@voltro/integration-http 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to the `@voltro/*` packages are recorded here. The format
+follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## Stability contract — read this before you pin a version
+
+Voltro is **`0.x` — pre-1.0, and deliberately so.** Under SemVer, `0.y.z` means
+"anything MAY change." We hold to exactly that, stated out loud:
+
+- **Pin exact versions.** Depend on `@voltro/runtime@0.4.2`, never `^0.4.2` or
+  `~0.4.2`. There is no compatible-range promise below 1.0.
+- **Every MINOR may break.** Breaking changes land on a minor bump (`0.4.x →
+  0.5.0`); patches (`0.4.1 → 0.4.2`) are additive or fixes only. This is the
+  standard `0.x` reading of SemVer — the minor slot carries breaking under `0.x`.
+- **Read this changelog before upgrading.** The `⚠ BREAKING` section of each
+  release lists every incompatible change with its migration. It is the only
+  migration path we provide — there is no deprecation cycle, no compat shim.
+- **All packages release together (lockstep).** One coordinated version across
+  the whole framework; the git tag is the source of truth.
+
+This is not a placeholder disclaimer — it is the contract. The framework is
+refactored aggressively while it has no external stability obligations, and that
+velocity is the point. A stable-core tier and per-package `1.0` graduation are
+planned, but not yet; until then, treat the whole surface as movable and pin
+exact.
+
+The **public API** of each package is its `publishConfig.exports` entry points,
+minus anything marked `@internal` (those are cross-package internals and are
+stripped from the published `.d.ts`). Importing a deep path that isn't an
+exported entry point is unsupported.
+
+---
+
+## [Unreleased]
+
+_Changes staged for the next release accumulate here (rolled up from
+`.changes/*.md` at tag time — see `.changes/README.md`)._
+
+---
+
+## [0.1.0]
+
+Initial pre-release baseline. This is the starting point the changelog tracks
+from; it is not an exhaustive history of prior development. The framework ships
+as `@voltro/*` packages spanning the runtime, database/query layer, web client
+and router, durable workflows, the CLI, and the plugin ecosystem
+(auth, storage, mail, billing, observability, and more). Not published to a
+public registry yet.
+
+Subsequent releases record their deltas from here under dated headings, with
+`⚠ BREAKING` first.

package/LICENSE

@@ -0,0 +1,57 @@
+Voltro — Proprietary Software License
+
+Copyright (c) 2026 Voltro UG. All rights reserved.
+
+This software and all associated source code, documentation, and other
+materials (the "Software") are the proprietary property of Voltro UG
+("Voltro"). This is NOT open-source software.
+
+Your access to and use of the Software is governed exclusively by the Voltro
+Terms of Service at:
+
+    https://voltro.cloud/legal/terms
+
+By downloading, installing, or using the Software you agree to those Terms.
+Subject to and conditioned on your continued compliance with them, Voltro
+grants you a limited, non-exclusive, non-transferable, non-sublicensable,
+revocable license to use the Software. All rights not expressly granted in the
+Terms are reserved by Voltro. If you do not agree to the Terms, you have no
+license and may not use the Software.
+
+The Terms of Service — including the scope of permitted use, plan
+entitlements, fees, and pricing — may change from time to time. The version in
+force is the one published at the URL above. Commercial terms and pricing are
+NOT part of this notice and are not fixed by, or granted in perpetuity by, the
+version of the Software in which this file appears.
+
+Permitted use — your own software. Voltro is a development framework. You may
+use the Software to build, run, and commercially distribute your own
+applications and services, and to charge your own customers for them, without
+owing Voltro any share of that revenue or any further permission beyond the
+Terms. Applications you build with the Software are yours.
+
+Prohibited use — reselling Voltro. You may NOT redistribute, resell,
+sublicense, publish, or otherwise provide the Software itself — in whole or in
+part, in source or compiled form — to third parties as a library, framework,
+SDK, template, starter, or development tool for them to build upon, whether
+standalone or repackaged. Shipping the Software as a non-separable, bundled
+dependency inside an application you deliver (for example, compiled into your
+deployed app) is permitted; extracting or re-exposing it as a reusable
+component for others is not.
+
+Except as expressly permitted above or by the Terms, you may not copy, modify,
+merge, publish, sublicense, sell, distribute, or create derivative works of the
+Software, in whole or in part.
+
+Third-party open-source components distributed alongside the Software are the
+property of their respective owners and are licensed under their own terms; see
+THIRD-PARTY-NOTICES.md where provided. Nothing in this notice limits your
+rights, or extends Voltro's, in those components.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL
+VOLTRO BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM,
+OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR ITS USE.
+
+For licensing inquiries, contact Voltro UG.

