@nebutra/integration-vault 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebutra/integration-vault",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Tenant-scoped SaaS OAuth and credential vault for tool calling",
   "private": false,
   "license": "MIT",
@@ -10,15 +10,19 @@
     "category": "integrations",
     "summary": "OAuth, secret storage, and SaaS action invocation boundary"
   },
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
   },
   "dependencies": {
     "p-limit": "^7.3.0",
-    "@nebutra/errors": "0.1.2",
-    "@nebutra/vault": "0.1.2"
+    "@nebutra/vault": "0.1.2",
+    "@nebutra/errors": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",
@@ -38,6 +42,12 @@
   "publishConfig": {
     "access": "public"
   },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "build": "tsup",
     "test": "vitest run",

package/.turbo/turbo-build.log

@@ -1,22 +0,0 @@
-
-> @nebutra/integration-vault@0.1.2 build /Users/tseka_luk/Documents/Nebutra-SaaS-Lab/Nebutra-Sailor/packages/integrations/integration-vault
-> tsup
-
-CLI Building entry: src/cli.ts, src/index.ts
-CLI Using tsconfig: tsconfig.json
-CLI tsup v8.5.1
-CLI Using tsup config: /Users/tseka_luk/Documents/Nebutra-SaaS-Lab/Nebutra-Sailor/packages/integrations/integration-vault/tsup.config.ts
-CLI Target: es2022
-CLI Cleaning output folder
-ESM Build start
-ESM dist/chunk-TQULRIQM.js     8.99 KB
-ESM dist/index.js              350.00 B
-ESM dist/cli.js                2.07 KB
-ESM dist/cli.js.map            3.96 KB
-ESM dist/index.js.map          71.00 B
-ESM dist/chunk-TQULRIQM.js.map 19.61 KB
-ESM ⚡️ Build success in 25ms
-DTS Build start
-DTS ⚡️ Build success in 3098ms
-DTS dist/cli.d.ts   13.00 B
-DTS dist/index.d.ts 4.66 KB

package/.turbo/turbo-test.log

@@ -1,14 +0,0 @@
-
-> @nebutra/integration-vault@0.1.1 test /Users/tseka_luk/Documents/Nebutra-SaaS-Lab/Nebutra-Sailor/packages/integrations/integration-vault
-> vitest run
-
-
- RUN  v4.1.4 /Users/tseka_luk/Documents/Nebutra-SaaS-Lab/Nebutra-Sailor/packages/integrations/integration-vault
-
- ✓ src/index.test.ts (4 tests) 17ms
-
- Test Files  1 passed (1)
-      Tests  4 passed (4)
-   Start at  09:38:42
-   Duration  1.75s (transform 231ms, setup 0ms, import 1.06s, tests 17ms, environment 0ms)
-

package/.turbo/turbo-typecheck.log

@@ -1,4 +0,0 @@
-
-> @nebutra/integration-vault@0.1.2 typecheck /Users/tseka_luk/Documents/Nebutra-SaaS-Lab/Nebutra-Sailor/packages/integrations/integration-vault
-> tsc --noEmit
-

package/examples/connect-token.ts

@@ -1,34 +0,0 @@
-import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
-
-const vault = IntegrationVault.local({
-  providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["docs"] })],
-});
-
-try {
-  const flow = await vault.startOAuth({
-    tenantId: "tenant_demo",
-    app: "docs",
-    scopes: ["documents:write"],
-  });
-
-  const connection = await vault.connectToken({
-    tenantId: "tenant_demo",
-    app: "docs",
-    accessToken: "local-development-token",
-    scopes: flow.scopes,
-  });
-
-  process.stdout.write(
-    `${JSON.stringify(
-      {
-        auth_url: flow.url,
-        token_id: connection.tokenId,
-        scopes: connection.scopes,
-      },
-      null,
-      2,
-    )}\n`,
-  );
-} finally {
-  await vault.close();
-}

