@khoavu882/doflow 2.0.0-beta.3 → 2.0.0-beta.5

package/src/adapters/{index.ts → index.js}

@@ -4,7 +4,7 @@
 
 // Harness adapters own native formats and paths. This module intentionally only
 // validates and resolves that boundary; it never reads or writes harness files.
-const { resolveRegistrySource } = require('./resolve-source.ts');
+const { resolveRegistrySource } = require('./resolve-source.js');
 
 const ADAPTER_METHODS = Object.freeze(['discover', 'render', 'plan', 'apply', 'remove', 'verify']);
 
@@ -12,12 +12,12 @@ const ADAPTER_METHODS = Object.freeze(['discover', 'render', 'plan', 'apply', 'r
  * A3: the Codex shape used to be inlined here, putting per-harness knowledge on the shared side of
  * the boundary); this module only dispatches by adapter name. An adapter gaining a
  * nativeProjection declaration registers its normalizer here. */
-const NATIVE_PROJECTION_NORMALIZERS: Record<string, () => any> = Object.freeze({
-  codex: () => require('./codex/native-projection.ts').normalizeNativeProjection,
+const NATIVE_PROJECTION_NORMALIZERS                            = Object.freeze({
+  codex: () => require('./codex/native-projection.js').normalizeNativeProjection,
 });
 
 /** Dispatch a harness's nativeProjection declaration to its adapter's own normalizer. */
-function nativeProjectionFor(registry: any, harness: any, mcp: any, context: any) {
+function nativeProjectionFor(registry     , harness     , mcp     , context     ) {
   if (!harness.nativeProjection) return {};
   const load = NATIVE_PROJECTION_NORMALIZERS[harness.adapter];
   if (!load) {
@@ -32,9 +32,9 @@ function nativeProjectionFor(registry: any, harness: any, mcp: any, context: any
  * adapter receives. Native serializers may add adapter-specific fields, but
  * cannot infer applicability from a missing projection.
  */
-function projectAdapterInput({ registry, harness, scope, scopeRoot, assets = [], mcp = [], mcpAdoptable = [], policies = [], context = {} }: any) {
+function projectAdapterInput({ registry, harness, scope, scopeRoot, assets = [], mcp = [], mcpAdoptable = [], policies = [], context = {} }     ) {
   if (!registry || !harness) throw new Error('registry and harness are required for adapter projection');
-  const projectAsset = (asset: any) => {
+  const projectAsset = (asset     ) => {
     const projection = asset?.projection?.[harness.id];
     if (!projection || typeof projection.renderer !== 'string' || typeof projection.capability !== 'string') {
       throw new Error(`Asset '${asset?.id ?? '?'}' lacks a projection for '${harness.id}'`);
@@ -62,16 +62,16 @@ function projectAdapterInput({ registry, harness, scope, scopeRoot, assets = [],
   return Object.freeze({
     harness, scope, scopeRoot, context,
     assets: Object.freeze(assets.map(projectAsset)),
-    mcp: Object.freeze(mcp.map((server: any) => Object.freeze({ ...server }))),
+    mcp: Object.freeze(mcp.map((server     ) => Object.freeze({ ...server }))),
     // Servers whose existing entries the adapter may take as its own while it holds no MCP row.
-    mcpAdoptable: Object.freeze(mcpAdoptable.map((server: any) => Object.freeze({ ...server }))),
-    policies: Object.freeze(policies.map((policy: any) => Object.freeze({ ...policy }))),
+    mcpAdoptable: Object.freeze(mcpAdoptable.map((server     ) => Object.freeze({ ...server }))),
+    policies: Object.freeze(policies.map((policy     ) => Object.freeze({ ...policy }))),
     nativeTargets: Object.freeze({ ...harness.nativeTargets }),
     projection: Object.freeze({ ...projection }),
   });
 }
 
-function assertAdapter(adapter: any, name = 'adapter') {
+function assertAdapter(adapter     , name = 'adapter') {
   if (!adapter || typeof adapter !== 'object') throw new Error(`${name} must be an object`);
   for (const method of ADAPTER_METHODS) {
     if (typeof adapter[method] !== 'function') throw new Error(`${name} must implement ${method}()`);
@@ -88,8 +88,8 @@ function createAdapterRegistry(adapters = {}) {
   }
   return Object.freeze({
     names: () => [...resolved.keys()],
-    has: (name: any) => resolved.has(name),
-    get(name: any) {
+    has: (name     ) => resolved.has(name),
+    get(name     ) {
       const adapter = resolved.get(name);
       if (!adapter) throw new Error(`No registered adapter '${name}'`);
       return adapter;
@@ -97,7 +97,7 @@ function createAdapterRegistry(adapters = {}) {
   });
 }
 
