@socketsecurity/lib 5.28.0 → 6.0.1

package/dist/releases/socket-btm.d.ts

@@ -1,5 +1,5 @@
 /**
- * @fileoverview Socket-btm release download utilities.
+ * @file Socket-btm release download utilities.
  */
 import { type Arch, type Libc, type Platform } from '../constants/platform';
 import type { AssetPattern } from './github-types';
@@ -15,52 +15,94 @@ export declare const SOCKET_BTM_REPO: {
  * Configuration for downloading socket-btm generic assets.
  */
 export interface SocketBtmAssetConfig {
-    /** Asset name or pattern on GitHub. */
+    /**
+     * Asset name or pattern on GitHub.
+     */
     asset: string | AssetPattern;
-    /** @internal Discriminator fields */
+    /**
+     * @internal Discriminator fields
+     */
     bin?: never;
-    /** Working directory (defaults to process.cwd()). */
+    /**
+     * Working directory (defaults to process.cwd()).
+     */
     cwd?: string | undefined;
-    /** Download destination directory. @default 'build/downloaded' */
+    /**
+     * Download destination directory. @default 'build/downloaded'
+     */
     downloadDir?: string | undefined;
-    /** @internal Discriminator fields */
+    /**
+     * @internal Discriminator fields
+     */
     libc?: never;
-    /** Output filename. @default resolved asset name */
+    /**
+     * Output filename. @default resolved asset name.
+     */
     output?: string | undefined;
-    /** Suppress log messages. @default false */
+    /**
+     * Suppress log messages. @default false.
+     */
     quiet?: boolean | undefined;
-    /** Remove macOS quarantine attribute after download. @default false */
+    /**
+     * Remove macOS quarantine attribute after download. @default false.
+     */
     removeMacOSQuarantine?: boolean | undefined;
-    /** Specific release tag to download. */
+    /**
+     * Specific release tag to download.
+     */
     tag?: string | undefined;
-    /** @internal Discriminator fields */
+    /**
+     * @internal Discriminator fields
+     */
     targetArch?: never;
-    /** @internal Discriminator fields */
+    /**
+     * @internal Discriminator fields
+     */
     targetPlatform?: never;
 }
 /**
  * Configuration for downloading socket-btm binary releases.
  */
 export interface SocketBtmBinaryConfig {
-    /** @internal Discriminator field */
+    /**
+     * @internal Discriminator field
+     */
     asset?: never;
-    /** Binary/executable name (without extension). @default tool */
+    /**
+     * Binary/executable name (without extension). @default tool.
+     */
     bin?: string | undefined;
-    /** Working directory (defaults to process.cwd()). */
+    /**
+     * Working directory (defaults to process.cwd()).
+     */
     cwd?: string | undefined;
-    /** Download destination directory. @default 'build/downloaded' */
+    /**
+     * Download destination directory. @default 'build/downloaded'
+     */
     downloadDir?: string | undefined;
-    /** Linux libc variant. Auto-detected if not specified. */
+    /**
+     * Linux libc variant. Auto-detected if not specified.
+     */
     libc?: Libc | undefined;
-    /** Suppress log messages. @default false */
+    /**
+     * Suppress log messages. @default false.
+     */
     quiet?: boolean | undefined;
-    /** Remove macOS quarantine attribute after download. @default true */
+    /**
+     * Remove macOS quarantine attribute after download. @default true.
+     */
     removeMacOSQuarantine?: boolean | undefined;
-    /** Specific release tag to download. */
+    /**
+     * Specific release tag to download.
+     */
     tag?: string | undefined;
-    /** Target architecture (defaults to current arch). */
+    /**
+     * Target architecture (defaults to current arch).
+     */
     targetArch?: Arch | undefined;
-    /** Target platform (defaults to current platform). */
+    /**
+     * Target platform (defaults to current platform).
