[RRFC] Add support to plugin dependencies.

Motivation ("The Why")

Add support to plugin dependencies.
More specific title would be: add support to optional (not installed by default) global-style dependencies.
This would allow a running application installed at current (node_modules) to install an optional dependency and load it.

• Plugin dependencies should be installed at root level.
• They need to be installed with global style, so the node_modules tree won't mutate.
• Can or should be managed by the application that installed it.
• It would be great to have it inside package-lock.json for reproducibility.
  • Can or should be ignored by npm ci, and forced by npm ci --with-plugins.

Example

Using a real yeoman project generation:

mkdir new-project
cd new-project
npm install yo --save-dev
npx yo node --experimental

• npx yo node is using a generator called node that is provided by generator-node package.
• --experimental flag uses an auto install feature that installs generator-node inside a hidden global-style node_modules.
  • Once installed, yo loads it and executes.
  • yo is running so if we mutate current node_modules, it will break.
  • node generator can install another generator, so if we mutate the hidden node_modules will break node generator.

This hidden global-style node_modules is a workaround, I want to get rid of it.

A implementation would be to add dependenciesMeta like peerDependenciesMeta:

{
  devDependencies: {
    'generator-node': '2.8.0'
  },
  dependenciesMeta: { // Unified meta for *Dependencies
    'generator-node': {
      globalStyle: true,
      optional: true,
      autoInstall: false
    }
  }
}

How

Current Behaviour

• No support this feature.

Desired Behaviour

• Add support to global_style dependency.

References

• https://github.com/npm/arborist/issues/121

The proposal names npm ci, npx yo node, package-lock.json, and the hidden global-style node_modules as the relevant entry points; no implementation files or tests are identified. Start by reading the proposal and its referenced arborist issue, then define the dependency metadata and installation behavior before implementation can be considered done.