fix(lint): replace no-explicit-any with concrete types in src files

[RAMADANdboss]

• discord.ts: payload typed as Record<string,unknown>
• keys.ts: add KeytarLike interface, remove any from keytar field
• pagerduty.ts: payload typed as Record<string,unknown>, safe inner casts
• slack.ts: introduce SlackBlock type alias, remove any[] and any fields
• schemaFormatter.ts: applySchema/loadAndApplySchema params typed as unknown
• inspect.ts: catch error: unknown, statusIndicator cast to TTLStatus
• mcp.ts: catch error: unknown
• pause.ts: catch error: unknown
• resume.ts: catch error: unknown
• watch.ts: catch error: unknown in watch and unwatch handlers
• aws_secrets.ts: clientPromise Promise, clientConfig Record<string,unknown>
• channels.ts: replace client as any with typed cast, remove b: any
• decoder.ts: symbol typed as unknown in interface and local variable
• discovery.ts: health/request/page casts replaced with narrow types

What does this PR do?

Why?

Does this touch secret-key handling or transaction submission?

• Yes — see notes above
• No

Checklist

• Tests pass (npm test)
• Type check passes (npx tsc --noEmit)
• Lint passes (npm run lint)
• Tests cover the new functionality (TDD preferred — see CONTRIBUTING.md)
• No unnecessary dependencies added
• Commit messages follow conventional format
• No console.log in core logic
• ADR added if this is a significant design decision (see docs/adr)
• E2E sandbox tested, if this touches RPC or daemon behavior (see docs/e2e-sandbox.md)

closes #363

[drips-wave]

@RAMADANdboss Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Refactor
  • Strengthened type handling across alert integrations, CLI commands, schema processing, AWS services, account balances, ledger decoding, and storage discovery.
  • Improved validation of webhook payloads, command errors, credentials, RPC responses, and decoded data.
  • Preserved existing alert delivery, command behavior, error reporting, and balance-processing workflows.
  • No new end-user features or visible behavior changes.

Walkthrough

This PR replaces explicit any usage with unknown, typed records, and local interfaces across alert payloads, CLI commands, AWS integrations, RPC calls, storage discovery, and decoded ledger values. Runtime behavior remains unchanged.

Changes

Type safety cleanup

Layer / File(s)	Summary
Alert payload contracts src/alerts/discord.ts, src/alerts/keys.ts, src/alerts/pagerduty.ts, src/alerts/slack.ts	Webhook payloads, Slack blocks, PagerDuty merges, and keytar credentials use narrower local types.
CLI and command boundary types src/cli/schemaFormatter.ts, src/commands/*.ts	Schema APIs now use unknown, command catches use unknown, and inspect status uses a narrower union.
Core client and RPC typing src/core/aws_secrets.ts, src/core/channels.ts, src/core/discovery.ts	AWS clients, balance responses, event requests, ledger windows, and pagination cursors use explicit types.
Decoded value contract src/core/decoder.ts	Decoded ledger key symbols now use unknown in both the interface and implementation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• chore(lint): eliminate no-explicit-any warnings in src/rpc/client.ts #360 — Covers a similar explicit-any cleanup, although it targets different files and code paths.

Possibly related PRs

• AbdulmalikAlayande/sorokeep#292 — Adds the alert template and payload flows whose typing is tightened here.
• AbdulmalikAlayande/sorokeep#259 — Introduces the AWS secret-fetching flow updated here.
• AbdulmalikAlayande/sorokeep#271 — Modifies the same storage discovery pagination path.

Suggested reviewers: abdulmalikalayande

Poem

A rabbit found loose types in a row,
And gave each a safer shape to show.
Unknowns now guard the trail,
Typed payloads fill the pail,
While no runtime paths change their flow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: replacing no-explicit-any usages with concrete types in src files.
Description check	✅ Passed	The description matches the changeset and lists the files and typing updates made in the PR.
Linked Issues check	✅ Passed	The PR addresses issue #363 by replacing remaining no-explicit-any usages with concrete types or unknown-based narrowing, matching the lint cleanup goal.
Out of Scope Changes check	✅ Passed	All changes are type-safety cleanups directly related to the lint objective, with no unrelated behavior changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

src/core/decoder.ts (1)

22-30: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add edge-case coverage for the widened symbol contract.

