@cortexkit/antigravity-auth-core 3.0.28 → 3.0.30

package/dist/common-auth-embedded/claustrum/hub.d.ts

@@ -107,11 +107,12 @@ export interface ClaustrumHubMemberOptions<_Q = QuotaObservation> {
     logger?: ClaustrumLogger;
 }
 /** What a lease may do with the shared custody. */
-export type ClaustrumLeasedCustody = Pick<ClaustrumScopedCustody, 'authorize' | 'reportFailure' | 'forget' | 'keptReceiptState'>;
+export type ClaustrumLeasedCustody = Pick<ClaustrumScopedCustody, 'authorize' | 'reportFailure' | 'reportUsage' | 'usageReportState' | 'forget' | 'keptReceiptState'>;
 /**
  * One acquisition of the hub's shared custody. `custody` throws `closed`
  * after `release()`, and once the connection it belongs to ended for any
- * reason, vault mode going off included. `release()` is idempotent.
+ * reason, vault mode going off included. Best-effort `reportUsage` instead
+ * ignores reports through an ended lease. `release()` is idempotent.
  */
 export interface CustodyLease {
     readonly custody: ClaustrumLeasedCustody;

package/dist/common-auth-embedded/claustrum/hub.js

@@ -523,6 +523,14 @@ export class ClaustrumDiscoveryHub {
                 check();
                 return custody.reportFailure(attempt, status, source);
             },
+            reportUsage: (input) => {
+                if (!state.released && !generation.ended)
+                    custody.reportUsage(input);
+            },
+            usageReportState: () => {
+                check();
+                return custody.usageReportState();
+            },
             forget: (credentialId) => {
                 check();
                 custody.forget(credentialId);

package/dist/common-auth-embedded/claustrum/index.d.ts

@@ -12,6 +12,7 @@ export { acquireInsulaQuotaSource, type InsulaQuotaContext, type InsulaQuotaLook
 export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, } from './interlock.js';
 export { drainVaultQuota } from './quota-writer.js';
 export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, type MutateVaultRosterOptions, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, type ReorderVaultRosterOptions, type ReorderVaultRosterResult, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, type VaultRosterSeed, vaultRosterSeed, vaultRoutingRows, } from './roster.js';
+export type { ClaustrumUsageReading, ClaustrumUsageReportState, } from './usage.js';
 export { type ChangeNotice, ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, type ScopedRosterWatchOptions, type ScopedWatchEnd, type ScopedWatchHandle, type ScopedWatchNoticeShape, type ScopedWatchSource, WATCH_RETRY_MS, type WatchMode, } from './watch.js';
 /** How long `connectClaustrumScopedClient` waits by default. */
 export declare const SCOPED_CONNECT_TIMEOUT_MS = 10000;

package/dist/common-auth-embedded/claustrum/roster.d.ts

@@ -48,6 +48,8 @@ export interface VaultRosterFile {
     complete: boolean;
     /** The unusable records of an incomplete reply: a safe id and a fixed reason. */
     rejected?: SkippedVaultRecord[];
+    /** Opaque limits data; roster-only writers preserve even newer schemas. */
+    limits?: unknown;
     rows: VaultRosterRow[];
     declined: DeclinedAccount[];
 }

package/dist/common-auth-embedded/claustrum/roster.js

@@ -209,6 +209,7 @@ export function projectVaultRoster(previous, inventory, options = {}) {
     return {
         version: 1,
         view: inventory.view,
+        ...(previous?.limits !== undefined && { limits: previous.limits }),
         complete,
         ...(!complete && {
             rejected: inventory.skipped.map((record) => ({
@@ -319,6 +320,7 @@ function decodeRoster(value) {
         // that was used whole, so it reads as complete.
         complete: value.complete !== false,
         ...(rejected && { rejected }),
+        ...(value.limits !== undefined && { limits: value.limits }),
         rows,
         declined,
     };

