Files

T

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-09-07 19:36:14 -04:00

Vellum repository guidance

Use Bun exclusively for dependency installation and project scripts. Do not introduce npm, pnpm, or Yarn lockfiles or commands.
Keep event-owned database reads and writes scoped by event_id (or the hosting user_id for event records).
Store timestamps as timezone-aware values.
Do not import @album/database into client components.
Cross-application payloads belong in @album/contracts, not in duplicated local interfaces.
Never log contributor names, emails, or object keys in bulk. Log photo and event ids only.
Send testing email only to Mailpit through the non-production mail configuration. Never send tests through a production provider.
Guest gallery queries must return approved photos only.
Uploads go directly to object storage via short-lived presigned PUTs. Do not stream original files through Next.js.