package/examples/invoke-consented.ts

@@ -1,32 +0,0 @@
-import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
-
-const vault = IntegrationVault.local({
-  providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["docs"] })],
-});
-
-try {
-  await vault.connectToken({
-    tenantId: "tenant_demo",
-    app: "docs",
-    accessToken: "local-development-token",
-    scopes: ["documents:write"],
-  });
-
-  await vault.grantConsent({
-    tenantId: "tenant_demo",
-    app: "docs",
-    action: "create_page",
-    scopes: ["documents:write"],
-  });
-
-  const result = await vault.invoke({
-    tenantId: "tenant_demo",
-    app: "docs",
-    action: "create_page",
-    args: { title: "Layer 1", body: "Published through the integration vault." },
-  });
-
-  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-} finally {
-  await vault.close();
-}

package/examples/provider-fallback.ts

@@ -1,26 +0,0 @@
-import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
-
-const vault = IntegrationVault.local({
-  providers: [
-    new InMemoryIntegrationProvider({ id: "primary", apps: ["crm"] }),
-    new InMemoryIntegrationProvider({ id: "fallback", apps: ["*"] }),
-  ],
-});
-
-try {
-  const direct = await vault.startOAuth({ tenantId: "tenant_demo", app: "crm" });
-  const fallback = await vault.startOAuth({ tenantId: "tenant_demo", app: "calendar" });
-
-  process.stdout.write(
-    `${JSON.stringify(
-      {
-        direct_provider: direct.provider,
-        fallback_provider: fallback.provider,
-      },
-      null,
-      2,
-    )}\n`,
-  );
-} finally {
-  await vault.close();
-}

package/src/cli.ts

@@ -1,57 +0,0 @@
-import { readFile, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { IntegrationVault } from "./index";
-
-const command = process.argv[2] ?? "doctor";
-const tenantId = process.env.TENANT_ID ?? "local";
-const statePath = join(process.cwd(), ".nebutra", "debug", "integration-vault.jsonl");
-const vault = IntegrationVault.local();
-
-async function appendState(entry: Record<string, unknown>): Promise<void> {
-  await writeFile(statePath, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`, {
-    flag: "a",
-  }).catch(async (error) => {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-    await import("node:fs/promises").then(({ mkdir }) =>
-      mkdir(dirname(statePath), { recursive: true }),
-    );
-    await writeFile(statePath, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`, {
-      flag: "a",
-    });
-  });
-}
-
-try {
-  if (command === "doctor") {
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", ...(await vault.doctor()) }, null, 2)}\n`,
-    );
-  } else if (command === "connect") {
-    const app = process.argv[3];
-    if (!app) throw new Error("Missing app name");
-    const flow = await vault.startOAuth({ app, tenantId });
-    await appendState({ type: "connect", app, tenantId, flow });
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", auth_url: flow.url, state: flow.state }, null, 2)}\n`,
-    );
-  } else if (command === "list") {
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", connections: await vault.list(tenantId) }, null, 2)}\n`,
-    );
-  } else if (command === "debug") {
-    const raw = await readFile(statePath, "utf8").catch(() => "");
-    const entries = raw
-      .trim()
-      .split("\n")
-      .filter(Boolean)
-      .map((line) => JSON.parse(line) as unknown);
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", entries }, null, 2)}\n`,
-    );
-  } else {
-    process.stderr.write(`Unknown integration-vault command: ${command}\n`);
-    process.exitCode = 1;
-  }
-} finally {
-  await vault.close();
-}

