# Vellum repository guidance

- Use Bun exclusively for dependency installation and project scripts. Do not
  introduce npm, pnpm, or Yarn lockfiles or commands.
- Keep event-owned database reads and writes scoped by `event_id` (or the
  hosting `user_id` for event records).
- Store timestamps as timezone-aware values.
- Do not import `@album/database` into client components.
- Cross-application payloads belong in `@album/contracts`, not in duplicated
  local interfaces.
- Never log contributor names, emails, or object keys in bulk. Log photo and
  event ids only.
- Send testing email only to Mailpit through the non-production mail
  configuration. Never send tests through a production provider.
- Guest gallery queries must return approved photos only.
- Uploads go directly to object storage via short-lived presigned PUTs. Do not
  stream original files through Next.js.