@chris1807/claude-kit 2.0.0

package/templates/hooks/sensitive-data-blocker.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Sensitive Data Blocker Hook (PreToolUse - Bash)
+# Blocks database queries that reference sensitive PII fields like TIN, SSN, etc.
+# Even encrypted values must never be exposed.
+# Exit code 2 = BLOCK the action.
+
+# Read the tool input from stdin
+INPUT=$(cat)
+
+# Extract the command being run
+COMMAND=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    tool = data.get('tool_name', '')
+    inp = data.get('tool_input', {})
+    if tool == 'Bash':
+        print(inp.get('command', ''))
+except:
+    pass
+" 2>/dev/null)
+
+if [ -z "$COMMAND" ]; then
+    exit 0
+fi
+
+# Only check commands that interact with MongoDB
+if ! echo "$COMMAND" | grep -qE 'mongosh|mongo '; then
+    exit 0
+fi
+
+# Case-insensitive check for sensitive field names in the query
+SENSITIVE_PATTERN='\b(TIN|Tin|TaxId|TaxIdentificationNumber|EIN|SSN|SocialSecurityNumber|Social|EncryptedTin|EncryptedSSN|EncryptedTaxId|BankAccountNumber|AccountNumber|RoutingNumber)\b'
+
+if echo "$COMMAND" | grep -qE "$SENSITIVE_PATTERN"; then
+    echo "BLOCKED: Database query references a sensitive PII field (TIN, SSN, bank account, etc.)"
+    echo "These fields contain encrypted sensitive data that must never be queried or displayed."
+    echo "Use explicit inclusion projections with only non-sensitive fields."
+    echo "If you need to work with this data, use the application UI instead."
+    exit 2
+fi
+
+exit 0

package/templates/hooks/sensitive-data-mcp-blocker.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# Sensitive Data MCP Blocker Hook (PreToolUse - MCP MongoDB/MSSQL/Postgres tools)
+# Blocks MCP database tool calls that reference sensitive PII fields.
+# Even encrypted values must never be exposed.
+# Exit code 2 = BLOCK the action.
+
+# Read the tool input from stdin
+INPUT=$(cat)
+
+# Extract tool name and full input JSON
+TOOL_INFO=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    tool = data.get('tool_name', '')
+    inp = json.dumps(data.get('tool_input', {}))
+    print(f'{tool}\n{inp}')
+except:
+    pass
+" 2>/dev/null)
+
+TOOL_NAME=$(echo "$TOOL_INFO" | head -1)
+TOOL_INPUT=$(echo "$TOOL_INFO" | tail -1)
+
+if [ -z "$TOOL_NAME" ]; then
+    exit 0
+fi
+
+# Case-insensitive check for sensitive field names anywhere in the tool input
+SENSITIVE_PATTERN='\b(TIN|Tin|TaxId|TaxIdentificationNumber|EIN|SSN|SocialSecurityNumber|Social|EncryptedTin|EncryptedSSN|EncryptedTaxId|BankAccountNumber|AccountNumber|RoutingNumber)\b'
+
+if echo "$TOOL_INPUT" | grep -qE "$SENSITIVE_PATTERN"; then
+    echo "BLOCKED: MCP database query references a sensitive PII field (TIN, SSN, bank account, etc.)"
+    echo "These fields contain encrypted sensitive data that must never be queried or displayed."
+    echo "Use explicit inclusion projections with only non-sensitive fields."
+    echo "If you need to work with this data, use the application UI instead."
+    exit 2
+fi
+
+exit 0

