Replace local OAuth with the shared oauth-core package

xAI login and refresh go through @corbits/xai-provider. Callback
copy is injected from branding so auth does not import it.

Author: TheGreatAxios

bun.lock

@@ -81,6 +81,7 @@
   },
   "dependencies": {
     "@corbits/codex-provider": "github:corbitsdev/corbits-codex-provider",
+    "@corbits/oauth-core": "github:corbitsdev/corbits-oauth-core",
     "@corbits/openai-responses": "github:corbitsdev/corbits-openai-responses",
     "@corbits/xai-provider": "github:corbitsdev/corbits-xai-provider",
     "@intx/agent": "workspace:*",

package.json

@@ -1,13 +1,19 @@
 import { describe, expect, test } from "bun:test";
 
 import {
-  PRODUCT_GITHUB_LABEL,
-  PRODUCT_GITHUB_URL,
-  PRODUCT_SITE_LABEL,
-  PRODUCT_SITE_URL,
-} from "../branding.js";
-import { callbackPageHtml, humanizeIdentifier } from "./callback-page.js";
-import { authorizationDoneHtml } from "./oauth/callback-server.js";
+  authorizationDoneHtml,
+  callbackPageHtml,
+  humanizeIdentifier,
+  type CallbackPageCopy,
+} from "./callback-page.js";
+
+const copy: CallbackPageCopy = {
+  productName: "Fixture Product",
+  siteUrl: "https://fixture.example",
+  siteLabel: "fixture.example",
+  githubUrl: "https://github.com/fixture",
+  githubLabel: "github.com/fixture",
+};
 
 describe("humanizeIdentifier", () => {
   test("machine identifiers lose their separators and lead with a capital", () => {
@@ -24,59 +30,57 @@ describe("humanizeIdentifier", () => {
 
 describe("callbackPageHtml", () => {
   test("success names the server that connected", () => {
-    const html = callbackPageHtml({ subject: "linear" });
+    const html = callbackPageHtml({ subject: "linear" }, copy);
     expect(html).toContain("Linear connected successfully");
     expect(html).not.toContain("access_denied");
   });
 
   test("provider authorization waits for native setup before claiming connection", () => {
-    const html = authorizationDoneHtml("Codex");
+    const html = authorizationDoneHtml("Codex", copy);
     expect(html).toContain("Codex authorization received");
     expect(html).toContain("finish setup");
     expect(html).not.toContain("connected successfully");
   });
 
   test("failure names the server and the humanized reason", () => {
-    const html = callbackPageHtml({
-      subject: "granola",
-      error: "access_denied",
-    });
+    const html = callbackPageHtml(
+      {
+        subject: "granola",
+        error: "access_denied",
+      },
+      copy,
+    );
     expect(html).toContain("Granola failed to connect");
     expect(html).toContain("Access denied.");
     expect(html).not.toContain("access_denied");
   });
 
   test("an unnamed authorization still renders both outcomes", () => {
-    expect(callbackPageHtml()).toContain("Authorization complete");
-    expect(callbackPageHtml({ error: "server_error" })).toContain(
+    expect(callbackPageHtml({}, copy)).toContain("Authorization complete");
+    expect(callbackPageHtml({ error: "server_error" }, copy)).toContain(
       "Authorization did not complete",
     );
   });
 
   test("the subject is escaped rather than pasted into markup", () => {
-    expect(callbackPageHtml({ subject: "<script>x</script>" })).not.toContain(
-      "<script>x",
-    );
+    expect(
+      callbackPageHtml({ subject: "<script>x</script>" }, copy),
+    ).not.toContain("<script>x");
   });
 
-  test("the footer links to the product site and the GitHub org", () => {
-    const html = callbackPageHtml({ subject: "linear" });
+  test("the footer links to the injected site and GitHub copy", () => {
+    const html = callbackPageHtml({ subject: "linear" }, copy);
     const link = (url: string, label: string) =>
       `<a href="${url}" target="_blank" rel="noopener noreferrer">${label}</a>`;
-    expect(html).toContain(link(PRODUCT_SITE_URL, PRODUCT_SITE_LABEL));
-    expect(html).toContain(link(PRODUCT_GITHUB_URL, PRODUCT_GITHUB_LABEL));
-  });
-
-  test("each footer label names the destination its URL actually points at", () => {
-    expect(PRODUCT_SITE_URL).toContain(PRODUCT_SITE_LABEL);
-    expect(PRODUCT_GITHUB_URL).toContain(PRODUCT_GITHUB_LABEL);
+    expect(html).toContain(link(copy.siteUrl, copy.siteLabel));
+    expect(html).toContain(link(copy.githubUrl, copy.githubLabel));
   });
 
   // An allowlist rather than a shape match: an unexpected origin fails loudly
   // instead of passing because it happened to be wrapped in an anchor tag.
   const allowedOrigins = new Set([
-    PRODUCT_SITE_URL,
-    PRODUCT_GITHUB_URL,
+    copy.siteUrl,
+    copy.githubUrl,
     // The SVG namespace the wordmark declares; a URI, never fetched.
     "http://www.w3.org/2000/svg",
   ]);
@@ -97,7 +101,7 @@ describe("callbackPageHtml", () => {
     ["failure", { subject: "linear", error: "access_denied" }],
   ] as const) {
     test(`the ${outcome} page names no off-machine origin beyond the footer links`, () => {
-      const html = callbackPageHtml(page);
+      const html = callbackPageHtml(page, copy);
       expect(offMachineOrigins(html)).toEqual([]);
       expect(html).not.toMatch(
         /\b(?:fetch|XMLHttpRequest|WebSocket|EventSource|sendBeacon|importScripts)\s*\(/,