@verdaccio/e2e-ui 2.1.1 → 2.2.0

package/README.md

@@ -0,0 +1,134 @@
+# @verdaccio/e2e-ui
+
+Reusable Cypress test suites for the Verdaccio web UI. Targets Verdaccio.
+
+## Install
+
+```bash
+pnpm add -D @verdaccio/e2e-ui cypress
+```
+
+## Wire up
+
+`cypress.config.ts`:
+
+```ts
+import { defineConfig } from 'cypress';
+import { setupVerdaccioTasks } from '@verdaccio/e2e-ui';
+
+const registryUrl = process.env.VERDACCIO_URL || 'http://localhost:4873';
+
+export default defineConfig({
+  e2e: {
+    baseUrl: registryUrl,
+    supportFile: 'cypress/support/e2e.ts',
+    specPattern: 'cypress/e2e/**/*.cy.ts',
+    setupNodeEvents(on) {
+      setupVerdaccioTasks(on, { registryUrl });
+    },
+  },
+  env: { VERDACCIO_URL: registryUrl },
+});
+```
+
+`cypress/support/e2e.ts`:
+
+```ts
+import '@verdaccio/e2e-ui/commands';
+```
+
+Spec file (one per suite, or use `registerAllTests`):
+
+```ts
+import { createRegistryConfig, homeTests } from '@verdaccio/e2e-ui';
+
+const config = createRegistryConfig({
+  registryUrl: Cypress.env('VERDACCIO_URL'),
+});
+
+homeTests(config);
+```
+
+## Available suites
+
+| Export | Covers |
+|---|---|
+| `homeTests` | Empty-registry landing page, help card, 404 |
+| `signinTests` | Login dialog, greeting, logout |
+| `layoutTests` | `/-/static/ui-options.js` health, header chrome, footer |
+| `searchTests` | Search input, query fires, empty state, clear |
+| `settingsTests` | Settings dialog, language picker, language switch |
+| `publishTests` | Publishes via `cy.task`, asserts readme / sidebar / tabs |
+
+## Configuration
+
+```ts
+createRegistryConfig({
+  registryUrl: 'http://localhost:4873',
+  credentials: { user: 'test', password: 'test' },    // optional
+  testIds: { header: { settingsTooltip: 'my-btn' } }, // optional per-field override
+  selectors: { loginDialog: { submitButton: '#go' } },// optional per-field override
+});
+```
+
+Every data-testid referenced by the suites is configurable. See
+[`src/testIds.ts`](./src/testIds.ts) for the full `TestIds` + `Selectors`
+shapes and defaults. Overrides are merged per section — unspecified fields
+inherit from `DEFAULT_TEST_IDS` / `DEFAULT_SELECTORS`.
+
+## `publishPackage` task
+
+Publishes a throwaway package so downstream specs have something to assert on.
+
+```ts
+cy.task('publishPackage', {
+  pkgName: '@verdaccio/pkg-scoped',
+  version: '1.0.0',
+  dependencies: { debug: '4.0.0' },
+  unique: true, // appends -t<timestamp> so reruns don't collide on 403
+}).then((result) => {
+  // result: { pkgName, version, tempFolder, stdout, stderr, exitCode }
+});
+
+// in after():
+cy.task('cleanupPublished', tempFolder);
+```
+
+Under the hood: creates a throwaway user via `PUT /-/user/...`, scaffolds a
+temp project with an `.npmrc` carrying the legacy auth token, spawns
+`npm publish --tag latest`.
+
+## Verdaccio config requirements
+
+```yaml
+web:
+  enable: true
+  login: true
+  showSettings: true  # required by settingsTests
+
+userRateLimit:
+  windowMs: 1000
+  max: 10000          # default (1000 / 15min) is too tight for a full suite run
+
+packages:
+  '**':
+    access: $all
+    publish: $anonymous $authenticated
+    unpublish: $anonymous $authenticated
+    proxy: npmjs
+```
+
+Restart Verdaccio after changing these — it reads them at startup.
+
+## Custom commands
+
+- `cy.getByTestId(selector)` — shortcut for `cy.get('[data-testid=<selector>]')`
+- `cy.login(user, password, selectors?)` — fills + submits the login dialog;
+  pass `selectors` to override form field IDs for non-default builds
+
+Task calls are strongly typed — `cy.task('publishPackage', …)` returns
+`Chainable<PublishPackageResult>`, unknown task names fail at compile time.
+
+## License
+
+MIT

package/build/cjs/commands/index.cjs

@@ -1,15 +1,31 @@
 //#region src/commands/index.ts
+/**
+* Default login form selectors. Kept in sync with `DEFAULT_SELECTORS`
+* in ../testIds.ts — duplicating them here (as plain constants) lets
+* `cy.login` call sites that don't pass an explicit selectors object
+* still work without importing anything.
+*/
+var DEFAULT_LOGIN_SELECTORS = {
+	loginButton: "header--button-login",
+	usernameInput: "#login--dialog-username",
+	passwordInput: "#login--dialog-password",
+	submitButton: "#login--dialog-button-submit"
+};
 Cypress.Commands.add("getByTestId", (selector, ...args) => {
 	return cy.get(`[data-testid=${selector}]`, ...args);
 });
-Cypress.Commands.add("login", (user, password) => {
-	cy.getByTestId("header--button-login").click();
+Cypress.Commands.add("login", (user, password, selectors = {}) => {
+	const loginButton = selectors.loginButton ?? DEFAULT_LOGIN_SELECTORS.loginButton;
+	const usernameInput = selectors.usernameInput ?? DEFAULT_LOGIN_SELECTORS.usernameInput;
+	const passwordInput = selectors.passwordInput ?? DEFAULT_LOGIN_SELECTORS.passwordInput;
+	const submitButton = selectors.submitButton ?? DEFAULT_LOGIN_SELECTORS.submitButton;
+	cy.getByTestId(loginButton).click();
 	cy.wait(300);
-	cy.get("#login--dialog-username").type(user);
+	cy.get(usernameInput).type(user);
 	cy.wait(200);
-	cy.get("#login--dialog-password").type(password);
+	cy.get(passwordInput).type(password);
 	cy.wait(500);
-	cy.get("#login--dialog-button-submit").click();
+	cy.get(submitButton).click();
 });
 //#endregion
 

package/build/cjs/commands/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../../src/commands/index.ts"],"sourcesContent":["/// <reference types=\"cypress\" />\n\ndeclare global {\n  namespace Cypress {\n    interface Chainable {\n      /**\n       * Find element by data-testid attribute\n       */\n      getByTestId(selector: string, ...args: any[]): Chainable<JQuery<HTMLElement>>;\n      /**\n       * Login to Verdaccio UI\n       */\n      login(user: string, password: string): Chainable<void>;\n    }\n  }\n}\n\nCypress.Commands.add('getByTestId', (selector: string, ...args: any[]) => {\n  return cy.get(`[data-testid=${selector}]`, ...args);\n});\n\nCypress.Commands.add('login', (user: string, password: string) => {\n  cy.getByTestId('header--button-login').click();\n  cy.wait(300);\n  cy.get('#login--dialog-username').type(user);\n  cy.wait(200);\n  cy.get('#login--dialog-password').type(password);\n  cy.wait(500);\n  cy.get('#login--dialog-button-submit').click();\n});\n\nexport {};\n"],"mappings":";AAiBA,QAAQ,SAAS,IAAI,gBAAgB,UAAkB,GAAG,SAAgB;AACxE,QAAO,GAAG,IAAI,gBAAgB,SAAS,IAAI,GAAG,KAAK;EACnD;AAEF,QAAQ,SAAS,IAAI,UAAU,MAAc,aAAqB;AAChE,IAAG,YAAY,uBAAuB,CAAC,OAAO;AAC9C,IAAG,KAAK,IAAI;AACZ,IAAG,IAAI,0BAA0B,CAAC,KAAK,KAAK;AAC5C,IAAG,KAAK,IAAI;AACZ,IAAG,IAAI,0BAA0B,CAAC,KAAK,SAAS;AAChD,IAAG,KAAK,IAAI;AACZ,IAAG,IAAI,+BAA+B,CAAC,OAAO;EAC9C"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../src/commands/index.ts"],"sourcesContent":["/// <reference types=\"cypress\" />\n\n/**\n * Default login form selectors. Kept in sync with `DEFAULT_SELECTORS`\n * in ../testIds.ts — duplicating them here (as plain constants) lets\n * `cy.login` call sites that don't pass an explicit selectors object\n * still work without importing anything.\n */\nconst DEFAULT_LOGIN_SELECTORS = {\n  loginButton: 'header--button-login',\n  usernameInput: '#login--dialog-username',\n  passwordInput: '#login--dialog-password',\n  submitButton: '#login--dialog-button-submit',\n};\n\nexport interface LoginSelectors {\n  /** data-testid of the header \"Login\" button that opens the dialog. */\n  loginButton?: string;\n  /** CSS selector for the username input. */\n  usernameInput?: string;\n  /** CSS selector for the password input. */\n  passwordInput?: string;\n  /** CSS selector for the submit button. */\n  submitButton?: string;\n}\n\ndeclare global {\n  namespace Cypress {\n    interface Chainable {\n      /**\n       * Find element by data-testid attribute.\n       */\n      getByTestId(selector: string, ...args: any[]): Chainable<JQuery<HTMLElement>>;\n      /**\n       * Login to Verdaccio UI. Selectors default to Verdaccio 6.x\n       * conventions; pass `selectors` to override any subset for\n       * non-default builds.\n       */\n      login(\n        user: string,\n        password: string,\n        selectors?: LoginSelectors\n      ): Chainable<void>;\n    }\n  }\n}\n\nCypress.Commands.add('getByTestId', (selector: string, ...args: any[]) => {\n  return cy.get(`[data-testid=${selector}]`, ...args);\n});\n\nCypress.Commands.add(\n  'login',\n  (user: string, password: string, selectors: LoginSelectors = {}) => {\n    const loginButton = selectors.loginButton ?? DEFAULT_LOGIN_SELECTORS.loginButton;\n    const usernameInput =\n      selectors.usernameInput ?? DEFAULT_LOGIN_SELECTORS.usernameInput;\n    const passwordInput =\n      selectors.passwordInput ?? DEFAULT_LOGIN_SELECTORS.passwordInput;\n    const submitButton =\n      selectors.submitButton ?? DEFAULT_LOGIN_SELECTORS.submitButton;\n\n    cy.getByTestId(loginButton).click();\n    cy.wait(300);\n    cy.get(usernameInput).type(user);\n    cy.wait(200);\n    cy.get(passwordInput).type(password);\n    cy.wait(500);\n    cy.get(submitButton).click();\n  }\n);\n\nexport {};\n"],"mappings":";;;;;;;AAQA,IAAM,0BAA0B;CAC9B,aAAa;CACb,eAAe;CACf,eAAe;CACf,cAAc;CACf;AAkCD,QAAQ,SAAS,IAAI,gBAAgB,UAAkB,GAAG,SAAgB;AACxE,QAAO,GAAG,IAAI,gBAAgB,SAAS,IAAI,GAAG,KAAK;EACnD;AAEF,QAAQ,SAAS,IACf,UACC,MAAc,UAAkB,YAA4B,EAAE,KAAK;CAClE,MAAM,cAAc,UAAU,eAAe,wBAAwB;CACrE,MAAM,gBACJ,UAAU,iBAAiB,wBAAwB;CACrD,MAAM,gBACJ,UAAU,iBAAiB,wBAAwB;CACrD,MAAM,eACJ,UAAU,gBAAgB,wBAAwB;AAEpD,IAAG,YAAY,YAAY,CAAC,OAAO;AACnC,IAAG,KAAK,IAAI;AACZ,IAAG,IAAI,cAAc,CAAC,KAAK,KAAK;AAChC,IAAG,KAAK,IAAI;AACZ,IAAG,IAAI,cAAc,CAAC,KAAK,SAAS;AACpC,IAAG,KAAK,IAAI;AACZ,IAAG,IAAI,aAAa,CAAC,OAAO;EAE/B"}

package/build/cjs/index.cjs

@@ -1,10 +1,26 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_publish = require("./tasks/publish.cjs");
+const require_testIds = require("./testIds.cjs");
 const require_home = require("./tests/home.cjs");
 const require_signin = require("./tests/signin.cjs");
-const require_publish = require("./tests/publish.cjs");
+const require_publish$1 = require("./tests/publish.cjs");
+const require_search = require("./tests/search.cjs");
+const require_settings = require("./tests/settings.cjs");
+const require_layout = require("./tests/layout.cjs");
 //#region src/index.ts
 /**
 * Build a full RegistryConfig from user-provided options with defaults.
+*
+* `testIds` and `selectors` are deep-merged per section with the
+* defaults in `./testIds`. Consumers targeting a non-default Verdaccio
+* build can override just the fields that drifted:
+*
+*   createRegistryConfig({
+*     registryUrl: 'http://localhost:4873',
+*     testIds: {
+*       header: { settingsTooltip: 'my-new-settings-btn' },
+*     },
+*   });
 */
 function createRegistryConfig(options) {
 	const url = new URL(options.registryUrl);
@@ -15,7 +31,9 @@ function createRegistryConfig(options) {
 			user: "test",
 			password: "test"
 		},
-		title: options.title ?? "Verdaccio"
+		title: options.title ?? "Verdaccio",
+		testIds: require_testIds.mergeTestIds(require_testIds.DEFAULT_TEST_IDS, options.testIds),
+		selectors: require_testIds.mergeSelectors(require_testIds.DEFAULT_SELECTORS, options.selectors)
 	};
 }
 /**
@@ -34,12 +52,38 @@ function createRegistryConfig(options) {
 */
 function setupVerdaccioTasks(on, options) {
 	const config = createRegistryConfig(options);
-	on("task", { registry() {
-		return {
-			registryUrl: config.registryUrl,
-			port: config.port
-		};
-	} });
+	on("task", {
+		registry() {
+			return {
+				registryUrl: config.registryUrl,
+				port: config.port
+			};
+		},
+		async publishPackage(input) {
+			return require_publish.publishPackage({
+				registryUrl: input.registryUrl ?? config.registryUrl,
+				credentials: input.credentials ?? config.credentials,
+				pkgName: input.pkgName,
+				version: input.version,
+				dependencies: input.dependencies,
+				devDependencies: input.devDependencies,
+				unique: input.unique
+			});
+		},
+		async cleanupPublished(tempFolder) {
+			await require_publish.cleanupPublished(tempFolder);
+			return null;
+		},
+		async unpublishPackage(input) {
+			return require_publish.unpublishPackage(typeof input === "string" ? {
+				pkgName: input,
+				registryUrl: config.registryUrl
+			} : {
+				...input,
+				registryUrl: input.registryUrl ?? config.registryUrl
+			});
+		}
+	});
 }
 /**
 * Register all Verdaccio UI tests.