package/src/index.test.ts

@@ -1,119 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  CapabilityError,
-  InMemoryIntegrationProvider,
-  InMemorySaasConsentStore,
-  type IntegrationProvider,
-  IntegrationVault,
-} from "./index";
-
-describe("IntegrationVault", () => {
-  it("requires tenant context before starting OAuth", async () => {
-    const vault = IntegrationVault.local({
-      providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["notion"] })],
-    });
-
-    await expect(vault.startOAuth({ app: "notion", tenantId: "" })).rejects.toThrow(
-      CapabilityError,
-    );
-  });
-
-  it("stores tokens encrypted and lists only token ids and scopes", async () => {
-    const vault = IntegrationVault.local({
-      providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["notion"] })],
-    });
-    const connection = await vault.connectToken({
-      tenantId: "tenant_a",
-      app: "notion",
-      accessToken: "secret-token",
-      scopes: ["pages:write"],
-    });
-
-    await expect(vault.list("tenant_a")).resolves.toEqual([
-      expect.objectContaining({
-        app: "notion",
-        tokenId: connection.tokenId,
-        scopes: ["pages:write"],
-      }),
-    ]);
-    expect(JSON.stringify(await vault.list("tenant_a"))).not.toContain("secret-token");
-  });
-
-  it("requires explicit per-action consent before invoking a SaaS action", async () => {
-    const consent = new InMemorySaasConsentStore();
-    const vault = IntegrationVault.local({
-      consent,
-      providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["notion"] })],
-    });
-    await vault.connectToken({
-      tenantId: "tenant_a",
-      app: "notion",
-      accessToken: "secret-token",
-      scopes: ["pages:write"],
-    });
-
-    await expect(
-      vault.invoke({
-        tenantId: "tenant_a",
-        app: "notion",
-        action: "create_page",
-        args: { title: "Layer 1" },
-      }),
-    ).resolves.toMatchObject({
-      ok: false,
-      suggestion: expect.stringContaining("vault:connect"),
-    });
-
-    await consent.grant({
-      tenantId: "tenant_a",
-      app: "notion",
-      action: "create_page",
-      scopes: ["pages:write"],
-    });
-
-    await expect(
-      vault.invoke({
-        tenantId: "tenant_a",
-        app: "notion",
-        action: "create_page",
-        args: { title: "Layer 1" },
-      }),
-    ).resolves.toMatchObject({
-      ok: true,
-      provider: "local",
-      result: { app: "notion", action: "create_page", title: "Layer 1" },
-    });
-  });
-
-  it("caps provider doctor concurrency to avoid burst health checks", async () => {
-    let active = 0;
-    let maxActive = 0;
-    const providers = Array.from({ length: 12 }, (_, index): IntegrationProvider => {
-      const id = `provider_${index}`;
-      return {
-        id,
-        supports: () => true,
-        startOAuth: async (request) => ({
-          provider: id,
-          app: request.app,
-          url: `https://example.test/${id}`,
-          state: `state_${id}`,
-          scopes: request.scopes ?? [],
-        }),
-        invoke: async () => ({ provider: id }),
-        doctor: async () => {
-          active += 1;
-          maxActive = Math.max(maxActive, active);
-          await new Promise((resolve) => setTimeout(resolve, 0));
-          active -= 1;
-          return { ok: true, provider: id };
-        },
-      };
-    });
-
-    const vault = IntegrationVault.local({ providers });
-
-    await expect(vault.doctor()).resolves.toMatchObject({ ok: true });
-    expect(maxActive).toBeLessThanOrEqual(4);
-  });
-});