+     */
     targetPlatform?: Platform | undefined;
 }
 /**
@@ -68,132 +110,140 @@ export interface SocketBtmBinaryConfig {
  */
 export type SocketBtmReleaseConfig = SocketBtmBinaryConfig | SocketBtmAssetConfig;
 /**
- * Detect the libc variant (musl or glibc) on Linux systems.
- * Returns undefined for non-Linux platforms.
- *
- * @returns 'musl', 'glibc', or undefined (for non-Linux)
+ * Detect the libc variant (musl or glibc) on Linux systems. Returns undefined
+ * for non-Linux platforms.
  *
  * @example
- * ```typescript
- * const libc = detectLibc()
- * console.log(libc) // 'glibc', 'musl', or undefined
- * ```
+ *   ;```typescript
+ *   const libc = detectLibc()
+ *   console.log(libc) // 'glibc', 'musl', or undefined
+ *   ```
+ *
+ * @returns 'musl', 'glibc', or undefined (for non-Linux)
  */
 export declare function detectLibc(): Libc | undefined;
 /**
  * Download a release from socket-btm.
  *
+ * @example
+ *   ;```typescript
+ *   const binPath = await downloadSocketBtmRelease('lief', {
+ *     downloadDir: '/tmp/build/downloaded',
+ *   })
+ *   ```
+ *
  * @param tool - Tool/package name for release matching (e.g., 'lief', 'curl')
- * @param options - Download configuration
- * @returns Path to the downloaded file
+ * @param options - Download configuration.
  *
- * @example
- * ```typescript
- * const binPath = await downloadSocketBtmRelease('lief', {
- *   downloadDir: '/tmp/build/downloaded',
- * })
- * ```
+ * @returns Path to the downloaded file
  */
 export declare function downloadSocketBtmRelease(tool: string, options: SocketBtmReleaseConfig | undefined): Promise<string>;
 /**
  * Get asset name for a socket-btm binary.
  *
+ * @example
+ *   ;```typescript
+ *   getBinaryAssetName('lief', 'linux', 'x64', 'musl')
+ *   // 'lief-linux-x64-musl'
+ *   ```
+ *
  * @param binaryBaseName - Binary basename (e.g., 'binject', 'node')
- * @param platform - Target platform
- * @param arch - Target architecture
+ * @param platform - Target platform.
+ * @param arch - Target architecture.
  * @param libc - Linux libc variant (optional)
- * @returns Asset name (e.g., 'binject-darwin-arm64', 'node-linux-x64-musl')
  *
- * @example
- * ```typescript
- * getBinaryAssetName('lief', 'linux', 'x64', 'musl')
- * // 'lief-linux-x64-musl'
- * ```
+ * @returns Asset name (e.g., 'binject-darwin-arm64', 'node-linux-x64-musl')
  */
 export declare function getBinaryAssetName(binaryBaseName: string, platform: Platform, arch: Arch, libc?: Libc | undefined): string;
 /**
  * Get binary filename for output.
  *
+ * @example
+ *   ;```typescript
+ *   getBinaryName('node', 'win32') // 'node.exe'
+ *   getBinaryName('node', 'linux') // 'node'
+ *   ```
+ *
  * @param binaryBaseName - Binary basename (e.g., 'node', 'binject')
- * @param platform - Target platform
- * @returns Binary filename (e.g., 'node', 'node.exe')
+ * @param platform - Target platform.
  *
- * @example
- * ```typescript
- * getBinaryName('node', 'win32')  // 'node.exe'
- * getBinaryName('node', 'linux')  // 'node'
- * ```
+ * @returns Binary filename (e.g., 'node', 'node.exe')
  */
 export declare function getBinaryName(binaryBaseName: string, platform: Platform): string;
+/**
+ * Lazily load the fs module to avoid Webpack errors. Uses non-'node:' prefixed
+ * require to prevent Webpack bundling issues.
+ *
+ * @private
+ */
 /**
  * Get platform-arch identifier for directory structure and asset names.
