fix: serialize registration timestamps and client URI correctly

[OskarEichler]

Fixes

Convert Android dynamic-registration epoch seconds to milliseconds before date formatting. Return the iOS registrationClientUri as its absolute URL string rather than an NSURL object that cannot cross the JSON bridge.

Breaking / observable changes

Android issued/expiry dates now represent the provider timestamp instead of dates near January 1970. The zero-expiry sentinel remains the epoch. Access-token expiry already uses milliseconds and is unchanged. Missing iOS registration URLs still produce an empty string.

Verification

Compiled actual Java factory checks cover issued-at, expiry, zero sentinel and unchanged token expiry. A Foundation harness executes the actual Objective-C formatter and verifies JSON serializability and missing-URL behavior; both defects reproduce on the baseline.

Each patch was applied independently to upstream commit 6f9090ce1b991c0acc2a6f5dc8bea838deaf4f7a and passed its targeted external actual-source diagnostics or standalone type/lockfile check. The combined fixes pass 75 focused diagnostics. These use synthetic values, controlled native/bridge doubles and disposable filesystem projects, not real credentials.

Combined branch checks:

• Existing Jest suite: 3 suites, 81 tests pass.
• Root lint, demo lint, targeted App.tsx lint, demo TypeScript and standalone public-type checks pass.
• Expo plugin TypeScript build passes. The optional lint:plugin command has a baseline tooling limitation: ESLint 6 does not find its TypeScript-only input.
• Android Debug demo build passes with RN 0.79.2.
• Unsigned iOS Simulator Debug demo build passes with RN 0.79.2.
• Android and iOS production Metro demo bundles pass.
• git diff --check passes.

No checked-in test/spec files were added, changed or disabled. The source changes are supported by external reproducible diagnostics because this audit's repository policy prohibits checked-in test edits. Live OAuth providers, physical-device/browser authentication and a full Expo native build were not exercised. React Doctor reports two warnings: the discovery response is explicitly guarded by response.ok === false, and the demo pending reset is inside finally; both paths are exercised by focused checks. No rules were suppressed.

Scope

• packages/react-native-app-auth/android/src/main/java/com/rnappauth/utils/RegistrationResponseFactory.java
• packages/react-native-app-auth/ios/RNAppAuth.m
• .changeset/appauth-registration-response.md

Unrelated audit fixes are submitted separately. The separate iOS process-global OIDURLSessionProvider request-isolation issue is not claimed fixed by these changes.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

🦋 Changeset detected

Latest commit: 259611f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
react-native-app-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR