Yarn Plug'n'Play依赖隔离与隐性依赖防护治理（pnp-解析-白名单）最佳实践

实现示例type PnpMap = Map<string, Set<string>> function declared(pnp: PnpMap, pkg: string, dep: string): boolean { const set = pnp.get(pkg); return !!set && set.has(dep) } function evaluate(pnp: PnpMap, requests: { pkg: string; dep: string }[]): { ok: boolean; errors: string[] } { const errors: string[] = []; for (const r of requests) { if (!declared(pnp, r.pkg, r.dep)) errors.push(`${r.pkg}:${r.dep}`) } return { ok: errors.length === 0, errors } } 审计与运行治理审计未声明依赖访问并阻断；变更需审批与回归校验。生产构建按映射执行隔离解析；拒绝隐性依赖。