  *
  * # Format: `<os>-<arch>[-<libc>]`
  *
- * The OS segment is `process.platform` verbatim: `darwin` / `linux` /
- * `win32`. The arch segment is `process.arch` verbatim: `x64` / `arm64`.
- * The optional libc suffix is `-musl` (Linux only; the glibc default is
- * unsuffixed to match Node.js's own linuxstatic convention).
+ * The OS segment is `process.platform` verbatim: `darwin` / `linux` / `win32`.
+ * The arch segment is `process.arch` verbatim: `x64` / `arm64`. The optional
+ * libc suffix is `-musl` (Linux only; the glibc default is unsuffixed to match
+ * Node.js's own linuxstatic convention).
  *
  * # Why these specific conventions
  *
  * ## Why `win32`, not `win`
  *
- * `win32` is what `process.platform` returns on every Windows host. Every
- * npm package whose install-time platform filter uses the standard
- * `os` / `cpu` / `libc` manifest fields must match `process.platform`
- * strings exactly (npm compares them verbatim — there's no shorthand
- * layer). Using `win` internally here would have forced a translation
- * every time we constructed an install filter or a target triple, and
- * reviewers would have to remember "we abbreviate on disk but not in
- * package filters." Since the two now match, there's no translation
- * step to get wrong.
- *
- * pnpm's pack-app (v11+) accepts `<os>-<arch>[-<libc>]` target strings
- * and its shards are `@pnpm/exe.<os>-<arch>` (with `win32`, not `win` —
- * see pnpm#11314). Our naming matches so asset names we emit can flow
- * directly into pack-app's `--target` arg, `pnpm.app.targets` config,
- * and sibling-package-name construction without a translation map.
+ * `win32` is what `process.platform` returns on every Windows host. Every npm
+ * package whose install-time platform filter uses the standard `os` / `cpu` /
+ * `libc` manifest fields must match `process.platform` strings exactly (npm
+ * compares them verbatim — there's no shorthand layer). Using `win` internally
+ * here would have forced a translation every time we constructed an install
+ * filter or a target triple, and reviewers would have to remember "we
+ * abbreviate on disk but not in package filters." Since the two now match,
+ * there's no translation step to get wrong.
+ *
+ * Pnpm's pack-app (v11+) accepts `<os>-<arch>[-<libc>]` target strings and its
+ * shards are `@pnpm/exe.<os>-<arch>` (with `win32`, not `win` — see
+ * pnpm#11314). Our naming matches so asset names we emit can flow directly into
+ * pack-app's `--target` arg, `pnpm.app.targets` config, and
+ * sibling-package-name construction without a translation map.
  *
  * ## Why `-musl` is the suffix (and glibc is unsuffixed)
  *
- * Node.js's own linuxstatic tarballs historically used the unqualified
- * `linux` for glibc and a separate download channel for musl. The pnpm
- * ecosystem codified that as `linux-<arch>` (glibc, default) and
- * `linux-<arch>-musl` (the libc outlier), matching the asymmetric
- * reality of Linux distros — glibc is the majority case, musl is
- * Alpine-and-similar. Adding `-glibc` for the default would be
- * redundant noise in the name.
+ * Node.js's own linuxstatic tarballs historically used the unqualified `linux`
+ * for glibc and a separate download channel for musl. The pnpm ecosystem
+ * codified that as `linux-<arch>` (glibc, default) and `linux-<arch>-musl` (the
+ * libc outlier), matching the asymmetric reality of Linux distros — glibc is
+ * the majority case, musl is Alpine-and-similar. Adding `-glibc` for the
+ * default would be redundant noise in the name.
  *
  * ## Why libc is only appended for Linux
  *
- * macOS and Windows have exactly one system libc each (Apple libSystem,
+ * MacOS and Windows have exactly one system libc each (Apple libSystem,
  * Microsoft UCRT). A hypothetical `darwin-arm64-libsystem` conveys no
- * information. Node.js, npm, and pnpm all treat libc as a Linux-only
- * axis; we follow the same convention so callers don't have to special-
- * case `'darwin-arm64'.startsWith('darwin-arm64')` style matches.
