network changes. O(n) in the hostname length. */
+function shortHostname(hostname) { return hostname.split(".", 1)[0].toLowerCase(); }
+/** Whether `holder` was written on this machine, so a local PID probe can speak for it. The exact
+ * hostname, or the same first label in this same kernel boot: a lock a killed process left under one
+ * hostname spelling would otherwise read as foreign under the next and, with `staleMs: Infinity`,
+ * wedge every later acquisition (demo practice run, 2026-11-02: an Agent Plugin stayed off on every
+ * boot). Another machine with the same first label would also need this exact boot to be mistaken. */
+function sameMachine(holder, s) {
+    if (holder.hostname === s.hostname)
+        return true;
+    return shortHostname(holder.hostname) === shortHostname(s.hostname) && fromThisBoot({ boot: s.boot, bootId: holder.bootId, atMs: Date.parse(holder.acquiredAt) });
+}
 function holderAlive(holder, s) {
-    if (holder.hostname !== s.hostname)
+    if (!sameMachine(holder, s))
         return undefined;
     // A recorded boot id decides; without one, only an acquisition before this boot proves a restart.
     if (fromEarlierBoot({ boot: s.boot, bootId: holder.bootId, atMs: Date.parse(holder.acquiredAt) }))
@@ -130,8 +152,28 @@ function legacyOwnerAlive(snapshot, s) {
         return false;
     return s.processPort.isAlive({ pid });
 }
+/** Incomplete JSON may still prove a local owner's death. Display/release metadata is not
+ * required for a PID probe; absent/invalid PIDs and foreign hosts remain unknown, never dead.
+ * This prevents an incomplete dead holder from wedging Infinity-staleness stores forever.
+ * @complexity O(n) parsing for n lock bytes, one local process probe.
+ */
+function incompleteOwnerAlive({ raw, s }, _options = {}) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof value !== "object" || value === null)
+        return undefined;
+    const row = value;
+    if (!validPid(row.pid) || row.hostname !== s.hostname)
+        return undefined;
+    return s.processPort.isAlive({ pid: row.pid });
+}
 function ownerAlive(snapshot, s) {
-    return snapshot.holder ? holderAlive(snapshot.holder, s) : legacyOwnerAlive(snapshot, s);
+    return snapshot.holder ? holderAlive(snapshot.holder, s) : legacyOwnerAlive(snapshot, s) ?? incompleteOwnerAlive({ raw: snapshot.raw, s });
 }
 function sameFile(a, b) { return a.ino === b.ino && a.dev === b.dev; }
 function sameStat(a, b) { return sameFile(a, b) && a.mtimeMs === b.mtimeMs; }

package/dist/fs/verified-directory-move.d.ts

@@ -10,6 +10,16 @@ export declare function directoryFingerprint({ dir }: {
     excluded?: readonly string[];
     filesystem?: typeof fs;
 }): string;
+/** SHA-256 of one file through the same bounded reader used by directory verification.
+ * @param required.path - File path already authorized/contained by the host.
+ * @param optional.filesystem - Injectable native read/close operations.
+ * @returns Raw digest bytes; read/open errors propagate and the descriptor always closes.
+ * @complexity O(file bytes) time, O(64 KiB) space. */
+export declare function fileDigest({ path: absolute }: {
+    path: string;
+}, { filesystem }?: {
+    filesystem?: Pick<typeof fs, 'openSync' | 'readSync' | 'closeSync'>;
+}): Buffer;
 interface MoveDirectoryOptions {
     excluded?: readonly string[];
     filesystem?: typeof fs;

package/dist/fs/verified-directory-move.js

@@ -24,7 +24,7 @@ export function directoryFingerprint({ dir }, { excluded = [], filesystem = fs }
             else if (kind === "link")
                 digest.update(JSON.stringify(filesystem.readlinkSync(absolute)));
             else
-                digest.update(fileDigest({ absolute, filesystem }));
+                digest.update(fileDigest({ path: absolute }, { filesystem }));
         }
     }
     visit("");
@@ -37,7 +37,12 @@ function entryKind(stat) {
         return "directory";
     return stat.isFile() ? "file" : "unsupported";
 }
-function fileDigest({ absolute, filesystem }) {
+/** SHA-256 of one file through the same bounded reader used by directory verification.
+ * @param required.path - File path already authorized/contained by the host.
+ * @param optional.filesystem - Injectable native read/close operations.
+ * @returns Raw digest bytes; read/open errors propagate and the descriptor always closes.
+ * @complexity O(file bytes) time, O(64 KiB) space. */
+export function fileDigest({ path: absolute }, { filesystem = fs } = {}) {
     const digest = createHash("sha256"), buffer = Buffer.allocUnsafe(64 * 1024);
     const descriptor = filesystem.openSync(absolute, "r");
     try {

