chore(plugins): the host plugin API file holds its size baseline again

Tightens the two comments the rawBodyBase64 field and the type parity note
added to runtime/plugin-sdk.ts, lowers its lint:size entry, and points the
shared guide at the client files it names by their full path.

server/scripts/size-baseline.json

@@ -15,7 +15,7 @@
   "src/nest/journey/journey-domain.service.ts": 1799,
   "src/nest/places/places.service.ts": 1598,
   "src/nest/plugins/plugin-runtime.service.ts": 1463,
-  "src/nest/plugins/runtime/plugin-sdk.ts": 1094,
+  "src/nest/plugins/runtime/plugin-sdk.ts": 1093,
   "src/nest/reservations/reservations.service.ts": 1239,
   "src/nest/trips/trips.service.ts": 1009,
   "src/nest/vacay/vacay.service.ts": 1433

server/src/nest/plugins/runtime/plugin-sdk.ts

@@ -1,10 +1,8 @@
 /**
- * The plugin API as the isolated child implements it: its own copy of the published
- * trek-plugin-sdk types, so the child has zero external deps (plugin-sdk's
- * test/host-types.test-d.ts holds the two to the same names and members).
- * PURE — no server imports. This runs inside the isolated child. Every ctx
- * method is plumbing that turns a call into an RPC message to the host; the
- * child holds no db handle, no secrets, no network by default.
+ * The plugin API as the isolated child implements it, its own copy of the trek-plugin-sdk
+ * types (plugin-sdk's test/host-types.test-d.ts holds the two to the same names and members).
+ * PURE: no server imports, zero external deps. Every ctx method is plumbing that turns a call
+ * into an RPC message to the host; the child holds no db handle, no secrets, no network.
  */
 
 /** Mirrors the published package's constant — bumped on any breaking API change. */
@@ -337,8 +335,7 @@ export interface PluginRequest {
    * providers; never Cookie/Authorization/session). Empty on authenticated routes.
    * Verify a provider signature against a secret you hold in `ctx.config`/`ctx.settings`. */
   headers: Record<string, string>;
-  /** The RAW body, base64 — only on `auth:false` routes (webhooks), else null. Run an HMAC
-   * over this, never over the parsed `body` (re-serializing does not reproduce the bytes). */
+  /** Raw body, base64, on `auth:false` routes only (else null): HMAC this, not the parsed `body`. */
   rawBodyBase64?: string | null;
   user: { id: number; username: string; isAdmin: boolean } | null;
 }

shared/CLAUDE.md

@@ -35,7 +35,7 @@ One folder per domain exporting Zod schemas plus inferred types (`export type X
 
 **Schemas mirror the exact wire behavior of existing routes** (`weather/weather.schema.ts` is the example): strings stay strings if the route never coerced them, optional fields reflect partial response subsets, and bespoke 4xx error strings are reproduced in the server controller, not derived from the schema. Don't "tidy up" a schema to be stricter than the contract it documents.
 
-**Response schemas** (`<x>ResponseSchema`, with the row schemas they are built from) describe what a route answers, and the server checks them: a handler declares one with `@ResponseContract(schema)` (`server/src/nest/common/response-contract.ts`), and under `NODE_ENV=test` every response it sends is parsed against it, so the e2e and integration suites fail on drift. They follow the wire exactly as the routes have always sent it, flags as 0/1 and times as stored where that is what goes out, booleans where the service converts. Objects are not strict: an extra key passes, a declared one that is missing or of another type fails. `successResponseSchema` (`{ success: true }`) and `emptyResponseSchema` (a 204) live in `src/common/`. They are exported from the barrel for the client to type its calls with; the client's own copies in `types.ts` have not moved onto them yet.
+**Response schemas** (`<x>ResponseSchema`, with the row schemas they are built from) describe what a route answers, and the server checks them: a handler declares one with `@ResponseContract(schema)` (`server/src/nest/common/response-contract.ts`), and under `NODE_ENV=test` every response it sends is parsed against it, so the e2e and integration suites fail on drift. They follow the wire exactly as the routes have always sent it, flags as 0/1 and times as stored where that is what goes out, booleans where the service converts. Objects are not strict: an extra key passes, a declared one that is missing or of another type fails. `successResponseSchema` (`{ success: true }`) and `emptyResponseSchema` (a 204) live in `src/common/`. They are exported from the barrel for the client to type its calls with; the client's own copies in `client/src/types.ts` have not moved onto them yet.
 
 ## Rules for new contracts
 
@@ -65,7 +65,7 @@ The parity rule governs **existing** routes; it is not a license to mint new deb
 
 ## Money (`src/money/money.ts`)
 
-`toMinor`, `sumMinor`, `splitEqualShares` and `currencyDecimals` are the budget arithmetic both sides must agree on to the cent: amounts are netted in whole hundredths, equal splits hand the leftover hundredths out by rotation from `itemId % n`, and the shares always sum back to the total. The server's settlement uses these directly; `money.spec.ts` holds the share table that used to be duplicated between the server and client tests. The client still carries its own `splitEqualShares` (in euros, `CostsPanel.helpers.ts`) and `currencyDecimals` (`utils/formatters.ts`); folding them onto these is client work, not a second implementation to copy.
+`toMinor`, `sumMinor`, `splitEqualShares` and `currencyDecimals` are the budget arithmetic both sides must agree on to the cent: amounts are netted in whole hundredths, equal splits hand the leftover hundredths out by rotation from `itemId % n`, and the shares always sum back to the total. The server's settlement uses these directly; `money.spec.ts` holds the share table that used to be duplicated between the server and client tests. The client still carries its own `splitEqualShares` (in euros, `client/src/components/Budget/CostsPanel.helpers.ts`) and `currencyDecimals` (`client/src/utils/formatters.ts`); folding them onto these is client work, not a second implementation to copy.
 
 ## Permissions (`src/permissions/permissions.ts`)