+ * information. Node.js, npm, and pnpm all treat libc as a Linux-only axis; we
+ * follow the same convention so callers don't have to special- case
+ * `'darwin-arm64'.startsWith('darwin-arm64')` style matches.
  *
  * ## Why this function exists at all (vs. inlining)
  *
- * Two upstream APIs that socket-btm consumers end up calling — the
- * npm manifest filter (`os`/`cpu`/`libc`) and pnpm's pack-app
- * `--target` — both need the exact same triple format. Centralizing
- * the construction here means a future schema change (e.g. Node
- * introducing `riscv64`) gets one edit, and the error message for an
- * unsupported platform is uniform across downloaders, pack-app
+ * Two upstream APIs that socket-btm consumers end up calling — the npm manifest
+ * filter (`os`/`cpu`/`libc`) and pnpm's pack-app `--target` — both need the
+ * exact same triple format. Centralizing the construction here means a future
+ * schema change (e.g. Node introducing `riscv64`) gets one edit, and the error
+ * message for an unsupported platform is uniform across downloaders, pack-app
  * invocations, and the `@socketbin/*` resolver logic.
  *
- * @param platform - Target platform
- * @param arch - Target architecture
+ * @example
+ *   ;```typescript
+ *   getPlatformArch('linux', 'x64', 'musl') // 'linux-x64-musl'
+ *   getPlatformArch('darwin', 'arm64') // 'darwin-arm64'
+ *   getPlatformArch('win32', 'x64') // 'win32-x64'
+ *   getPlatformArch('darwin', 'x64', 'musl') // 'darwin-x64' — libc ignored
+ *   ```
+ *
+ * @param platform - Target platform.
+ * @param arch - Target architecture.
  * @param libc - Linux libc variant (optional; non-linux platforms ignore)
- * @returns Platform-arch identifier (e.g., 'darwin-arm64', 'linux-x64-musl', 'win32-x64')
  *
- * @example
- * ```typescript
- * getPlatformArch('linux', 'x64', 'musl')  // 'linux-x64-musl'
- * getPlatformArch('darwin', 'arm64')       // 'darwin-arm64'
- * getPlatformArch('win32', 'x64')          // 'win32-x64'
- * getPlatformArch('darwin', 'x64', 'musl') // 'darwin-x64' — libc ignored
- * ```
+ * @returns Platform-arch identifier (e.g., 'darwin-arm64', 'linux-x64-musl',
+ *   'win32-x64')
  */
 export declare function getPlatformArch(platform: Platform, arch: Arch, libc?: Libc | undefined): string;

package/dist/releases/socket-btm.js

@@ -29,9 +29,11 @@ __export(socket_btm_exports, {
 });
 module.exports = __toCommonJS(socket_btm_exports);
 var import_platform = require("../constants/platform");
-var import_github_api = require("./github-api");
+var import_github_asset_url = require("./github-asset-url");
+var import_github_listing = require("./github-listing");
 var import_github_downloads = require("./github-downloads");
-var import_primordials = require("../primordials");
+var import_fs = require("../node/fs");
+var import_error = require("../primordials/error");
 const SOCKET_BTM_REPO = {
   owner: "SocketDev",
   repo: "socket-btm"
@@ -47,20 +49,12 @@ const ARCH_MAP = {
   arm64: "arm64",
   x64: "x64"
 };
-let _fs;
-// @__NO_SIDE_EFFECTS__
-function getFs() {
-  if (_fs === void 0) {
-    _fs = require("node:fs");
-  }
-  return _fs;
-}
 function detectLibc() {
   if ((0, import_platform.getPlatform)() !== "linux") {
     return void 0;
   }
   try {
-    const fs = /* @__PURE__ */ getFs();
+    const fs = (0, import_fs.getNodeFs)();
     const muslPaths = [
       "/lib/ld-musl-x86_64.so.1",
       "/lib/ld-musl-aarch64.so.1",
@@ -95,25 +89,25 @@ async function downloadSocketBtmRelease(tool, options) {
       resolvedAsset = asset;
     } else {
       if (tag) {
-        throw new import_primordials.ErrorCtor(
+        throw new import_error.ErrorCtor(
           "Cannot use asset pattern with explicit tag. Either provide exact asset name or omit tag."
