[RRFC] make `--auth-type=web` the default for login + publish to the public registry in npm 9

[MylesBorins]

Motivation ("The Why")

We recently introduced a significant upgrade to the login + publish which streamlines the login + publish experience through the website.

Example

How

Current Behaviour

today you have to do npm login --auth-type=web or npm publish --auth-type=web to take advantage of the new flow.

Desired Behaviour

npm login and npm publish use --auth-type=web by default /w an opt out via --auth-type=legacy

We would likely want to only have this as the behavior for the public registry

References

• n/a

[bnb]

Is the dual intention of this to also move the current workflow to be a "legacy" workflow? If so, is there going to be a better machine-run publishes in the near future?

[MylesBorins]

We are definitely interested in exploring improvements to publishing flows with a focus on CI/CD based workflows but it isn't yet on the public roadmap as we have to complete a number of existing work items and get some up front design done before we can speculate on timelines