package/src/index.ts

@@ -1,413 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { CapabilityError } from "@nebutra/errors";
-import { type EncryptedSecret, LocalProvider, type VaultProvider } from "@nebutra/vault";
-import pLimit from "p-limit";
-
-export { CapabilityError } from "@nebutra/errors";
-
-export interface OAuthStartRequest {
-  readonly app: string;
-  readonly tenantId: string;
-  readonly scopes?: readonly string[];
-}
-
-export interface OAuthStartResult {
-  readonly provider: string;
-  readonly app: string;
-  readonly url: string;
-  readonly state: string;
-  readonly scopes: readonly string[];
-}
-
-export interface ConnectTokenRequest {
-  readonly tenantId: string;
-  readonly app: string;
-  readonly accessToken: string;
-  readonly scopes: readonly string[];
-  readonly provider?: string;
-}
-
-export interface InvokeRequest {
-  readonly tenantId: string;
-  readonly app: string;
-  readonly action: string;
-  readonly args: Record<string, unknown>;
-}
-
-export interface InvokeResult {
-  readonly ok: boolean;
-  readonly provider?: string;
-  readonly result?: unknown;
-  readonly suggestion?: string;
-  readonly error?: string;
-}
-
-export interface IntegrationConnection {
-  readonly id: string;
-  readonly tenantId: string;
-  readonly app: string;
-  readonly provider: string;
-  readonly tokenId: string;
-  readonly scopes: readonly string[];
-  readonly encrypted: EncryptedSecret;
-  readonly connectedAt: string;
-}
-
-export interface ListedConnection {
-  readonly id: string;
-  readonly app: string;
-  readonly provider: string;
-  readonly tokenId: string;
-  readonly scopes: readonly string[];
-  readonly connectedAt: string;
-}
-
-export interface IntegrationProvider {
-  readonly id: string;
-  supports(app: string): boolean;
-  startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;
-  invoke(request: InvokeRequest, token: string, scopes: readonly string[]): Promise<unknown>;
-  doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }>;
-}
-
-export interface SaasConsentGrant {
-  readonly tenantId: string;
-  readonly app: string;
-  readonly action: string;
-  readonly scopes: readonly string[];
-}
-
-export interface SaasConsentStore {
-  grant(grant: SaasConsentGrant): Promise<void>;
-  hasConsent(grant: SaasConsentGrant): Promise<boolean>;
-  list(tenantId?: string): Promise<SaasConsentGrant[]>;
-}
-
-export interface IntegrationVaultOptions {
-  readonly vault?: VaultProvider;
-  readonly providers?: readonly IntegrationProvider[];
-  readonly consent?: SaasConsentStore;
-}
-
-const PROVIDER_DOCTOR_CONCURRENCY = 4;
-
-function requireTenant(tenantId: string): void {
-  if (!tenantId.trim()) {
-    throw new CapabilityError("integration-vault", "Tenant context is required", {
-      suggestion:
-        "Pass tenantId from the Sailor tenant context before starting OAuth or invoking SaaS tools.",
-      statusCode: 400,
-    });
-  }
-}
-
-function consentKey(grant: Omit<SaasConsentGrant, "scopes">): string {
-  return [grant.tenantId, grant.app, grant.action].join(":");
-}
-
-export class InMemorySaasConsentStore implements SaasConsentStore {
-  readonly #grants = new Map<string, SaasConsentGrant>();
-
-  async grant(grant: SaasConsentGrant): Promise<void> {
-    this.#grants.set(consentKey(grant), { ...grant, scopes: [...grant.scopes] });
-  }
-
-  async hasConsent(grant: SaasConsentGrant): Promise<boolean> {
-    const existing = this.#grants.get(consentKey(grant));
-    if (!existing) return false;
-    const scopes = new Set(existing.scopes);
-    return grant.scopes.every((scope) => scopes.has(scope));
-  }
-
-  async list(tenantId?: string): Promise<SaasConsentGrant[]> {
-    return Array.from(this.#grants.values()).filter(
-      (grant) => tenantId === undefined || grant.tenantId === tenantId,
-    );
-  }
-}
-
-export class InMemoryIntegrationProvider implements IntegrationProvider {
-  readonly id: string;
-  readonly #apps: ReadonlySet<string>;
-
-  constructor(options: { id: string; apps: readonly string[] }) {
-    this.id = options.id;
-    this.#apps = new Set(options.apps);
-  }
-
-  supports(app: string): boolean {
-    return this.#apps.has(app) || this.#apps.has("*");
-  }
-
-  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {
-    return {
-      provider: this.id,
-      app: request.app,
-      url: `http://127.0.0.1:8787/oauth/${request.app}?tenant=${request.tenantId}`,
-      state: `state_${request.tenantId}_${request.app}`,
-      scopes: request.scopes ?? [],
-    };
-  }
-
-  async invoke(
-    request: InvokeRequest,
-    _token: string,
-    _scopes: readonly string[],