package/dist/common-auth-embedded/claustrum/usage.d.ts

@@ -0,0 +1,41 @@
+import type { ClaustrumLogger } from './errors.js';
+/** Reply quota metadata, never authorization headers or bearer material. */
+export interface ClaustrumUsageReading {
+    provider: string;
+    observedAtMs: number;
+    headers?: Record<string, string>;
+    frame?: unknown;
+    account?: string;
+}
+/** Structural to also typecheck with the claustrum-client 0.6.2 peer minimum. */
+export interface ScopedUsageSource {
+    reportUsageScoped?(input: {
+        credentialId: string;
+        reading: Record<string, unknown>;
+        enrollmentToken?: string;
+    }): Promise<void>;
+}
+export interface ClaustrumUsageReportState {
+    readonly pending: number;
+    readonly inFlight: boolean;
+    readonly dropped: number;
+}
+/** One queue per custody connection, shared by every hub member on it. */
+export declare class ScopedUsageReporter {
+    #private;
+    private readonly options;
+    constructor(options: {
+        client: ScopedUsageSource;
+        owns: (credentialId: string) => boolean;
+        token: () => Promise<string>;
+        logger: ClaustrumLogger;
+        setTimeout: typeof setTimeout;
+        clearTimeout: typeof clearTimeout;
+    });
+    state(): ClaustrumUsageReportState;
+    report(credentialId: string, reading: ClaustrumUsageReading): void;
+    forget(credentialId: string): void;
+    /** Start the final flush; the custody's existing shutdown drain bounds it. */
+    close(): Promise<void> | undefined;
+    drop(): void;
+}

package/dist/common-auth-embedded/claustrum/usage.js

@@ -0,0 +1,145 @@
+import { ClaustrumCredentialError } from '@cortexkit/claustrum-client';
+function plain(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        (Object.getPrototypeOf(value) === Object.prototype ||
+            Object.getPrototypeOf(value) === null));
+}
+/** One queue per custody connection, shared by every hub member on it. */
+export class ScopedUsageReporter {
+    options;
+    #queue = new Map();
+    #latest = new Map();
+    #errors = new Set();
+    #timer;
+    #running;
+    #closing = false;
+    #stopped = false;
+    #dropped = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    state() {
+        return {
+            pending: this.#queue.size,
+            inFlight: this.#running !== undefined,
+            dropped: this.#dropped,
+        };
+    }
+    report(credentialId, reading) {
+        if (this.#closing || !this.options.client.reportUsageScoped)
+            return;
+        try {
+            if (!this.options.owns(credentialId)) {
+                this.#dropped++;
+                return;
+            }
+            if (!plain(reading) || 'credentialId' in reading || 'vouched' in reading)
+                throw new Error('invalid reading');
+            const json = JSON.stringify(reading);
+            if (Buffer.byteLength(json, 'utf8') > 15_360)
+                throw new Error('oversized reading');
+            // Snapshot now: a caller mutating its reply metadata later cannot change
+            // an already validated queued reading, including its ordering timestamp.
+            const copy = JSON.parse(json);
+            if (!plain(copy) ||
+                'credentialId' in copy ||
+                'vouched' in copy ||
+                typeof copy.observedAtMs !== 'number' ||
+                !Number.isFinite(copy.observedAtMs))
+                throw new Error('invalid reading');
+            if (copy.observedAtMs <= (this.#latest.get(credentialId) ?? -Infinity)) {
+                this.#dropped++;
+                return;
+            }
+            if (this.#queue.has(credentialId))
+                this.#dropped++;
+            this.#latest.set(credentialId, copy.observedAtMs);
+            this.#queue.set(credentialId, copy);
+            if (!this.#timer && !this.#running) {
+                this.#timer = this.options.setTimeout(() => {
+                    this.#timer = undefined;
+                    this.#flush();
+                }, 1_000);
+                this.#timer.unref?.();
+            }
+        }
+        catch {
+            this.#dropped++;
+        }
+    }
+    forget(credentialId) {
+        if (this.#queue.delete(credentialId))
+            this.#dropped++;
+        this.#latest.delete(credentialId);
+    }
+    #flush() {
+        if (this.#running || !this.#queue.size || this.#stopped)
+            return this.#running;
+        // Start on a microtask even during close, so all failures stay off the
+        // provider request path and only one send can be in flight on this client.
+        const running = Promise.resolve().then(async () => {
+            while (!this.#stopped && this.#queue.size) {
+                const entry = this.#queue.entries().next().value;
+                if (!entry)
+                    break;
+                const [credentialId, reading] = entry;
+                this.#queue.delete(credentialId);
+                try {
+                    const enrollmentToken = await this.options.token();
+                    if (this.#stopped || !this.options.owns(credentialId)) {
+                        if (!this.#stopped)
+                            this.#dropped++;
+                        continue;
+                    }
+                    await this.options.client.reportUsageScoped?.({
+                        credentialId,
+                        reading,
+                        enrollmentToken,
+                    });
+                }
+                catch (error) {
+                    if (!this.#stopped)
+                        this.#dropped++;
+                    this.#log(error);
+                }
+            }
+        });
+        this.#running = running;
+        void running.finally(() => {
+            this.#running = undefined;
+        });
+        return running;
+    }
+    #log(error) {
+        // Only codes from credential refusals are exposed. Transport messages,
+        // arbitrary thrown objects and reply contents can contain secrets.
+        let code = 'transport_error';
+        try {
+            if (error instanceof ClaustrumCredentialError)
+                code = /^[a-z][a-z0-9_]{0,63}$/.test(error.code) ? error.code : code;
+            if (this.#errors.has(code))
+                return;
+            this.#errors.add(code);
+            this.options.logger.debug('claustrum usage report dropped', { code });
+        }
+        catch {
+            // A caller's logger must not turn best-effort reporting into a rejection.
+        }
+    }
+    /** Start the final flush; the custody's existing shutdown drain bounds it. */
+    close() {
+        this.#closing = true;
+        if (this.#timer)
+            this.options.clearTimeout(this.#timer);
+        this.#timer = undefined;
+        return this.#flush();
+    }
+    drop() {
+        this.#stopped = true;
+        this.#dropped += this.#queue.size + (this.#running ? 1 : 0);
+        this.#running = undefined;
+        this.#queue.clear();
+        this.#latest.clear();
+    }
+}

