Disallow per-package registries and proxies

Related rules

From the same buckets as this rule.

• High

  Enforce a single package manager via packageManager field

  Root package.json must define the packageManager field (e.g., "pnpm@9.x") and the repo must not contain other lockfiles or tool config (e.g., yarn.lock, package-lock.json) conflicting with that choice.

  monorepo-hygieneci-cd-build-hygiene+1
• High

  Forbid cross-package relative imports in JS/TS

  In JS/TS workspaces, imports must use workspace package names (as defined in each package.json and exports) rather than relative paths crossing package boundaries.

  monorepo-hygienemodule-architecture+1
• High

  Keep a single lockfile at the repo root

  Permit exactly one lockfile at the monorepo root (pnpm-lock.yaml, yarn.lock, or package-lock.json). Forbid lockfiles inside workspace packages. Validate against PR changes and existing tree.

  monorepo-hygienedependency-supply-chain+1