package/dist/fs/workspace-directory.d.ts

@@ -2,8 +2,10 @@ import type { DirectoryRecord } from "./directory-registry.js";
 /** Shared selection policy for CLI/dev hosts. A registry ID disambiguates adopted paths;
  * a basename selects the home first. No initialized home site preserves the supplied fallback.
  * Hosts may probe availability to resolve an ambiguous name to its sole available directory.
+ * Two live directories with one name never stop a boot: the one inside a configured root wins,
+ * then the most recently opened, then path order, and `report` names every path and ID.
  * Offline records and explicit ID selection are preserved; probe failures propagate.
- * @complexity O(n) registered/child directories and validation probes.
+ * @complexity O(n log n) registered/child directories and validation probes.
  */
 export declare function selectWorkspaceDirectory({ home, entries, fallback, selected, roots, listDirectories, isInitialized }: {
     home: string;
@@ -17,9 +19,12 @@ export declare function selectWorkspaceDirectory({ home, entries, fallback, sele
     isInitialized: (required: {
         path: string;
     }) => boolean;
-}, { isAvailable }?: {
+}, { isAvailable, report }?: {
     isAvailable?: (required: {
         path: string;
     }) => boolean;
+    report?: (required: {
+        message: string;
+    }) => void;
 }): string;
 //# sourceMappingURL=workspace-directory.d.ts.map

package/dist/fs/workspace-directory.js

@@ -2,10 +2,12 @@ import path from "node:path";
 /** Shared selection policy for CLI/dev hosts. A registry ID disambiguates adopted paths;
  * a basename selects the home first. No initialized home site preserves the supplied fallback.
  * Hosts may probe availability to resolve an ambiguous name to its sole available directory.
+ * Two live directories with one name never stop a boot: the one inside a configured root wins,
+ * then the most recently opened, then path order, and `report` names every path and ID.
  * Offline records and explicit ID selection are preserved; probe failures propagate.
- * @complexity O(n) registered/child directories and validation probes.
+ * @complexity O(n log n) registered/child directories and validation probes.
  */
-export function selectWorkspaceDirectory({ home, entries, fallback, selected, roots = [home], listDirectories, isInitialized }, { isAvailable } = {}) {
+export function selectWorkspaceDirectory({ home, entries, fallback, selected, roots = [home], listDirectories, isInitialized }, { isAvailable, report = ({ message }) => console.warn(message) } = {}) {
     if (selected !== undefined) {
         const byId = entries.find((entry) => entry.id === selected);
         if (byId)
@@ -15,16 +17,28 @@ export function selectWorkspaceDirectory({ home, entries, fallback, selected, ro
             return inHome;
         const matches = [...new Set([...entries.filter((entry) => path.basename(entry.path) === selected).map((entry) => entry.path),
                 ...roots.filter((root) => root !== home).map((root) => path.join(root, selected)).filter((dir) => isInitialized({ path: dir }))])];
-        if (matches.length > 1) {
-            // A stale scratch catalog row must not block the sole live site or choose by row order.
-            const available = matches.filter(dir => isAvailable?.({ path: dir }) ?? true);
-            if (available.length === 1)
-                return available[0];
-            throw new Error("More than one registered directory has this name. Select its registry ID.");
-        }
+        if (matches.length > 1)
+            return pickDuplicate({ matches, entries, roots, isAvailable, report });
         return matches[0] ?? path.join(path.dirname(fallback), selected);
     }
     const candidates = [...entries.filter((entry) => path.dirname(entry.path) === home).sort((a, b) => (b.lastOpened ? Date.parse(b.lastOpened) : 0) - (a.lastOpened ? Date.parse(a.lastOpened) : 0)).map((entry) => entry.path), ...roots.flatMap((root) => listDirectories({ root }))];
     return candidates.find((dir) => isInitialized({ path: dir })) ?? fallback;
 }
+/** One name, several directories. A stale scratch catalog row must not block the sole live site or
+ * choose by row order; a live scratch copy (another tool's sandbox) must not stop the boot either.
+ * Throws only when none is available, because then there is nothing to serve.
+ * @complexity O(n log n) matches.
+ */
+function pickDuplicate({ matches, entries, roots, isAvailable, report }) {
+    const label = (dir) => `${dir} (${entries.find((entry) => entry.path === dir)?.id ?? "not registered"})`;
+    const available = matches.filter((dir) => isAvailable?.({ path: dir }) ?? true);
+    if (available.length === 0)
+        throw new Error(`No registered directory with this name is available: ${matches.map(label).join(", ")}. Select its registry ID.`);
+    const inRoot = (dir) => (roots.includes(path.dirname(dir)) ? 1 : 0);
+    const opened = (dir) => Date.parse(entries.find((entry) => entry.path === dir)?.lastOpened ?? "") || 0;
+    const [chosen, ...others] = [...available].sort((a, b) => inRoot(b) - inRoot(a) || opened(b) - opened(a) || a.localeCompare(b));
+    if (others.length > 0)
+        report({ message: `More than one directory has this name. Using ${label(chosen)}; also found ${others.map(label).join(", ")}. Select a registry ID to choose another.` });
+    return chosen;
+}
 //# sourceMappingURL=workspace-directory.js.map

