Monorepo Boundary Violations
Flags imports that reach into another workspace package through a path the package did not export — deep relative traversals and non-exported subpaths.
A workspace package's public surface is what its package.json exports declare; everything else is internal and free to change. An import that tunnels past the entry points couples the importer to internals, breaks when the package refactors, and silently bypasses the package's compatibility contract. Detection is aggregate-time: per-file import records are collected by the per-file lane, and verdicts are computed against the whole workspace package map — never cached per file, because a verdict depends on other packages' manifests.
Severity guide
- info
- Not emitted by this family.
- warning
- Each violation is a real boundary leak; type-only imports are flagged softer by surfaces.
- critical
- Not emitted by this family.
Examples
Before
import { helper } from '@scope/other-pkg/src/internal/helper';After
import { helper } from '@scope/other-pkg';
// or add './helper' to other-pkg's exports if it is genuinely publicThe deep path couples this package to other-pkg internals; the entry-point import survives refactors.
Remediation
Import through the target package’s exported entry points, or export the subpath deliberately.
Either switch the import to the package entry point, or — when the subpath is genuinely public — declare it in the target package’s exports map so the boundary decision is visible and reviewable. A package exporting its full surface (./*) is boundary-exempt by construction.