refactor(protect): moving api and client into protect package