Contract Enforcement

❌ Forbidden Patterns

Inline Schema in Server Action

// ❌ FORBIDDEN — schema defined inline instead of from contracts
"use server";

const LoginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
});

export async function login(input: unknown) {
  const parsed = LoginSchema.safeParse(input);
  // ...
}

Inline Interface in Component

// ❌ FORBIDDEN — interface defined inline instead of from contracts
interface ChatMessage {
  id: string;
  role: "user" | "assistant";
  content: string;
}

export function MessageBubble({ message }: { message: ChatMessage }) {
  // ...
}

Inline Type in Core Package

// ❌ FORBIDDEN — type defined locally in core
type UserProfile = {
  id: string;
  email: string;
  name: string;
};

export function getUserProfile(): Promise<UserProfile> {
  // ...
}

✅ Required Patterns

Server Action with Contract Import

// ✅ REQUIRED — schema from @template/contracts
"use server";

import { LoginRequestSchema, type LoginResponse } from "@template/contracts";

type ActionResult<T> =
  | { success: true; data: T }
  | { success: false; error: string };

export async function login(
  input: unknown
): Promise<ActionResult<LoginResponse>> {
  const parsed = LoginRequestSchema.safeParse(input);
  if (!parsed.success) {
    return { success: false, error: "Invalid credentials" };
  }
  // ...
}

Component with Contract Import

// ✅ REQUIRED — type from @template/contracts
import { type ChatMessage } from "@template/contracts";

export function MessageBubble({ message }: { message: ChatMessage }) {
  // ...
}

Core Package with Contract Import

// ✅ REQUIRED — type from @template/contracts
import { type UserProfile } from "@template/contracts";

export function getUserProfile(): Promise<UserProfile> {
  // ...
}

Violation Detection Signs

Look for these patterns that indicate contract violations:

Exception: Local component props (type ButtonProps) and UI-only state types are NOT violations — they don't cross package boundaries.

When to Invoke

Checklist

• No inline DTOs in Server Actions
• No inline DTOs in core package
• No inline schemas in components
• All Server Actions validate with contract schemas
• All API data types imported from @template/contracts
• Contracts exist in shared location

Resources

• Contract Definitions: See shared-contracts skill
• Package Location: packages/contracts/