         );
       }
-      resolvedTag = await (0, import_github_api.getLatestRelease)(toolPrefix, SOCKET_BTM_REPO, {
+      resolvedTag = await (0, import_github_listing.getLatestRelease)(toolPrefix, SOCKET_BTM_REPO, {
         assetPattern: asset
       }) ?? void 0;
       if (!resolvedTag) {
-        throw new import_primordials.ErrorCtor(
+        throw new import_error.ErrorCtor(
           `No ${tool} release with matching asset pattern found`
         );
       }
-      const assetUrl = await (0, import_github_api.getReleaseAssetUrl)(
+      const assetUrl = await (0, import_github_asset_url.getReleaseAssetUrl)(
         resolvedTag,
         asset,
         SOCKET_BTM_REPO
       );
       if (!assetUrl) {
-        throw new import_primordials.ErrorCtor(`No matching asset found in release ${resolvedTag}`);
+        throw new import_error.ErrorCtor(`No matching asset found in release ${resolvedTag}`);
       }
       resolvedAsset = assetUrl.split("/").pop() || asset.toString();
     }
@@ -174,7 +168,7 @@ async function downloadSocketBtmRelease(tool, options) {
 function getBinaryAssetName(binaryBaseName, platform, arch, libc) {
   const mappedArch = ARCH_MAP[arch];
   if (!mappedArch) {
-    throw new import_primordials.ErrorCtor(`Unsupported architecture: ${arch}`);
+    throw new import_error.ErrorCtor(`Unsupported architecture: ${arch}`);
   }
   const muslSuffix = platform === "linux" && libc === "musl" ? "-musl" : "";
   const ext = platform === "win32" ? ".exe" : "";
@@ -187,7 +181,7 @@ function getBinaryAssetName(binaryBaseName, platform, arch, libc) {
   if (platform === "win32") {
     return `${binaryBaseName}-win32-${mappedArch}${ext}`;
   }
-  throw new import_primordials.ErrorCtor(`Unsupported platform: ${platform}`);
+  throw new import_error.ErrorCtor(`Unsupported platform: ${platform}`);
 }
 function getBinaryName(binaryBaseName, platform) {
   return platform === "win32" ? `${binaryBaseName}.exe` : binaryBaseName;
@@ -195,11 +189,11 @@ function getBinaryName(binaryBaseName, platform) {
 function getPlatformArch(platform, arch, libc) {
   const mappedPlatform = PLATFORM_MAP[platform];
   if (!mappedPlatform) {
-    throw new import_primordials.ErrorCtor(`Unsupported platform: ${platform}`);
+    throw new import_error.ErrorCtor(`Unsupported platform: ${platform}`);
   }
   const mappedArch = ARCH_MAP[arch];
   if (!mappedArch) {
-    throw new import_primordials.ErrorCtor(`Unsupported architecture: ${arch}`);
+    throw new import_error.ErrorCtor(`Unsupported architecture: ${arch}`);
   }
   const muslSuffix = platform === "linux" && libc === "musl" ? "-musl" : "";
   return `${mappedPlatform}-${mappedArch}${muslSuffix}`;

package/dist/schema/parse.d.ts

@@ -1,26 +1,25 @@
 /**
- * @fileoverview Throwing twin of `validateSchema`.
- *
- * Use `parseSchema(schema, data)` for fail-fast trust boundaries (app
- * startup, config files, internal assertions). Use the non-throwing
- * `validateSchema` for recoverable input (form fields, API request bodies,
- * anywhere errors need to surface to a user).
