[FEATURE] VSR: Release Manager

[darcyclarke]

Description

Allow for two staged publishing by introducing a blessed top-level key explicitly for "staged packages" in packuments (ex. stagedVersions). Published versions to the staging version have specific requirements (ex. below with modifications to a staged versions dist fields).

// ex. packument changes...
{
  "stagedVersions": {
    "1.0.0": {
      "description": "...",
      "dependencies": {},
      "devDependencies": {},
      "dist": {
        "gitHead": "7e89a7531bec760ba87f9021e7d73979e2bd0e14",
        "integrity": "sha512-gUkXEu+5b+jBjcXJek4f5V3TLswqLvEPYMkF8fmCP4TG9ja8coLRrytXzSVlqACcIxt7fC55xHOCBLBPTou62g==",
        "tarball": "https://registry.vlt.io/pkg/-/staged/pkg-1.0.0.tgz",
        "time": "2019-08-20T04:09:19.830Z",
        "status": "pending",
        "tag": "latest",
        "user": "cibot"
      },
    }
  }
}

Changes/Requirements

• add --stage flag to vlt publish
• add vlt view <pkg> & vlt view <pkg> versions (which should show staged versions)
• add vlt promote <pkg>
• add 2fa for publishing & promotion
• add 2fa enforcement for promotion
• add UI

Prior Art

• RFC: Add staging workflow for CI and human interoperability npm/rfcs#92