Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@registry/crates/pnpm-registry/src/auth.rs`:
- Around line 339-355: The revoke_by_key implementation removes the token from
inner.tokens before doing the blocking SQLite delete, causing a divergence if
Connection::open() or delete_token() fails; change the flow to keep memory and
DB in sync by either (A) performing the persistent delete first inside the
tokio::task::spawn_blocking block (using self.persist.clone() and the key) and
only removing from inner.tokens after that succeeds, or (B) if you prefer
minimal change, keep the current removal but on any error from the
spawn_blocking call reacquire the TokenStore mutex and re-insert the removed
TokenRecord back into inner.tokens (use the previously captured record variable)
so the in-memory map is restored; reference revoke_by_key, inner.tokens,
persist, Connection::open, and delete_token when making the change.

In `@registry/crates/pnpm-registry/src/server.rs`:
- Around line 553-695: All responses from the auth endpoint group (serve_whoami,
serve_profile, list_tokens, revoke_token_by_key, logout and any branch-returning
helpers they call) must be marked non-cacheable and Vary by Authorization; add
Cache-Control: private, no-store and Vary: Authorization to every Response these
handlers emit, including 401/403/404/error branches. Implement this by adding a
small helper (e.g. add_no_cache_headers(resp: Response) -> Response) that
inserts header::CACHE_CONTROL = "private, no-store" and header::VARY =
"Authorization" and use it to wrap the Response returned from json_response(),
error_response() usages, not_found() branches and the success responses in
serve_whoami, serve_profile, list_tokens, revoke_token_by_key, and logout (or
alternatively change json_response to always set these headers for the auth
endpoints), ensuring no code path in those functions returns a Response without
those headers.

---

Outside diff comments:
In `@registry/crates/pnpm-registry/src/publish.rs`:
- Around line 184-188: The calculation in iso_from_unix_millis uses normal
division for the day count which truncates toward zero for negative millis and
yields wrong dates before epoch; replace the expression computing days
(currently using millis / 86_400_000) with millis.div_euclid(86_400_000) so the
day component uses Euclidean division while keeping ms_in_day =
millis.rem_euclid(86_400_000) as-is; update the tuple binding (days, ms_in_day)
accordingly in the iso_from_unix_millis function.

---

Nitpick comments:
In `@registry/crates/pnpm-registry/src/server.rs`:
- Around line 645-663: The logout handler leaks the raw bearer token in the URL
(raw_token) which can end up in request/access logs; update the request logging
middleware or this handler so that any log entry for the logout route records
the matched route or a redacted path instead of the full request URI.
Specifically, detect requests handled by the logout function (or requests
containing the raw_token) and replace the path with a constant like
"/-/logout/{redacted}" (or set a sanitized route attribute on the
request/context that your logger reads) before any access logging occurs,
ensuring state.inner.auth.tokens.lookup(raw_token) and revoke_by_raw(raw_token)
still receive the original raw_token while logs only contain the redacted path.

In `@registry/crates/pnpm-registry/tests/auth_user_endpoints.rs`:
- Around line 227-238: Remove the unused app parameter from the uses_token
function signature and its helper implementation (function uses_token), make it
take (raw_token: &str, candidate_key: &str) only, and update all call sites that
pass an app (e.g., the call near line ~203 referenced in the comment) to call
the new two-argument signature; keep the SHA256 hashing and comparison logic
unchanged.