In `@apps/backend/src/lib/oauth.tsx`:
- Around line 128-171: The linkOAuthAccountToUser function creates a
projectUserOAuthAccount but omits setting allowSignIn and
allowConnectedAccounts; update the prisma.projectUserOAuthAccount.create call in
linkOAuthAccountToUser to include allowSignIn: true and allowConnectedAccounts:
true (matching how createOAuthUserAndAccount sets these flags) so the linked
OAuth account can be used for sign-in and connected account features.

In `@apps/dashboard/src/components/form-dialog.tsx`:
- Around line 90-100: The reset-on-open logic fails when props.open is undefined
because prevOpen only tracks props.open; update the effect to use the resolved
open state (const resolvedOpen = props.open ?? openState) and track that in
prevOpen instead of props.open so transitions from closed→open are detected;
when resolvedOpen becomes true and prevOpen.current was false call
form.reset(props.defaultValues), then set prevOpen.current = resolvedOpen;
update references to prevOpen, the effect dependency to include resolvedOpen (or
compute inside effect) and keep form.reset(props.defaultValues) as the reset
action.

In
`@sdks/implementations/swift/Examples/StackAuthiOS/StackAuthiOS/StackAuthiOSApp.swift`:
- Around line 991-1029: Replace printing full tokens/headers in getAccessToken,
getRefreshToken and getAuthHeaders with a redacted summary: log only safe
metadata (e.g., token length and JWT part count for access tokens, token length
for refresh, and for headers show header names and masked values or "<redacted>"
placeholders) instead of the full secrets returned from
clientApp.getAccessToken, clientApp.getRefreshToken and
clientApp.getAuthHeaders; implement masking logic in the methods that build the
result string before calling viewModel.logCall, and gate full-output behind a
DEBUG flag or similar if you want an opt-in verbose mode.

In
`@sdks/implementations/swift/Examples/StackAuthMacOS/StackAuthMacOS/StackAuthMacOSApp.swift`:
- Around line 954-991: Log redaction: in getAccessToken(), getRefreshToken(),
and getAuthHeaders() avoid printing full secrets—replace full JWT/refresh token
strings and sensitive header values (e.g., "Authorization") with a redacted form
(e.g., show only first/last N chars or a fixed "REDACTED" placeholder) before
calling viewModel.logCall; implement the redaction logic in a small helper (used
by these functions) and gate full-token output behind a DEBUG-only toggle if you
want an opt-in developer view.

In `@sdks/implementations/swift/Sources/StackAuth/APIClient.swift`:
- Around line 235-249: The 401 handling in sendWithRetry can cause an infinite
refresh loop because it retries with attempt: 0 after a refresh; modify
sendWithRetry to accept a didRefreshToken Bool (default false) and when you call
fetchNewAccessToken(tokenStore:) set didRefreshToken to true on the retry so you
never refresh twice for the same request; update the recursive calls inside
sendWithRetry (including the retry paths for rate limiting and network errors)
to propagate the didRefreshToken flag and ensure the invalid_access_token branch
only attempts fetchNewAccessToken when didRefreshToken == false, passing the
flag through to subsequent sendWithRetry invocations.

In `@sdks/implementations/swift/Sources/StackAuth/StackClientApp.swift`:
- Around line 196-234: Move the ASWebAuthenticationSession instance out of the
closure into a property (e.g., self.session) and assign it before calling
session.start(); update the completion handler to capture [weak self] to avoid
retaining self, and inside the handler use guard let self = self else {
continuation.resume(throwing: OAuthError(code: "oauth_error", message: "OAuth
flow aborted")); return } (or resume appropriately) before calling
self.callOAuthCallback; after finishing (success or any error) clear the stored
session (self.session = nil) so the session/presentationContextProvider
reference is released; ensure the presentationContextProvider assignment and the
Task that calls callOAuthCallback also use weak self or the guarded self to
avoid the retain cycle while still resuming the continuation with
StackAuthError/OAuthError as before.

In `@sdks/implementations/swift/Sources/StackAuth/TokenStore.swift`:
- Around line 280-288: ExplicitTokenStore.setTokens and NullTokenStore.setTokens
only update when non-nil, which is inconsistent with MemoryTokenStore and
KeychainTokenStore that unconditionally assign (including nil); update the
implementations of setTokens in ExplicitTokenStore and NullTokenStore to assign
self.accessToken = accessToken and self.refreshToken = refreshToken (i.e.,
always set, even if nil) so behavior matches
MemoryTokenStore/KeychainTokenStore, and update or remove the "Store refreshed
tokens..." comment if it no longer accurately describes the logic.

In `@sdks/spec/src/_utilities.spec.md`:
- Around line 13-15: Fix the markdown lint issues by converting the bare URL
example into an inline code span and normalizing list indentation: change the
example line containing https://api.stack-auth.com/api/v1/users/me to use
backticks (`https://api.stack-auth.com/api/v1/users/me`) and ensure the list
items "baseUrl defaults to \"https://api.stack-auth.com\"" and "Remove trailing
slash from final URL" (and the repeated block in the 24–31 region) use
consistent leading list markers and spacing (e.g., a single leading "- " for
each item) so the lists are not indented and the bare URL MD034 violation is
resolved.

In `@sdks/spec/src/apps/client-app.spec.md`:
- Line 16: The markdown contains bare URLs (e.g., the Default string
"https://api.stack-auth.com") which trigger MD034; update those occurrences by
wrapping the URL in code or link syntax (for example replace
"https://api.stack-auth.com" with a code span like `https://api.stack-auth.com`
or a markdown link) wherever it appears (notably the Default line and the other
occurrence around line 130) so the bare URL is no longer unformatted prose.

