Add support for `npm unpublish`

[KN4CK3R]

trafficstars

related to #20670

This PR adds support for npm unpublish to delete a package.

There is a problem with the current npm cli not working with private registries which prevents testing (for me). Maybe someone with more npm knowledge can help.

[silverwind]

Maybe test with last known working cli, e.g. npm i -g [email protected] to downgrade global npm on your machine. Aftwards you can revert to latest via npm i -g npm@latest.

[KN4CK3R]

I did but that version fails to resolve the delete url, so that may be fixed in the new version. 🤷‍♂️

[silverwind]

Odd, maybe try with yarn or pnpm, just to confirm it's working :D

[KN4CK3R]

Both do not support unpublish...

[silverwind]

Hmm okay. I gues we'll see how it goes.

Generally I think unpublish should probably be able to be disabled via config, it's considered bad practice as it breaks dependants. Public npm restricts unpublish to the first 72h after creation or for unpopular packages. Not a blocker here.

[lunny]

A configuration to disable it is better.

[silverwind]

Still think one global package deletion policy would make sense, not only for npm but other package types as well. Configuring it per-package will become cumbersome fast.

[KN4CK3R]

I will add this to the package todo list.