Why I can use classes from libraries which are not directly added in project.json (ASP.NET Core)
<p>I have three layers in my app: <code>Repositories -&gt; Services -&gt; Web</code>. Repositories and Services are created as an 'Class Libary (package)' in VS 2015 (this application should run also on OSX/Linux that's why I have to create that kind of library). I addedd dependency in Services to Repository. Here is part of project.json in Services:</p>

<pre><code>   "dependencies": {
      "App.Repositories": ""
  },
</code></pre>

<p>And I added dependency in Web to Services. Here is part of project.json in Web (MVC6):</p>

<pre><code>  "dependencies": {
    "Microsoft.AspNet.IISPlatformHandler": "1.0.0-rc1-final",
    "Microsoft.AspNet.Mvc": "6.0.0-rc1-final",
    "Microsoft.AspNet.Server.Kestrel": "1.0.0-rc1-final",
    "Microsoft.AspNet.StaticFiles": "1.0.0-rc1-final",
    "Microsoft.Extensions.Configuration.FileProviderExtensions" : "1.0.0-rc1-final",
    "Microsoft.Extensions.Logging": "1.0.0-rc1-final",
    "Microsoft.Extensions.Logging.Console": "1.0.0-rc1-final",
    "Microsoft.Extensions.Logging.Debug" : "1.0.0-rc1-final",
    "App.Services": ""
  },
</code></pre>

<p>Thanks to this I can write code like that in Services:</p>

<pre><code>using App.Repositories;

namespace App.Services
{
    public class Service
    {
        public Service()
        {
            var repository = new Repository();
            repository.DoSomething();
        }
    }
}
</code></pre>

<p>And this is ok, because "reference" between projects exists. However I can also use classes placed in Repositories in Web, like that:</p>

<pre><code>using Microsoft.AspNet.Mvc;
using App.Repositories;

namespace App.Web.Controllers
{
    [Route("api/[controller]")]
    public class ValuesController : Controller
    {
        public ValuesController()
        {
            var repository = new Repository();
            repository.DoSomething();
        }
    }
}
</code></pre>

<p>Questions:</p>

<ol>
<li>Is it normal behaviour in ASP.NET Core 1? </li>
<li>How to prevent using classes from Repositories in Web (or general between not directly added libraries)? </li>
</ol>