Contracts and generated types

Rust contracts and shared TypeScript validation define the boundaries between the injector, runtime, and plugins.

Make a contract change

1. Locate the owning Rust contract and its existing use.
2. Update the contract deliberately, including compatibility implications.
3. Regenerate TypeScript declarations.
4. Update Zod validation and affected RPC handlers.
5. Update the public SDK only when the capability is intended for plugin authors.
6. Test valid, invalid, and incompatible inputs.

pnpm contracts:generate
pnpm typecheck

The generated TypeScript output lives in packages/schemas/src/generated.ts. Do not hand-edit it. CI regenerates it and fails if the committed file differs.

Validation is separate from typing

Generated types cannot validate untrusted messages. Zod schemas enforce runtime boundaries, and main-process operations apply additional authorization and resource checks.

Keep constraints consistent across the manifest, shared schemas, sandbox client, host handlers, and native code. A widened TypeScript type alone does not implement a new operation.

Version concepts

Product/package version is 2.0.0-beta.1. SDK_API_VERSION and executable plugin apiVersion remain 2. Manifest schemaVersion remains 1. Do not increment protocol versions as a side effect of changing release labels.

Use compatibility tests for any actual format change and document its migration separately.