Maurice
96b0e7546e
Reworks how the plugins panel talks about safety, since the old copy oversold it. Drops the "install at your own risk" banner and the generic trust note, and replaces them with: - a collapsible security section that lays out plainly how a plugin is contained, what the permissions actually mean (a hard limit on what a plugin CAN do, not a promise of what it does), where the limits are, and what a hostile plugin could do at worst. - a short note on what "Reviewed" means: a maintainer scanned it for malware each version, not for quality — not a guarantee it's harmless. - the consent dialog for the update flow: when an update asks for rights you never granted, it lists the new permissions and outbound hosts and makes you approve before the plugin turns back on. Full copy in all 22 locales.
@trek/shared
Single source of truth for TREK's API contracts, expressed as Zod schemas and consumed by both the server (request validation + inferred DTO types) and the client (typed requests/responses).
This package is part of the incremental NestJS + React 19 migration (see the "Brownfield Rewrite" board). It is intentionally dormant until modules start importing it — adding it changes nothing for users.
Rules
- One folder per domain:
src/<domain>/<domain>.schema.ts(+.spec.ts). - Domain-agnostic building blocks live in
src/common/. - A route is only considered migrated once its contract lives here.
- Schemas are the source of truth; server DTOs and client types are inferred from them
(
z.infer<typeof schema>), never hand-duplicated.
Consumption (dev)
Both apps resolve @trek/shared to this package's TypeScript source:
- Server (
tsx): viapathsinserver/tsconfig.json. - Client (
vite): viaresolve.aliasinclient/vite.config.ts(+pathsfor the type-checker).
Production packaging (Docker / workspace wiring) is introduced in card F2, when the server first depends on this package at runtime. Until then prod builds are untouched.
Not yet here
The canonical error envelope is finalised in card F5 (it must match TREK's current Express error responses byte-for-byte), so it is deliberately not invented in F1.