package/dist/http/guarded/client.js

@@ -1,6 +1,6 @@
 // Policy refusals use EgressRefusedError; DNS, connection and transport failures retain their
 // own errors because they are operational failures, not decisions that a different URL fixes.
-import { classifyIpAddress } from "../../net/address.js";
+import { classifyIpAddress, isLoopbackHostname } from "../../net/address.js";
 import { effectivePort } from "../../core/effective-port.js";
 import { FetchTimeoutError } from "../../fetch-with-timeout.js";
 import { isIP } from "node:net";
@@ -43,10 +43,18 @@ async function resolveHostAddresses(hostname, dns) {
         return [literal];
     return [...await dns.resolve({ hostname })];
 }
-// Keep the resolved IP in internal diagnostics only; the caller-safe refusal must not disclose it.
-function assertNoPrivateAddress(hostname, addresses) {
+/** Validate every resolved peer, allowing loopback only for an explicitly configured origin.
+ * Keep the resolved IP in internal diagnostics only; the caller-safe refusal must not disclose it.
+ * @throws EgressRefusedError before any connection for a denied or mixed DNS answer.
+ * @complexity O(a + o) time for a addresses and o configured origins, O(1) space.
+ */
+function assertNoPrivateAddress({ url, addresses, policy }, _options = {}) {
+    const hostname = url.hostname;
+    const allowLoopback = isLoopbackHostname({ hostname }) && (policy.loopbackOriginAllowlist?.includes(url.origin) ?? false);
     for (const address of addresses) {
         const addressClass = classifyAddress({ ip: address });
+        if (allowLoopback && addressClass === "loopback")
+            continue;
         if (addressClass !== "public") {
             throw new EgressRefusedError({ message: `egress to '${hostname}' (${address}) rejected: resolved address is ${addressClass}` }, {
                 callerSafeMessage: `egress to '${hostname}' rejected: resolved address is ${addressClass}`,
@@ -64,7 +72,7 @@ async function resolvePinnedPeer(url, policy, dns) {
         throw new Error(`could not resolve any address for host '${url.hostname}'`);
     }
     if (policy.denyPrivateAddresses && !isDevAllowlisted) {
-        assertNoPrivateAddress(url.hostname, addresses);
+        assertNoPrivateAddress({ url, addresses, policy });
     }
     return {
         ip: addresses[0],

package/dist/http/guarded/ports.d.ts

@@ -29,6 +29,11 @@ export interface EgressPolicy {
     readonly denyPrivateAddresses: boolean;
     /** Explicit development capability; IPv6 literals use their bracket-free hostname (e.g. fd00::1). */
     readonly devHostAllowlist: readonly string[];
+    /** Trusted host configuration only: exact normalized scheme+host+port origins on localhost
+     * or loopback IP literals whose loopback peers may be dialed. Public DNS names cannot rebind
+     * to loopback through this exception. Other private classes remain denied, including mixed answers.
+     * Rechecked on every redirect; this never grants other ports or hostname aliases. */
+    readonly loopbackOriginAllowlist?: readonly string[];
     readonly maxRedirects: number;
     /** Historical name: ceiling on each socket's idle timeout, not total transfer time. */
     readonly connectTimeoutMs: number;

package/dist/http/multipart.adapter.d.ts

@@ -0,0 +1,15 @@
+/** Decodes bounded multipart bytes into successful controls, preserving repeated choice names.
+ * @param required - Buffered request bytes and the multipart Content-Type including its boundary.
+ * @param options - Positive integer byte/control caps; defaults to 12 MiB and 2000 controls.
+ * @returns A null-prototype body; repeated names become arrays, empty file pickers are omitted.
+ * @throws RangeError for invalid limits, oversized bodies or too many controls; parser errors propagate.
+ * @example await parseFormMultipart({ bytes, contentType }, { maxBytes: 1024, maxControls: 10 });
+ * @complexity O(b + c) time and space for bounded body bytes b and controls c; no network I/O. */
+export declare function parseFormMultipart({ bytes, contentType }: {
+    bytes: Uint8Array;
+    contentType: string;
+}, { maxBytes, maxControls }?: {
+    maxBytes?: number;
+    maxControls?: number;
+}): Promise<Record<string, unknown>>;
+//# sourceMappingURL=multipart.adapter.d.ts.map