package/templates/hooks/sensitive-data-output-blocker.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# Sensitive Data Output Blocker Hook (PostToolUse - Bash, Read, Grep, MCP DB tools)
+# Scans tool output for sensitive PII field names that may have been returned
+# by broad database queries, file reads of seed/dump data, or grep results.
+# Exit code 2 = BLOCK (prevents the output from being used).
+
+# Read the tool result from stdin
+INPUT=$(cat)
+
+# Extract output from any tool type (Bash stdout, Read content, Grep results, MCP results)
+OUTPUT=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    tool = data.get('tool_name', '')
+    result = data.get('tool_result', '')
+
+    # Handle different result shapes
+    if isinstance(result, dict):
+        # Bash tool: check stdout
+        text = result.get('stdout', '')
+        # MCP/other tools: check content or stringify the whole result
+        if not text:
+            text = result.get('content', '')
+        if not text:
+            text = json.dumps(result)
+    elif isinstance(result, str):
+        text = result
+    else:
+        text = str(result)
+
+    print(text)
+except:
+    pass
+" 2>/dev/null)
+
+if [ -z "$OUTPUT" ]; then
+    exit 0
+fi
+
+# Check if output contains sensitive field names as keys (indicating PII was returned)
+# These patterns match field names in JSON documents, MongoDB output, C# properties, etc.
+SENSITIVE_PATTERNS=(
+    # JSON/MongoDB style: "TIN": or 'TIN':
+    '"(TIN|Tin|TaxId|TaxIdentificationNumber|EIN|SSN|SocialSecurityNumber|EncryptedTin|EncryptedSSN|EncryptedTaxId|BankAccountNumber|AccountNumber|RoutingNumber)"\s*:'
+    # C# property style: .TIN = or .TaxId =
+    '\.(TIN|TaxId|TaxIdentificationNumber|EIN|SSN|SocialSecurityNumber|EncryptedTin|EncryptedSSN|EncryptedTaxId|BankAccountNumber|AccountNumber|RoutingNumber)\s*='
+    # YAML/config style: TIN: (start of line or after whitespace)
+    '(^|\s)(TIN|TaxId|TaxIdentificationNumber|EIN|SSN|SocialSecurityNumber|EncryptedTin|EncryptedSSN|EncryptedTaxId|BankAccountNumber|AccountNumber|RoutingNumber):\s'
+)
+
+for PATTERN in "${SENSITIVE_PATTERNS[@]}"; do
+    if echo "$OUTPUT" | grep -qE "$PATTERN"; then
+        echo "BLOCKED: Output contains sensitive PII fields (TIN, SSN, bank account, etc.)"
+        echo "The output includes documents or data with sensitive fields."
+        echo "For database queries: use an explicit inclusion projection listing only non-sensitive fields."
+        echo "For code searches: avoid reading seed data, test fixtures, or dump files containing PII."
+        echo "If you need to work with this data, use the application UI instead."
+        exit 2
+    fi
+done
+
+exit 0

package/templates/hooks/test-on-change.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+# Test Runner Hook (PostToolUse - Edit/Write)
+# Suggests running related tests when source files are modified.
+# Does NOT auto-run tests (too slow) — just reminds which tests to run.
+
+INPUT=$(cat)
+
+FILE_PATH=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    inp = data.get('tool_input', {})
+    print(inp.get('file_path', ''))
+except:
+    pass
+" 2>/dev/null)
+
+if [ -z "$FILE_PATH" ]; then
+    exit 0
+fi
+
+EXT="${FILE_PATH##*.}"
+
+# Only suggest for source files, not tests or configs
+if echo "$FILE_PATH" | grep -qE '(Test|test|spec|__tests__)'; then
+    exit 0
+fi
+
+case "$EXT" in
+    cs)
+        if echo "$FILE_PATH" | grep -q "Glasswing"; then
+            echo "Run: dotnet test src/Glasswing.Tests/ --filter \"$(basename ${FILE_PATH%.cs})\""
+        elif echo "$FILE_PATH" | grep -q "Monarch"; then
+            echo "Run: dotnet test src/Monarch.Tests/ --filter \"$(basename ${FILE_PATH%.cs})\""
+        fi
+        ;;
+    ts|tsx)
+        if echo "$FILE_PATH" | grep -q "glasswing-client"; then
+            echo "Run: cd src/glasswing-client && npx vitest run --reporter=verbose"
+        elif echo "$FILE_PATH" | grep -q "monarch-client"; then
+            echo "Run: cd src/monarch-client && npx vitest run --reporter=verbose"
+        fi
+        ;;
+esac
+
+exit 0

package/templates/hooks/uat-reminder.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# UAT Reminder Hook for Glasswing-and-Monarch
+# Fires on the Stop event to remind about UAT after feature implementation
+#
+# This checks if recent conversation context suggests a feature was being
+# implemented and reminds the user to run UAT before marking it complete.
+
+echo "Reminder: If you just completed a feature implementation, run UAT before marking it done."
+echo "Use: 'Use gm-uat-generator to create UAT checklist for [Feature ID]'"