-  ): Promise<unknown> {
-    return { app: request.app, action: request.action, ...request.args };
-  }
-
-  async doctor(): Promise<{ ok: boolean; provider: string }> {
-    return { ok: true, provider: this.id };
-  }
-}
-
-export class HttpIntegrationProvider implements IntegrationProvider {
-  readonly id: string;
-  readonly #baseUrl: string;
-  readonly #apps: ReadonlySet<string>;
-  readonly #fetch: typeof fetch;
-
-  constructor(options: {
-    id: string;
-    baseUrl: string;
-    apps?: readonly string[];
-    fetch?: typeof fetch;
-  }) {
-    this.id = options.id;
-    this.#baseUrl = options.baseUrl.replace(/\/$/, "");
-    this.#apps = new Set(options.apps ?? ["*"]);
-    this.#fetch = options.fetch ?? fetch;
-  }
-
-  supports(app: string): boolean {
-    return this.#apps.has(app) || this.#apps.has("*");
-  }
-
-  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {
-    return {
-      provider: this.id,
-      app: request.app,
-      url: `${this.#baseUrl}/oauth/${request.app}/start?tenant=${encodeURIComponent(request.tenantId)}`,
-      state: `state_${request.tenantId}_${request.app}`,
-      scopes: request.scopes ?? [],
-    };
-  }
-
-  async invoke(request: InvokeRequest, token: string): Promise<unknown> {
-    const response = await this.#fetch(`${this.#baseUrl}/invoke`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/json",
-      },
-      body: JSON.stringify(request),
-    });
-    if (!response.ok) {
-      throw new CapabilityError(
-        "integration-vault",
-        `Provider ${this.id} returned ${response.status}`,
-        {
-          suggestion: "Run `pnpm vault:doctor` and refresh or reconnect this SaaS app.",
-          metadata: { provider: this.id, app: request.app, status: response.status },
-        },
-      );
-    }
-    return response.json();
-  }
-
-  async doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }> {
-    return {
-      ok: true,
-      provider: this.id,
-      suggestion:
-        "Network health is checked on invoke; configure provider API keys in the sidecar environment.",
-    };
-  }
-}
-
-class InMemoryConnectionStore {
-  readonly #connections = new Map<string, IntegrationConnection>();
-
-  upsert(connection: IntegrationConnection): IntegrationConnection {
-    this.#connections.set(`${connection.tenantId}:${connection.app}`, connection);
-    return connection;
-  }
-
-  get(tenantId: string, app: string): IntegrationConnection | undefined {
-    return this.#connections.get(`${tenantId}:${app}`);
-  }
-
-  list(tenantId: string): ListedConnection[] {
-    return Array.from(this.#connections.values())
-      .filter((connection) => connection.tenantId === tenantId)
-      .map((connection) => ({
-        id: connection.id,
-        app: connection.app,
-        provider: connection.provider,
-        tokenId: connection.tokenId,
-        scopes: connection.scopes,
-        connectedAt: connection.connectedAt,
-      }));
-  }
-}
-
-export class IntegrationVault {
-  readonly #vault: VaultProvider;
-  readonly #providers: IntegrationProvider[];
-  readonly #connections = new InMemoryConnectionStore();
-  readonly #consent: SaasConsentStore;
-
-  constructor(options: IntegrationVaultOptions) {
-    this.#vault =
-      options.vault ??
-      new LocalProvider({
-        provider: "local",
-        masterKey: process.env.VAULT_LOCAL_MASTER_KEY ?? "integration-vault-local-development-key",
-      });
-    this.#providers =
-      options.providers && options.providers.length > 0
-        ? [...options.providers]
-        : [new InMemoryIntegrationProvider({ id: "local", apps: ["*"] })];
-    this.#consent = options.consent ?? new InMemorySaasConsentStore();
-  }
-
-  static local(options: IntegrationVaultOptions = {}): IntegrationVault {
-    return new IntegrationVault(options);
-  }
-
-  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {
-    requireTenant(request.tenantId);
-    return this.#providerFor(request.app).startOAuth(request);
-  }
-
-  async connectToken(request: ConnectTokenRequest): Promise<ListedConnection> {
-    requireTenant(request.tenantId);
-    const provider = request.provider
-      ? this.#providers.find((candidate) => candidate.id === request.provider)
-      : this.#providerFor(request.app);
-    if (!provider) {
-      throw new CapabilityError("integration-vault", "Integration provider not found", {
-        suggestion: "Configure a provider adapter before connecting this app.",
-        metadata: { app: request.app, provider: request.provider },
-        statusCode: 404,
-      });
-    }
-    const tokenId = `tok_${randomUUID()}`;