-function resolveAdapter(adapterRegistry: any, harness: any) {
+function resolveAdapter(adapterRegistry     , harness     ) {
   if (!adapterRegistry || typeof adapterRegistry.get !== 'function') throw new Error('adapterRegistry must expose get(name)');
   if (!harness || typeof harness.adapter !== 'string') throw new Error('Harness must declare an adapter');
   return adapterRegistry.get(harness.adapter);

package/src/adapters/kiro/{index.ts → index.js}

@@ -17,9 +17,9 @@
 // https://kiro.dev/docs/hooks/
 const fs = require('node:fs');
 const path = require('node:path');
-const { planTree, applyTree, removeTree, verifyTree, resolveTransform, copyTreeAssets, copyTreeDestDir, ledgerFileResources, ledgerSiblingFingerprints, siblingReplacedNotices, sourceDirFor } = require('../copy-tree.ts');
-const { readMcpFiles, planMcpEntries, verifyMcpEntries, ownedMcpIds, writeMcpEntries } = require('../mcp-entries.ts');
-const { declaredHarnessPaths, resolveHarnessPaths } = require('../../helper/harness-paths.ts');
+const { planTree, applyTree, removeTree, verifyTree, resolveTransform, copyTreeAssets, copyTreeDestDir, ledgerFileResources, ledgerSiblingFingerprints, siblingReplacedNotices, sourceDirFor } = require('../copy-tree.js');
+const { readMcpFiles, planMcpEntries, verifyMcpEntries, ownedMcpIds, writeMcpEntries } = require('../mcp-entries.js');
+const { declaredHarnessPaths, resolveHarnessPaths } = require('../../helper/harness-paths.js');
 
 const HARNESS = 'kiro';
 const MCP_CONTAINER = 'mcpServers';
@@ -41,13 +41,13 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
   // Parity note: Kiro's historical nativePaths() derived even its user-scope root from scopeRoot
   // (the CLI passes $HOME there for -g installs), never from a separate homeDir argument — so the
   // resolver is fed no homeDir and "root" keeps resolving exactly as before.
-  function nativePaths({ scope, scopeRoot }: any = {}) {
+  function nativePaths({ scope, scopeRoot }      = {}) {
     return resolveHarnessPaths(declaredPaths, { scope, scopeRoot });
   }
 
   /** Discovery keeps the MCP files as plan read them (`mcpSnapshot`), which verify compares against,
    * and reports the servers DoFlow owns in Kiro's mcp.json now (`mcpOwned`). */
-  function discover({ scope, scopeRoot, mcp = [], mcpAdoptable = [], ledger, fsImpl = fs }: any) {
+  function discover({ scope, scopeRoot, mcp = [], mcpAdoptable = [], ledger, fsImpl = fs }     ) {
     const paths = nativePaths({ scope, scopeRoot });
     const entries = mcpEntriesInput({ paths, mcp, mcpAdoptable, ledger });
     const mcpSnapshot = readMcpFiles({ file: entries.file, ownRows: entries.ownRows, container: MCP_CONTAINER, fsImpl });
@@ -65,7 +65,7 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
    * `kiro-agents`, so nothing reaches this function. It is kept as a pure passthrough only to
    * satisfy the six-function adapter contract every harness must implement identically.
    */
-  function render({ content = '' }: any = {}) {
+  function render({ content = '' }      = {}) {
     return String(content);
   }
 
@@ -84,11 +84,11 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
    * `kiro-agent-json` layout and `kiro-agents` transform: kiro-cli discovers agents as
    * `.kiro/agents/<name>.json`, so each shared `<name>.md` spec is rendered, not mirrored.
    */
-  function kiroTreeAssets(assets: any) {
-    return [...copyTreeAssets(assets), ...(assets || []).filter((asset: any) => asset.renderer === 'kiro-agents')];
+  function kiroTreeAssets(assets     ) {
+    return [...copyTreeAssets(assets), ...(assets || []).filter((asset     ) => asset.renderer === 'kiro-agents')];
   }
 
-  function planCopyTreeAssets({ assets, scope, scopeRoot, context, ledger, removing, fsImpl = fs }: any) {
+  function planCopyTreeAssets({ assets, scope, scopeRoot, context, ledger, removing, fsImpl = fs }     ) {
     const paths = nativePaths({ scope, scopeRoot });
     const changes = [];
     const conflicts = [];
@@ -105,10 +105,10 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
         // is never deleted on removal, forced or not.
         force: !removing && context?.force === true, });
       treeResults.push(result);
-      conflicts.push(...result.conflicts.map((reason: any) => `${asset.id}: ${reason}`));
+      conflicts.push(...result.conflicts.map((reason     ) => `${asset.id}: ${reason}`));
       // A hand-edited file at a path DoFlow no longer writes is the user's: it stays, only its
       // ownership row is released.
-      notices.push(...result.kept.map((item: any) => `kept hand-edited ${path.relative(paths.root, item.target)}; DoFlow no longer manages it`));
+      notices.push(...result.kept.map((item     ) => `kept hand-edited ${path.relative(paths.root, item.target)}; DoFlow no longer manages it`));
       for (const change of result.changes) {
         changes.push({
           assetId: asset.id, target: change.target, source: change.source, operation: change.operation,
@@ -124,7 +124,7 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
     return { changes, conflicts, notices: [...siblingReplacedNotices(treeResults), ...notices] };
   }
 