package/dist/http/multipart.adapter.js

@@ -0,0 +1,54 @@
+/** Bounded multipart controls decoded by the installed Web Request implementation. */
+// Node's bundled parser can turn filename="" into a text control, losing upload identity.
+// The installed Undici parser distinguishes absent filenames from empty ones (filename !== null).
+import { Request } from "undici";
+/** The browser's empty file picker (no filename, no bytes) is not a successful control. */
+const isEmptyFilePicker = (raw) => typeof raw !== "string" && raw.name === "" && raw.size === 0;
+async function toFormValue(raw) {
+    return typeof raw === "string" ? raw : { filename: raw.name, contentType: raw.type, bytes: new Uint8Array(await raw.arrayBuffer()) };
+}
+/** Adds one control, turning a repeated name into an array of values in submission order. */
+function appendControl({ body, name, value }) {
+    if (!Object.hasOwn(body, name)) {
+        body[name] = value;
+        return;
+    }
+    const existing = body[name];
+    // This array belongs to this parse only; append without quadratic repeated copies.
+    if (Array.isArray(existing))
+        existing.push(value);
+    else
+        body[name] = [existing, value];
+}
+/** Decodes bounded multipart bytes into successful controls, preserving repeated choice names.
+ * @param required - Buffered request bytes and the multipart Content-Type including its boundary.
+ * @param options - Positive integer byte/control caps; defaults to 12 MiB and 2000 controls.
+ * @returns A null-prototype body; repeated names become arrays, empty file pickers are omitted.
+ * @throws RangeError for invalid limits, oversized bodies or too many controls; parser errors propagate.
+ * @example await parseFormMultipart({ bytes, contentType }, { maxBytes: 1024, maxControls: 10 });
+ * @complexity O(b + c) time and space for bounded body bytes b and controls c; no network I/O. */
+export async function parseFormMultipart({ bytes, contentType }, { maxBytes = 12 * 1024 * 1024, maxControls = 2000 } = {}) {
+    validateLimits({ maxBytes, maxControls });
+    if (bytes.byteLength > maxBytes)
+        throw new RangeError(`form upload exceeds ${maxBytes / (1024 * 1024)} MB`);
+    const request = new Request("https://form.invalid/", { method: "POST", headers: { "content-type": contentType }, body: Buffer.from(bytes) });
+    const data = await request.formData();
+    const body = Object.create(null);
+    let count = 0;
+    for (const [name, raw] of data.entries()) {
+        count += 1;
+        if (count > maxControls)
+            throw new RangeError("too many form controls");
+        if (!isEmptyFilePicker(raw))
+            appendControl({ body, name, value: await toFormValue(raw) });
+    }
+    return body;
+}
+/** Reject invalid host configuration before allocating a parsed form. */
+function validateLimits({ maxBytes, maxControls }) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)
+        throw new RangeError("maxBytes must be a positive safe integer");
+    if (!Number.isSafeInteger(maxControls) || maxControls <= 0)
+        throw new RangeError("maxControls must be a positive safe integer");
+}
+//# sourceMappingURL=multipart.adapter.js.map

package/dist/http.d.ts

@@ -1,5 +1,12 @@
 export type HttpWaitOptions = {
     timeoutMs?: number;
+    /** Optional transport policy (for example, a pinned loopback TLS probe). False retries; throwing
+     * records the diagnostic and retries. Each call receives the remaining overall time budget.
+     */
+    probe?: ((required: {
+        url: string;
+        timeoutMs: number;
+    }) => Promise<boolean>) | undefined;
 };
 /**
  * Poll a URL until it returns an OK (2xx) response or the timeout elapses,
@@ -10,5 +17,5 @@ export type HttpWaitOptions = {
  * @returns `true` once an OK response is received.
  * @throws When the timeout elapses without an OK response (message includes the last error).
  */
-export declare function waitForHttpOk(url: string, { timeoutMs }?: HttpWaitOptions): Promise<true>;
+export declare function waitForHttpOk(url: string, { timeoutMs, probe }?: HttpWaitOptions): Promise<true>;
 //# sourceMappingURL=http.d.ts.map

