package.json engines兼容性治理（node-npm范围-阻断）最佳实践

实现示例type Engines = { node?: string; npm?: string } function semverRangeValid(r?: string): boolean { return !!r && /^(\^|~)?\d+\.\d+\.\d+$/.test(r) } function matchRange(range: string, v: string): boolean { const m = /^(\^|~)?(\d+)\.(\d+)\.(\d+)$/.exec(range) if (!m) return false const op = m[1] || '' const R = { M: parseInt(m[2],10), m: parseInt(m[3],10), p: parseInt(m[4],10) } const V = v.split('.').map(x => parseInt(x,10)) if (op === '^') return V[0] === R.M && (V[1] > R.m || (V[1] === R.m && V[2] >= R.p)) if (op === '~') return V[0] === R.M && V[1] === R.m && V[2] >= R.p return V[0] === R.M && V[1] === R.m && V[2] === R.p } function evaluate(eng: Engines, env: { node: string; npm: string }): { ok: boolean; errors: string[] } { const errors: string[] = [] if (eng.node && (!semverRangeValid(eng.node) || !matchRange(eng.node, env.node))) errors.push('node') if (eng.npm && (!semverRangeValid(eng.npm) || !matchRange(eng.npm, env.npm))) errors.push('npm') return { ok: errors.length === 0, errors } } 审计与CI门禁记录 `engines` 与环境版本；不匹配阻断并输出修复建议。生产环境仅在受控版本窗口内运行。