@@ -60,14 +104,25 @@ function setupVerdaccioTasks(on, options) {
 function registerAllTests(config) {
 	require_home.homeTests(config);
 	require_signin.signinTests(config);
-	require_publish.publishTests(config);
+	require_layout.layoutTests(config);
+	require_search.searchTests(config);
+	require_settings.settingsTests(config);
+	require_publish$1.publishTests(config);
 }
 //#endregion
+exports.DEFAULT_SELECTORS = require_testIds.DEFAULT_SELECTORS;
+exports.DEFAULT_TEST_IDS = require_testIds.DEFAULT_TEST_IDS;
+exports.cleanupPublished = require_publish.cleanupPublished;
 exports.createRegistryConfig = createRegistryConfig;
 exports.homeTests = require_home.homeTests;
-exports.publishTests = require_publish.publishTests;
+exports.layoutTests = require_layout.layoutTests;
+exports.publishPackage = require_publish.publishPackage;
+exports.publishTests = require_publish$1.publishTests;
 exports.registerAllTests = registerAllTests;
+exports.searchTests = require_search.searchTests;
+exports.settingsTests = require_settings.settingsTests;
 exports.setupVerdaccioTasks = setupVerdaccioTasks;
 exports.signinTests = require_signin.signinTests;
+exports.unpublishPackage = require_publish.unpublishPackage;
 
 //# sourceMappingURL=index.cjs.map

package/build/cjs/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import { RegistryConfig, VerdaccioUiOptions } from './types';\n\nexport type { RegistryConfig, VerdaccioUiOptions } from './types';\nexport { homeTests, signinTests, publishTests } from './tests';\n\n/**\n * Build a full RegistryConfig from user-provided options with defaults.\n */\nexport function createRegistryConfig(options: VerdaccioUiOptions): RegistryConfig {\n  const url = new URL(options.registryUrl);\n  return {\n    registryUrl: options.registryUrl,\n    port: options.port ?? (parseInt(url.port, 10) || 4873),\n    credentials: options.credentials ?? { user: 'test', password: 'test' },\n    title: options.title ?? 'Verdaccio',\n  };\n}\n\n/**\n * Register Verdaccio Cypress tasks in setupNodeEvents.\n *\n * Usage in cypress.config.ts:\n *   import { setupVerdaccioTasks } from '@verdaccio/e2e-ui';\n *\n *   export default defineConfig({\n *     e2e: {\n *       setupNodeEvents(on) {\n *         setupVerdaccioTasks(on, { registryUrl: 'http://localhost:4873' });\n *       },\n *     },\n *   });\n */\nexport function setupVerdaccioTasks(\n  on: Cypress.PluginEvents,\n  options: VerdaccioUiOptions\n): void {\n  const config = createRegistryConfig(options);\n\n  on('task', {\n    registry() {\n      return {\n        registryUrl: config.registryUrl,\n        port: config.port,\n      };\n    },\n  });\n}\n\n/**\n * Register all Verdaccio UI tests.\n *\n * Usage in a spec file:\n *   import { registerAllTests, createRegistryConfig } from '@verdaccio/e2e-ui';\n *\n *   const config = createRegistryConfig({ registryUrl: 'http://localhost:4873' });\n *   registerAllTests(config);\n *\n * Or pick individual suites:\n *   import { homeTests, signinTests } from '@verdaccio/e2e-ui';\n *\n *   const config = createRegistryConfig({ registryUrl: 'http://localhost:4873' });\n *   homeTests(config);\n *   signinTests(config);\n */\nexport function registerAllTests(config: RegistryConfig): void {\n  homeTests(config);\n  signinTests(config);\n  publishTests(config);\n}\n\n// Re-export for convenience\nimport { homeTests, signinTests, publishTests } from './tests';\n"],"mappings":";;;;;;;;AAQA,SAAgB,qBAAqB,SAA6C;CAChF,MAAM,MAAM,IAAI,IAAI,QAAQ,YAAY;AACxC,QAAO;EACL,aAAa,QAAQ;EACrB,MAAM,QAAQ,SAAS,SAAS,IAAI,MAAM,GAAG,IAAI;EACjD,aAAa,QAAQ,eAAe;GAAE,MAAM;GAAQ,UAAU;GAAQ;EACtE,OAAO,QAAQ,SAAS;EACzB;;;;;;;;;;;;;;;;AAiBH,SAAgB,oBACd,IACA,SACM;CACN,MAAM,SAAS,qBAAqB,QAAQ;AAE5C,IAAG,QAAQ,EACT,WAAW;AACT,SAAO;GACL,aAAa,OAAO;GACpB,MAAM,OAAO;GACd;IAEJ,CAAC;;;;;;;;;;;;;;;;;;AAmBJ,SAAgB,iBAAiB,QAA8B;AAC7D,cAAA,UAAU,OAAO;AACjB,gBAAA,YAAY,OAAO;AACnB,iBAAA,aAAa,OAAO"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import {\n  cleanupPublished,\n  publishPackage,\n  PublishPackageResult,\n  PublishPackageTaskInput,\n  unpublishPackage,\n  UnpublishPackageInput,\n  UnpublishPackageResult,\n} from './tasks';\nimport {\n  DEFAULT_SELECTORS,\n  DEFAULT_TEST_IDS,\n  mergeSelectors,\n  mergeTestIds,\n} from './testIds';\nimport { RegistryConfig, RegistryTaskResult, VerdaccioUiOptions } from './types';\n\nexport type {\n  RegistryConfig,\n  RegistryTaskResult,\n  VerdaccioUiOptions,\n} from './types';\nexport type {\n  PublishPackageInput,\n  PublishPackageTaskInput,\n  PublishPackageResult,\n  UnpublishPackageInput,\n  UnpublishPackageResult,\n} from './tasks';\nexport type { DeepPartial, Selectors, TestIds } from './testIds';\nexport { DEFAULT_SELECTORS, DEFAULT_TEST_IDS } from './testIds';\nexport { publishPackage, cleanupPublished, unpublishPackage } from './tasks';\nexport {\n  homeTests,\n  signinTests,\n  publishTests,\n  searchTests,\n  settingsTests,\n  layoutTests,\n} from './tests';\n\n/**\n * Build a full RegistryConfig from user-provided options with defaults.\n *\n * `testIds` and `selectors` are deep-merged per section with the\n * defaults in `./testIds`. Consumers targeting a non-default Verdaccio\n * build can override just the fields that drifted:\n *\n *   createRegistryConfig({\n *     registryUrl: 'http://localhost:4873',\n *     testIds: {\n *       header: { settingsTooltip: 'my-new-settings-btn' },\n *     },\n *   });\n */\nexport function createRegistryConfig(options: VerdaccioUiOptions): RegistryConfig {\n  const url = new URL(options.registryUrl);\n  return {\n    registryUrl: options.registryUrl,\n    port: options.port ?? (parseInt(url.port, 10) || 4873),\n    credentials: options.credentials ?? { user: 'test', password: 'test' },\n    title: options.title ?? 