-  function applyCopyTreeAssets(changes: any, { fsImpl = fs }: any = {}) {
+  function applyCopyTreeAssets(changes     , { fsImpl = fs }      = {}) {
     let applied = 0;
     const grouped = new Map();
     for (const change of changes) {
@@ -139,13 +139,13 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
     return applied;
   }
 
-  function removeCopyTreeAssets(changes: any, { fsImpl = fs }: any = {}) {
-    const treeChanges = changes.filter((change: any) => change.kind === 'copy-tree-file' && change.operation === 'remove' && !change.retained)
-      .map((change: any) => ({ relPath: change.identity, target: change.target, operation: 'remove', fingerprint: change.fingerprint, pruneGuard: change.pruneGuard }));
+  function removeCopyTreeAssets(changes     , { fsImpl = fs }      = {}) {
+    const treeChanges = changes.filter((change     ) => change.kind === 'copy-tree-file' && change.operation === 'remove' && !change.retained)
+      .map((change     ) => ({ relPath: change.identity, target: change.target, operation: 'remove', fingerprint: change.fingerprint, pruneGuard: change.pruneGuard }));
     return removeTree({ changes: treeChanges, fsImpl }).removed;
   }
 
-  function verifyCopyTreeAssets({ assets, scope, scopeRoot, context, fsImpl = fs }: any) {
+  function verifyCopyTreeAssets({ assets, scope, scopeRoot, context, fsImpl = fs }     ) {
     const paths = nativePaths({ scope, scopeRoot });
     const statuses = [];
     const resources = [];
@@ -154,7 +154,7 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
       const destDir = copyTreeDestDir(paths.configDir, asset);
       const sourceDir = sourceDirFor(asset, context, fsImpl, 'Kiro');
       const result = verifyTree({ sourceDir, destDir, fsImpl, layout: asset.layout, transform: asset.transform, plannedWrites: context?.plannedWrites });
-      conflicts.push(...result.conflicts.map((reason: any) => `${asset.id}: ${reason}`));
+      conflicts.push(...result.conflicts.map((reason     ) => `${asset.id}: ${reason}`));
       for (const resource of result.resources) {
         resources.push({
           assetId: asset.id, target: resource.target, ownershipIdentity: `doflow:${HARNESS}:copy-tree:${asset.id}:${resource.relPath}`,
@@ -177,15 +177,15 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
    * registry (core/registry/mcp.json) only ever declares stdio servers today, so only the fields it
    * actually carries are emitted — this never invents a field the registry doesn't supply.
    */
-  function buildServerEntry(server: any) {
+  function buildServerEntry(server     ) {
     if (server.url) return { url: server.url, ...(server.headers ? { headers: server.headers } : {}) };
     return { command: server.command, ...(server.args?.length ? { args: server.args } : {}) };
   }
 
-  function ownershipIdentity(id: any) { return `doflow:${HARNESS}:mcp-server:${id}`; }
+  function ownershipIdentity(id     ) { return `doflow:${HARNESS}:mcp-server:${id}`; }
 
-  function mcpOwnRows(ledger: any) {
-    return (ledger?.resources || []).filter((row: any) => row.harness === HARNESS).flatMap((row: any) => {
+  function mcpOwnRows(ledger     ) {
+    return (ledger?.resources || []).filter((row     ) => row.harness === HARNESS).flatMap((row     ) => {
       if (row.kind === 'mcp-server') {
         return [{ identity: row.identity, target: row.target, fingerprint: row.fingerprint ?? null, ownershipIdentity: row.ownershipIdentity, legacy: false }];
       }
@@ -196,13 +196,13 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
   }
 