Verify tests cover contract-instance keys, non-string native values from scValToNative, and the exception path returning "Unknown".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/core/decoder.ts` around lines 22 - 30, Add edge-case tests for the
decoder logic assigning symbol: verify contract-instance keys produce
"ContractInstance", non-string values returned by scValToNative are preserved,
and exceptions from scValToNative produce "Unknown".

src/alerts/slack.ts (1)

135-146: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Validate custom Slack blocks before assigning them to the payload.

JSON.parse() is still untrusted here: parsed.blocks can be non-array/malformed, and when parsed is an array the current SlackBlock[] type allows any Record<string, unknown> rather than real Slack block objects. Parse as unknown, validate the array and at least a type block shape, and fall back to text when invalid.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/alerts/slack.ts` around lines 135 - 146, Update the customMessage parsing
in the Slack payload construction to parse into unknown and validate parsed
blocks before assigning them. Require arrays to contain valid Slack block
objects with at least a string type field, validate parsed.blocks similarly for
object payloads, and fall back to buildFallbackText(event) when validation fails
while preserving valid text and blocks handling.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/alerts/keys.ts`:
- Around line 18-20: Update the constructor of the keytar-owning class to ensure
this.keytar is always initialized: either require and validate a KeytarLike
dependency or create the appropriate real keytar fallback when keytarMock is
omitted. Remove the unsafe cast that masks undefined, while preserving mock
injection for tests and ensuring saveKey() and listKeys() can safely dereference
this.keytar.

In `@src/alerts/pagerduty.ts`:
- Line 123: Update buildPayload and the send flow to model the PagerDuty
envelope with an explicit type, including the nested payload and guarded
template overrides, instead of casting the result to Record<string, unknown>.
Remove or narrow the top-level and nested casts before mutation while preserving
the existing payload construction and send behavior.

In `@src/commands/inspect.ts`:
- Line 74: Update the rendering expression in the inspect output around
statusIndicator so item.status is validated as a TTLStatus before use, rather
than relying on the direct type assertion. Add or reuse a runtime guard that
handles invalid values safely, while preserving statusIndicator behavior for
valid statuses.

In `@src/core/aws_secrets.ts`:
- Line 9: Update the cached client declaration in the AWS Secrets Manager class
to use Promise<SecretsManagerClient> rather than Promise<unknown>. Type the
constructor configuration with the SecretsManager client’s indexed/config type
or a typed factory, then adjust resolveKey() to call client.send(...) directly
without an InstanceType cast and remove the Record<string, unknown>
configuration typing.

---

Outside diff comments:
In `@src/alerts/slack.ts`:
- Around line 135-146: Update the customMessage parsing in the Slack payload
construction to parse into unknown and validate parsed blocks before assigning
them. Require arrays to contain valid Slack block objects with at least a string
type field, validate parsed.blocks similarly for object payloads, and fall back
to buildFallbackText(event) when validation fails while preserving valid text
and blocks handling.

In `@src/core/decoder.ts`:
- Around line 22-30: Add edge-case tests for the decoder logic assigning symbol:
verify contract-instance keys produce "ContractInstance", non-string values
returned by scValToNative are preserved, and exceptions from scValToNative
produce "Unknown".

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 833d4529-153d-4289-b3c0-b9821207a5db

📥 Commits

Reviewing files that changed from the base of the PR and between 35d9237 and 4b6252e.

📒 Files selected for processing (14)

• src/alerts/discord.ts
• src/alerts/keys.ts
• src/alerts/pagerduty.ts
• src/alerts/slack.ts
• src/cli/schemaFormatter.ts
• src/commands/inspect.ts
• src/commands/mcp.ts
• src/commands/pause.ts
• src/commands/resume.ts
• src/commands/watch.ts
• src/core/aws_secrets.ts
• src/core/channels.ts
• src/core/decoder.ts
• src/core/discovery.ts

📜 Review details

🔇 Additional comments (13)

src/alerts/keys.ts (1)

6-17: LGTM!

