chore: sync upstream cella v0.13.0 (d84e7e13)

.git-blame-ignore-revs

@@ -0,0 +1,4 @@
+# Formatting-only commits that `git blame` skips (GitHub reads this file; locally: git config blame.ignoreRevsFile .git-blame-ignore-revs).
+
+# style: line width 150 with shallow objects collapsed (#1229)
+25d183326355a1de182eb15c775b61833d1f681d

.github/workflows/ci.yml

@@ -74,8 +74,8 @@ jobs:
       - name: Run Biome
         run: pnpm biome check .
 
-      - name: Run style checks (terminology / docs / comments)
-        run: pnpm prose:check
+      - name: Run style checks (terminology / docs / comments / frontend)
+        run: pnpm style
 
       - name: Run lens checks (append-only / collision / purity / wire completeness)
         run: pnpm --filter shared lens:check
@@ -288,12 +288,9 @@ jobs:
         if: env.SCW_ACCESS_KEY != ''
         run: pnpm --filter infra preflight --mode production --login
 
-  # Storybook component tests (Vitest browser mode via Playwright). Heavy: runs on the release PR only.
+  # Storybook component tests (Vitest browser mode via Playwright). Heavy: runs on the release PR only, so a
+  # story that breaks on a feature PR fails the release PR; run `pnpm test:storybook` before merging frontend work.
   storybook-test:
-    # Same-repo branch only: release-please pushes its branch into this repo, so a
-    # PR from another repository (whose branch name its author fully controls)
-    # cannot spoof the prefix to trigger the heavy suites. head_ref is set only for
-    # pull_request events.
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.head_ref, 'release-please--branches--main')
     runs-on: ubuntu-latest
     timeout-minutes: 20

backend/README.md

@@ -2,12 +2,24 @@
 
 Hono API server on PostgreSQL (Drizzle ORM): authentication, entity CRUD, file uploads, real-time sync, and all server-side business logic. Runs as part of `pnpm dev`.
 
+## Dependencies
+
+tsup bundles the backend into `dist/`, and the production image installs only `dependencies` (`pnpm install --prod`). So
+`dependencies` lists the packages the bundle loads from disk ([keep-on-disk.ts](../shared/src/keep-on-disk.ts)), and every
+other package is a devDependency, runtime libraries included. The build throws on a `dependencies` entry it would inline.
+`pnpm deps:unused` (knip) reports unused and unlisted packages across the workspaces.
+
 ## Query module conventions
 
 Database access for a module lives in `<module>-queries.ts`. Operations and handlers assemble
 authorization and request filters, then call these query functions. Business rules, HTTP response
 shaping, notifications, and cache invalidation stay outside query modules.
 
+A module's `helpers/` holds database-free code only: key formats, crypto, cookies, URL or HTML
+building, column selections. A function that reads or writes is a query. One that combines queries
+with rules, permission checks or side effects is an operation, also when only other operations call
+it.
+
 When adding or changing a query:
 
 - Accept `ctx` as the first argument and read database and scope values from `ctx.var` inside the

backend/drizzle/20261002100738_bindings_version_drop_mentions/migration.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "actors" ADD COLUMN "bindings_version" uuid DEFAULT gen_random_uuid() NOT NULL;--> statement-breakpoint
+ALTER TABLE "attachments" DROP COLUMN "mentions";--> statement-breakpoint
+ALTER TABLE "tasks" DROP COLUMN "mentions";