   /** Everything the shared entry-ownership rules (../mcp-entries.ts) need from this adapter. */
-  function mcpEntriesInput({ paths, mcp = [], mcpAdoptable = [], ledger, assets = [] }: any) {
-    const rendered = (servers: any) => servers.map((server: any) => ({ id: server.id, entry: buildServerEntry(server) }));
+  function mcpEntriesInput({ paths, mcp = [], mcpAdoptable = [], ledger, assets = [] }     ) {
+    const rendered = (servers     ) => servers.map((server     ) => ({ id: server.id, entry: buildServerEntry(server) }));
     return {
       file: paths.mcp, selected: rendered(mcp), adoptable: rendered(mcpAdoptable),
       ownRows: mcpOwnRows(ledger),
-      foreignRows: (ledger?.resources || []).filter((row: any) => row.kind === 'mcp-server' && row.harness !== HARNESS)
-        .map((row: any) => ({ harness: row.harness, identity: row.identity, target: row.target })),
+      foreignRows: (ledger?.resources || []).filter((row     ) => row.kind === 'mcp-server' && row.harness !== HARNESS)
+        .map((row     ) => ({ harness: row.harness, identity: row.identity, target: row.target })),
       identityFor: ownershipIdentity, assetId: pseudoAssetId(assets), renderer: MCP_RENDERER, label: 'Kiro MCP',
     };
   }
@@ -210,9 +210,9 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
   /** Kiro has no hooks or mcp asset of its own in core/registry/assets.json (mcp servers come from
    * core/registry/mcp.json, not an asset), so an MCP entry change piggybacks on an asset id
    * this harness actually receives — the same "pseudo-component" technique
-   * src/adapters/gemini/index.ts#hooksAssetId already uses for its own settings-only component. */
-  function pseudoAssetId(assets: any) {
-    return assets.find((asset: any) => asset.id === 'guidance.context-layer')?.id ?? assets[0]?.id;
+   * src/adapters/gemini/index.js#hooksAssetId already uses for its own settings-only component. */
+  function pseudoAssetId(assets     ) {
+    return assets.find((asset     ) => asset.id === 'guidance.context-layer')?.id ?? assets[0]?.id;
   }
 
   // ---- shared adapter contract ----
@@ -226,11 +226,11 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
    * `assets` array; per-file installed status for the hooks tree itself is reported through
    * `copyTree.statuses`/`copyTree.resources`, exactly like it is for skills and agents.
    */
-  function hooksSurface(paths: any) {
+  function hooksSurface(paths     ) {
     return { status: 'supported', target: paths.hooks };
   }
 
-  function plan({ scope, scopeRoot, assets = [], mcp = [], mcpAdoptable = [], discovery, context = {}, ledger, fsImpl = fs }: any) {
+  function plan({ scope, scopeRoot, assets = [], mcp = [], mcpAdoptable = [], discovery, context = {}, ledger, fsImpl = fs }     ) {
     const found = discovery || discover({ scope, scopeRoot, mcp, mcpAdoptable, ledger, fsImpl });
     const changes = [];
     const conflicts = [];
@@ -253,12 +253,25 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
         skills: { status: 'supported', target: found.paths.skills },
         agents: { status: 'supported', target: found.paths.agents },
         hooks: hooksSurface(found.paths),
-        mcp: { status: found.mcpSnapshot[found.paths.mcp].ok ? 'supported' : 'blocked', target: found.paths.mcp, selected: mcp.map((item: any) => item.id) },
+        mcp: { status: found.mcpSnapshot[found.paths.mcp].ok ? 'supported' : 'blocked', target: found.paths.mcp, selected: mcp.map((item     ) => item.id) },
       },
     };
   }
 
-  function apply({ changes = [], fsImpl = fs }: any) {
+  /** The hook front doors (IC-037): the scripts and the agent that wires them. */
+  function hookDoorAssets(assets     ) { return (assets || []).filter((asset     ) => asset.id === 'kiro.hooks-scripts' || asset.id === 'kiro.doflow-agent'); }
+
+  function planHookDoors({ scope, scopeRoot, assets = [], context = {}, ledger, fsImpl = fs }     ) {
+    const doors = planCopyTreeAssets({ assets: hookDoorAssets(assets), scope, scopeRoot, context, ledger, removing: false, fsImpl });
+    return { changes: doors.changes, conflicts: doors.conflicts, prerequisites: [], notices: doors.notices };
+  }
+
+  function verifyHookDoors({ scope, scopeRoot, assets = [], context = {}, fsImpl = fs }     ) {
+    const doors = verifyCopyTreeAssets({ assets: hookDoorAssets(assets), scope, scopeRoot, context, fsImpl });
+    return { ok: doors.conflicts.length === 0, statuses: doors.statuses, resources: doors.resources, conflicts: doors.conflicts };
+  }
+
+  function apply({ changes = [], fsImpl = fs }     ) {
     writeMcpEntries(changes, { container: MCP_CONTAINER, fsImpl });
     applyCopyTreeAssets(changes, { fsImpl });
     // An update that no longer ships a copy-tree file carries its rows as removals inside the
@@ -266,12 +279,12 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
     removeCopyTreeAssets(changes, { fsImpl });
   }
 
