Enforcing workspace member visibility in Biome vs Cargo for private API boundaries

Biome workspace member visibility enforcement

Biome's workspace configuration supports include and exclude fields in workspace.json to control member exposure. Additionally, the publish configuration can restrict accidental public access by setting publish = false for private members. However, Biome's resolver behavior for workspace members differs from Cargo's, creating potential for inconsistent public API surface when using use statements across members.

The core constraint is maintaining Rust's pub(crate)-like visibility semantics at the workspace level. While Cargo provides native mechanisms through its dependency resolution and crate visibility rules, Biome lacks an equivalent native configuration-level enforcement. This creates uncertainty about which members should remain private when consumed as dependencies by other workspace members or external packages.

The unresolved question centers on whether Biome should adopt a configuration-driven visibility model similar to Rust's module system, or rely on Cargo's existing pub(crate) semantics with Biome acting as a configuration layer only.

Key questions

• Should Biome implement native workspace member visibility restrictions comparable to Rust's pub(crate) semantics?
• How can configuration drift between Biome's workspace handling and Cargo's dependency resolution be mitigated to prevent unexpected public API exposure?
• What verification strategy should be used to ensure Biome's workspace member exclusion behavior aligns with expected privacy boundaries?