[RRFC] remove --access public for initial publish of scoped modules

[bnb]

Motivation ("The Why")

Currently, to publish a scoped module for the first time you need to include --access public unless the organization you're publishing it to is on a paid plan, in which case it will be published privately. My guess is that the majority of npm users who are publishing are not, in fact, publishing to paid organizations and having that path be the default makes... little sense at this point in time.

Especially with the intersection of npm workspaces providing a good interface for scoped modules from a single source and the recent malicious usage the registry has seen, I think it would be nice to reduce the barrier to entry to publishing into scopes by normalizing the publishing experience across scoped namespace and global namespace packages and dropping --access private as the default for publishing a scoped module.

There's some compounding reasons why I don't feel like this is a particularly big deal:

• if you have an oopsie you can always change to restricted later
• the global namespace does not have this concept and it's not a problem there
• the DX of having to do this for some projects but not others is confusing and absolutely not intuitive
• npm probably doesn't care about pushing paid teams as much as it was once... required to

How

Current Behaviour

• --access public is required to publish a scoped module on initial publish

Desired Behaviour

• --access public is not required to publish a scoped module on initial publish

[ljharb]

One consequence/benefit of this change might be that organization members would presumably be able to publish a scoped package for the first time - currently, it requires an org admin (or owner) to publish the first one.

[darcyclarke]

Closing as we discuss in the npm RFC calls that we'll get a new flag added to npm init for --init-private=true|false & then in v9 we'll change that alongside changes to access for npm publish

[ljharb]

(in parallel with changing the default so that scoped packages are assumed to be public)