package.json exports入口治理（白名单-条件-破坏性防护）最佳实践

实现示例type Exports = Record<string, string | Record<string, string>>

const allowKeys = new Set<string>(['.', './package.json'])

const allowConds = new Set<string>(['import','require','default'])

function validTarget(t: string): boolean { return /^\.\/.+/.test(t) }

function validEntry(k: string, v: string | Record<string, string>): boolean {

if (!allowKeys.has(k)) return false

if (typeof v === 'string') return validTarget(v)

return Object.keys(v).every(c => allowConds.has(c) && validTarget(v[c]))

}

function evaluate(exp: Exports): { ok: boolean; errors: string[] } {

const errors: string[] = []

for (const [k, v] of Object.entries(exp)) if (!validEntry(k, v)) errors.push(`entry:${k}`)

return { ok: errors.length === 0, errors }

}

审计与发布治理审计入口变更与条件导出；不合规阻断发布并输出证据。变更需审批与兼容性验证，防止破坏性行为进入产线。