[ggonzalez94]

This continues the TAP simplification work by moving repeated parsing, path construction, private-file, and atomic persistence helpers into the packages that own those concerns. The branch keeps observable behavior intact while making core TAP state, tapd runtime state, CLI config IO, and host adapters use shared helper surfaces instead of local copies.\n\nI reviewed the full 130-commit diff against main for direction and consistency, then validated it with lint, typecheck, build, the full test suite, and release package verification.

---

Note

Medium Risk
Mostly refactors to shared helpers for payload parsing, ID generation, and filesystem IO/path resolution; risk is moderate because changes touch daemon discovery/spawn, config persistence, and app manifest handling where subtle path/parse differences could affect runtime behavior.

Overview
Centralizes repeated TAP helper logic into the owning packages and updates callers to use it, replacing scattered ad-hoc validation/parsing and path construction.

Apps (scheduling, transfer) now rely on core parsers (parse*ActionPayload) and shared ID/grant helpers (generateActionId, createGrantSet) instead of local payload validation and manual grant-set shaping.

The CLI migrates YAML/JSON reads and atomic writes to shared utilities (readYamlFile*, write*Atomic, readJsonFileOrDefault) and adopts canonical path helpers for TAP state (e.g., defaultConfigPath, conversations dir, app manifest paths) and tapd runtime files (socket/token/port/pid/log), including improved Hermes config/state parsing via stricter shape checks.

Core app management now exposes appManifestPath and uses shared atomic JSON helpers for manifest persistence, while TapAppRegistry/CLI app install validation switch to a shared hasTapAppShape/isObject check. Tests were updated accordingly and a small loopback transport cloning wrapper was introduced.

^{Reviewed by Cursor Bugbot for commit a054f5e. Bugbot is set up for automated code reviews on this repo. Configure here.}