npm cli future changes

[wraithgar]

Resetting the old issue so we can consolidate it into a better task list.

These are changes in consideration for future semver major npm releases.

Breaking changes

• stop reading process.env.NODE in config for nodeBin
• remove man pages
• Remove install scripts support
• Support for reading stdin across all commands (ie. https://github.com/npm/rfcs/blob/3d5b2130504139bdc8a3b599923aa07d2ff79c96/accepted/0000-dependency-selector-syntax.md#commands-could-read-from-stdin)
• Support Package Distributions by default
• Consider changing strict-ssl default based on environment variables fix: let fetch option respect NODE_TLS_REJECT_UNAUTHORIZED env as def… make-fetch-happen#257
• feat: add bun.lockb to ignorelist npm-packlist#168
• Revert all of the hacks around "globstar" in packlist. Just use node-glob's patterns. This is just a [BUG] npm pack doesn't match directory prefiex (dist-* doesn't match dist-cjs/index.js) cli#7514 [BUG/QUESTION] since npm 9.x some files[] globs undermatch npm-packlist#152 at this point.
• Make --silent truly silent (eg dont set up any process listeners) and create a net-new way of hiding only logging output. (The opposite could also be done). Then go through and remove all npm.silent checks. [BUG] Inconsistent --silent for npm install cli#4877 (comment)
• Make run-script banners a log event. They have been swapped to stderr for json mode, but I think they should always be on stderr. I think an open question would be if they should be called with output.error or as an actual log (maybe with a custom META prefix)? [BUG] When run script loglevel is ignored unless set to "silent" cli#3354 (comment)
• Apply --ignore-scripts to the prepare script when packing and publishing [BUG] --ignore-scripts is not respected by npm publish cli#3707 [BUG] npm pack and publish should not run hooks, or hooks need to have opt-out cli#7211 (comment)
• Make pack --json return an object like publish --json instead of an array
• Dont unwrap any single item arrays in view --json
• Set all json output on known top-level keys. I think those should be result and error to start (🚲 those names).
• get rid of "populate deps on init" https://github.com/npm/init-package-json/blob/main/lib/default-input.js#L11-L39
• add bun.lock to default pack ignorelist feat: add bun.lock to ignorelist npm-packlist#257
• [BUG] npx needs to stop mixing local, global, and npx contexts #937
• change default licensing #970
• Make init.author prompt like init.license init-package-json#30

Features

• New npm link experience
• Add new "lifecycle events" API - differentiate between scripts & events - user/project & dependency defined usecases)
• First-class import-maps Support
• Warn/error on unecessary config items in publishConfig

[wraithgar]

npm/cli#8090

[wraithgar]

Remove url.parse from nopt

[wraithgar]

npm/cmd-shim#164