sideEffects字段与摇树优化安全治理（副作用-误删-白名单）最佳实践

实现示例type Pkg = { sideEffects?: boolean | string[]; files: string[] }

function hasSideEffectFile(files: string[]): boolean {

return files.some(f => /\.(css|scss|less|sass)$/i.test(f) || /polyfill|shim|global/i.test(f))

}

function validPatterns(list: string[]): boolean {

return list.length > 0 && list.every(p => /^\.\//.test(p) || /\*/.test(p))

}

function evaluate(pkg: Pkg): { ok: boolean; errors: string[] } {

const errors: string[] = []

if (typeof pkg.sideEffects === 'boolean') {

if (pkg.sideEffects === false && hasSideEffectFile(pkg.files)) errors.push('side-effects:false-with-files')

} else if (Array.isArray(pkg.sideEffects)) {

if (!validPatterns(pkg.sideEffects)) errors.push('patterns')

}

return { ok: errors.length === 0, errors }

}

审计与发布治理副作用文件与字段不一致时阻断；白名单模式需规范化与审批。入口一致性与运行验证通过后再启用摇树优化。