• pnpm-lock.yaml: Language not supported

apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx (1)

18-19: Centralize the public OAuth sentinel constant.

To avoid drift across routes/models, import the shared sentinel from stack-shared instead of redefining it locally.

♻️ Suggested change

-import { KnownError, KnownErrors } from "@stackframe/stack-shared";
+import { KnownError, KnownErrors } from "@stackframe/stack-shared";
+import { publicOAuthClientSecretSentinel } from "@stackframe/stack-shared/dist/utils/oauth";
@@
-const publicOAuthClientSecretSentinel = "__stack_public_client__";

apps/backend/src/oauth/model.tsx (1)

45-56: Reuse the shared public-client sentinel constant.

This avoids string duplication across OAuth flows and keeps the sentinel consistent everywhere.

♻️ Suggested change

-import { KnownErrors } from "@stackframe/stack-shared";
+import { KnownErrors } from "@stackframe/stack-shared";
+import { publicOAuthClientSecretSentinel } from "@stackframe/stack-shared/dist/utils/oauth";
@@
-    const publicOAuthClientSecretSentinel = "__stack_public_client__";

apps/backend/src/app/api/latest/auth/oauth/token/route.tsx (1)

30-30: Import the sentinel constant instead of redefining it.

The publicOAuthClientSecretSentinel is already defined in packages/stack-shared/src/utils/oauth.tsx. Importing it ensures consistency and avoids potential drift if the value changes.

♻️ Proposed fix

 import { getSoleTenancyFromProjectBranch } from "@/lib/tenancies";
 import { getProjectBranchFromClientId, oauthServer } from "@/oauth";
+import { publicOAuthClientSecretSentinel } from "@stackframe/stack-shared/dist/utils/oauth";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 ...
 async handler(req, fullReq) {
-    const publicOAuthClientSecretSentinel = "__stack_public_client__";
     const clientId = req.body.client_id;

apps/backend/src/app/api/latest/auth/oauth/authorize/[provider_id]/route.tsx (1)

17-17: Import the sentinel constant from shared utils.

Same as the token route - this constant is already defined in packages/stack-shared/src/utils/oauth.tsx. Import it for consistency.

♻️ Proposed fix

+import { publicOAuthClientSecretSentinel } from "@stackframe/stack-shared/dist/utils/oauth";
 ...
-const publicOAuthClientSecretSentinel = "__stack_public_client__";

apps/e2e/tests/backend/backend-helpers.ts (1)

1238-1246: Please justify the new any parameter (or tighten it).

Consider adding a short comment explaining why any is needed, or replace it with a concrete type/unknown.

📝 Minimal guideline-compliant tweak

-export async function updateProjectConfig(config: any) {
+export async function updateProjectConfig(
+  // Config shape varies per test; allow free-form overrides here.
+  config: any,
+) {

As per coding guidelines, Try to avoid the any type; whenever you need to use any, leave a comment explaining why you're using it.

sdks/implementations/swift/Sources/StackAuth/APIClient.swift (1)

314-323: Consider reusing getOAuthClientSecret() for consistency.

Line 318 duplicates the sentinel fallback logic that already exists in getOAuthClientSecret(). While functionally correct, reusing the helper would improve maintainability.

♻️ Suggested refactor

         if let publishableClientKey = publishableClientKey {
             request.setValue(publishableClientKey, forHTTPHeaderField: "x-stack-publishable-client-key")
         }
         
-        let oauthClientSecret = publishableClientKey ?? publishableClientKeyNotNecessarySentinel
+        let oauthClientSecret = getOAuthClientSecret()
         let body = [
             "grant_type=refresh_token",
             "refresh_token=\(formURLEncode(refreshToken))",
             "client_id=\(formURLEncode(projectId))",
             "client_secret=\(formURLEncode(oauthClientSecret))"
         ].joined(separator: "&")