package/dist/http.js

@@ -7,6 +7,17 @@
  */
 import { setTimeout as sleep } from "node:timers/promises";
 import { fetchWithTimeout } from "./fetch-with-timeout.js";
+/** Use the injected transport policy or the existing bounded fetch, retaining HTTP diagnostics.
+ * @returns Whether this attempt is ready. @complexity One network request, bounded by timeoutMs.
+ */
+async function requestHttpOk({ url, timeoutMs }, { probe } = {}) {
+    if (probe)
+        return probe({ url, timeoutMs });
+    const response = await fetchWithTimeout(url, { cache: "no-store" }, { timeoutMs });
+    if (!response.ok)
+        throw new Error(`HTTP ${response.status} from ${url}`);
+    return true;
+}
 /** @internal Extract a human-readable message from an unknown thrown value. */
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -20,7 +31,7 @@ function errorMessage(error) {
  * @returns `true` once an OK response is received.
  * @throws When the timeout elapses without an OK response (message includes the last error).
  */
-export async function waitForHttpOk(url, { timeoutMs = 20000 } = {}) {
+export async function waitForHttpOk(url, { timeoutMs = 20000, probe } = {}) {
     const startedAt = Date.now();
     let lastError = null;
     while (Date.now() - startedAt < timeoutMs) {
@@ -33,10 +44,9 @@ export async function waitForHttpOk(url, { timeoutMs = 20000 } = {}) {
             // clock once `await fetch(...)` itself returns, so an unbounded fetch call defeats the loop's
             // own deadline exactly like Finding 2 of the 2026-08-16 audit describes.
             const remaining = timeoutMs - (Date.now() - startedAt);
-            const response = await fetchWithTimeout(url, { cache: "no-store" }, { timeoutMs: Math.max(1, remaining) });
-            if (response.ok)
+            if (await requestHttpOk({ url, timeoutMs: Math.max(1, remaining) }, { probe }))
                 return true;
-            lastError = new Error(`HTTP ${response.status} from ${url}`);
+            lastError = new Error(`Readiness probe refused ${url}`);
         }
         catch (error) {
             lastError = new Error(errorMessage(error));

package/dist/net/index.d.ts

@@ -1,3 +1,4 @@
 export { isPrivateAddress, expandIpv6, isLoopbackApiHost, isBlockedExternalApiHostname, isLoopbackHostname } from "./address.js";
 export { probeLoopbackHttp } from './local-http-probe.js';
+export { requestLoopbackHttp } from './local-http-request.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/net/index.js

@@ -1,3 +1,4 @@
 export { isPrivateAddress, expandIpv6, isLoopbackApiHost, isBlockedExternalApiHostname, isLoopbackHostname } from "./address.js";
 export { probeLoopbackHttp } from './local-http-probe.js';
+export { requestLoopbackHttp } from './local-http-request.js';
 //# sourceMappingURL=index.js.map

package/dist/net/local-http-request.d.ts

@@ -0,0 +1,20 @@
+/** Bounded private local-control request, with the same pinned-leaf TLS policy as local probes.
+ * Never follows redirects, resolves DNS, logs payloads, or permits remote credentials.
+ * @returns Status, content type and bounded response bytes. Transport/size/deadline errors reject.
+ * @complexity O(response bytes), bounded to maxBytes (1 MiB) and timeoutMs (5s) by default.
+ */
+export declare function requestLoopbackHttp({ url, method, headers, body }: {
+    url: string;
+    method: string;
+    headers?: Readonly<Record<string, string>>;
+    body?: string;
+}, { certificate, timeoutMs, maxBytes }?: {
+    certificate?: string | Buffer | undefined;
+    timeoutMs?: number;
+    maxBytes?: number;
+}): Promise<{
+    status: number;
+    body: Buffer;
+    contentType: string | undefined;
+}>;
+//# sourceMappingURL=local-http-request.d.ts.map

package/dist/net/local-http-request.js

@@ -0,0 +1,38 @@
+import { X509Certificate } from 'node:crypto';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isLoopbackHostname } from './address.js';
+/** Bounded private local-control request, with the same pinned-leaf TLS policy as local probes.
+ * Never follows redirects, resolves DNS, logs payloads, or permits remote credentials.
+ * @returns Status, content type and bounded response bytes. Transport/size/deadline errors reject.
+ * @complexity O(response bytes), bounded to maxBytes (1 MiB) and timeoutMs (5s) by default.
+ */
+export function requestLoopbackHttp({ url, method, headers = {}, body }, { certificate, timeoutMs = 5000, maxBytes = 1024 * 1024 } = {}) {
+    const target = new URL(url);
+    if (!isLoopbackHostname({ hostname: target.hostname }) || !['http:', 'https:'].includes(target.protocol)) {
+        return Promise.reject(new Error('Expected loopback HTTP URL'));
+    }
+    const trust = certificate === undefined ? {} : { ca: new X509Certificate(certificate).toString(), allowPartialTrustChain: true };
+    return new Promise((resolve, reject) => {
+        const request = target.protocol === 'https:' ? httpsRequest : httpRequest;
+        const req = request(target, { method, headers, agent: false, signal: AbortSignal.timeout(timeoutMs),
+            hostname: '127.0.0.1', servername: 'localhost', rejectUnauthorized: true, ...trust,
+        }, res => {
+            const chunks = [];
+            let size = 0;
+            res.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > maxBytes) {
+                    res.destroy(new Error('Local response too large'));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.once('error', reject);
+            res.once('end', () => resolve({ status: res.statusCode ?? 502, body: Buffer.concat(chunks), contentType: res.headers['content-type'] }));
+        });
+        req.once('error', reject);
+        req.end(body);
+    });
+}
+//# sourceMappingURL=local-http-request.js.map