package/dist/common-auth-embedded/commands/builtins.d.ts

@@ -41,6 +41,11 @@ export interface QuotaSectionOptions {
     check?(ids: readonly string[], invocation: CommandInvocation): Promise<void>;
 }
 export interface RoutingSectionOptions {
+    /**
+     * Show how long the plugin may wait for the current account's limit to
+     * reset before switching. Opt in only when the plugin supports that policy.
+     */
+    sameAccountWait?: boolean;
     /**
      * Further `routing.mode` values the plugin routes as `ordered` with the
      * former main row moved (`main-first`, `fallback-first`), offered between

package/dist/common-auth-embedded/commands/builtins.js

@@ -468,6 +468,44 @@ function routingSection(options, snap) {
                     : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
+    if (options.routing?.sameAccountWait) {
+        const waitLabel = 'Longest wait on the same account';
+        const waitChoices = [
+            { value: '0', label: "Don't wait" },
+            { value: '15', label: '15 minutes' },
+            { value: 'max', label: 'Until the cache expires' },
+        ];
+        const rawWait = record(snap.settings.routing).maxSameAccountWait;
+        const wait = String(rawWait === 0 || rawWait === 'max' ? rawWait : 15);
+        const waitName = (value) => waitChoices.find((choice) => choice.value === value)?.label ?? value;
+        lines.push(`${waitLabel}: ${waitName(wait)}`);
+        actions.push({
+            id: 'maxSameAccountWait',
+            label: waitLabel,
+            group: ACTIONS_GROUP,
+            knobs: [
+                {
+                    kind: 'choice',
+                    id: 'maxSameAccountWait',
+                    label: waitLabel,
+                    choices: waitChoices,
+                    value: wait,
+                },
+            ],
+            run: async ({ values }) => {
+                const value = String(values.maxSameAccountWait);
+                const maxSameAccountWait = value === 'max' ? 'max' : Number(value);
+                await store.updateSettings((settings) => {
+                    settings.routing = {
+                        ...record(settings.routing),
+                        maxSameAccountWait,
+                    };
+                    return undefined;
+                }, locks);
+                return `${waitLabel} set to ${waitName(value)}.`;
+            },
+        });
+    }
     return {
         id: 'routing',
         slot: 'routing',