'Verdaccio',\n    testIds: mergeTestIds(DEFAULT_TEST_IDS, options.testIds),\n    selectors: mergeSelectors(DEFAULT_SELECTORS, options.selectors),\n  };\n}\n\n/**\n * Register Verdaccio Cypress tasks in setupNodeEvents.\n *\n * Usage in cypress.config.ts:\n *   import { setupVerdaccioTasks } from '@verdaccio/e2e-ui';\n *\n *   export default defineConfig({\n *     e2e: {\n *       setupNodeEvents(on) {\n *         setupVerdaccioTasks(on, { registryUrl: 'http://localhost:4873' });\n *       },\n *     },\n *   });\n */\nexport function setupVerdaccioTasks(\n  on: Cypress.PluginEvents,\n  options: VerdaccioUiOptions\n): void {\n  const config = createRegistryConfig(options);\n\n  on('task', {\n    registry(): RegistryTaskResult {\n      return {\n        registryUrl: config.registryUrl,\n        port: config.port,\n      };\n    },\n    /**\n     * Publish a throwaway package to the registry.\n     *\n     * Usage from a Cypress spec:\n     *\n     *   cy.task('publishPackage', { pkgName: '@verdaccio/pkg-scoped' });\n     *\n     * Any field not provided falls back to the values configured here\n     * (registryUrl, credentials). The task returns a PublishPackageResult.\n     */\n    async publishPackage(\n      input: PublishPackageTaskInput\n    ): Promise<PublishPackageResult> {\n      return publishPackage({\n        registryUrl: input.registryUrl ?? config.registryUrl,\n        credentials: input.credentials ?? config.credentials,\n        pkgName: input.pkgName,\n        version: input.version,\n        dependencies: input.dependencies,\n        devDependencies: input.devDependencies,\n        unique: input.unique,\n      });\n    },\n    /**\n     * Remove a temp project folder returned by a previous publishPackage\n     * call. Returns null (Cypress tasks must return something serializable).\n     *\n     *   cy.task('cleanupPublished', result.tempFolder);\n     */\n    async cleanupPublished(tempFolder: string): Promise<null> {\n      await cleanupPublished(tempFolder);\n      return null;\n    },\n    /**\n     * Unpublish a package from the registry so the next test starts\n     * from a clean slate. Accepts either a package name or a full input\n     * object (to reuse a prior tempFolder's token).\n     *\n     *   cy.task('unpublishPackage', '@verdaccio/pkg-scoped');\n     *   cy.task('unpublishPackage', { pkgName, tempFolder });\n     */\n    async unpublishPackage(\n      input: string | (Omit<UnpublishPackageInput, 'registryUrl'> & {\n        registryUrl?: string;\n      })\n    ): Promise<UnpublishPackageResult> {\n      const normalized =\n        typeof input === 'string'\n          ? { pkgName: input, registryUrl: config.registryUrl }\n          : { ...input, registryUrl: input.registryUrl ?? config.registryUrl };\n      return unpublishPackage(normalized);\n    },\n  });\n}\n\n/**\n * Register all Verdaccio UI tests.\n *\n * Usage in a spec file:\n *   import { registerAllTests, createRegistryConfig } from '@verdaccio/e2e-ui';\n *\n *   const config = createRegistryConfig({ registryUrl: 'http://localhost:4873' });\n *   registerAllTests(config);\n *\n * Or pick individual suites:\n *   import { homeTests, signinTests } from '@verdaccio/e2e-ui';\n *\n *   const config = createRegistryConfig({ registryUrl: 'http://localhost:4873' });\n *   homeTests(config);\n *   signinTests(config);\n */\nexport function registerAllTests(config: RegistryConfig): void {\n  homeTests(config);\n  signinTests(config);\n  layoutTests(config);\n  searchTests(config);\n  settingsTests(config);\n  publishTests(config);\n}\n\n// Re-export for convenience\nimport {\n  homeTests,\n  signinTests,\n  publishTests,\n  searchTests,\n  settingsTests,\n  layoutTests,\n} from './tests';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,qBAAqB,SAA6C;CAChF,MAAM,MAAM,IAAI,IAAI,QAAQ,YAAY;AACxC,QAAO;EACL,aAAa,QAAQ;EACrB,MAAM,QAAQ,SAAS,SAAS,IAAI,MAAM,GAAG,IAAI;EACjD,aAAa,QAAQ,eAAe;GAAE,MAAM;GAAQ,UAAU;GAAQ;EACtE,OAAO,QAAQ,SAAS;EACxB,SAAS,gBAAA,aAAa,gBAAA,kBAAkB,QAAQ,QAAQ;EACxD,WAAW,gBAAA,eAAe,gBAAA,mBAAmB,QAAQ,UAAU;EAChE;;;;;;;;;;;;;;;;AAiBH,SAAgB,oBACd,IACA,SACM;CACN,MAAM,SAAS,qBAAqB,QAAQ;AAE5C,IAAG,QAAQ;EACT,WAA+B;AAC7B,UAAO;IACL,aAAa,OAAO;IACpB,MAAM,OAAO;IACd;;EAYH,MAAM,eACJ,OAC+B;AAC/B,UAAO,gBAAA,eAAe;IACpB,aAAa,MAAM,eAAe,OAAO;IACzC,aAAa,MAAM,eAAe,OAAO;IACzC,SAAS,MAAM;IACf,SAAS,MAAM;IACf,cAAc,MAAM;IACpB,iBAAiB,MAAM;IACvB,QAAQ,MAAM;IACf,CAAC;;EAQJ,MAAM,iBAAiB,YAAmC;AACxD,SAAM,gBAAA,iBAAiB,WAAW;AAClC,UAAO;;EAUT,MAAM,iBACJ,OAGiC;AAKjC,UAAO,gBAAA,iBAHL,OAAO,UAAU,WACb;IAAE,SAAS;IAAO,aAAa,OAAO;IAAa,GACnD;IAAE,GAAG;IAAO,aAAa,MAAM,eAAe,OAAO;IAAa,CACrC;;EAEtC,CAAC;;;;;;;;;;;;;;;;;;AAmBJ,SAAgB,iBAAiB,QAA8B;AAC7D,cAAA,UAAU,OAAO;AACjB,gBAAA,YAAY,OAAO;AACnB,gBAAA,YAAY,OAAO;AACnB,gBAAA,YAAY,OAAO;AACnB,kBAAA,cAAc,OAAO;AACrB,mBAAA,aAAa,OAAO"}

package/build/cjs/tasks/publish.cjs

@@ -0,0 +1,245 @@
+let child_process = require("child_process");
+let fs_promises = require("fs/promises");
+let os = require("os");
+let path = require("path");
+//#region src/tasks/publish.ts
+function sanitizeFolderName(name) {
+	return name.replace(/[^a-zA-Z0-9-_]/g, "-");
+}
+/**
+* Obtain a registry-API-compatible (legacy) auth token for publish.
+*
+* Strategy: create a throwaway user per call. `PUT /-/user/org.couchdb.user:<name>`
+* only returns a token on CREATE (and 409s on existing users), so we
+* guarantee success by generating a unique username each time.
+*
+* We need a legacy token specifically because:
+*   - Verdaccio's default API middleware accepts legacy tokens but NOT
+*     JWTs from `/-/verdaccio/sec/login`
+*   - Modern npm (>= 10.x) refuses to run `npm publish` at all without
+*     an `_authToken` entry in `.npmrc`, even against a registry that
+*     allows `$anonymous` publish — it errors out client-side
+*
+* The throwaway user stays in the test registry's htpasswd store after
+* the run, which is fine for ephemeral CI environments and local temp
+* setups (both wipe storage between runs).
