Keep a single lockfile at the repo root

Related rules

From the same buckets as this rule.

• High

  Disallow per-package registries and proxies

  Registry configuration (e.g., .npmrc, .yarnrc.yml) must live at the monorepo root. Forbid .npmrc files inside workspace packages overriding registry auth or URL.

  monorepo-hygienedependency-supply-chain+1
• High

  Enforce a single package manager via packageManager field

  Root package.json must define the packageManager field (e.g., "pnpm@9.x") and the repo must not contain other lockfiles or tool config (e.g., yarn.lock, package-lock.json) conflicting with that choice.

  monorepo-hygieneci-cd-build-hygiene+1
• High

  Forbid cross-package relative imports in JS/TS

  In JS/TS workspaces, imports must use workspace package names (as defined in each package.json and exports) rather than relative paths crossing package boundaries.

  monorepo-hygienemodule-architecture+1