package/templates/infrastructure/CLAUDE-WORKFLOW.md

@@ -0,0 +1,274 @@
+
+## Claude Kit Workflow
+
+This project uses [Claude Kit](https://github.com/Christopher-Waters/claude-kit) — a standardized set of agents, hooks, MCP servers, and workflows installed via `npx @chris1807/claude-kit init`.
+
+### Agent Pipeline
+
+When given a task, Claude Code can delegate through specialized agents:
+
+```
+You (give task)
+  ├── manager → orchestrates workflow, delegates to agents below
+  ├── Explore → finds relevant files
+  ├── Plan → designs the approach
+  ├── mockup → creates HTML screen mockups before implementation
+  ├── backend / frontend / legacy → implements code
+  ├── deployer → commits, pushes, triggers CD pipeline
+  ├── db-admin → queries/fixes MongoDB data
+  ├── devops-tracker → creates/updates Azure DevOps work items
+  ├── test-runner → runs xUnit, Vitest, Playwright tests
+  ├── build-validator → confirms builds pass
+  ├── lint-checker → runs ESLint and dotnet format
+  ├── uat-generator → generates UAT checklists from requirements
+  ├── security-auditor → scans for secrets, vulnerabilities
+  ├── api-tester → tests API endpoints with curl
+  ├── azure-ops → manages Azure infrastructure
+  └── reviewer → reviews code quality
+```
+
+### Sensitive Data Policy
+
+**NEVER query, display, or expose sensitive PII fields from the database — even if the values are encrypted.** This includes TIN, SSN, EIN, TaxId, BankAccountNumber, RoutingNumber, and any `Encrypted*` variants. Even encrypted/hashed values must not appear in output, logs, or summaries. When querying collections that may contain sensitive fields, always use explicit inclusion projections listing only the non-sensitive fields needed. If a user requests access to sensitive data, direct them to use the application UI.
+
+### Automated Hooks
+
+These run automatically — no action needed:
+
+| When | What Happens |
+|------|-------------|
+| **Before any Bash command** | Sensitive data blocker prevents database queries that reference TIN, SSN, or other PII fields |
+| **Before any MCP database tool** | Sensitive data MCP blocker prevents MCP database queries that reference PII fields |
+| **After any Bash/MCP/Read/Grep command** | Sensitive data output blocker scans results for PII field names and blocks exposure |
+| **Before any file write** | Secret blocker scans for hardcoded credentials and blocks them |
+| **Before any file edit** | Protected files guard warns/blocks edits to production configs |
+| **After any file edit** | Auto-formatter runs (dotnet format for .cs, eslint --fix for .ts) |
+| **After any file edit** | Test suggestions appear for related test files |
+| **When Claude stops** | UAT reminder if a feature was implemented |
+| **When Claude stops** | Self-improvement prompt to save learnings to memory |
+
+### MCP Servers Available
+
+| Server | What It Does |
+|--------|-------------|
+| **Azure DevOps** | Work items, pipelines, repos, wiki |
+| **Playwright** | Browser testing (navigate, click, fill, screenshot) |
+| **MongoDB** | Direct database queries and updates |
+| **Microsoft Teams** | Send/read team messages and notifications |
+| **Stripe** | Payment management (when configured) |
+| **Azure** | 40+ Azure services via CLI |
+
+### Memory System
+
+Claude maintains persistent memory across sessions in `~/.claude/projects/.../memory/`. This includes:
+- **User preferences** — how you like to work
+- **Feedback patterns** — what to do and what to avoid (self-improving)
+- **Project context** — decisions, priorities, blockers
+- **References** — URLs, test accounts, external resources
+
+### Development Workflow
+
+1. **Pick a work item** from Azure DevOps (or describe what you need)
+2. **Claude implements** using `/implement AB#<id>` (auto-creates branch)
+3. **Hooks guard** against secrets and bad patterns automatically
+4. **PR merges** into `develop` → deploys to Dev environment
+5. **Create a release** using `/create-release <N>` to group work items
+6. **Deploy the release** using `/deploy-release 23 staging` then `/deploy-release 23 production`
+7. **Test** using Playwright MCP for browser testing
+8. **Track** work items using the devops-tracker agent
+9. **Learn** — Claude saves what worked for next time
+
+### Branching Strategy
+
+#### Target Branch-to-Environment Mapping
+
+All projects should converge to this standard. Each long-lived branch maps to an Azure subscription and environment:
+