+ * @file Throwing twin of `validateSchema`. Use `parseSchema(schema, data)` for
+ *   fail-fast trust boundaries (app startup, config files, internal
+ *   assertions). Use the non-throwing `validateSchema` for recoverable input
+ *   (form fields, API request bodies, anywhere errors need to surface to a
+ *   user).
  *
  * @example
- * ```ts
- * import { z } from 'zod'
- * import { parseSchema } from '@socketsecurity/lib/schema/parse'
+ *   ;```ts
+ *   import { z } from 'zod'
+ *   import { parseSchema } from '@socketsecurity/lib/schema/parse'
  *
- * const Config = z.object({ host: z.string(), port: z.number() })
- * const config = parseSchema(Config, json)  // throws on invalid
- * ```
+ *   const Config = z.object({ host: z.string(), port: z.number() })
+ *   const config = parseSchema(Config, json) // throws on invalid
+ *   ```
  */
 import type { Infer } from './types';
 /**
  * Parse `data` against `schema` and return the validated value.
  *
- * @throws {Error} When validation fails. The message lists all issues as
- *   `path: message, path: message, ...`. Use `validateSchema` if you need
- *   structured access to the error list.
+ * @throws {Error} When validation fails. The message lists all issues as `path:
+ *   message, path: message, ...`. Use `validateSchema` if you need structured
+ *   access to the error list.
  */
 export declare function parseSchema<S>(schema: S, data: unknown): Infer<S>;

package/dist/schema/parse.js

@@ -24,14 +24,14 @@ __export(parse_exports, {
 });
 module.exports = __toCommonJS(parse_exports);
 var import_validate = require("./validate");
-var import_primordials = require("../primordials");
+var import_error = require("../primordials/error");
 function parseSchema(schema, data) {
   const result = (0, import_validate.validateSchema)(schema, data);
   if (result.ok) {
     return result.value;
   }
   const summary = result.errors.map((e) => `${e.path.join(".") || "(root)"}: ${e.message}`).join(", ");
-  throw new import_primordials.ErrorCtor(`Validation failed: ${summary}`);
+  throw new import_error.ErrorCtor(`Validation failed: ${summary}`);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/schema/types.d.ts

@@ -1,55 +1,64 @@
 /**
- * @fileoverview Shared types for schema validation.
- *
- * `Schema<T>` is the Zod-shaped duck-type contract — any validator with
- * a `.safeParse(data)` method returning `{ success, data?, error? }`
- * satisfies it. socket-lib detects Zod (v3 and v4) structurally via this
- * interface; consumers bring their own Zod.
- *
- * `ValidateResult<T>` / `ValidationIssue` / `Infer<S>` / `AnySchema` are
- * the normalized shapes produced by `@socketsecurity/lib/schema/validate`
- * and `@socketsecurity/lib/schema/parse`.
+ * @file Shared types for schema validation. `Schema<T>` is the Zod-shaped
+ *   duck-type contract — any validator with a `.safeParse(data)` method
+ *   returning `{ success, data?, error? }` satisfies it. socket-lib detects Zod
+ *   (v3 and v4) structurally via this interface; consumers bring their own Zod.
+ *   `ValidateResult<T>` / `ValidationIssue` / `Infer<S>` / `AnySchema` are the
+ *   normalized shapes produced by `@socketsecurity/lib/schema/validate` and
+ *   `@socketsecurity/lib/schema/parse`.
  */
 /**
  * Result of a Zod-shaped schema's `.safeParse()` call.
  *
- * @template T - The expected type of the parsed data
+ * @template T - The expected type of the parsed data.
  */
 export interface ParseResult<T> {
-    /** Indicates whether parsing was successful */
+    /**
+     * Indicates whether parsing was successful.