Also applies to: 35-35

src/alerts/slack.ts (1)

15-17: LGTM!

Also applies to: 43-43

src/alerts/discord.ts (1)

189-189: LGTM!

src/core/channels.ts (1)

112-115: LGTM!

src/core/discovery.ts (2)

74-74: LGTM!

Also applies to: 120-121

---

93-106: 🎯 Functional Correctness

No change needed for the getEvents limit.

@stellar/stellar-sdk accepts limit on GetEventsRequest and maps it into the RPC pagination.limit field, so the current top-level shape is still sent to the RPC server through the SDK; using pagination: { limit: 100 } directly is only an optional cleanup.

			> Likely an incorrect or invalid review comment.

src/core/decoder.ts (1)

5-5: LGTM!

src/cli/schemaFormatter.ts (1)

74-76: LGTM!

Also applies to: 85-88

src/commands/inspect.ts (1)

79-84: LGTM!

src/commands/mcp.ts (1)

15-17: LGTM!

src/commands/pause.ts (1)

28-32: LGTM!

src/commands/resume.ts (1)

27-31: LGTM!

src/commands/watch.ts (1)

160-165: LGTM!

Also applies to: 209-213

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Make the keytar dependency truly required or initialize a real fallback.

keytarMock may be undefined, but the cast at Line 20 hides that fact. A no-argument construction will crash when saveKey() or listKeys() dereferences this.keytar.

Proposed fix

-  constructor(keytarMock?: KeytarLike) {
-    this.keytar = keytarMock as KeytarLike;
+  constructor(keytar: KeytarLike) {
+    this.keytar = keytar;
   }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	constructor(keytarMock?: KeytarLike) {
	// Fallback to allow mock injection during test environments safely
	this.keytar = keytarMock;
	this.keytar = keytarMock as KeytarLike;
	constructor(keytar: KeytarLike) {
	// Fallback to allow mock injection during test environments safely
	this.keytar = keytar;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/alerts/keys.ts` around lines 18 - 20, Update the constructor of the
keytar-owning class to ensure this.keytar is always initialized: either require
and validate a KeytarLike dependency or create the appropriate real keytar
fallback when keytarMock is omitted. Remove the unsafe cast that masks
undefined, while preserving mock injection for tests and ensuring saveKey() and
listKeys() can safely dereference this.keytar.

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate and inspect the relevant file and symbols without running repo code.
if [ -f src/alerts/pagerduty.ts ]; then
  echo "== file exists =="
  wc -l src/alerts/pagerduty.ts
  echo
  echo "== outline =="
  ast-grep outline src/alerts/pagerduty.ts --view expanded || true
  echo
  echo "== relevant lines 1-190 =="
  sed -n '1,190p' src/alerts/pagerduty.ts | nl -ba | sed -n '1,190p'
else
  echo "src/alerts/pagerduty.ts not found"
  git ls-files | rg 'pagerduty|alerts' || true
fi

Repository: AbdulmalikAlayande/sorokeep

Length of output: 1137

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

if [ -f src/alerts/pagerduty.ts ]; then
  echo "== file exists =="
  wc -l src/alerts/pagerduty.ts
  echo
  echo "== outline =="
  ast-grep outline src/alerts/pagerduty.ts --view expanded || true
  echo
  echo "== relevant lines 1-190 =="
  sed -n '1,190p' src/alerts/pagerduty.ts | nl -ba | sed -n '1,190p'
else
  echo "src/alerts/pagerduty.ts not found"
  git ls-files | rg 'pagerduty|alerts' || true
fi

Repository: AbdulmalikAlayande/sorokeep

Length of output: 1137

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,200p' src/alerts/pagerduty.ts

Repository: AbdulmalikAlayande/sorokeep

Length of output: 7812

---

Avoid untyped mutations of the PagerDuty payload.

buildPayload() returns the full PagerDuty envelope as unknown, and send() casts the top-level record plus nested payload before mutation. Model the envelope inline (for example, with a typed payload and any guarded template overrides) so these casts can be removed or narrowed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/alerts/pagerduty.ts` at line 123, Update buildPayload and the send flow
to model the PagerDuty envelope with an explicit type, including the nested
payload and guarded template overrides, instead of casting the result to
Record<string, unknown>. Remove or narrow the top-level and nested casts before
mutation while preserving the existing payload construction and send behavior.