package/README.md

@@ -0,0 +1,26 @@
+<div align="center">
+
+# @voltro/integration-http
+
+**Server-side HTTP transport core for integration plugins: token auth, transient retry with Retry-After, per-request timeout, and an SSRF host-allowlist guard — over an injectable fetch seam, Effect-first with typed errors.**
+
+[📖 Documentation](https://docs.voltro.dev/docs/intro/getting-started) · [Changelog](./CHANGELOG.md) · [voltro.dev](https://voltro.dev) · [Voltro Cloud](https://voltro.cloud)
+
+</div>
+
+---
+
+```sh
+npm install @voltro/integration-http
+```
+
+> ### [→ Read the documentation for @voltro/integration-http](https://docs.voltro.dev/docs/intro/getting-started)
+
+Installation, guides, the full API reference, and examples all live in the
+**[Voltro documentation](https://docs.voltro.dev/docs/intro/getting-started)** — the single source of truth. This README is
+deliberately short so there is nothing here to drift out of date.
+
+## License
+
+Proprietary. © 2026 Voltro UG. Your use is governed by the
+[Terms of Service](https://voltro.cloud/legal/terms). See the bundled `LICENSE`.

package/SECURITY.md

@@ -0,0 +1,56 @@
+# Security Policy
+
+We take the security of Voltro and the applications built on it seriously. This
+document explains how to report a vulnerability and what to expect in return.
+
+## Reporting a vulnerability
+
+**Please do not open public issues or discuss suspected vulnerabilities in
+public channels.** Report them privately by email:
+
+**security contact: [support@voltro.dev](mailto:support@voltro.dev)**
+(subject line: `SECURITY`).
+
+Include, where you can:
+
+- the affected package(s) and version(s) (e.g. `@voltro/runtime@x.y.z`);
+- a description of the issue and its impact;
+- a minimal reproduction or proof of concept;
+- any suggested remediation.
+
+If you'd like to encrypt your report, ask in a first plain email and we'll
+arrange a key.
+
+## What to expect
+
+- **Acknowledgement** of your report within **3 business days**.
+- An initial assessment (severity, affected surface) and a remediation plan as
+  soon as we've reproduced the issue.
+- **Coordinated disclosure:** we'll agree a disclosure timeline with you and
+  credit you in the release notes if you wish. Please give us reasonable time to
+  ship a fix before any public disclosure.
+
+We do not currently run a paid bug-bounty program, but we genuinely appreciate
+responsible disclosure and will credit reporters.
+
+## Software Bill of Materials (SBOM)
+
+A CycloneDX SBOM of the third-party runtime dependency graph is generated for the
+published packages (`pnpm gen:sbom` → `sbom.cdx.json`). If your procurement or
+security team needs it, request it at
+[support@voltro.dev](mailto:support@voltro.dev).
+
+## Supported versions
+
+Voltro is pre-1.0 and ships in lockstep: **only the latest published minor of
+each `@voltro/*` package receives security fixes.** Please upgrade to the latest
+release before reporting, and pin exact versions in production.
+
+## Scope
+
+In scope: the published `@voltro/*` packages and the framework's own code.
+
+Out of scope: vulnerabilities in third-party dependencies that are already
+tracked upstream (we monitor these via a production-dependency audit gate in
+CI), and issues that require a non-default, explicitly-unsafe configuration. If
+you're unsure, report it anyway — we'd rather hear about it.

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,11 @@
+# Third-Party Notices — @voltro/integration-http
+
+This package depends on the open-source software listed below. Each is the
+property of its respective copyright holders and is used under the terms of
+its license. This file is provided for attribution; it grants no rights in
+@voltro/integration-http itself, which is proprietary (see LICENSE).
+
+Generated from the resolved runtime dependency closure (0 packages).
+
+---
+

package/dist/index.d.ts

@@ -0,0 +1,186 @@
+import { Effect } from 'effect';
+
+/**
+ * SSRF guard for an ARBITRARY (user-supplied) outbound URL — webhook targets,
+ * ingest URLs. Throws when the URL is non-http(s), or its host is an IP LITERAL
+ * in a loopback / private / link-local (incl. `169.254.169.254` cloud-metadata)
+ * / reserved range, or `localhost` / `*.internal` / `*.local`. Fails CLOSED on a
+ * malformed URL.
+ *
+ * SYNC + node-free by design (this is a leaf package — no `node:dns`): it does
+ * NOT resolve DNS, so a HOSTNAME that resolves to a private IP (DNS rebinding)
+ * is not caught here — pair it with network-layer egress control for that. It
+ * DOES block the high-severity direct-IP vector (metadata endpoint, loopback,
+ * RFC-1918), which is the common webhook-SSRF exploit.
+ */
+export declare const assertPublicUrl: (rawUrl: string) => void;
+
+/**
+ * SSRF guard: the resolved URL's host MUST equal the configured base host.
+ * Used by every request so a crafted ref can't pivot the server-side fetch to
+ * an internal address. Fails CLOSED — a malformed URL returns `false`.
+ */
+export declare const assertSameHost: (baseUrl: string, targetUrl: string) => boolean;
+
+/**
+ * How each request is authenticated. Given the (optional) per-call context the
+ * caller passes to a request method, produce the outgoing headers. Keeping this
+ * a function means bearer tokens, tracking headers, or per-subject credentials
+ * are all expressible without the core knowing any auth scheme. Return the FULL
+ * header set for the request (the client does not merge — you own it).
+ */
+export declare type AuthHeaders<Ctx> = (ctx: Ctx) => Record<string, string>;
+
+/** Exponential backoff with a cap; attempt is 1-based. */
+export declare const backoffMs: (attempt: number, policy: HttpPolicy) => number;
+
+declare type CallOptions<Ctx> = [Ctx] extends [void] ? {
+    readonly ctx?: void;
+    readonly body?: unknown;
+} | undefined : HttpRequestOptions<Ctx>;
+
+export declare const DEFAULT_POLICY: HttpPolicy;
+
+/** Minimal fetch surface so tests can inject a stub — and so the core stays
+ *  transport-agnostic (a `Response` structurally satisfies this shape). */
+export declare type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    headers: {
+        get: (name: string) => string | null;
+    };
+    text: () => Promise<string>;
+    arrayBuffer: () => Promise<ArrayBuffer>;
+}>;
+
+/**
+ * A bound HTTP client: typed methods over one base URL + auth + policy. Each
+ * method returns an `Effect` that fails with the caller's typed error `E`.
+ */
+export declare interface HttpClient<E, Ctx = void> {
+    /** GET `path` → raw bytes/status. */
+    readonly get: (path: string, options?: CallOptions<Ctx>) => Effect.Effect<RawResult, E>;
+    /** GET `path` → JSON (`null` for an empty body). */
+    readonly getJson: (path: string, options?: CallOptions<Ctx>) => Effect.Effect<unknown, E>;
+    /** POST `path` (JSON body) → JSON. */
+    readonly postJson: (path: string, options?: CallOptions<Ctx>) => Effect.Effect<unknown, E>;
+    /** PUT `path` (JSON body) → JSON. */
+    readonly putJson: (path: string, options?: CallOptions<Ctx>) => Effect.Effect<unknown, E>;
+    /** DELETE `path` → JSON. */
+    readonly deleteJson: (path: string, options?: CallOptions<Ctx>) => Effect.Effect<unknown, E>;
+    /** Escape hatch: a raw request with a caller-chosen method → raw bytes. */
+    readonly request: (method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, options?: CallOptions<Ctx>) => Effect.Effect<RawResult, E>;
+    /** The resolved policy in effect (defaults merged). */
+    readonly policy: HttpPolicy;
+}
+
