Monorepo Dependency Boundary Auditor

The problem

Large monorepos often degrade into a "distributed monolith" where uncontrolled imports, circular dependencies, and version skew break build caching and make releases unpredictable. Manually auditing thousands of internal package boundaries to find forbidden deep imports or layering violations is nearly impossible at scale.

What it does

• Identifies package-level and file-level circular dependencies that block clean builds and deployments.
• Detects forbidden imports, such as domain leakage, layering drift, or production code importing test helpers.
• Audits "shared" and "core" packages for excessive fan-in/fan-out and ownership ambiguity.
• Surfaces version skew across the workspace, including conflicting peer dependencies and duplicate runtime libraries.
• Generates a prioritized remediation sequence and a 100-point boundary-health score.

Frameworks & tools

Supports workspaces using pnpm, Yarn, npm, Nx, and Turborepo. Works with dependency-cruiser, ESLint boundary rules, and TypeScript project references.

Why this beats prompting it yourself

Generic LLM prompts often miss subtle build-graph risks or fail to distinguish between acceptable type-only imports and dangerous runtime cycles. This skill applies a structured rubric to evaluate dependency direction, release coupling, and ownership, ensuring architectural drift is quantified rather than guessed.

Use cases

• Perform a pre-migration audit before moving to a new monorepo manager like Nx or Turbo.
• Identify the root cause of slow CI builds and cache invalidation issues.
• Review a complex Pull Request that introduces new internal package relationships.
• Map ownership and boundaries during a team reorganization or repository split.

Known limitations

Requires access to package manifests, lockfiles, or a dependency graph. It identifies architectural risks but does not perform automated refactoring or file movement.