-    const encrypted = await this.#vault.encrypt(request.accessToken, {
-      id: tokenId,
-      tenantId: request.tenantId,
-      metadata: { name: `${request.app}:access-token`, type: "oauth_token" },
-    });
-    const connection = this.#connections.upsert({
-      id: `conn_${randomUUID()}`,
-      tenantId: request.tenantId,
-      app: request.app,
-      provider: provider.id,
-      tokenId,
-      scopes: [...request.scopes],
-      encrypted,
-      connectedAt: new Date().toISOString(),
-    });
-    return this.#redact(connection);
-  }
-
-  async grantConsent(grant: SaasConsentGrant): Promise<void> {
-    requireTenant(grant.tenantId);
-    await this.#consent.grant(grant);
-  }
-
-  async invoke(request: InvokeRequest): Promise<InvokeResult> {
-    requireTenant(request.tenantId);
-    const connection = this.#connections.get(request.tenantId, request.app);
-    if (!connection) {
-      return {
-        ok: false,
-        error: "App is not connected",
-        suggestion: `Run \`pnpm vault:connect ${request.app}\` before invoking ${request.app}.${request.action}.`,
-      };
-    }
-    const hasConsent = await this.#consent.hasConsent({
-      tenantId: request.tenantId,
-      app: request.app,
-      action: request.action,
-      scopes: connection.scopes,
-    });
-    if (!hasConsent) {
-      return {
-        ok: false,
-        error: "SaaS action is not authorized",
-        suggestion: `Run \`pnpm vault:connect ${request.app}\` and grant ${request.app}.${request.action} for this tenant.`,
-      };
-    }
-    try {
-      const token = await this.#vault.decrypt(connection.encrypted, { tenantId: request.tenantId });
-      const provider = this.#providerById(connection.provider);
-      const result = await provider.invoke(request, token, connection.scopes);
-      return { ok: true, provider: provider.id, result };
-    } catch (error) {
-      return {
-        ok: false,
-        error: error instanceof Error ? error.message : String(error),
-        suggestion: "Refresh the connection or inspect provider health with `pnpm vault:doctor`.",
-      };
-    }
-  }
-
-  async list(tenantId: string): Promise<ListedConnection[]> {
-    requireTenant(tenantId);
-    return this.#connections.list(tenantId);
-  }
-
-  async doctor(): Promise<{
-    ok: boolean;
-    providers: Array<{ ok: boolean; provider: string; suggestion?: string }>;
-  }> {
-    const limit = pLimit(PROVIDER_DOCTOR_CONCURRENCY);
-    const providers = await Promise.all(
-      this.#providers.map((provider) => limit(() => provider.doctor())),
-    );
-    return { ok: providers.some((provider) => provider.ok), providers };
-  }
-
-  async close(): Promise<void> {
-    await this.#vault.close();
-  }
-
-  #providerFor(app: string): IntegrationProvider {
-    const provider = this.#providers.find((candidate) => candidate.supports(app));
-    if (!provider) {
-      throw new CapabilityError("integration-vault", "No provider supports this app", {
-        suggestion: "Configure a provider adapter or local connector for this SaaS app.",
-        metadata: { app },
-        statusCode: 404,
-      });
-    }
-    return provider;
-  }
-
-  #providerById(id: string): IntegrationProvider {
-    const provider = this.#providers.find((candidate) => candidate.id === id);
-    if (!provider) {
-      throw new CapabilityError("integration-vault", "Connection provider is unavailable", {
-        suggestion: "Reconnect this app or enable the provider adapter.",
-        metadata: { provider: id },
-        statusCode: 404,
-      });
-    }
-    return provider;
-  }
-
-  #redact(connection: IntegrationConnection): ListedConnection {
-    return {
-      id: connection.id,
-      app: connection.app,
-      provider: connection.provider,
-      tokenId: connection.tokenId,
-      scopes: connection.scopes,
-      connectedAt: connection.connectedAt,
-    };
-  }
-}
-
-export const vault = IntegrationVault.local();

package/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "extends": "../../../tsconfig.base.json",
-  "compilerOptions": {
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "target": "esnext",
-    "types": ["node"],
-    "incremental": false
-  },
-  "include": ["src", "examples"],
-  "exclude": ["node_modules", "dist"]
-}

package/tsup.config.ts

@@ -1,11 +0,0 @@
-import { defineConfig } from "tsup";
-
-export default defineConfig({
-  entry: ["src/index.ts", "src/cli.ts"],
-  format: ["esm"],
-  dts: true,
-  sourcemap: true,
-  clean: true,
-  target: "es2022",
-  external: ["@nebutra/errors", "@nebutra/vault"],
-});