+export declare interface HttpClientConfig<E, Ctx = void> {
+    /** Absolute base URL. Every request path is joined beneath it; the SSRF
+     *  guard pins outbound requests to this host. */
+    readonly baseUrl: string;
+    /** Build the request headers (auth + any per-call headers). */
+    readonly auth: AuthHeaders<Ctx>;
+    /** Map a transport failure to the caller's typed error. */
+    readonly makeError: MakeError<E>;
+    /** The fetch implementation. Pass the global `fetch` in production or a stub
+     *  in tests. */
+    readonly fetchImpl: FetchLike;
+    /** Retry/backoff/timeout overrides, merged over {@link DEFAULT_POLICY}. */
+    readonly policy?: Partial<HttpPolicy>;
+    /** Injected clock for Retry-After math (tests). */
+    readonly now?: () => number;
+}
+
+export declare interface HttpPolicy {
+    /** Max attempts INCLUDING the first. Default 4. */
+    readonly maxAttempts: number;
+    /** First-retry delay (ms). Default 500. */
+    readonly initialDelayMs: number;
+    /** Cap on any single backoff (ms). Default 10_000. */
+    readonly maxDelayMs: number;
+    /** Per-request timeout (ms). Default 20_000. */
+    readonly timeoutMs: number;
+    /** Honour a `Retry-After` response header over computed backoff. Default true. */
+    readonly honourRetryAfter: boolean;
+}
+
+export declare interface HttpRequestOptions<Ctx> {
+    /** Per-call auth context passed to `auth` (e.g. a resolved token / subject). */
+    readonly ctx: Ctx;
+    /** Extra JSON body for POST/PUT — serialized by the client. */
+    readonly body?: unknown;
+}
+
+/**
+ * Maps a transport-level failure into the CALLER's typed error. Supplying this
+ * is how each integration keeps ONE core but its OWN `Schema.TaggedError`
+ * (`JiraError`, `GithubError`, …). `code: 'session_expired'` marks a stale
+ * token (a 401) — non-transient, re-auth rather than retry.
+ */
+export declare interface MakeError<E> {
+    (args: {
+        readonly status?: number;
+        readonly message: string;
+        readonly transient: boolean;
+        readonly code?: 'session_expired';
+    }): E;
+}
+
+/**
+ * Build a bound {@link HttpClient}. The SSRF host-allowlist, transient retry
+ * with Retry-After, per-request timeout, and 401 → `session_expired` all come
+ * from the shared core — this only binds the config once.
+ *
+ * @example
+ * ```ts no-check
+ * const github = makeHttpClient<GithubError>({
+ *   baseUrl: 'https://api.github.com',
+ *   auth: () => ({ authorization: `Bearer ${token}`, accept: 'application/vnd.github+json' }),
+ *   makeError: (a) => new GithubError(a),
+ *   fetchImpl: fetch as unknown as FetchLike,
+ * })
+ * const repo = yield* github.getJson('/repos/acme/widgets')
+ * ```
+ */
+export declare const makeHttpClient: <E, Ctx = void>(config: HttpClientConfig<E, Ctx>) => HttpClient<E, Ctx>;
+
+/** Parse a `Retry-After` header — either delta-seconds or an HTTP date. */
+export declare const parseRetryAfter: (value: string | null, nowMs: number) => number | null;
+
+export declare interface RawResult {
+    readonly status: number;
+    readonly bytes: Uint8Array;
+    readonly contentType: string | null;
+    readonly text: () => string;
+}
+
+/**
+ * Perform one request with retry/backoff/timeout. Succeeds with the raw
+ * response (bytes + status); fails with the caller's typed error.
+ */
+export declare const request: <E>(args: RequestArgs<E>) => Effect.Effect<RawResult, E>;
+
+export declare interface RequestArgs<E> {
+    readonly fetchImpl: FetchLike;
+    readonly baseUrl: string;
+    readonly method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+    readonly path: string;
+    readonly headers: Record<string, string>;
+    readonly body?: string;
+    readonly policy: HttpPolicy;
+    readonly makeError: MakeError<E>;
+    /** Injected clock for Retry-After date math (tests). */
+    readonly now?: () => number;
+}
+
+/** Convenience: `request` + JSON-parse the body (empty body → `null`). */
+export declare const requestJson: <E>(args: RequestArgs<E>) => Effect.Effect<unknown, E>;
+
+/** Status codes worth retrying — the conservative transient set. */
+export declare const RETRYABLE_STATUS: Set<number>;
+
+export { }

