A list could leave the instance as a TREK file, which only another TREK reads. Export now asks for a format, and GPX is the second one: the places as waypoints, for OsmAnd, Organic Maps, a Garmin or gpx.studio. Import takes a GPX in the same dialog as a list file. Asked for in discussion #2301. The GPX is written from the very list file the JSON export returns, so what may leave the instance is still decided in one place. Name, description and address, notes, website and category go into GPX's own elements, where every app shows them. Labels, status, phone and the rest travel in a TREK extension namespace, so a GPX made by TREK comes back as the same list. A place without coordinates cannot be a waypoint; it is left out and the export says how many were. A GPX is read on the server, sent as text, with the XML library the trip importer already uses. A document with a DOCTYPE is refused before parsing, which closes both external entities and entity expansion. Size is capped like the list file, and the element count is capped before a tree is built. The reader only turns the GPX into a list file: the browser previews it and imports it through the existing route, so one contract, one transaction and one skipped counter cover both formats. Waypoints and named route points become places; tracks and unnamed route points are counted in the preview and not imported. The two list-file routes get a body ceiling of twice the file limit. The global 100 kB cap refused most real favourites files, and it already refused list files well under the megabyte the contract allows.
@trek/shared
Single source of truth for TREK's API contracts, expressed as Zod schemas and consumed by both the server (request validation + inferred DTO types) and the client (typed requests/responses).
This package is part of the incremental NestJS + React 19 migration (see the "Brownfield Rewrite" board). It is intentionally dormant until modules start importing it — adding it changes nothing for users.
Rules
- One folder per domain:
src/<domain>/<domain>.schema.ts(+.spec.ts). - Domain-agnostic building blocks live in
src/common/. - A route is only considered migrated once its contract lives here.
- Schemas are the source of truth; server DTOs and client types are inferred from them
(
z.infer<typeof schema>), never hand-duplicated.
Consumption (dev)
Both apps resolve @trek/shared to this package's TypeScript source:
- Server (
tsx): viapathsinserver/tsconfig.json. - Client (
vite): viaresolve.aliasinclient/vite.config.ts(+pathsfor the type-checker).
Production packaging (Docker / workspace wiring) is introduced in card F2, when the server first depends on this package at runtime. Until then prod builds are untouched.
Not yet here
The canonical error envelope is finalised in card F5 (it must match TREK's current Express error responses byte-for-byte), so it is deliberately not invented in F1.