This also refactors auth and prompt related files to use
promises and new npm-profile behavior

If the package specification does not match any
existing version, a warning message is added to the log.

## References

Ref #7472
Closes #7180

This PR refactors `exit-handler.js` to be a class so that it can more
easily track its internal state. It uses this state to now fully
distinguish between 3 states: npm never being set, npm not loaded, and
exit handler never called. There are some new error messages shown via
console.error if we know we are in an unexpected state.

This also continues the refactoring started in #7415 to separate
concerns between `npm` and `CLI`. Identifying the error message and
logging it have been move to `npm` but catching that error and setting
the `process.exitCode` are still handled in `exit-handler.js` and
`cli/entry.js`.

It also moves `command.cmdExec` to `npm` since it never called from
within any `command` instance. This lets `npm` only ever call
`command.exec` or `command.workspaceExec` now.

This has the effect of adding licenses back into the lockfiles.
Based on code in shrinkwrap.js and inventory.js, it appears that
lockfiles are supposed to store the license. It's likely that in
practice this behavior has not been consistent due to fetching
of minifed manifests and packuments.

I also attempted to remove the license code from shrinkwrap but
that caused many more tests to break. Plus I believe this is the
intended behavior, to have licenses in lockfiles based on bug
reports like #7384

This adds a new packument cache that is an instance of `lru-cache`.
It uses that package's ability to limit content based on size, and has
some multipliers based on research to mostly correctly approximate the
correlation between packument size and its memory usage.  It also limits
the total size of the cache based on the actual heap available.

Closes: #7276
Related: npm/pacote#369

Every page of npm help <x> display the local npm version.

This pull request helps the local reader of the documentation to know
which version of the documentation they are reading.

## References
Closes: #7110

This will make them actually run again

These tests assert what happens if a shellout command like exec throws unexpected errors by checking what is written to stderr. Progress also gets written to stderr but is not always deterministic due to the nature of calling it via setInterval. So this disables progress for these tests so the stderr assertions can be relied on to be the same.

The logging output was making bare string assertions fail

Originally this was in #7468:

We backed off of it while we were rebuilding pacote's packument cache.

Now that that's done we can assess this in isolation.  I think it makes
sense.  The packument is cached here, all this is awaiting is
normalization and ssri calculation.

The only place this potentially does anything is in the premature
loading of manifests in `#buildDepStep` when looking at problem edges.
We can just wait till we need them and not throw a ton of requests in
parallel before we actually need them.

Removing the premature loading in problem edges will have to be a
separate effort, as it is somehow load bearing

Since npm completion is implemented by calling npm completion -- arg1
this will write a logfile for that command. I noticed this as I was trying
to look through my logs for a recent command and found that it had been
removed since I used enough tab completions to fill logs-max.

On Windows, `npm help json` and `npm help global` attempt to display
`npm-json.html` and `npm-global.html` files which leads to an error
because these files have not been generated.

This pull request duplicates the `package-json.md` and `folders.md`
files in order to generate these files and make the above-mentioned
commands functional.

Closes: #7374

Co-authored-by: Luke Karrys <luke@lukekarrys.com>

- make uninstall is no longer possible using current source code
- Fixes #7488

Signed-off-by: Avinal Kumar <avinal.xlvii@gmail.com>




## References

- Refer https://docs.npmjs.com/cli/v7/using-npm/removal#synopsis

Signed-off-by: Avinal Kumar <avinal.xlvii@gmail.com>

Err on the side of not displaying things even if they're not valid
config

This removes the v9 bug report template and changes the v10 template to
specifically mention that it is for bugs for the latest release line.

Previously we would bump these issue templates whenever we did a major
release. I think it makes more sense to have only a single bug template
most of the time and to add templates for old versions when we are
offering bug fix support for them. Currently we don't offer bug fixes
for the v9 release line.

It also removes the `Release 10.x` label which I find to mostly add
noise.
I think it would be better to have no default release line label, and
and instead manually add this label when we identify a bug that only
affects a specific release line that we intend to fix. Or if we are
supporting multiple versions then we can add the label to the bug
template
for old versions.

These will be used to generate normal and json error messages in the
same format from both commands and the exit handler.

This also does a few others things:
- makes `did-you-mean` take a package so it can be sync and called more
easily from the error handlers
- standardize all error messages with 2 space indentation to match the
rest of npm

Our existing example present in npm doc was giving warning, so just
modified that so that we will not get any warning .

Closes: #7302

Dev dep but it fixed the hoisting of @tufjs/models

Our existing example present in npm doc was giving warning.

issue: #7302

Fixes #3867

The first argument to all `log.method()` calls gets formatted
differently with a color. So calls to these should always be a short
descriptive title or an empty string.

This changes a bunch of commands to use the new `output.buffer`
capabilities from `proc-log` as well as the `outputError` helper from
`utils/output-error.js`.

This also adds a few comments about future display related breaking
changes that npm should make.

There is some new behavior around `run-script` and how it outputs
errors. It now displays the error for each workspace similar to how that
error would get displayed when the process exits.

Fixes: #5444

This PR will continue running through all workspaces for `npm view` even
when a workspace encounters an `E404` error. This usually happens when
you run `npm view -ws` but have private workspaces. A future iteration
could log a different message if an `E404` is encountered on a private
workspace, but for this PR I wanted to keep it generic since there are a
number of reasons a request for a package manifest could 404.

Fixes #6630

In refactoring this behavior previously plain strings were no longer
being passed through JSON.stringify even in json mode. This commit
changes that to the previous behavior which fixes the bug in `npm view`.
This also required changing the behavior of `npm pkg` which relied on
this.

Fixes #7537

This converts all remaining commands/utils to use the display layer for
formatting their json output

This has no functional difference but matches where
we landed for the rest of the commands.

…7534)

This will fix the `npm cache add` to cache package with same header as
it's used in `npm install` by adding extra manifest call with
`fullMetadata: true` while caching to match behaviour with install
command which internally request manifest with fullMetadata.

## References
Closes #7465

<!-- What / Why -->
<!-- Describe the request in detail. What it does and why it's being
changed. -->
Updates `publish` command docs:
 - Refers to `npm tag` which is now `npm dist-tag`
 - Add docs specific for `npm publish --tag`

## References
<!-- Examples:
  Related to #0
  Depends on #0
  Blocked by #0
  Fixes #0
  Closes #0
-->

Details explained in issue #7555

Closes #7555

`npm publish --workspaces` will skip workspace packages marked as
private in package.json.
Currently it's skipping those packages only when you have configured
auth for those packages, it would error out with `ENEEDAUTH` if it
doesn't find the valid auth information.

this fix checks for the private property before checking for auth for
the packages that will essentially not going to get published.

Fixes #7199

Invalid scripts warnings are gone that should not be there