package/dist/process.d.ts

@@ -49,6 +49,14 @@ export type ProcessUsagePorts = {
 export type ProcessUsageOptions = {
     timeoutMs?: number;
 };
+/** Private-memory samples are separate from RSS; unsupported hosts retain null readings. */
+export type ProcessPrivateMemory = {
+    metric: "physical-footprint" | "private-working-set" | "unavailable";
+    readings: Array<{
+        pid: number;
+        bytes: number | null;
+    }>;
+};
 export type StampedProcessMatchCriteria<TStamp extends ProcessStampShape> = Partial<TStamp>;
 export type StopProcessesResult = {
     alreadyStopped: boolean;
@@ -153,9 +161,15 @@ export declare function waitForProcessExit(pid: number | null | undefined, timeo
  * Enumerate all running processes as `{ pid, ppid, command }` snapshots, using
  * the platform-appropriate backend. Returns an empty list on any failure.
  *
- * @returns The current process snapshots (empty on error).
+ * @param input - Optional host platform and bounded execution port.
+ * @param options - Probe timeout (5000ms); commandLines=false reads executable names only and
+ * preserves nameless Windows identities even when usage diagnostics are unavailable.
+ * @returns The current process snapshots (empty on error), capped at 8MiB of probe output.
+ * @example await listProcessSnapshots({}, { commandLines: false })
  */
-export declare function listProcessSnapshots(): Promise<ProcessSnapshot[]>;
+export declare function listProcessSnapshots(input?: ProcessUsagePorts, options?: ProcessUsageOptions & {
+    commandLines?: boolean;
+}): Promise<ProcessSnapshot[]>;
 /**
  * Sample process RSS and cumulative CPU without reading command lines. Returns
  * [] on command, timeout, buffer or JSON failure. RSS totals may count shared
@@ -164,6 +178,29 @@ export declare function listProcessSnapshots(): Promise<ProcessSnapshot[]>;
  * @param options - Execution timeout (default 5000ms); output is capped at 8MiB.
  */
 export declare function listProcessUsage(input?: ProcessUsagePorts, options?: ProcessUsageOptions): Promise<ProcessUsage[]>;
+/**
+ * Decode macOS `footprint -p` output into bytes; absent or invalid readings return null.
+ * @example parseProcessFootprint({ text: "Footprint: 187 MB" })
+ */
+export declare function parseProcessFootprint({ text }: {
+    text: string;
+}, _options?: {}): number | null;
+/**
+ * Read private memory once per unique PID, without attaching an inspector or changing target state.
+ * macOS uses physical footprint; Windows uses private working set joined by PID, never PrivateBytes
+ * or Win32_Process.WorkingSetSize. Failed probes return null; invalid PIDs/limits throw RangeError.
+ * @param input - Requested PIDs and optional host platform/bounded execution port.
+ * @param options - Per-probe timeout (5000ms) and unique-PID limit (512); excess is rejected.
+ * @returns Accurately labeled bytes, including a null row for every unavailable PID.
+ * @complexity O(n) output space for n unique PIDs; macOS makes n sequential bounded probes,
+ * Windows makes one bounded bulk probe plus O(m) parsing space for m host processes.
+ * @example await sampleProcessPrivateMemory({ pids: [123] }, { timeoutMs: 10000 })
+ */
+export declare function sampleProcessPrivateMemory(input: ProcessUsagePorts & {
+    pids: readonly number[];
+}, options?: ProcessUsageOptions & {
+    maxPids?: number;
+}): Promise<ProcessPrivateMemory>;
 /**
  * Collect the transitive set of descendant PIDs (including the roots) from a
  * process snapshot list, returned sorted by numeric PID descending for deterministic ordering.