+     */
     success: boolean;
-    /** Parsed and validated data (only present when `success` is `true`) */
+    /**
+     * Parsed and validated data (only present when `success` is `true`)
+     */
     data?: T | undefined;
-    /** Error information (only present when `success` is `false`) */
+    /**
+     * Error information (only present when `success` is `false`)
+     */
     error?: unknown;
 }
 /**
  * Zod-shaped duck-type for any validator exposing `safeParse` / `parse`.
  *
- * @template T - The expected output type after validation
- *
  * @example
- * ```ts
- * import { z } from 'zod'
+ *   ;```ts
+ *   import { z } from 'zod'
+ *
+ *   const userSchema = z.object({ name: z.string(), age: z.number() })
  *
- * const userSchema = z.object({ name: z.string(), age: z.number() })
+ *   // Schema satisfies this interface
+ *   const schema: Schema<User> = userSchema
+ *   const result = schema.safeParse({ name: 'Alice', age: 30 })
+ *   ```
  *
- * // Schema satisfies this interface
- * const schema: Schema<User> = userSchema
- * const result = schema.safeParse({ name: 'Alice', age: 30 })
- * ```
+ * @template T - The expected output type after validation.
  */
 export interface Schema<T = unknown> {
-    /** Non-throwing parse. */
+    /**
+     * Non-throwing parse.
+     */
     safeParse(data: unknown): ParseResult<T>;
-    /** Throwing parse. */
+    /**
+     * Throwing parse.
+     */
     parse(data: unknown): T;
-    /** Optional schema name for debugging. */
+    /**
+     * Optional schema name for debugging.
+     */
     _name?: string | undefined;
 }
 /**
- * Internal structural shape of a Zod v4 schema — carries the inferred
- * output type on `_zod.output`. Used for type-only detection in `Infer<S>`.
+ * Internal structural shape of a Zod v4 schema — carries the inferred output
+ * type on `_zod.output`. Used for type-only detection in `Infer<S>`.
  *
  * @internal
  */
@@ -60,8 +69,8 @@ interface ZodV4LikeSchema<O = unknown> {
     safeParse(data: unknown): unknown;
 }
 /**
- * Internal structural shape of a Zod v3 schema — carries the inferred
- * output type on `_output`. Used for type-only detection in `Infer<S>`.
+ * Internal structural shape of a Zod v3 schema — carries the inferred output
+ * type on `_output`. Used for type-only detection in `Infer<S>`.
  *
  * @internal
  */
@@ -71,9 +80,8 @@ interface ZodV3LikeSchema<O = unknown> {
 }
 /**
  * Internal structural shape of a TypeBox `TSchema` — carries the inferred
- * output type on the phantom `static` field. Only used inside socket-lib
- * for type-only detection in `Infer<S>`; external callers should pass
- * Zod schemas.
+ * output type on the phantom `static` field. Only used inside socket-lib for
+ * type-only detection in `Infer<S>`; external callers should pass Zod schemas.
  *
  * @internal
  */
@@ -87,8 +95,8 @@ export type AnySchema = ZodV4LikeSchema<unknown> | ZodV3LikeSchema<unknown> | Ty
 /**
  * Infer the validated output type from any supported schema kind.
  *
- * Order matters: TypeBox schemas carry a phantom `static` field, so we
- * check for TypeBox before falling through to Zod and the duck-type.
+ * Order matters: TypeBox schemas carry a phantom `static` field, so we check
+ * for TypeBox before falling through to Zod and the duck-type.
  */
 export type Infer<S> = S extends {
     static: infer Static;
@@ -103,9 +111,13 @@ export type Infer<S> = S extends {
  * A single normalized validation error.
  */
 export interface ValidationIssue {
-    /** Array path into the value (e.g. `['user', 'age']`). */
+    /**
+     * Array path into the value (e.g. `['user', 'age']`).
+     */
     path: Array<string | number>;
-    /** Human-readable description of the failure. */
+    /**
+     * Human-readable description of the failure.
+     */
     message: string;
 }
 /**