+*/
+async function obtainLegacyToken(registryUrl) {
+	const user = `e2e-bot-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+	const password = "e2e-bot-password";
+	const url = `${registryUrl.replace(/\/$/, "")}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;
+	const res = await fetch(url, {
+		method: "PUT",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			name: user,
+			password,
+			_id: `org.couchdb.user:${user}`,
+			type: "user",
+			roles: []
+		})
+	});
+	if (!res.ok) {
+		const body = await res.text();
+		throw new Error(`[publishPackage] failed to create throwaway user "${user}" (HTTP ${res.status}): ${body}`);
+	}
+	const json = await res.json();
+	if (!json.token) throw new Error(`[publishPackage] user creation response did not contain a token: ${JSON.stringify(json)}`);
+	return {
+		user,
+		token: json.token
+	};
+}
+async function createTempProject(pkgName, version, registryUrl, token, dependencies, devDependencies) {
+	const tempFolder = await (0, fs_promises.mkdtemp)((0, path.join)((0, os.tmpdir)(), `verdaccio-e2e-ui-${sanitizeFolderName(pkgName)}-`));
+	const manifest = {
+		name: pkgName,
+		version,
+		description: `e2e test fixture ${pkgName}`,
+		main: "index.js",
+		dependencies,
+		devDependencies,
+		keywords: [
+			"verdaccio",
+			"e2e",
+			"test"
+		],
+		author: "Verdaccio E2E <verdaccio@example.org>",
+		license: "MIT",
+		publishConfig: {
+			access: "public",
+			registry: registryUrl
+		}
+	};
+	await (0, fs_promises.writeFile)((0, path.join)(tempFolder, "package.json"), JSON.stringify(manifest, null, 2));
+	await (0, fs_promises.writeFile)((0, path.join)(tempFolder, "README.md"), `# ${pkgName}\n\nPublished by @verdaccio/e2e-ui for e2e testing.\n`);
+	await (0, fs_promises.writeFile)((0, path.join)(tempFolder, "index.js"), `module.exports = ${JSON.stringify(pkgName)};\n`);
+	const registryHost = registryUrl.replace(/^https?:/, "");
+	const npmrc = [
+		`registry=${registryUrl}`,
+		`${registryHost}/:_authToken=${token}`,
+		"access=public",
+		""
+	].join("\n");
+	await (0, fs_promises.writeFile)((0, path.join)(tempFolder, ".npmrc"), npmrc);
+	return tempFolder;
+}
+function spawnNpmPublish(cwd, registryUrl) {
+	return new Promise((resolvePromise, rejectPromise) => {
+		const proc = (0, child_process.spawn)("npm", [
+			"publish",
+			"--registry",
+			registryUrl,
+			"--tag",
+			"latest",
+			"--loglevel=error"
+		], {
+			cwd,
+			env: { ...process.env }
+		});
+		let stdout = "";
+		let stderr = "";
+		proc.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		proc.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		proc.on("error", rejectPromise);
+		proc.on("close", (code) => {
+			resolvePromise({
+				stdout,
+				stderr,
+				exitCode: code ?? -1
+			});
+		});
+	});
+}
+/**
+* Publish a throwaway npm package to the target Verdaccio registry.
+*
+* Flow:
+*   1. Create a throwaway user via `PUT /-/user/...` and capture its
+*      legacy auth token. See `obtainLegacyToken` for why.
+*   2. Scaffold a temp project with `package.json`, `README.md`,
+*      `index.js`, and an `.npmrc` that includes the token.
+*   3. Spawn `npm publish` from that temp dir.
+*
+* `input.credentials` is kept on the signature for forward-compat but
+* is currently unused — each call mints its own throwaway user.
+*
+* Throws on non-zero npm exit. Returns the temp folder path on success
+* so callers can inspect or clean up.
+*/
+async function publishPackage(input) {
+	const baseVersion = input.version ?? "1.0.0";
+	const version = input.unique ? `${baseVersion}-t${Date.now()}` : baseVersion;
+	const { token } = await obtainLegacyToken(input.registryUrl);
+	const tempFolder = await createTempProject(input.pkgName, version, input.registryUrl, token, input.dependencies ?? {}, input.devDependencies ?? {});
+	const { stdout, stderr, exitCode } = await spawnNpmPublish(tempFolder, input.registryUrl);
+	if (exitCode !== 0) throw new Error(`[publishPackage] npm publish failed for ${input.pkgName}@${version} (exit ${exitCode}):\n${stderr || stdout}`);
+	return {
+		pkgName: input.pkgName,
+		version,
+		tempFolder,
+		stdout,
+		stderr,
+		exitCode
+	};
+}
+/**
+* Remove a temp project folder previously created by publishPackage.
+* Safe to call with a missing path or a path outside the OS tmp dir —
+* in the latter case it refuses rather than rm-rf'ing arbitrary paths.
+*/
+async function cleanupPublished(tempFolder) {
+	if (!tempFolder) return;
+	const tmpRoot = (0, os.tmpdir)();
+	if (!tempFolder.startsWith(tmpRoot)) throw new Error(`[cleanupPublished] refusing to remove "${tempFolder}" — not under ${tmpRoot}`);
+	await (0, fs_promises.rm)(tempFolder, {
+		recursive: true,
+		force: true
+	});
+}
+function spawnNpmUnpublish(cwd, registryUrl, pkgSpec) {
+	return new Promise((resolvePromise, rejectPromise) => {
+		const proc = (0, child_process.spawn)("npm", [
+			"unpublish",
+			pkgSpec,
+			"--force",
+			"--registry",
+			registryUrl,
+			"--loglevel=error"
+		], {
+			cwd,
+			env: { ...process.env }
+		});
+		let stdout = "";
+		let stderr = "";
+		proc.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		proc.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		proc.on("error", rejectPromise);
+		proc.on("close", (code) => {
+			resolvePromise({
+				stdout,
+				stderr,
+				exitCode: code ?? -1
+			});
+		});
+	});
+}
+/**
+* Unpublish a package from the target registry so subsequent tests
+* start from a clean slate.
+*
+* If `tempFolder` is provided (typically from a prior `publishPackage`
+* result), its `.npmrc` is reused so no extra throwaway user is
+* minted. Otherwise this function creates its own temp folder + token.
+* Either way the temp folder used by THIS call is removed on exit
+* (but callers still own the lifecycle of a tempFolder they passed in).
+*
+* Treats HTTP 404 / "tarball does not exist" as success so reruns and
+* parallel teardowns don't flap.
