Make npm pack honor min-release-age-exclude when resolving packages from a registry. #6939

Make npm pack honor min-release-age-exclude when resolving packages from a registry.

Given:

min-release-age=7
min-release-age-exclude=@myscope/*

 npm pack @myscope/some-package@1.2.3  incorrectly failed with  ETARGET  when the package was newer than seven days, despite matching the exclusion.

Root cause

min-release-age  is flattened into the  before  option consumed by  pacote . However,  pacote  does not interpret  min-release-age-exclude ; callers must remove  before  for matching packages.

 npm pack  performs two manifest resolutions:

1. Directly through pacote.manifest
2. Internally through  libnpmpack 

Both resolutions received the unmodified before option, so the exclusion was never applied.

Fix

Derive effective options for each package spec using the existing Arborist release-age helpers:

• Clear before when the package matches min-release-age-exclude 
• Preserve the cutoff for nonmatching packages
• Pass the same effective options to both manifest resolutions

Using the alias target prevents an excluded alias name from disabling the release-age policy for an unrelated package.

Test coverage

Added regression coverage confirming that:

• A recently published scoped package matching an exclusion glob can be packed
• An excluded alias name does not exempt its non-excluded registry target

The original scenario was also reproduced against a local registry: it failed with ETARGET before this change and successfully produced the tarball afterward.

References

Fixes #9759

Originally posted by @martinrrm in npm/cli#9760