18 lines
883 B
Markdown
18 lines
883 B
Markdown
# Vellum repository guidance
|
|
|
|
- Use Bun exclusively for dependency installation and project scripts. Do not
|
|
introduce npm, pnpm, or Yarn lockfiles or commands.
|
|
- Keep event-owned database reads and writes scoped by `event_id` (or the
|
|
hosting `user_id` for event records).
|
|
- Store timestamps as timezone-aware values.
|
|
- Do not import `@album/database` into client components.
|
|
- Cross-application payloads belong in `@album/contracts`, not in duplicated
|
|
local interfaces.
|
|
- Never log contributor names, emails, or object keys in bulk. Log photo and
|
|
event ids only.
|
|
- Send testing email only to Mailpit through the non-production mail
|
|
configuration. Never send tests through a production provider.
|
|
- Guest gallery queries must return approved photos only.
|
|
- Uploads go directly to object storage via short-lived presigned PUTs. Do not
|
|
stream original files through Next.js.
|