package/dist/common-auth-embedded/fs/private-files.d.ts

@@ -21,6 +21,11 @@ export declare class PrivateFileError extends Error {
     orphanPath?: string;
     constructor(path: string, stage: string, cause: unknown);
 }
+/** Native sharing and delete-pending errors reveal neither ownership nor expiry. */
+export declare function isWindowsSharingViolation(error: unknown): error is PrivateFileError & {
+    reason: 'io-error';
+    win32Code: 32 | 303;
+};
 export declare function privateOperation<T>(path: string, stage: string, operation: () => Promise<T>): Promise<T>;
 /** Tests only: policy options used by safe-parent checks that pass none. */
 export declare function setSafeParentOptionsForTest(options?: PosixOwnerOnlyPathAsyncOptions): void;

package/dist/common-auth-embedded/fs/private-files.js

@@ -93,6 +93,13 @@ export class PrivateFileError extends Error {
         this.reason = detail?.reason;
     }
 }
+/** Native sharing and delete-pending errors reveal neither ownership nor expiry. */
+export function isWindowsSharingViolation(error) {
+    return (windowsPrivateFiles &&
+        error instanceof PrivateFileError &&
+        error.reason === 'io-error' &&
+        (error.win32Code === 32 || error.win32Code === 303));
+}
 export async function privateOperation(path, stage, operation) {
     try {
         return await operation();