In `@apps/backend/src/lib/oauth.tsx`:
- Around line 89-97: The current TODO leaves an unhandled edge case when the
merge strategy is link_method and the incoming OAuth account has an unverified
email; update the logic in the oauth merge flow to either (A) implement the
intended behavior (e.g., send verification email and defer linking until
verified, or reject linking and instruct the user to verify via the OAuth
provider) or (B) make the failure explicit and documented by replacing the vague
StackAssertionError with a clear, actionable
KnownErrors.ContactChannelAlreadyUsedForAuthBySomeoneElse (or a new specific
KnownError) that includes the chosen resolution and guidance; ensure
captureError("oauth-link-method-email-not-verified", ...) records the chosen
resolution and relevant context (existingContactChannel, email, emailVerified),
and add/update tests for the branch in the function handling link_method so the
behavior is enforced.

In
`@sdks/implementations/swift/Examples/StackAuthMacOS/StackAuthMacOS/StackAuthMacOSApp.swift`:
- Around line 1357-1367: The getOAuthUrl() method logs sensitive PKCE and state
data — specifically result.state, result.codeVerifier, and potentially sensitive
query params embedded in result.url — so redact those values before calling
viewModel.logCall or viewModel.logInfo. Update the getOAuthUrl() flow to mask
result.state and result.codeVerifier (e.g., replace with "[REDACTED]") and
sanitize result.url by removing or masking query parameters like state and
code_verifier (or strip the entire query string) and then log the sanitized
strings; adjust references to getOAuthUrl(), viewModel.logCall(...),
viewModel.logInfo(...), result.url, result.state, and result.codeVerifier to use
the redacted/sanitized values.
- Around line 261-359: The SDKTestViewModel performs UI-state mutations (logs,
selectedSection, isLoading, clientApp/_clientApp/_serverApp, and the
logCall/clearLogs/trimLogs methods) from async Task contexts and must be
constrained to the main actor; annotate the SDKTestViewModel declaration with
`@MainActor` so all its property accesses and mutations run on the main thread and
avoid off-main updates after await points.

In `@sdks/implementations/swift/Sources/StackAuth/Errors.swift`:
- Around line 171-183: In StackAuthError.from, add a case for the
"INVALID_APPLE_CREDENTIALS" error code so it returns an
InvalidAppleCredentialsError() instead of falling through to the generic
StackAuthError; locate the switch on the code string inside the
StackAuthError.from method and add `case "INVALID_APPLE_CREDENTIALS": return
InvalidAppleCredentialsError()` alongside the other cases, keeping the existing
default fallback intact.

In `@sdks/implementations/swift/Sources/StackAuth/StackClientApp.swift`:
- Around line 607-619: The code path that returns handleNoUser(or: or) allows
handleNoUser to return nil when or == .throw, causing callers to get nil instead
of an actual thrown error; update the logic in the user-fetch block (the async
user retrieval and checks around await user.isAnonymous and await
user.isRestricted) so that when or == .throw you actually throw a descriptive
error rather than returning the result of handleNoUser, or change handleNoUser
to throw when passed .throw; specifically locate the user validation branch that
currently does "return handleNoUser(or: or)" after isAnonymous/isRestricted
checks and replace it with code that either calls a throwing variant or throws
an Authentication/Authorization error when or == .throw, otherwise continue
returning nil for non-throwing options.

In `@sdks/spec/src/apps/client-app.spec.md`:
- Around line 136-138: The doc mixes "canceled" and "cancelled"; standardize to
a single spelling (use "canceled" to match the ASAuthorizationError.canceled
symbol) by updating the StackAuthError example and any prose: change
StackAuthError(code: "oauth_cancelled") to StackAuthError(code:
"oauth_canceled") and ensure all occurrences in the section reference
ASAuthorizationError.canceled and "canceled" consistently.

In
`@sdks/implementations/swift/Examples/StackAuthMacOS/StackAuthMacOS/StackAuthMacOSApp.swift`:
- Around line 690-742: The signUp(), signIn(), and signInWrongPassword()
functions currently include plaintext passwords in the params string passed to
viewModel.logInfo and viewModel.logCall; update these functions to avoid logging
raw passwords by constructing a safe params string that masks or replaces the
password value (e.g., "password: \"[REDACTED]\"" or a masked version) before any
call to viewModel.logInfo or viewModel.logCall; ensure the same redaction
approach is applied to the analogous password-update functions referenced (lines
~908-951) so no plaintext password is ever included in logged params or details.

In
`@apps/dashboard/src/app/`(main)/(protected)/projects/[projectId]/auth-methods/providers.tsx:
- Around line 71-82: In ProviderSettingDialog, remove the unnecessary cast on
props.id and instead use props.id directly, and for the remaining casts on
props.provider (used for clientId, clientSecret, facebookConfigId,
microsoftTenantId, appleBundleIds / bundleIdsArray) add a short explanatory
comment that these properties only exist on the 'standard' variant of the
AdminOAuthProviderConfig discriminated union so TypeScript cannot prove their
existence without runtime narrowing, and that the temporary (props.provider as
any) workaround is intentional until proper runtime narrowing is implemented;
reference the bundleIdsArray and defaultValues initializations and ensure the
comment sits immediately above the casts.

In `@sdks/implementations/swift/Sources/StackAuth/StackClientApp.swift`:
- Around line 287-296: The code in StackClientApp.swift constructs the error
message from json["error"] which discards the server's standardized "message"
field; update the error handling in the response parsing (the block that checks
httpResponse.statusCode != 200, where OAuthError is thrown and
INVALID_APPLE_CREDENTIALS is handled) to read the server's "message" field
(e.g., let message = json["message"] as? String ?? "Apple Sign In failed") so
the thrown OAuthError and logs include the server-provided message while keeping
the existing fallback and the special-case fatalError for
"INVALID_APPLE_CREDENTIALS".