What TailorMD generates

# Data Pipeline

TailorMD recipe: **Python Data**. Python 3.12. The bar is reproducibility.

## Stack

- **Python:** 3.12 (pinned)
- **Workflow:** batch ETL
- **Orchestrator:** Prefect
- **Data store:** Parquet on S3
- **Env:** uv with a committed lockfile

## Non-negotiables

Reproducibility
- Pin Python 3.12 and commit the lockfile. No undocumented `pip install`.
- Set a random seed anywhere randomness affects results.
- Treat raw data as immutable; every derived dataset is regenerated from code.

Data safety
- Never commit data, credentials, or `.env`.
- Validate with pydantic/pandera at every boundary — fail loud on contract violation.
- No PII in logs or committed fixtures.

# My Library

TailorMD recipe: **OSS Library**. A library with a deliberate public API and semver discipline.

## Stack

- **Language:** TypeScript
- **Package manager:** pnpm
- **Test runner:** Vitest
- **License:** MIT

## Non-negotiables

API surface
- Every exported symbol is intentional. Breaking changes require a major semver bump.
- Document public API in README and TSDoc; keep internals unexported or `@internal`.
- Changelog entries for every release — Added / Changed / Fixed / Breaking.

Contributors
- Conventional Commits. PRs need tests for behavior changes.
- CI must pass: lint, typecheck, test, build before merge.

# Acme Billing

TailorMD recipe: **Next.js SaaS**. App Router SaaS — type safety, thin handlers, billing you can trust.

## Stack

- **Framework:** Next.js (App Router), React Server Components, TypeScript `strict`
- **Auth:** Clerk
- **Database:** Postgres via Drizzle
- **Payments:** Stripe
- **Deploy:** Vercel

## Non-negotiables

Security
- Never commit `.env*`. All env access goes through `lib/env.ts` (Zod-parsed).
- Authorize every route handler and Server Action before touching data.
- Verify webhook signatures (Stripe) before processing. Treat unsigned payloads as hostile.
- Enforce tenant scoping in queries — filter every row by current org/user id.

Quality
- Server Components by default. `"use client"` only for interactivity.
- Mutations via Server Actions or route handlers, then `revalidatePath` / `revalidateTag`.
- Keep route handlers thin: parse → authorize → delegate to `lib/` → respond.

# Project API

TailorMD recipe: **Django API**. Django + DRF with layered apps and JWT auth.

## Stack

- **Framework:** Django 5 + Django REST Framework
- **Auth:** JWT (simplejwt)
- **Database:** Postgres
- **Tasks:** Celery + Redis

## Non-negotiables

Architecture
- One app per domain (`users`, `billing`, `core`). No god-models.
- Serializers validate input; views stay thin — delegate to services in `services.py`.
- All list endpoints paginated; N+1 queries forbidden (use `select_related` / `prefetch_related`).

Security
- Permission classes on every viewset. Default-deny, opt-in per action.
- Never log tokens or passwords. Rotate secrets via env, not commits.