package/dist/common-auth-embedded/fs/refresh-file-lock.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { lstat, mkdir, open, readFile, rename, rm, stat, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
+import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, isWindowsSharingViolation, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
 /**
  * Create a new owner-only file and write `text` into it, failing with EEXIST if
@@ -367,54 +367,109 @@ export async function acquireRefreshFileLockWithClock(options) {
         else
             await rm(path, { recursive: true, force: true }).catch(() => { });
     }
-    async function releaseEvictionMarker() {
-        if (await ownsEvictionMarker()) {
-            await removeLeaseObject(evictPath);
+    function isRetryableRemoval(error, path) {
+        if (!windowsPrivateFiles ||
+            !(error instanceof PrivateFileError) ||
+            error.stage !== 'remove' ||
+            error.path !== path)
+            return false;
+        // Native sharing/delete-pending errors use isWindowsSharingViolation.
+        // node:fs rm supplies only errno: EBUSY/EPERM can also mean a sharing refusal.
+        return (isWindowsSharingViolation(error) ||
+            (error.win32Code === undefined &&
+                error.reason === undefined &&
+                (error.code === 'EBUSY' || error.code === 'EPERM')));
+    }
+    async function removeOwnedLeaseObject(path, stillOwned, deadline = performance.now() + EVICT_TTL + 1_000) {
+        let original;
+        let delayMs = 5;
+        while (await stillOwned()) {
+            try {
+                await removeLeaseObject(path);
+                return;
+            }
+            catch (error) {
+                if (!isRetryableRemoval(error, path))
+                    throw error;
+                original ??= error;
+            }
+            const remainingMs = deadline - performance.now();
+            if (remainingMs <= 0)
+                throw original;
+            await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+            if (performance.now() >= deadline)
+                throw original;
+            delayMs = Math.min(delayMs * 2, 50);
         }
     }
+    async function releaseEvictionMarker(deadline) {
+        let ownedDirectory;
+        await removeOwnedLeaseObject(evictPath, async () => {
+            if (!windowsPrivateFiles)
+                return ownsEvictionMarker();
+            const current = await lstat(evictPath).catch((error) => {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                return undefined;
+            });
+            if (!current ||
+                (ownedDirectory && !sameMarkerDirectory(ownedDirectory, current)))
+                return false;
+            if (await ownsEvictionMarker()) {
+                ownedDirectory = current;
+                return true;
+            }
+            if (!ownedDirectory)
+                return false;
+            // Recursive rm can delete owner.json before the directory delete fails.
+            // Only that same, now-ownerless directory is still ours to clean up.
+            try {
+                await stat(evictOwnerPath);
+                return false;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                return true;
+            }
+        }, deadline);
+    }
     // Returns whether the directory at the marker path was still the one this
     // process created when its owner write failed. Only then is the failure ours
     // to report: a gone or replaced directory is a lost race.
-    async function removeOwnMarkerAfterFailedOwnerWrite(created) {
+    async function removeOwnMarkerAfterFailedOwnerWrite(created, deadline) {
         // Best effort only: never throws, so the original owner-write error below
         // keeps explaining the failure. Removes the directory this process just
         // created when its owner write failed, and leaves a contender's
         // replacement alone when the identities differ.
         if (!created)
             return false;
-        let current;
-        try {
-            const st = await lstat(evictPath);
-            current = { dev: st.dev, ino: st.ino, birthtimeMs: st.birthtimeMs };
-        }
-        catch {
-            // Renamed away by a contender's steal: nothing of ours left to clean.
-            return false;
-        }
-        if (!sameMarkerDirectory(created, current))
-            return false;
-        // Remove only an ownerless directory. An owner file that appeared after
-        // our failed write belongs to someone: ours goes through
-        // releaseEvictionMarker in the caller, and a contender's must stay, since
-        // it may be holding the marker right now.
+        let stillOurs = false;
         try {
-            await stat(evictOwnerPath);
-            return true;
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                return true;
-        }
-        try {
-            await removeLeaseObject(evictPath);
+            await removeOwnedLeaseObject(evictPath, async () => {
+                stillOurs = false;
+                const st = await lstat(evictPath).catch(() => undefined);
+                if (!st || !sameMarkerDirectory(created, st))
+                    return false;
+                stillOurs = true;
+                // Recheck both identity and absence of an owner before every attempt;
+                // a contender's replacement or newly published owner must stay.
+                try {
+                    await stat(evictOwnerPath);
+                    return false;
+                }
+                catch (error) {
+                    return error.code === 'ENOENT';
+                }
+            }, deadline);
         }
         catch {
             // A removal failure keeps the stale marker recoverable later; it must
             // never mask the original owner-write error.
         }
-        return true;
+        return stillOurs;
     }
-    async function tryAcquireEvictionMarker() {
+    async function tryAcquireEvictionMarker(deadline) {
         if (windowsPrivateFiles)
             await createPrivateDirectoryExclusive(evictPath);
         else
@@ -455,11 +510,11 @@ export async function acquireRefreshFileLockWithClock(options) {
             // A race code while our own directory is still in place is not a lost
             // race but a write that fails here every time: report it, rather than
             // retrying the same failure until a deadline hides the cause.
-            const stillOurs = await removeOwnMarkerAfterFailedOwnerWrite(created);
+            const stillOurs = await removeOwnMarkerAfterFailedOwnerWrite(created, deadline);
