package.json exports入口治理（白名单-条件-破坏性防护）最佳实践

实现示例type Exports = Record<string, string | Record<string, string>> const allowKeys = new Set<string>(['.', './package.json']) const allowConds = new Set<string>(['import','require','default']) function validTarget(t: string): boolean { return /^\.\/.+/.test(t) } function validEntry(k: string, v: string | Record<string, string>): boolean { if (!allowKeys.has(k)) return false if (typeof v === 'string') return validTarget(v) return Object.keys(v).every(c => allowConds.has(c) && validTarget(v[c])) } function evaluate(exp: Exports): { ok: boolean; errors: string[] } { const errors: string[] = [] for (const [k, v] of Object.entries(exp)) if (!validEntry(k, v)) errors.push(`entry:${k}`) return { ok: errors.length === 0, errors } } 审计与发布治理审计入口变更与条件导出；不合规阻断发布并输出证据。变更需审批与兼容性验证，防止破坏性行为进入产线。