-  function remove({ changes = [], fsImpl = fs }: any) {
+  function remove({ changes = [], fsImpl = fs }     ) {
     writeMcpEntries(changes, { container: MCP_CONTAINER, fsImpl });
     removeCopyTreeAssets(changes, { fsImpl });
   }
 
-  function verify({ scope, scopeRoot, assets = [], mcp = [], mcpAdoptable = [], discovery, ledger, operation, context = {}, fsImpl = fs }: any) {
+  function verify({ scope, scopeRoot, assets = [], mcp = [], mcpAdoptable = [], discovery, ledger, operation, context = {}, fsImpl = fs }     ) {
     const paths = nativePaths({ scope, scopeRoot });
     const resources = [];
     const conflicts = [];
@@ -297,7 +310,7 @@ function createKiroAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] } =
     };
   }
 
-  return { nativePaths, discover, render, plan, apply, remove, verify, buildServerEntry };
+  return { nativePaths, discover, render, plan, apply, remove, verify, planHookDoors, verifyHookDoors, buildServerEntry };
 }
 
 const singleton = createKiroAdapter();
@@ -305,6 +318,7 @@ const singleton = createKiroAdapter();
 module.exports = {
   nativePaths: singleton.nativePaths, discover: singleton.discover, render: singleton.render,
   plan: singleton.plan, apply: singleton.apply, remove: singleton.remove, verify: singleton.verify,
+  planHookDoors: singleton.planHookDoors, verifyHookDoors: singleton.verifyHookDoors,
   buildServerEntry: singleton.buildServerEntry,
   createKiroAdapter,
 };

package/src/adapters/{mcp-entries.ts → mcp-entries.js}

@@ -14,7 +14,7 @@
 // the same reason a file DoFlow cannot read is described by a fixed reason, never parser output.
 const fs = require('node:fs');
 const path = require('node:path');
-const { fingerprint } = require('./copy-tree.ts');
+const { fingerprint } = require('./copy-tree.js');
 
 const REASONS = Object.freeze({
   json: 'invalid JSON',
@@ -22,29 +22,29 @@ const REASONS = Object.freeze({
   container: 'server container is not an object',
 });
 
-function isObject(value: any): boolean { return Boolean(value) && typeof value === 'object' && !Array.isArray(value); }
+function isObject(value     )          { return Boolean(value) && typeof value === 'object' && !Array.isArray(value); }
 
-function entryFingerprint(value: any): string { return fingerprint(value); }
+function entryFingerprint(value     )         { return fingerprint(value); }
 
-function fingerprintOrNull(value: any): string | null { return value === undefined ? null : entryFingerprint(value); }
+function fingerprintOrNull(value     )                { return value === undefined ? null : entryFingerprint(value); }
 
 /** Deep equality that ignores key order, so a reformatted entry still equals DoFlow's rendering. */
-function sameValue(a: any, b: any): boolean { return a !== undefined && b !== undefined && entryFingerprint(a) === entryFingerprint(b); }
+function sameValue(a     , b     )          { return a !== undefined && b !== undefined && entryFingerprint(a) === entryFingerprint(b); }
 
-function shortId(id: any): string { const text = String(id); return text.length > 40 ? `${text.slice(0, 37)}...` : text; }
+function shortId(id     )         { const text = String(id); return text.length > 40 ? `${text.slice(0, 37)}...` : text; }
 
-function shortPath(file: string): string { return file.length > 80 ? `...${file.slice(-77)}` : file; }
+function shortPath(file        )         { return file.length > 80 ? `...${file.slice(-77)}` : file; }
 
 const NOTICES = Object.freeze({
-  collision: (id: any, file: string) => `MCP: kept your own entry '${shortId(id)}' in ${path.basename(file)} and did not register DoFlow's; rename or remove yours to let DoFlow manage it.`,
-  released: (id: any, file: string) => `MCP: entry '${shortId(id)}' in ${path.basename(file)} was changed outside DoFlow; it is yours now and DoFlow no longer updates or removes it.`,
-  untouched: (file: string) => `MCP: left ${shortPath(file)} untouched because it cannot be edited safely; DoFlow no longer manages the entries in it.`,
+  collision: (id     , file        ) => `MCP: kept your own entry '${shortId(id)}' in ${path.basename(file)} and did not register DoFlow's; rename or remove yours to let DoFlow manage it.`,
+  released: (id     , file        ) => `MCP: entry '${shortId(id)}' in ${path.basename(file)} was changed outside DoFlow; it is yours now and DoFlow no longer updates or removes it.`,
+  untouched: (file        ) => `MCP: left ${shortPath(file)} untouched because it cannot be edited safely; DoFlow no longer manages the entries in it.`,
 });
 