package/dist/index.js

@@ -0,0 +1,151 @@
+import { Duration as e, Effect as t } from "effect";
+//#region src/core.ts
+var n = /* @__PURE__ */ new Set([
+	408,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]), r = {
+	maxAttempts: 4,
+	initialDelayMs: 500,
+	maxDelayMs: 1e4,
+	timeoutMs: 2e4,
+	honourRetryAfter: !0
+}, i = (e, t) => Math.min(t.initialDelayMs * 2 ** (e - 1), t.maxDelayMs), a = (e, t) => {
+	if (!e) return null;
+	let n = Number(e);
+	if (Number.isFinite(n)) return Math.max(0, n * 1e3);
+	let r = Date.parse(e);
+	return Number.isNaN(r) ? null : Math.max(0, r - t);
+}, o = (e, t) => {
+	try {
+		return new URL(e).host === new URL(t).host;
+	} catch {
+		return !1;
+	}
+}, s = (e, t) => e === 127 || e === 10 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 169 && t === 254 || e === 0 || e === 100 && t >= 64 && t <= 127 || e >= 224, c = (e) => {
+	let t;
+	try {
+		t = new URL(e);
+	} catch {
+		throw Error("SSRF: malformed url");
+	}
+	if (t.protocol !== "http:" && t.protocol !== "https:") throw Error(`SSRF: blocked url scheme "${t.protocol}"`);
+	let n = t.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+	if (n === "localhost" || n.endsWith(".localhost") || n.endsWith(".internal") || n.endsWith(".local")) throw Error(`SSRF: blocked host "${n}"`);
+	let r = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(n);
+	if (r) {
+		let e = r.slice(1).map(Number);
+		if (e.some((e) => e > 255) || s(e[0], e[1])) throw Error(`SSRF: blocked address "${n}"`);
+		return;
+	}
+	if (n.includes(":") && (n === "::1" || n === "::" || n.startsWith("::ffff:") || /^fe[89ab]/.test(n) || n.startsWith("fc") || n.startsWith("fd"))) throw Error(`SSRF: blocked address "${n}"`);
+}, l = (e) => typeof e == "object" && !!e && e._transient === !0, u = (r) => {
+	let { fetchImpl: s, baseUrl: c, method: u, path: d, headers: f, body: p, policy: m, makeError: h } = r, g = r.now ?? Date.now, _ = `${c.replace(/\/$/, "")}${d.startsWith("/") ? d : `/${d}`}`;
+	if (!o(c, _)) return t.fail(h({
+		message: `blocked off-host request to ${_}`,
+		transient: !1
+	}));
+	let v = t.tryPromise({
+		try: async (e) => {
+			let t = await s(_, {
+				method: u,
+				headers: f,
+				...p === void 0 ? {} : { body: p },
+				signal: e
+			}), r = new Uint8Array(await t.arrayBuffer()), i = t.headers.get("content-type"), o = () => new TextDecoder().decode(r);
+			if (t.status >= 200 && t.status < 300) return {
+				status: t.status,
+				bytes: r,
+				contentType: i,
+				text: o
+			};
+			throw t.status === 401 ? h({
+				status: 401,
+				message: "session expired",
+				transient: !1,
+				code: "session_expired"
+			}) : n.has(t.status) ? {
+				_transient: !0,
+				status: t.status,
+				message: `HTTP ${t.status}: ${o().slice(0, 500)}`,
+				retryAfterMs: m.honourRetryAfter ? a(t.headers.get("retry-after"), g()) : null
+			} : h({
+				status: t.status,
+				message: `HTTP ${t.status}: ${o().slice(0, 500)}`,
+				transient: !1
