fix(android): preserve structured additional response parameters

[OskarEichler]

Fixes

Decode JSON objects and arrays once, preserve nested null values, accept null native values without a crash, and retain scalar/malformed strings. Iterate map entries directly and share the base authorization response serializer when adding a PKCE verifier.

Breaking / observable changes

Observable response correction: JSON-array additional parameters become arrays, and nested JSON null stays null instead of the string "null". Scalar strings (including "null", numbers and booleans), permissive legacy objects, field names and PKCE response shapes are preserved. Consumers that relied on the old array/string or null/string mismatch should adapt.

Verification

Compiled actual Java serializers pass structured array/object/null, malformed/scalar string, permissive parser and PKCE field-equivalence checks. No claimed timing benchmark; the implementation avoids the prior repeated lookup and exception-on-ordinary-scalar parsing path.

Each patch was applied independently to upstream commit 6f9090ce1b991c0acc2a6f5dc8bea838deaf4f7a and passed its targeted external actual-source diagnostics or standalone type/lockfile check. The combined fixes pass 75 focused diagnostics. These use synthetic values, controlled native/bridge doubles and disposable filesystem projects, not real credentials.

Combined branch checks:

• Existing Jest suite: 3 suites, 81 tests pass.
• Root lint, demo lint, targeted App.tsx lint, demo TypeScript and standalone public-type checks pass.
• Expo plugin TypeScript build passes. The optional lint:plugin command has a baseline tooling limitation: ESLint 6 does not find its TypeScript-only input.
• Android Debug demo build passes with RN 0.79.2.
• Unsigned iOS Simulator Debug demo build passes with RN 0.79.2.
• Android and iOS production Metro demo bundles pass.
• git diff --check passes.

No checked-in test/spec files were added, changed or disabled. The source changes are supported by external reproducible diagnostics because this audit's repository policy prohibits checked-in test edits. Live OAuth providers, physical-device/browser authentication and a full Expo native build were not exercised. React Doctor reports two warnings: the discovery response is explicitly guarded by response.ok === false, and the demo pending reset is inside finally; both paths are exercised by focused checks. No rules were suppressed.

Scope

• packages/react-native-app-auth/android/src/main/java/com/rnappauth/utils/MapUtil.java
• packages/react-native-app-auth/android/src/main/java/com/rnappauth/utils/TokenResponseFactory.java
• .changeset/appauth-android-response-values.md

Unrelated audit fixes are submitted separately. The separate iOS process-global OIDURLSessionProvider request-isolation issue is not claimed fixed by these changes.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.