-function refusal(label: string, file: string, reason: string): string { return `${label}: ${file}: ${reason}; DoFlow did not change the file`; }
+function refusal(label        , file        , reason        )         { return `${label}: ${file}: ${reason}; DoFlow did not change the file`; }
 
 /** Read one MCP file as a JSON object. `servers` is null when the file or its container is absent. */
-function readMcpFile(file: string, container: string, { fsImpl = fs }: { fsImpl?: any } = {}): any {
+function readMcpFile(file        , container        , { fsImpl = fs }                   = {})      {
   if (!fsImpl.existsSync(file)) return { ok: true, doc: null, servers: null };
   let doc;
   try { doc = JSON.parse(fsImpl.readFileSync(file, 'utf8')); } catch { return { ok: false, reason: REASONS.json }; }
@@ -55,52 +55,52 @@ function readMcpFile(file: string, container: string, { fsImpl = fs }: { fsImpl?
 }
 
 /** The `files` map plan and verify take: the scope's MCP file and every file an own row names. */
-function readMcpFiles({ file, ownRows = [], container, fsImpl = fs }: any): any {
-  const targets = new Set([file, ...ownRows.map((row: any) => row.target)]);
+function readMcpFiles({ file, ownRows = [], container, fsImpl = fs }     )      {
+  const targets = new Set([file, ...ownRows.map((row     ) => row.target)]);
   return Object.fromEntries([...targets].map((target) => {
     const read = readMcpFile(target, container, { fsImpl });
     return [target, read.ok ? { ok: true, servers: read.servers } : read];
   }));
 }
 
-function renderedById(selected: any[], adoptable: any[]): Map<string, any> {
-  const rendered = new Map<string, any>();
+function renderedById(selected       , adoptable       )                   {
+  const rendered = new Map             ();
   for (const { id, entry } of [...selected, ...adoptable]) if (!rendered.has(id)) rendered.set(id, entry);
   return rendered;
 }
 
 /** Shared by plan, verify and ownedMcpIds, so the three read one entry the same way. */
-function ownershipView({ file, files, selected = [], adoptable = [], ownRows = [], foreignRows = [] }: any): any {
+function ownershipView({ file, files, selected = [], adoptable = [], ownRows = [], foreignRows = [] }     )      {
   const rendered = renderedById(selected, adoptable);
-  const valueOf = (target: string, id: string) => (files[target]?.ok ? files[target].servers?.[id] : undefined);
-  const matches = (row: any, value: any) => {
+  const valueOf = (target        , id        ) => (files[target]?.ok ? files[target].servers?.[id] : undefined);
+  const matches = (row     , value     ) => {
     if (value === undefined) return false;
     const recorded = row.fingerprint ?? null;
     return recorded !== null ? entryFingerprint(value) === recorded : sameValue(value, rendered.get(row.identity));
   };
-  const rowsFor = (id: string) => ownRows.filter((row: any) => row.identity === id && row.target === file);
+  const rowsFor = (id        ) => ownRows.filter((row     ) => row.identity === id && row.target === file);
   // A legacy row is consumed alongside the current one, but never preferred over it.
-  const rowFor = (id: string) => { const rows = rowsFor(id); return rows.find((row: any) => !row.legacy) ?? rows[0] ?? null; };
+  const rowFor = (id        ) => { const rows = rowsFor(id); return rows.find((row     ) => !row.legacy) ?? rows[0] ?? null; };
   const adoptionOpen = ownRows.length === 0;
-  const adoptableIds = new Set(adoptable.map((server: any) => server.id));
-  const selectedIds = new Set(selected.map((server: any) => server.id));
+  const adoptableIds = new Set(adoptable.map((server     ) => server.id));
+  const selectedIds = new Set(selected.map((server     ) => server.id));
   /** An equal entry no own row claims is DoFlow's when another harness's row claims it, or when it
    * may be adopted. */
-  const claimable = (id: string, entry: any) => {
+  const claimable = (id        , entry     ) => {
     const value = valueOf(file, id);
-    return sameValue(value, entry) && (foreignRows.some((row: any) => row.identity === id && row.target === file)
+    return sameValue(value, entry) && (foreignRows.some((row     ) => row.identity === id && row.target === file)
       || (adoptionOpen && adoptableIds.has(id)));
   };
   /** Adoptable entries DoFlow takes out because nothing selects them any more. */
   const adoptedRemovals = () => (adoptionOpen && files[file]?.ok
-    ? adoptable.filter(({ id, entry }: any) => !selectedIds.has(id) && sameValue(valueOf(file, id), entry)) : []);
+    ? adoptable.filter(({ id, entry }     ) => !selectedIds.has(id) && sameValue(valueOf(file, id), entry)) : []);
   return { rendered, valueOf, matches, rowsFor, rowFor, claimable, adoptedRemovals };
 }
 
-function orderOf(selected: any[], adoptable: any[]): (a: any, b: any) => number {
+function orderOf(selected       , adoptable       )                             {
   const ids = [...renderedById(selected, adoptable).keys()];
-  const rank = (id: string) => { const index = ids.indexOf(id); return index < 0 ? ids.length : index; };
-  return (a: any, b: any) => (a.target < b.target ? -1 : a.target > b.target ? 1
+  const rank = (id        ) => { const index = ids.indexOf(id); return index < 0 ? ids.length : index; };
+  return (a     , b     ) => (a.target < b.target ? -1 : a.target > b.target ? 1
     : rank(a.identity) - rank(b.identity) || (a.identity < b.identity ? -1 : a.identity > b.identity ? 1 : 0));
 }
 
@@ -110,17 +110,17 @@ function orderOf(selected: any[], adoptable: any[]): (a: any, b: any) => number
  * `foreignRows` other harnesses' rows; `identityFor` composes the adapter's ownership identity.
  */
 function planMcpEntries({ file, files, selected = [], adoptable = [], ownRows = [], foreignRows = [], removing = false,
-  identityFor, assetId, renderer, label }: any): any {
+  identityFor, assetId, renderer, label }     )      {
   const view = ownershipView({ file, files, selected, adoptable, ownRows, foreignRows });
-  const changes: any[] = [];
-  const conflicts: string[] = [];
-  const notices: string[] = [];
-  const base = (fields: any) => ({ assetId, kind: 'mcp-server', sourceVersion: 'registry-v1', projection: { renderer }, ...fields });
-  const write = (operation: string, id: string, entry: any) => base({
+  const changes        = [];
+  const conflicts           = [];
+  const notices           = [];
+  const base = (fields     ) => ({ assetId, kind: 'mcp-server', sourceVersion: 'registry-v1', projection: { renderer }, ...fields });
+  const write = (operation        , id        , entry     ) => base({
     target: file, operation, identity: id, ownershipIdentity: identityFor(id),
     before: fingerprintOrNull(view.valueOf(file, id)), entry, fingerprint: entryFingerprint(entry), afterFingerprint: entryFingerprint(entry),
   });
-  const drop = (row: any, release: boolean) => base({
+  const drop = (row     , release         ) => base({
     target: row.target, operation: 'remove', identity: row.identity, ownershipIdentity: row.ownershipIdentity,
     before: fingerprintOrNull(view.valueOf(row.target, row.identity)), fingerprint: row.fingerprint ?? null,
     ...(release ? { release: true } : {}),
@@ -132,7 +132,7 @@ function planMcpEntries({ file, files, selected = [], adoptable = [], ownRows =
     else conflicts.push(refusal(label, target, files[target].reason));
   }
 
-  const consumed = new Set<any>();
+  const consumed = new Set     ();
   if (!removing && files[file]?.ok) {
     for (const { id, entry } of selected) {
       const rows = view.rowsFor(id);
@@ -184,7 +184,7 @@ function planMcpEntries({ file, files, selected = [], adoptable = [], ownRows =
 /** Apply one file's planned changes to the server map read now. Each change goes ahead only while
  * its entry still holds what plan saw, or already holds the change's end state, which makes two
  * harnesses' changes to one shared entry in one run idempotent. Release changes touch nothing. */
-function applyMcpEntries(servers: any, changes: any[]): any {
+function applyMcpEntries(servers     , changes       )      {
   const next = { ...(servers || {}) };
   for (const change of changes) {
     if (change.release) continue;
@@ -205,13 +205,13 @@ function applyMcpEntries(servers: any, changes: any[]): any {
  * whatever it holds now.
  */
 function verifyMcpEntries({ file, files, snapshot, selected = [], adoptable = [], ownRows = [], foreignRows = [], removing = false,
-  identityFor, assetId, renderer, label, harness, sourceVersion = 'unknown' }: any): any {
+  identityFor, assetId, renderer, label, harness, sourceVersion = 'unknown' }     )      {
   const now = ownershipView({ file, files, selected, adoptable, ownRows, foreignRows });
   const then = ownershipView({ file, files: snapshot, selected, adoptable, ownRows, foreignRows });
-  const statuses: any[] = [];
-  const resources: any[] = [];
-  const conflicts: string[] = [];
-  const report = (id: string, target: string, ownershipIdentity: any, status: string) => statuses.push({
+  const statuses        = [];
+  const resources        = [];
+  const conflicts           = [];
+  const report = (id        , target        , ownershipIdentity     , status        ) => statuses.push({
     harness, assetId, capability: 'mcp', identity: id, target, ownershipIdentity, status,
   });
 