+			});
+		},
+		catch: (e) => l(e) || typeof e == "object" && e && "_tag" in e ? e : {
+			_transient: !0,
+			message: `network error: ${String(e)}`,
+			retryAfterMs: null
+		}
+	}).pipe(t.timeoutFail({
+		duration: e.millis(m.timeoutMs),
+		onTimeout: () => ({
+			_transient: !0,
+			message: `request timed out after ${m.timeoutMs}ms`,
+			retryAfterMs: null
+		})
+	})), y = (n) => v.pipe(t.catchAll((r) => {
+		if (l(r) && n < m.maxAttempts) {
+			let a = r.retryAfterMs ?? i(n, m), o = r.retryAfterMs == null ? a / 2 + a / 2 * Math.random() : a, s = Math.min(o, m.maxDelayMs);
+			return t.sleep(e.millis(s)).pipe(t.flatMap(() => y(n + 1)));
+		}
+		return l(r) ? t.fail(h({
+			message: r.message,
+			transient: !0,
+			...r.status === void 0 ? {} : { status: r.status }
+		})) : t.fail(r);
+	})), b = (() => {
+		try {
+			return new URL(c).host;
+		} catch {
+			return "invalid";
+		}
+	})();
+	return y(1).pipe(t.withSpan("integration-http.request", { attributes: {
+		"http.request.method": u,
+		"server.address": b
+	} }));
+}, d = (e) => u(e).pipe(t.flatMap((n) => n.bytes.length === 0 ? t.succeed(null) : t.try({
+	try: () => JSON.parse(n.text()),
+	catch: () => e.makeError({
+		status: n.status,
+		message: "invalid JSON in response",
+		transient: !1
+	})
+}))), f = (e) => {
+	let t = {
+		...r,
+		...e.policy
+	}, n = (n, r, i) => {
+		let a = i?.ctx ?? void 0, o = i?.body;
+		return {
+			fetchImpl: e.fetchImpl,
+			baseUrl: e.baseUrl,
+			method: n,
+			path: r,
+			headers: e.auth(a),
+			...o === void 0 ? {} : { body: JSON.stringify(o) },
+			policy: t,
+			makeError: e.makeError,
+			...e.now ? { now: e.now } : {}
+		};
+	}, i = (e, t, r) => u(n(e, t, r)), a = (e, t, r) => d(n(e, t, r));
+	return {
+		get: (e, t) => i("GET", e, t),
+		getJson: (e, t) => a("GET", e, t),
+		postJson: (e, t) => a("POST", e, t),
+		putJson: (e, t) => a("PUT", e, t),
+		deleteJson: (e, t) => a("DELETE", e, t),
+		request: (e, t, n) => i(e, t, n),
+		policy: t
+	};
+};
+//#endregion
+export { r as DEFAULT_POLICY, n as RETRYABLE_STATUS, c as assertPublicUrl, o as assertSameHost, i as backoffMs, f as makeHttpClient, a as parseRetryAfter, u as request, d as requestJson };

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@voltro/integration-http",
+  "version": "0.1.0",
+  "description": "Server-side HTTP transport core for integration plugins: token auth, transient retry with Retry-After, per-request timeout, and an SSRF host-allowlist guard — over an injectable fetch seam, Effect-first with typed errors.",
+  "keywords": [
+    "voltro",
+    "typescript",
+    "framework"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://voltro.dev",
+  "bugs": {
+    "email": "support@voltro.dev"
+  },
+  "author": {
+    "name": "Voltro UG",
+    "url": "https://voltro.dev"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "peerDependencies": {
+    "effect": "^3.21.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}