+| Branch | Azure Subscription | Environment | CD Pipeline Trigger |
+|---|---|---|---|
+| `develop` | Dev | Development | Auto on merge |
+| `staging` | Staging | Staging | Auto on merge |
+| `main` | Production | Production | Auto on merge (with approval gate) |
+
+> **Note:** Some projects are not yet in sync — they may use `master` instead of `main`, or lack a `staging` branch. Until a project is migrated, the deployer and `/implement` use the **current branch** dynamically and do not assume branch names.
+
+#### Promotion Flow
+
+Code flows through environments via PRs — never by direct push:
+
+```
+feature/AB#1234-...  ──PR──▸  develop  ──PR──▸  staging  ──PR──▸  main
+   (work branch)              (Dev)            (Staging)        (Production)
+```
+
+- **develop → staging**: PR to promote all work ready for QA/stakeholder review
+- **staging → main**: PR to promote to production. May cherry-pick individual commits if only some stories are ready (see Cherry-Pick Deployments below)
+
+#### Release Management
+
+Releases group work items together for coordinated deployment across environments. Releases are tracked in Azure DevOps as iterations (`Release #N`) and work items are tagged with `release-{N}`.
+
+**Creating a release:**
+```
+/create-release 23
+```
+This creates a `Release #23` iteration, assigns the selected work items to it, and tags them with `release-23`.
+
+**Deploying a release to an environment:**
+```
+/deploy-release 23 staging
+/deploy-release 23 production
+```
+This finds all work items in Release #23, cherry-picks their commits into a release branch (`release/23-to-staging`), creates a PR targeting the environment branch, and links all work items.
+
+**Selective deployment:** Since releases are deployed via cherry-pick, you can deploy a full release or a subset. If staging has 5 user stories but only 3 should go to production, create a release with just those 3 and deploy it.
+
+**Release flow:**
+```
+/create-release 23          → Groups work items into Release #23
+/deploy-release 23 staging  → Cherry-picks Release #23 to staging
+  (QA/testing on staging)
+/deploy-release 23           → Auto-detects next env (production), deploys
+```
+
+#### Cherry-Pick Deployments
+
+Cherry-pick specific work items to an environment without a formal release:
+```
+/cherry-pick AB#1234 AB#1235 production
+```
+This finds commits for the specified work items, cherry-picks them into a branch (`cherry-pick/<date>-to-<environment>`), and creates a PR.
+
+#### Promoting Environments
+
+Promote all code from one environment to the next:
+```
+/promote staging production
+/promote                      ← auto-detects source and target from current branch
+```
+This creates a PR from the source branch to the target branch with a summary of all included commits.
+
+#### Rollbacks
+
+Roll back a deployment on any environment:
+```
+/rollback AB#1234 production   ← revert specific work items
+/rollback last staging         ← revert the most recent deployment
+```
+This creates a revert branch, reverts the specified commits, runs pre-flight checks, and creates a PR.
+
+For emergency production rollbacks, the `/rollback` command already runs pre-flight checks and skips UAT. Treat the resulting PR as urgent and flag the user accordingly.
+
+#### Deploying Changes
+
+Commit, push, and deploy the current changes:
+```
+/deploy "Add payment export feature"
+/deploy                       ← auto-generates commit message
+```
+This runs pre-flight checks, commits, pushes the current branch, and triggers the CD pipeline if on an environment branch.
+
+#### Branch Naming Convention
+
+When `/implement AB#<id>` is run, a branch is created off the current branch based on the Azure DevOps work item type:
+
+| Work Item Type | Branch Prefix | Example |
+|---|---|---|
+| Feature | `feature/` | `feature/AB#1234-add-payment-export` |
+| User Story | `story/` | `story/AB#1235-user-can-view-history` |
+| Bug | `bugfix/` | `bugfix/AB#1236-fix-login-redirect` |
+| Hot Fix | `hotfix/` | `hotfix/AB#1237-fix-crash-on-submit` |
+| (other) | `work/` | `work/AB#1238-update-dependencies` |
+
+Format: `{prefix}AB#{id}-{sanitized-title}` (title lowercased, special chars replaced with hyphens, max 50 chars)
+
+> **Note:** The Azure DevOps work item type is "Hot Fix" (two words), but the branch prefix and PR label use `hotfix` (one word, lowercase).
+
+#### PR Targeting
+