@@ -219,7 +219,7 @@ function verifyMcpEntries({ file, files, snapshot, selected = [], adoptable = []
     for (const target of Object.keys(files).filter((item) => !files[item].ok).sort()) conflicts.push(refusal(label, target, files[target].reason));
   }
 
-  const consumed = new Set<any>();
+  const consumed = new Set     ();
   if (!removing) {
     for (const { id, entry } of selected) {
       for (const row of now.rowsFor(id)) consumed.add(row);
@@ -239,7 +239,7 @@ function verifyMcpEntries({ file, files, snapshot, selected = [], adoptable = []
     }
   }
 
-  const leftover = (value: any, matching: boolean, target: string) => {
+  const leftover = (value     , matching         , target        ) => {
     if (!files[target]?.ok) return 'not-managed';
     if (value === undefined) return 'absent';
     return matching ? 'retained' : 'not-managed';
@@ -261,29 +261,29 @@ function verifyMcpEntries({ file, files, snapshot, selected = [], adoptable = []
 /** The ids DoFlow owns in this harness's MCP file now, in rendering order: those an own row matches,
  * and, while the harness holds no row, adoptable entries equal to DoFlow's rendering. A file that
  * cannot be read contributes none. */
-function ownedMcpIds({ file, files, selected = [], adoptable = [], ownRows = [] }: any): string[] {
+function ownedMcpIds({ file, files, selected = [], adoptable = [], ownRows = [] }     )           {
   const view = ownershipView({ file, files, selected, adoptable, ownRows });
-  const owned = new Set<string>(ownRows.filter((row: any) => view.matches(row, view.valueOf(row.target, row.identity))).map((row: any) => row.identity));
+  const owned = new Set        (ownRows.filter((row     ) => view.matches(row, view.valueOf(row.target, row.identity))).map((row     ) => row.identity));
   if (!ownRows.length) {
     for (const { id, entry } of adoptable) if (sameValue(view.valueOf(file, id), entry)) owned.add(id);
   }
-  const order: string[] = [...view.rendered.keys()];
+  const order           = [...view.rendered.keys()];
   return [...order.filter((id) => owned.has(id)), ...[...owned].filter((id) => !order.includes(id)).sort()];
 }
 
-function isSymlink(file: string, fsImpl: any): boolean {
+function isSymlink(file        , fsImpl     )          {
   try { return fsImpl.lstatSync(file).isSymbolicLink(); } catch { return false; }
 }
 
 /** A symlinked MCP file is written through to the file it points at, so the link stays a link. */
-function writePath(file: string, fsImpl: any): string {
+function writePath(file        , fsImpl     )         {
   if (!isSymlink(file, fsImpl)) return file;
   try { return fsImpl.realpathSync(file); } catch { return path.resolve(path.dirname(file), fsImpl.readlinkSync(file)); }
 }
 
 /** Write a JSON document atomically, keeping the existing file's permission bits: an MCP file kept
  * private for its tokens stays so. Creates missing directories; never deletes a file. */
-function writeMcpJson(file: string, doc: any, { fsImpl = fs }: { fsImpl?: any } = {}): string {
+function writeMcpJson(file        , doc     , { fsImpl = fs }                   = {})         {
   const dest = writePath(file, fsImpl);
   fsImpl.mkdirSync(path.dirname(dest), { recursive: true });
   const mode = fsImpl.existsSync(dest) ? fsImpl.statSync(dest).mode & 0o7777 : null;
@@ -303,14 +303,14 @@ function writeMcpJson(file: string, doc: any, { fsImpl = fs }: { fsImpl?: any }
  * every file's next document computed before the first write. An emptied container is kept as `{}`
  * or its member deleted, as the harness expects. Returns the number of files written.
  */
-function writeMcpEntries(changes: any[], { container, keepEmptyContainer = false, fsImpl = fs }: { container?: any, keepEmptyContainer?: boolean, fsImpl?: any } = {}): number {
-  const byFile = new Map<string, any[]>();
+function writeMcpEntries(changes       , { container, keepEmptyContainer = false, fsImpl = fs }                                                                  = {})         {
+  const byFile = new Map               ();
   for (const change of changes) {
     if (change.kind !== 'mcp-server' || change.release) continue;
     if (!byFile.has(change.target)) byFile.set(change.target, []);
-    byFile.get(change.target)!.push(change);
+    byFile.get(change.target) .push(change);
   }
-  const writes: [string, any][] = [];
+  const writes                  = [];
   for (const [file, group] of byFile) {
     const read = readMcpFile(file, container, { fsImpl });
     if (!read.ok) throw new Error(`MCP: ${file} changed after planning; nothing was written, re-run the command`);