+*/
+async function unpublishPackage(input) {
+	let workingFolder = input.tempFolder;
+	let ownsWorkingFolder = false;
+	if (!workingFolder) {
+		ownsWorkingFolder = true;
+		const { token } = await obtainLegacyToken(input.registryUrl);
+		workingFolder = await (0, fs_promises.mkdtemp)((0, path.join)((0, os.tmpdir)(), `verdaccio-e2e-ui-unpublish-`));
+		const registryHost = input.registryUrl.replace(/^https?:/, "");
+		await (0, fs_promises.writeFile)((0, path.join)(workingFolder, ".npmrc"), [
+			`registry=${input.registryUrl}`,
+			`${registryHost}/:_authToken=${token}`,
+			""
+		].join("\n"));
+	}
+	try {
+		const { stdout, stderr, exitCode } = await spawnNpmUnpublish(workingFolder, input.registryUrl, input.pkgName);
+		const alreadyGone = /404|not found|no such package|does not (exist|match)/i.test(`${stderr}\n${stdout}`);
+		if (exitCode !== 0 && !alreadyGone) throw new Error(`[unpublishPackage] npm unpublish failed for ${input.pkgName} (exit ${exitCode}):\n${stderr || stdout}`);
+		return {
+			pkgName: input.pkgName,
+			stdout,
+			stderr,
+			exitCode,
+			alreadyGone
+		};
+	} finally {
+		if (ownsWorkingFolder && workingFolder) await (0, fs_promises.rm)(workingFolder, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+}
+//#endregion
+exports.cleanupPublished = cleanupPublished;
+exports.publishPackage = publishPackage;
+exports.unpublishPackage = unpublishPackage;
+
+//# sourceMappingURL=publish.cjs.map

package/build/cjs/tasks/publish.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.cjs","names":[],"sources":["../../../src/tasks/publish.ts"],"sourcesContent":["import { spawn } from 'child_process';\nimport { mkdtemp, rm, writeFile } from 'fs/promises';\nimport { tmpdir } from 'os';\nimport { join } from 'path';\n\nexport interface PublishPackageInput {\n  pkgName: string;\n  version?: string;\n  registryUrl: string;\n  credentials: { user: string; password: string };\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  /**\n   * When true, append a timestamp suffix to the version so reruns against\n   * a persistent registry don't collide on 403. The suffix is a valid\n   * semver prerelease, e.g. `1.0.0-t1712345678`. Defaults to false.\n   */\n  unique?: boolean;\n}\n\n/**\n * Shape of the argument passed to `cy.task('publishPackage', ...)`.\n *\n * `registryUrl` and `credentials` are optional here (they fall back to\n * whatever was configured in `setupVerdaccioTasks`), but `pkgName` is\n * still required — every publish needs a name.\n */\nexport type PublishPackageTaskInput = Partial<\n  Omit<PublishPackageInput, 'pkgName'>\n> & {\n  pkgName: string;\n};\n\nexport interface PublishPackageResult {\n  pkgName: string;\n  version: string;\n  tempFolder: string;\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n}\n\nfunction sanitizeFolderName(name: string): string {\n  return name.replace(/[^a-zA-Z0-9-_]/g, '-');\n}\n\n/**\n * Obtain a registry-API-compatible (legacy) auth token for publish.\n *\n * Strategy: create a throwaway user per call. `PUT /-/user/org.couchdb.user:<name>`\n * only returns a token on CREATE (and 409s on existing users), so we\n * guarantee success by generating a unique username each time.\n *\n * We need a legacy token specifically because:\n *   - Verdaccio's default API middleware accepts legacy tokens but NOT\n *     JWTs from `/-/verdaccio/sec/login`\n *   - Modern npm (>= 10.x) refuses to run `npm publish` at all without\n *     an `_authToken` entry in `.npmrc`, even against a registry that\n *     allows `$anonymous` publish — it errors out client-side\n *\n * The throwaway user stays in the test registry's htpasswd store after\n * the run, which is fine for ephemeral CI environments and local temp\n * setups (both wipe storage between runs).\n */\nasync function obtainLegacyToken(\n  registryUrl: string\n): Promise<{ user: string; token: string }> {\n  const user = `e2e-bot-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n  const password = 'e2e-bot-password';\n  const base = registryUrl.replace(/\\/$/, '');\n  const url = `${base}/-/user/org.couchdb.user:${encodeURIComponent(user)}`;\n  const res = await fetch(url, {\n    method: 'PUT',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({\n      name: user,\n      password,\n      _id: `org.couchdb.user:${user}`,\n      type: 'user',\n      roles: [],\n    }),\n  });\n  if (!res.ok) {\n    const body = await res.text();\n    throw new Error(\n      `[publishPackage] failed to create throwaway user \"${user}\" ` +\n        `(HTTP ${res.status}): ${body}`\n    );\n  }\n  const json = (await res.json()) as { token?: string };\n  if (!json.token) {\n    throw new Error(\n      `[publishPackage] user creation response did not contain a token: ${JSON.stringify(\n        json\n      )}`\n    );\n  }\n  return { user, token: json.token };\n}\n\nasync function createTempProject(\n  pkgName: string,\n  version: string,\n  registryUrl: string,\n  token: string,\n  dependencies: Record<string, string>,\n  devDependencies: Record<string, string>\n): Promise<string> {\n  const tempFolder = await mkdtemp(\n    join(tmpdir(), `verdaccio-e2e-ui-${sanitizeFolderName(pkgName)}-`)\n  );\n  const manifest = {\n    name: pkgName,\n    version,\n    description: `e2e test fixture ${pkgName}`,\n    main: 'index.js',\n    dependencies,\n    devDependencies,\n    keywords: ['verdaccio', 'e2e', 'test'],\n    author: 'Verdaccio E2E <verdaccio@example.org>',\n    license: 'MIT',\n    // Scoped packages default to `restricted` access which modern npm\n    // refuses to publish anonymously. Pin it to `public` so the CLI\n    // skips that check for fixtures like `@verdaccio/pkg-scoped`.\n    publishConfig: {\n      access: 'public',\n      registry: registryUrl,\n    },\n  };\n  await writeFile(join(tempFolder, 'package.json'), JSON.stringify(manifest, null, 2));\n  await writeFile(\n    join(tempFolder, 'README.md'),\n    `# ${pkgName}\\n\\nPublished by @verdaccio/e2e-ui for e2e testing.