Support *all* conf keys in publishConfig

This adds a flatOptions.flatten() method, which takes an object full of
config keys, and turns it into an options object.  This method expects
an object that already inherits from npm's defaults, and is thus
expected to be internal only.

This commit also removes some config keys which were used by npm
dependencies at the start of the v7 beta process, but are no longer:

- all lockfile configs (since we don't use lockfiles any more! for
  anything! and good riddance, they're a rats' nest of race conditions)
- cacheMax/cacheMin (we only use preferOffline/offline/online now, so
  these are strictly legacy support as input and never shared with deps)

Once this lands in cli, we can remove the publishConfig handling logic
in npm-registry-fetch, as it will be redundant.

lib/publish.js

@@ -12,6 +12,9 @@ const output = require('./utils/output.js')
 const otplease = require('./utils/otplease.js')
 const { getContents, logTar } = require('./utils/tar.js')
 
+// this is the only case in the CLI where we use the old full slow
+// 'read-package-json' module, because we want to pull in all the
+// defaults and metadata, like git sha's and default scripts and all that.
 const readJson = util.promisify(require('read-package-json'))
 
 const completion = require('./utils/completion/none.js')
@@ -46,9 +49,22 @@ const publish = async args => {
   return tarball
 }
 
+// for historical reasons, publishConfig in package.json can contain
+// ANY config keys that npm supports in .npmrc files and elsewhere.
+// We *may* want to revisit this at some point, and have a minimal set
+// that's a SemVer-major change that ought to get a RFC written on it.
+const { flatten } = require('./utils/flat-options.js')
+const publishConfigToOpts = publishConfig =>
+  // create a new object that inherits from the config stack
+  // then squash the css-case into camelCase opts, like we do
+  flatten(Object.assign(Object.create(npm.config.list[0]), publishConfig))
+
 const publish_ = async (arg, opts) => {
   const { unicode, dryRun, json } = opts
-  let manifest = await readJson(`${arg}/package.json`)
+  const manifest = await readJson(`${arg}/package.json`)
+
+  if (manifest.publishConfig)
+    Object.assign(opts, publishConfigToOpts(manifest.publishConfig))
 
   // prepublishOnly
   await runScript({
@@ -58,7 +74,7 @@ const publish_ = async (arg, opts) => {
     pkg: manifest,
   })
 
-  const tarballData = await pack(arg)
+  const tarballData = await pack(arg, opts)
   const pkgContents = await getContents(manifest, tarballData)
 
   if (!json)
@@ -67,9 +83,11 @@ const publish_ = async (arg, opts) => {
   if (!dryRun) {
     // The purpose of re-reading the manifest is in case it changed,
     // so that we send the latest and greatest thing to the registry
-    manifest = await readJson(`${arg}/package.json`)
-    const { publishConfig } = manifest
-    await otplease(opts, opts => libpub(arg, manifest, { ...opts, publishConfig }))
+    // note that publishConfig might have changed as well!
+    const manifest = await readJson(`${arg}/package.json`, opts)
+    if (manifest.publishConfig)
+      Object.assign(opts, publishConfigToOpts(manifest.publishConfig))
+    await otplease(opts, opts => libpub(arg, manifest, opts))
   }
 
   // publish