             if (isLostMarkerRaceError(error) && !stillOurs)
                 return false;
             try {
-                await releaseEvictionMarker();
+                await releaseEvictionMarker(deadline);
             }
             catch {
                 // Removal must never mask the original owner-write error.
@@ -470,7 +525,7 @@ export async function acquireRefreshFileLockWithClock(options) {
             await options.onStep('eviction-marker-acquired');
         return true;
     }
-    async function recoverStaleEvictionMarker() {
+    async function recoverStaleEvictionMarker(deadline) {
         let evictStat;
         try {
             evictStat = await stat(evictPath);
@@ -529,12 +584,26 @@ export async function acquireRefreshFileLockWithClock(options) {
         }
         if (options.onStep)
             await options.onStep('stale-marker-claimed');
-        await removeLeaseObject(claimedPath);
+        const claimedIdentity = windowsPrivateFiles
+            ? await lstat(claimedPath)
+            : undefined;
+        // The unique renamed claim is ours, not the current marker path where a
+        // successor may already be working.
+        await removeOwnedLeaseObject(claimedPath, async () => {
+            if (!claimedIdentity)
+                return true;
+            const current = await lstat(claimedPath).catch((error) => {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                return undefined;
+            });
+            return !!current && sameMarkerDirectory(claimedIdentity, current);
+        }, deadline);
         return 'recovered';
     }
-    async function withEvictionMarker(action) {
+    async function withEvictionMarker(action, deadline) {
         try {
-            if (!(await tryAcquireEvictionMarker()))
+            if (!(await tryAcquireEvictionMarker(deadline)))
                 return false;
         }
         catch (error) {
@@ -555,12 +624,28 @@ export async function acquireRefreshFileLockWithClock(options) {
             }
             throw error;
         }
+        let actionFailed = false;
+        let actionError;
         try {
             await action();
         }
-        finally {
-            await releaseEvictionMarker();
+        catch (error) {
+            actionFailed = true;
+            actionError = error;
+        }
+        try {
+            await releaseEvictionMarker(deadline);
+        }
+        catch (error) {
+            // Cleanup sharing failures must not replace the lock's original
+            // sharing refusal when both removals exhaust the same deadline.
+            if (isRetryableRemoval(actionError, lockPath) &&
+                isRetryableRemoval(error, evictPath))
+                throw actionError;
+            throw error;
         }
+        if (actionFailed)
+            throw actionError;
         return true;
     }
     // Marker loss after a write may mean another contender has taken over.
@@ -847,6 +932,7 @@ export async function acquireRefreshFileLockWithClock(options) {
             // wall-clock adjustments cannot extend the retry deadline.
             const deadline = performance.now() + EVICT_TTL + 1_000;
             let delayMs = 5;
+            let removalError;
             for (;;) {
                 try {
                     let removalConfirmed = false;
@@ -873,7 +959,7 @@ export async function acquireRefreshFileLockWithClock(options) {
                             return;
                         await removeLeaseObject(lockPath);
                         removalConfirmed = true;
-                    });
+                    }, deadline);
                     if (markerAcquired) {
                         if (windowsPrivateFiles && !removalConfirmed)
                             throw new PrivateFileError(lockPath, 'release-not-confirmed', {
@@ -884,25 +970,34 @@ export async function acquireRefreshFileLockWithClock(options) {
                     }
                     if (signal?.aborted)
                         return;
-                    await recoverStaleEvictionMarker();
+                    await recoverStaleEvictionMarker(deadline);
                 }
                 catch (error) {
-                    if (windowsPrivateFiles)
-                        throw error;
-                    return;
+                    if (!isRetryableRemoval(error, lockPath)) {
+                        if (windowsPrivateFiles)
+                            throw error;
+                        return;
+                    }
+                    // Like rename, a fenced delete can be refused by a reader's Windows
+                    // handle without invalidating ownership. Drop the marker, back off,
+                    // and re-confirm the owner under a new marker before trying again.
+                    removalError ??= error;
                 }
                 const remainingMs = deadline - performance.now();
                 if (remainingMs <= 0)
                     break;
                 await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+                if (windowsPrivateFiles && performance.now() >= deadline)
+                    break;
                 delayMs = Math.min(delayMs * 2, 50);
             }
             // Do not delete by pathname without the marker: bounded retries leave the
             // lease to expire rather than risking removal of a successor's lock.
             if (windowsPrivateFiles)
-                throw new PrivateFileError(lockPath, 'release-not-confirmed', {
-                    code: 'ETIMEDOUT',
-                });
+                throw (removalError ??
+                    new PrivateFileError(lockPath, 'release-not-confirmed', {
+                        code: 'ETIMEDOUT',
+                    }));
         },
     };
 }

package/dist/common-auth-embedded/fs/with-lock.js

@@ -1,5 +1,5 @@
 import { join, resolve } from 'node:path';
-import { PrivateFileError, windowsPrivateFiles } from './private-files.js';
+import { isWindowsSharingViolation, } from './private-files.js';
 import { acquireRefreshFileLock } from './refresh-file-lock.js';
 export function lockPathFor(target, name) {
     return `${target}.${name}.lock`;
@@ -21,10 +21,7 @@ export class LockOwnershipError extends Error {
     }
 }
 function isChangingLockRead(error, target, name) {
-    if (!windowsPrivateFiles ||
-        !(error instanceof PrivateFileError) ||
-        error.reason !== 'io-error' ||
-        (error.win32Code !== 32 && error.win32Code !== 303) ||
+    if (!isWindowsSharingViolation(error) ||
         (error.stage !== 'read' && error.stage !== 'verify'))
         return false;
     const path = resolve(lockPathFor(target, name));