\\n`\n  );\n  await writeFile(\n    join(tempFolder, 'index.js'),\n    `module.exports = ${JSON.stringify(pkgName)};\\n`\n  );\n\n  // `.npmrc` — include an `_authToken` scoped to the registry host so\n  // modern npm (>= 10.x) is willing to run `npm publish`. Without this\n  // the CLI errors client-side with \"This command requires you to be\n  // logged in.\" even against a registry configured for `$anonymous`\n  // publish. The token is a legacy Verdaccio auth token obtained by\n  // creating a throwaway user via `PUT /-/user/...`.\n  const registryHost = registryUrl.replace(/^https?:/, '');\n  const npmrc = [\n    `registry=${registryUrl}`,\n    `${registryHost}/:_authToken=${token}`,\n    // Force public access for scoped packages.\n    'access=public',\n    '',\n  ].join('\\n');\n  await writeFile(join(tempFolder, '.npmrc'), npmrc);\n\n  return tempFolder;\n}\n\nfunction spawnNpmPublish(\n  cwd: string,\n  registryUrl: string\n): Promise<{ stdout: string; stderr: string; exitCode: number }> {\n  return new Promise((resolvePromise, rejectPromise) => {\n    // `--tag latest` is required so npm accepts prerelease versions\n    // (e.g. `1.0.0-t<ts>` when `unique: true`). Without it npm bails\n    // with \"You must specify a tag using --tag when publishing a\n    // prerelease version.\" For non-prerelease versions it's a no-op.\n    const proc = spawn(\n      'npm',\n      [\n        'publish',\n        '--registry',\n        registryUrl,\n        '--tag',\n        'latest',\n        '--loglevel=error',\n      ],\n      {\n        cwd,\n        env: { ...process.env },\n      }\n    );\n    let stdout = '';\n    let stderr = '';\n    proc.stdout.on('data', (chunk) => {\n      stdout += chunk.toString();\n    });\n    proc.stderr.on('data', (chunk) => {\n      stderr += chunk.toString();\n    });\n    proc.on('error', rejectPromise);\n    proc.on('close', (code) => {\n      resolvePromise({ stdout, stderr, exitCode: code ?? -1 });\n    });\n  });\n}\n\n/**\n * Publish a throwaway npm package to the target Verdaccio registry.\n *\n * Flow:\n *   1. Create a throwaway user via `PUT /-/user/...` and capture its\n *      legacy auth token. See `obtainLegacyToken` for why.\n *   2. Scaffold a temp project with `package.json`, `README.md`,\n *      `index.js`, and an `.npmrc` that includes the token.\n *   3. Spawn `npm publish` from that temp dir.\n *\n * `input.credentials` is kept on the signature for forward-compat but\n * is currently unused — each call mints its own throwaway user.\n *\n * Throws on non-zero npm exit. Returns the temp folder path on success\n * so callers can inspect or clean up.\n */\nexport async function publishPackage(\n  input: PublishPackageInput\n): Promise<PublishPackageResult> {\n  const baseVersion = input.version ?? '1.0.0';\n  const version = input.unique ? `${baseVersion}-t${Date.now()}` : baseVersion;\n\n  const { token } = await obtainLegacyToken(input.registryUrl);\n\n  const tempFolder = await createTempProject(\n    input.pkgName,\n    version,\n    input.registryUrl,\n    token,\n    input.dependencies ?? {},\n    input.devDependencies ?? {}\n  );\n  const { stdout, stderr, exitCode } = await spawnNpmPublish(\n    tempFolder,\n    input.registryUrl\n  );\n  if (exitCode !== 0) {\n    throw new Error(\n      `[publishPackage] npm publish failed for ${input.pkgName}@${version} ` +\n        `(exit ${exitCode}):\\n${stderr || stdout}`\n    );\n  }\n  return { pkgName: input.pkgName, version, tempFolder, stdout, stderr, exitCode };\n}\n\n/**\n * Remove a temp project folder previously created by publishPackage.\n * Safe to call with a missing path or a path outside the OS tmp dir —\n * in the latter case it refuses rather than rm-rf'ing arbitrary paths.\n */\nexport async function cleanupPublished(tempFolder: string): Promise<void> {\n  if (!tempFolder) return;\n  const tmpRoot = tmpdir();\n  if (!tempFolder.startsWith(tmpRoot)) {\n    throw new Error(\n      `[cleanupPublished] refusing to remove \"${tempFolder}\" — not under ${tmpRoot}`\n    );\n  }\n  await rm(tempFolder, { recursive: true, force: true });\n}\n\nexport interface UnpublishPackageInput {\n  registryUrl: string;\n  pkgName: string;\n  /**\n   * Temp folder returned by a previous `publishPackage` call. If\n   * provided, its existing `.npmrc` (which already carries a legacy\n   * auth token) is reused for the unpublish call — no extra throwaway\n   * user is minted. Otherwise this task creates its own.\n   */\n  tempFolder?: string;\n}\n\nexport interface UnpublishPackageResult {\n  pkgName: string;\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  /**\n   * True if the package was already absent (HTTP 404 from the\n   * registry). Tests typically want to treat this as success.\n   */\n  alreadyGone: boolean;\n}\n\nfunction spawnNpmUnpublish(\n  cwd: string,\n  registryUrl: string,\n  pkgSpec: string\n): Promise<{ stdout: string; stderr: string; exitCode: number }> {\n  return new Promise((resolvePromise, rejectPromise) => {\n    const proc = spawn(\n      'npm',\n      [\n        'unpublish',\n        pkgSpec,\n        '--force',\n        '--registry',\n        registryUrl,\n        '--loglevel=error',\n      ],\n      {\n        cwd,\n        env: { ...process.env },\n      }\n    );\n    let stdout = '';\n    let stderr = '';\n    proc.stdout.on('data', (chunk) => {\n      stdout += chunk.toString();\n    });\n    proc.stderr.on('data', (chunk) => {\n      stderr += chunk.toString();\n    });\n    proc.on('error', rejectPromise);\n    proc.on('close', (code) => {\n      resolvePromise({ stdout, stderr, exitCode: code ?? -1 });\n    });\n  });\n}\n\n/**\n * Unpublish a package from the target registry so subsequent tests\n * start from a clean slate.