Deferred from the quality-audit fix pass (#6). Two polish items in the vendored packages/oauth scaffold.
Location: packages/oauth/src/oauth/providers/registry.ts, packages/oauth/tsconfig.json (+ eslint)
Problem 1 — partially-dead registry: the package ships a full provider registry (registerProvider/getProvider/listProviders + self-registration side-effects per provider module), but createOAuthRouter resolves providers from config.providers, so the registration side-effects are effectively dead code.
Problem 2 — toolchain drift: the package's tsconfig/eslint diverge from the root config rather than extending a shared base (root targets ES2022/NodeNext with different lib/strictness settings).
Proposed fix: either route provider resolution through getProvider(name) (making registration the real injection seam) or drop the unused registry; and extract a shared base tsconfig/eslint at the repo root that both packages extends.
Why deferred: packages/oauth is intentionally a self-contained vendored scaffold (its own package.json/tsconfig/vitest, regenerated from the nanohype module-oauth-delegation template per CLAUDE.md), so "share the root config" is a judgment call that partly fights that design — worth a deliberate decision, not an incidental change.
Deferred from the quality-audit fix pass (#6). Two polish items in the vendored
packages/oauthscaffold.Location:
packages/oauth/src/oauth/providers/registry.ts,packages/oauth/tsconfig.json(+ eslint)Problem 1 — partially-dead registry: the package ships a full provider registry (
registerProvider/getProvider/listProviders+ self-registration side-effects per provider module), butcreateOAuthRouterresolves providers fromconfig.providers, so the registration side-effects are effectively dead code.Problem 2 — toolchain drift: the package's
tsconfig/eslint diverge from the root config rather than extending a shared base (root targets ES2022/NodeNext with different lib/strictness settings).Proposed fix: either route provider resolution through
getProvider(name)(making registration the real injection seam) or drop the unused registry; and extract a shared base tsconfig/eslint at the repo root that both packagesextends.Why deferred:
packages/oauthis intentionally a self-contained vendored scaffold (its own package.json/tsconfig/vitest, regenerated from the nanohype module-oauth-delegation template per CLAUDE.md), so "share the root config" is a judgment call that partly fights that design — worth a deliberate decision, not an incidental change.