package/dist/process.js

@@ -10,7 +10,7 @@
  * Uses `command` for invocation construction and `shell`'s direct buffered
  * executor for bounded usage samples; keeps a private `errorCode` copy.
  */
-import { execFile, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { posix, win32 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { captureLineTail } from "@jini-ai/core/text";
@@ -231,33 +231,24 @@ function parsePsOutput(stdout) {
         .filter((snapshot) => snapshot != null);
 }
 /** @internal Enumerate process snapshots on POSIX via `ps`. */
-async function listPosixProcessSnapshots() {
-    const stdout = await new Promise((resolveList, rejectList) => {
-        // eslint-disable-next-line sonarjs/no-os-command-from-path -- Fixed process-enumeration utility intentionally uses the trusted host PATH; command and argv are code-owned.
-        execFile("ps", ["-axo", "pid=,ppid=,command="], { encoding: "utf8", maxBuffer: 8 * 1024 * 1024 }, (error, out) => {
-            if (error)
-                rejectList(error);
-            else
-                resolveList(out);
-        });
-    });
-    return parsePsOutput(stdout);
+async function listPosixProcessSnapshots(input, options) {
+    // Fixed process-enumeration utility intentionally uses the trusted host PATH; command and argv are code-owned.
+    const stdout = await processProbeOutput({ command: "ps", run: input.run ?? execFileBuffered,
+        args: ["-axo", options.commandLines === false ? "pid=,ppid=,comm=" : "pid=,ppid=,command="],
+    }, options);
+    return parsePsOutput(stdout ?? "");
 }
 /** @internal Enumerate process snapshots on Windows via `Get-CimInstance Win32_Process` JSON. */
-async function listWindowsProcessSnapshots() {
+async function listWindowsProcessSnapshots(input, options) {
+    const field = options.commandLines === false ? "Name" : "CommandLine";
     const command = [
         "$ErrorActionPreference = 'Stop'",
-        "Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, CommandLine | ConvertTo-Json -Compress",
+        `Get-CimInstance Win32_Process | Select-Object ProcessId, ParentProcessId, ${field} | ConvertTo-Json -Compress`,
     ].join("; ");
-    const stdout = await new Promise((resolveList, rejectList) => {
-        execFile(windowsPowerShell(), ["-NoProfile", "-NonInteractive", "-Command", command], { encoding: "utf8", maxBuffer: 8 * 1024 * 1024 }, (error, out) => {
-            if (error)
-                rejectList(error);
-            else
-                resolveList(out);
-        });
-    });
-    const payload = stdout.trim();
+    const stdout = await processProbeOutput({ command: windowsPowerShell(), run: input.run ?? execFileBuffered,
+        args: ["-NoProfile", "-NonInteractive", "-Command", command],
+    }, options);
+    const payload = stdout?.trim();
     if (!payload)
         return [];
     const records = JSON.parse(payload);
@@ -265,8 +256,10 @@ async function listWindowsProcessSnapshots() {
         .map((record) => {
         const pid = Number(record.ProcessId);
         const ppid = Number(record.ParentProcessId);
-        const commandLine = record.CommandLine?.trim();
-        if (!commandLine || Number.isNaN(pid) || Number.isNaN(ppid))
+        const commandLine = options.commandLines === false ? record.Name?.trim() ?? "" : record.CommandLine?.trim();
+        if (commandLine == null || Number.isNaN(pid) || Number.isNaN(ppid))
+            return null;
+        if (options.commandLines !== false && !commandLine)
             return null;
         return { command: commandLine, pid, ppid };
     })
@@ -276,13 +269,17 @@ async function listWindowsProcessSnapshots() {
  * Enumerate all running processes as `{ pid, ppid, command }` snapshots, using
  * the platform-appropriate backend. Returns an empty list on any failure.
  *
- * @returns The current process snapshots (empty on error).
+ * @param input - Optional host platform and bounded execution port.
+ * @param options - Probe timeout (5000ms); commandLines=false reads executable names only and
+ * preserves nameless Windows identities even when usage diagnostics are unavailable.
+ * @returns The current process snapshots (empty on error), capped at 8MiB of probe output.
+ * @example await listProcessSnapshots({}, { commandLines: false })
  */
-export async function listProcessSnapshots() {
+export async function listProcessSnapshots(input = {}, options = {}) {
     try {
-        return process.platform === "win32"
-            ? await listWindowsProcessSnapshots()
-            : await listPosixProcessSnapshots();
+        return (input.platform ?? process.platform) === "win32"
+            ? await listWindowsProcessSnapshots(input, options)
+            : await listPosixProcessSnapshots(input, options);
     }
     catch {
         return [];
@@ -369,6 +366,89 @@ export async function listProcessUsage(input = {}, options = {}) {
         return [];
     }
 }
+/**
+ * Decode macOS `footprint -p` output into bytes; absent or invalid readings return null.
+ * @example parseProcessFootprint({ text: "Footprint: 187 MB" })
+ */
+export function parseProcessFootprint({ text }, _options = {}) {
+    const match = /Footprint:\s+([\d.]+)\s+(B|KB|MB|GB)\b/.exec(text);
+    if (!match)
+        return null;