\n *\n * If `tempFolder` is provided (typically from a prior `publishPackage`\n * result), its `.npmrc` is reused so no extra throwaway user is\n * minted. Otherwise this function creates its own temp folder + token.\n * Either way the temp folder used by THIS call is removed on exit\n * (but callers still own the lifecycle of a tempFolder they passed in).\n *\n * Treats HTTP 404 / \"tarball does not exist\" as success so reruns and\n * parallel teardowns don't flap.\n */\nexport async function unpublishPackage(\n  input: UnpublishPackageInput\n): Promise<UnpublishPackageResult> {\n  let workingFolder = input.tempFolder;\n  let ownsWorkingFolder = false;\n\n  if (!workingFolder) {\n    ownsWorkingFolder = true;\n    const { token } = await obtainLegacyToken(input.registryUrl);\n    workingFolder = await mkdtemp(\n      join(tmpdir(), `verdaccio-e2e-ui-unpublish-`)\n    );\n    const registryHost = input.registryUrl.replace(/^https?:/, '');\n    await writeFile(\n      join(workingFolder, '.npmrc'),\n      [\n        `registry=${input.registryUrl}`,\n        `${registryHost}/:_authToken=${token}`,\n        '',\n      ].join('\\n')\n    );\n  }\n\n  try {\n    const { stdout, stderr, exitCode } = await spawnNpmUnpublish(\n      workingFolder,\n      input.registryUrl,\n      input.pkgName\n    );\n\n    // Treat \"already absent\" as success. npm prints slightly different\n    // messages depending on version — match loosely.\n    const alreadyGone =\n      /404|not found|no such package|does not (exist|match)/i.test(\n        `${stderr}\\n${stdout}`\n      );\n\n    if (exitCode !== 0 && !alreadyGone) {\n      throw new Error(\n        `[unpublishPackage] npm unpublish failed for ${input.pkgName} ` +\n          `(exit ${exitCode}):\\n${stderr || stdout}`\n      );\n    }\n\n    return {\n      pkgName: input.pkgName,\n      stdout,\n      stderr,\n      exitCode,\n      alreadyGone,\n    };\n  } finally {\n    if (ownsWorkingFolder && workingFolder) {\n      await rm(workingFolder, { recursive: true, force: true }).catch(\n        () => undefined\n      );\n    }\n  }\n}\n"],"mappings":";;;;;AA0CA,SAAS,mBAAmB,MAAsB;AAChD,QAAO,KAAK,QAAQ,mBAAmB,IAAI;;;;;;;;;;;;;;;;;;;;AAqB7C,eAAe,kBACb,aAC0C;CAC1C,MAAM,OAAO,WAAW,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE;CAC5E,MAAM,WAAW;CAEjB,MAAM,MAAM,GADC,YAAY,QAAQ,OAAO,GAAG,CACvB,2BAA2B,mBAAmB,KAAK;CACvE,MAAM,MAAM,MAAM,MAAM,KAAK;EAC3B,QAAQ;EACR,SAAS,EAAE,gBAAgB,oBAAoB;EAC/C,MAAM,KAAK,UAAU;GACnB,MAAM;GACN;GACA,KAAK,oBAAoB;GACzB,MAAM;GACN,OAAO,EAAE;GACV,CAAC;EACH,CAAC;AACF,KAAI,CAAC,IAAI,IAAI;EACX,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,QAAM,IAAI,MACR,qDAAqD,KAAK,UAC/C,IAAI,OAAO,KAAK,OAC5B;;CAEH,MAAM,OAAQ,MAAM,IAAI,MAAM;AAC9B,KAAI,CAAC,KAAK,MACR,OAAM,IAAI,MACR,oEAAoE,KAAK,UACvE,KACD,GACF;AAEH,QAAO;EAAE;EAAM,OAAO,KAAK;EAAO;;AAGpC,eAAe,kBACb,SACA,SACA,aACA,OACA,cACA,iBACiB;CACjB,MAAM,aAAa,OAAA,GAAA,YAAA,UAAA,GAAA,KAAA,OAAA,GAAA,GAAA,SACJ,EAAE,oBAAoB,mBAAmB,QAAQ,CAAC,GAAG,CACnE;CACD,MAAM,WAAW;EACf,MAAM;EACN;EACA,aAAa,oBAAoB;EACjC,MAAM;EACN;EACA;EACA,UAAU;GAAC;GAAa;GAAO;GAAO;EACtC,QAAQ;EACR,SAAS;EAIT,eAAe;GACb,QAAQ;GACR,UAAU;GACX;EACF;AACD,QAAA,GAAA,YAAA,YAAA,GAAA,KAAA,MAAqB,YAAY,eAAe,EAAE,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC;AACpF,QAAA,GAAA,YAAA,YAAA,GAAA,KAAA,MACO,YAAY,YAAY,EAC7B,KAAK,QAAQ,uDACd;AACD,QAAA,GAAA,YAAA,YAAA,GAAA,KAAA,MACO,YAAY,WAAW,EAC5B,oBAAoB,KAAK,UAAU,QAAQ,CAAC,KAC7C;CAQD,MAAM,eAAe,YAAY,QAAQ,YAAY,GAAG;CACxD,MAAM,QAAQ;EACZ,YAAY;EACZ,GAAG,aAAa,eAAe;EAE/B;EACA;EACD,CAAC,KAAK,KAAK;AACZ,QAAA,GAAA,YAAA,YAAA,GAAA,KAAA,MAAqB,YAAY,SAAS,EAAE,MAAM;AAElD,QAAO;;AAGT,SAAS,gBACP,KACA,aAC+D;AAC/D,QAAO,IAAI,SAAS,gBAAgB,kBAAkB;EAKpD,MAAM,QAAA,GAAA,cAAA,OACJ,OACA;GACE;GACA;GACA;GACA;GACA;GACA;GACD,EACD;GACE;GACA,KAAK,EAAE,GAAG,QAAQ,KAAK;GACxB,CACF;EACD,IAAI,SAAS;EACb,IAAI,SAAS;AACb,OAAK,OAAO,GAAG,SAAS,UAAU;AAChC,aAAU,MAAM,UAAU;IAC1B;AACF,OAAK,OAAO,GAAG,SAAS,UAAU;AAChC,aAAU,MAAM,UAAU;IAC1B;AACF,OAAK,GAAG,SAAS,cAAc;AAC/B,OAAK,GAAG,UAAU,SAAS;AACzB,kBAAe;IAAE;IAAQ;IAAQ,UAAU,QAAQ;IAAI,CAAC;IACxD;GACF;;;;;;;;;;;;;;;;;;AAmBJ,eAAsB,eACpB,OAC+B;CAC/B,MAAM,cAAc,MAAM,WAAW;CACrC,MAAM,UAAU,MAAM,SAAS,GAAG,YAAY,IAAI,KAAK,KAAK,KAAK;CAEjE,MAAM,EAAE,UAAU,MAAM,kBAAkB,MAAM,YAAY;CAE5D,MAAM,aAAa,MAAM,kBACvB,MAAM,SACN,SACA,MAAM,aACN,OACA,MAAM,gBAAgB,EAAE,EACxB,MAAM,mBAAmB,EAAE,CAC5B;CACD,MAAM,EAAE,QAAQ,QAAQ,aAAa,MAAM,gBACzC,YACA,MAAM,YACP;AACD,KAAI,aAAa,EACf,OAAM,IAAI,MACR,2CAA2C,MAAM,QAAQ,GAAG,QAAQ,SACzD,SAAS,MAAM,UAAU,SACrC;AAEH,QAAO;EAAE,SAAS,MAAM;EAAS;EAAS;EAAY;EAAQ;EAAQ;EAAU;;;;;;;AAQlF,eAAsB,iBAAiB,YAAmC;AACxE,KAAI,CAAC,WAAY;CACjB,MAAM,WAAA,GAAA,GAAA,SAAkB;AACxB,KAAI,CAAC,WAAW,WAAW,QAAQ,CACjC,OAAM,IAAI,MACR,0CAA0C,WAAW,gBAAgB,UACtE;AAEH,QAAA,GAAA,YAAA,IAAS,YAAY;EAAE,WAAW;EAAM,OAAO;EAAM,CAAC;;AA2BxD,SAAS,kBACP,KACA,aACA,SAC+D;AAC/D,QAAO,IAAI,SAAS,gBAAgB,kBAAkB;EACpD,MAAM,QAAA,GAAA,cAAA,OACJ,OACA;GACE;GACA;GACA;GACA;GACA;GACA;GACD,EACD;GACE;GACA,KAAK,EAAE,GAAG,QAAQ,KAAK;GACxB,CACF;EACD,IAAI,SAAS;EACb,IAAI,SAAS;AACb,OAAK,OAAO,GAAG,SAAS,UAAU;AAChC,aAAU,MAAM,UAAU;IAC1B;AACF,OAAK,OAAO,GAAG,SAAS,UAAU;AAChC,aAAU,MAAM,UAAU;IAC1B;AACF,OAAK,GAAG,SAAS,cAAc;AAC/B,OAAK,GAAG,UAAU,SAAS;AACzB,kBAAe;IAAE;IAAQ;IAAQ,UAAU,QAAQ;IAAI,CAAC;IACxD;GACF;;;;;;;;;;;;;;;AAgBJ,eAAsB,iBACpB,OACiC;CACjC,IAAI,gBAAgB,MAAM;CAC1B,IAAI,oBAAoB;AAExB,KAAI,CAAC,eAAe;AAClB,sBAAoB;EACpB,MAAM,EAAE,UAAU,MAAM,kBAAkB,MAAM,YAAY;AAC5D,kBAAgB,OAAA,GAAA,YAAA,UAAA,GAAA,KAAA,OAAA,GAAA,GAAA,SACD,EAAE,8BAA8B,CAC9C;EACD,MAAM,eAAe,MAAM,YAAY,QAAQ,YAAY,GAAG;AAC9D,SAAA,GAAA,YAAA,YAAA,GAAA,KAAA,MACO,eAAe,SAAS,EAC7B;GACE,YAAY,MAAM;GAClB,GAAG,aAAa,eAAe;GAC/B;GACD,CAAC,KAAK,KAAK,CACb;;AAGH,KAAI;EACF,MAAM,EAAE,QAAQ,QAAQ,aAAa,MAAM,kBACzC,eACA,MAAM,aACN,MAAM,QACP;EAID,MAAM,cACJ,wDAAwD,KACtD,GAAG,OAAO,IAAI,SACf;AAEH,MAAI,aAAa,KAAK,CAAC,YACrB,OAAM,IAAI,MACR,+CAA+C,MAAM,QAAQ,SAClD,SAAS,MAAM,UAAU,SACrC;AAGH,SAAO;GACL,SAAS,MAAM;GACf;GACA;GACA;GACA;GACD;WACO;AACR,MAAI,qBAAqB,cACvB,QAAA,GAAA,YAAA,IAAS,eAAe;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC,CAAC,YAClD,KAAA,EACP"}