[coderabbitai]

🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Avoid asserting an unvalidated status as TTLStatus.

This cast can let out-of-contract values reach statusIndicator; its exhaustive switch then produces undefined for an invalid runtime status. Type item.status as TTLStatus at the result boundary or add a runtime guard before rendering.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/commands/inspect.ts` at line 74, Update the rendering expression in the
inspect output around statusIndicator so item.status is validated as a TTLStatus
before use, rather than relying on the direct type assertion. Add or reuse a
runtime guard that handles invalid values safely, while preserving
statusIndicator behavior for valid statuses.

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Repository files around aws_secrets:"
fd -a 'aws_secrets\.ts$|package.json$|.*secrets.*' . | sed 's#^\./##' | head -100

echo
echo "File outline:"
ast-grep outline src/core/aws_secrets.ts --view expanded || true

echo
echo "Relevant file contents:"
cat -n src/core/aws_secrets.ts

echo
echo "Search SecretsManagerClient and related usages:"
rg -n "SecretsManagerClient|clientPromise|clientConfig|as InstanceType|Record<string, unknown>" -S .

Repository: AbdulmalikAlayande/sorokeep

Length of output: 8266

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "package manager files:"
git ls-files | rg '(^|/)(package.json|package-lock.json|pnpm-lock.yaml|yarn.lock|bun.lockb|tsconfig.json)$' || true

echo
echo "package.json deps:"
if [ -f package.json ]; then
  node -e "const p=require('./package.json'); console.log(JSON.stringify({dependencies:p.dependencies,devDependencies:p.devDependencies}, null, 2))" | rg -n '"(`@aws-sdk/client-secrets-manager`|`@aws-sdk/credential-providers`|typescript)"|("aws-sdk|aws-crt|`@smithy`|`@aws-crypto`)"' | head -80 || true
fi

echo
echo "Lockfile entries for AWS SDK (if present):"
rg -n '`@aws-sdk/client-secrets-manager`|`@aws-sdk/credential-providers`|`@aws-sdk/signature-v4`|`@aws-sdk/config-resolver`|types' package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null | head -120 || true

echo
echo "TypeScript config:"
if [ -f tsconfig.json ]; then cat -n tsconfig.json; fi

Repository: AbdulmalikAlayande/sorokeep

Length of output: 10144

---

Preserve the AWS Secrets Manager client type instead of casting through unknown.

Type the cached promise as Promise<SecretsManagerClient> and use an indexed type or typed factory for the constructor config, so resolveKey() can call client.send(...) without an InstanceType cast and clientConfig is no longer hidden behind Record<string, unknown>.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/core/aws_secrets.ts` at line 9, Update the cached client declaration in
the AWS Secrets Manager class to use Promise<SecretsManagerClient> rather than
Promise<unknown>. Type the constructor configuration with the SecretsManager
client’s indexed/config type or a typed factory, then adjust resolveKey() to
call client.send(...) directly without an InstanceType cast and remove the
Record<string, unknown> configuration typing.

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
-	-	Generic High Entropy Secret	ded54f4	tests/commands/guard-cli-export-import.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[AbdulmalikAlayande]

Thanks — good, well-scoped set of fixes. Applied all 14 files (your branch predated the budget_exhausted alert event, so I reconciled discord.ts/pagerduty.ts/slack.ts by hand to keep both). Two follow-ups needed to actually compile against current dependency versions: aws_secrets.ts's SecretsManagerClient constructor cast needed a direct SecretsManagerClientConfig type instead of ConstructorParameters<...>[0] (which resolved to a union including undefined), and discovery.ts's getEvents request needed a real fix, not just a cast — it turned out request.pagination = { cursor } doesn't match the SDK's actual GetEventsRequest shape (cursor belongs at the top level, mutually exclusive with startLedger/endLedger). That was silently wrong under — nice catch by proxy, tightening the type surfaced a real pagination bug. Warning count now 264→237. Merged as eb5988e.