+    const units = { B: 1, KB: 1024, MB: 1024 * 1024, GB: 1024 * 1024 * 1024 };
+    const bytes = Number(match[1]) * units[match[2]];
+    return Number.isFinite(bytes) ? bytes : null;
+}
+/** @internal One bounded read-only OS probe; partial output on failure is discarded. */
+async function processProbeOutput(input, options) {
+    try {
+        const result = await input.run(input.command, input.args, {
+            encoding: "utf8", timeout: options.timeoutMs ?? 5000, maxBuffer: 8 * 1024 * 1024, windowsHide: true,
+        });
+        return result.ok ? result.stdout : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** @internal Performance instance names can reorder (node, node#1); only IDProcess is identity. */
+function parsePrivateWorkingSets({ stdout }) {
+    const readings = new Map();
+    try {
+        const payload = JSON.parse(stdout ?? "null");
+        for (const record of Array.isArray(payload) ? payload : [payload]) {
+            if (!record || typeof record !== "object")
+                continue;
+            const row = record;
+            const pid = cimNumber(row.IDProcess);
+            const bytes = cimNumber(row.WorkingSetPrivate);
+            if (!validSamplePid(pid))
+                continue;
+            readings.set(pid, Number.isSafeInteger(bytes) && bytes >= 0 ? bytes : null);
+        }
+    }
+    catch { /* Malformed/absent counters are unavailable, never zero. */ }
+    return readings;
+}
+const validSamplePid = (pid) => Number.isSafeInteger(pid) && pid > 0;
+/** @internal Reject invalid identities and oversized collections before making any OS calls. */
+function assertPrivateMemorySample({ pids, maxPids }) {
+    if (!pids.every(validSamplePid))
+        throw new RangeError("invalid process PID");
+    if (!Number.isSafeInteger(maxPids) || maxPids < 1 || pids.length > maxPids)
+        throw new RangeError("process sample exceeds PID limit");
+}
+/**
+ * Read private memory once per unique PID, without attaching an inspector or changing target state.
+ * macOS uses physical footprint; Windows uses private working set joined by PID, never PrivateBytes
+ * or Win32_Process.WorkingSetSize. Failed probes return null; invalid PIDs/limits throw RangeError.
+ * @param input - Requested PIDs and optional host platform/bounded execution port.
+ * @param options - Per-probe timeout (5000ms) and unique-PID limit (512); excess is rejected.
+ * @returns Accurately labeled bytes, including a null row for every unavailable PID.
+ * @complexity O(n) output space for n unique PIDs; macOS makes n sequential bounded probes,
+ * Windows makes one bounded bulk probe plus O(m) parsing space for m host processes.
+ * @example await sampleProcessPrivateMemory({ pids: [123] }, { timeoutMs: 10000 })
+ */
+export async function sampleProcessPrivateMemory(input, options = {}) {
+    const pids = [...new Set(input.pids)];
+    assertPrivateMemorySample({ pids, maxPids: options.maxPids ?? 512 });
+    const platform = input.platform ?? process.platform;
+    const run = input.run ?? execFileBuffered;
+    const readings = [];
+    if (platform === "darwin") {
+        for (const pid of pids) {
+            const stdout = await processProbeOutput({ command: "footprint", args: ["-p", String(pid)], run }, options);
+            readings.push({ pid, bytes: parseProcessFootprint({ text: stdout ?? "" }) });
+        }
+        return { metric: "physical-footprint", readings };
+    }
+    if (platform !== "win32")
+        return { metric: "unavailable", readings: pids.map((pid) => ({ pid, bytes: null })) };
+    const stdout = await processProbeOutput({ command: windowsPowerShell(), run, args: ["-NoProfile", "-NonInteractive", "-Command",
+            "$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_PerfFormattedData_PerfProc_Process | Select-Object IDProcess, WorkingSetPrivate | ConvertTo-Json -Compress"],
+    }, options);
+    const byPid = parsePrivateWorkingSets({ stdout });
+    return { metric: "private-working-set", readings: pids.map((pid) => ({ pid, bytes: byPid.get(pid) ?? null })) };
+}
 /**
  * Collect the transitive set of descendant PIDs (including the roots) from a
  * process snapshot list, returned sorted by numeric PID descending for deterministic ordering.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/platform",
-  "version": "0.6.16",
+  "version": "0.6.19",
   "description": "Generic OS/platform primitives: process exec and lifecycle, filesystem containment, HTTP readiness polling, toolchain discovery, blob storage, AWS signing, and an SSRF-safe asset cache.",
   "license": "Apache-2.0",
   "repository": {
@@ -21,6 +21,7 @@
       "./secrets/credential-sets/contracts": "universal",
       "./secrets/testing": "node",
       "./http/guarded": "node",
+      "./http/multipart": "node",
       "./mail": "node",
       "./mail/senders": "universal",
       "./mail/smtp": "node",
@@ -104,6 +105,11 @@
       "import": "./dist/secrets/testing.js",
       "default": "./dist/secrets/testing.js"
     },
+    "./http/multipart": {
+      "types": "./dist/http/multipart.adapter.d.ts",
+      "import": "./dist/http/multipart.adapter.js",
+      "default": "./dist/http/multipart.adapter.js"
+    },
     "./http/guarded": {
       "types": "./dist/http/guarded/index.d.ts",
       "import": "./dist/http/guarded/index.js",