OAuth 客户端: 授权 URL 以第二个 `?' 构建, 而广告的` 授权- endpoint' 已经包含一个查询( RFC 6749 §3.1)

The authorization server then receives `tenant = "acme?response_type=code"` and no `response_type` at all — a hard failure at the consent page, on every authorization, for every server whose endpoint carries a query. Servers do advertise such endpoints: a tenant/policy selector (Azure AD B2C's `?p=<policy>` is the well-known one), or — how we hit it — an environment/tier tag on a multi-tenant consent app (Nevermined advertises `https://nevermined.app/oauth/authorize?network=sandbox|live` because one consent app fronts two authorization servers). The TypeScript SDK is unaffected: `client/auth.js` builds the URL with `new URL(endpoint)` + `searchParams.set(...)`, which retains the existing query.