The provider hop sent redirect_uri=${origin}/callback (= hanzo.id/callback),
which the shared Google/GitHub OAuth client does NOT accept — verified live the
Google client accepts ONLY https://iam.hanzo.ai/callback (every other URI →
redirect_uri_mismatch). It also used the invalid authorize endpoint
accounts.google.com/signin/oauth.
- social.ts: Google endpoint → https://accounts.google.com/o/oauth2/v2/auth
(canonical/stable); add callbackOrigin param to buildProviderAuthUrl/
startProviderLogin (defaults to origin — local/single-host unchanged).
- TenantConfig.oauthCallbackOrigin (catalog-driven; defaults to publicOrigin);
SocialButtons passes it so the hop returns to the provider's REGISTERED
/callback. iam.hanzo.ai serves the same @hanzo/id SPA: the headless Callback
completes the exchange and forwards to the originating app.
- tests: lock the registered-callback override + canonical Google endpoint.
bump id 0.1.1→0.1.22, id-auth/id-shared 0.1.0→0.1.1
Hanzo
debd1e71bb