feat: add JSR protocol support for package specifiers

[eser]

Motivation

Given that JSR is an MIT-licensed open-source solution and is already supported by other package managers such as Volt and pnpm, I believe npm should also adopt this feature to maintain consistency within the JavaScript ecosystem and provide a seamless user experience.

Current Behavior

Before this change, installing JSR packages is possible by adding the following to the package.json:

{
  "dependencies": {
    "@scope/package": "npm:@jsr/scope__package@1.0.0"
  }
}

This approach is rather messy and relies on the npm compatibility registry API to download packages from the JSR registry.

Proposed Solution

The proposed solution would be to handle installing packages from JSR natively. Installing a package from JSR would be simplified to:

npm i jsr:@scope/package

Which then installs a JSR package into the package.json as follows:

{
  "dependencies": {
    "@scope/package": "jsr:@scope/package@1.0.0"
  }
}

Dependencies

This PR depends on npm/npm-package-arg#214 being merged first.

Reference

This implementation is based on the approach discussed in pnpm/pnpm#8941.

[wraithgar]

Thanks for tackling this. Looks like the bulk of the work is in the npm-package-arg parsing, and those specifics can be discussed there.

As far as this PR, this isn't going to work as submitted. Scoped registry config is its own thing already in npm, and trying to define a specific one muddies the waters quite a bit. What we will likely want to do is have a check in pacote that will refuse to fetch parsed jsr: references unless that registry scope has been configured.

The new test file is also not going to work like that. The tests are 1:1 analogs of the commands. In any case, most of those tests belong in npm-package-arg, not here. They are parsing concerns. The remaining test for requiring a @jsr scoped registry to be configured will be in pacote. I don't think any changes here will need to happen unless there are specific docs changes we want to make.

For now let's focus on the npm-package-arg PR and go from there to pacote.