+PRs always target the branch you were on when `/implement` was invoked. The base branch is captured dynamically at the start — no assumptions about branch names.
+
+#### Hot Fix Workflow
+
+Hot Fix work items follow the same automated checks (build, lint, tests, review) but skip manual UAT. An abbreviated confirmation is shown instead. Hot Fix PRs get a `hotfix` label. Hot Fixes target the current branch (which should be the project's production branch for production hot fixes).
+
+#### Slash Commands Reference
+
+All deployment and release operations are available as slash commands:
+
+| Command | Usage | What It Does |
+|---|---|---|
+| `/implement` | `/implement AB#1234` | Summarize work item → approve plan → implement → PR |
+| `/review` | `/review 142` | Automated code review on a PR |
+| `/deploy` | `/deploy "commit message"` | Commit, push, trigger pipeline |
+| `/create-release` | `/create-release 23` | Group work items into Release #23 |
+| `/deploy-release` | `/deploy-release 23 staging` | Cherry-pick release to environment |
+| `/add-to-release` | `/add-to-release 24 AB#4599` | Add work items to existing release |
+| `/cherry-pick` | `/cherry-pick AB#1234 AB#1235 production` | Cherry-pick specific work items |
+| `/promote` | `/promote staging production` | Promote all code between environments |
+| `/rollback` | `/rollback AB#1234 production` | Revert commits on an environment |
+| `/status` | `/status release 24` | Check release, pipeline, or work item status |
+| `/cleanup-branches` | `/cleanup-branches` | Delete merged branches |
+
+The CD pipeline is only triggered manually when pushing directly to an environment branch. For feature/work branches, the pipeline triggers on PR merge.
+
+### Pipeline Configuration
+
+Each project must define its environment chain and pipeline IDs so the slash commands (`/deploy`, `/promote`, `/deploy-release`) know which pipelines to trigger and what the promotion order is.
+
+Add this section to your project's `CLAUDE.md`:
+
+```markdown
+## Pipeline Configuration
+
+| Branch | Environment | Pipeline(s) |
+|--------|------------|-------------|
+| develop | Dev | My API (ID), My Client (ID) |
+| staging | Staging | My API (ID), My Client (ID) |
+| main | Production | My API (ID), My Client (ID) |
+```
+
+**Rules for slash commands:**
+- `/deploy` triggers the pipeline(s) listed for the current branch. If the current branch is not in this table, no pipeline is triggered.
+- `/promote` uses this table to determine the next environment (e.g., `develop` → `staging` → `main`).
+- `/deploy-release` and `/cherry-pick` create PRs targeting environment branches listed here.
+- The **order of rows** defines the promotion flow (top to bottom).
+
+**Examples from actual projects:**
+
+CSIPay (4 environments):
+```markdown
+| Branch | Environment | Pipeline(s) |
+|--------|------------|-------------|
+| Dev | Dev | CSIPay API (12), CSIPay Client (13) |
+| QA | QA | CSIPay API (12), CSIPay Client (13) |
+| Staging | Staging | CSIPay API (12), CSIPay Client (13) |
+| master | Production | CSIPay API (12), CSIPay Client (13) |
+```
+
+Glasswing and Monarch (1 environment currently):
+```markdown
+| Branch | Environment | Pipeline(s) |
+|--------|------------|-------------|
+| develop | Dev | CD - Development (28) |
+```
+
+### Environment Setup
+
+Each team member needs to set their own environment variables (never commit these):
+
+```bash
+# MongoDB (required for db-admin agent)
+export MONGODB_CONNECTION_STRING="mongodb+srv://..."
+
+# Microsoft Teams (required for team notifications)
+export TEAMS_TENANT_ID="..."
+export TEAMS_CLIENT_ID="..."
+export TEAMS_CLIENT_SECRET="..."
+
+# Stripe (required when payment integration is active)
+export STRIPE_SECRET_KEY="sk_test_..."
+
+# Azure (use az login instead of env vars)
+az login
+```

package/templates/infrastructure/azure-pipelines-template.yml

@@ -0,0 +1,199 @@
+# Standard Azure DevOps Pipeline Template (example)
+#
+# Multi-stage YAML pipeline that builds once and deploys to the correct
+# environment based on the source branch.
+#
+# Usage:
+# 1. Copy this file to your project root as azure-pipelines.yml
+# 2. Replace all {{PLACEHOLDER}} values with your project-specific values
+# 3. Remove stages you don't need (e.g., QA if your project doesn't have it)
+# 4. Create a new pipeline in Azure DevOps pointing to this file
+#
+# Branch-to-environment mapping:
+#   develop  → Dev
+#   staging  → Staging
+#   main     → Production
+
+trigger:
+  branches:
+    include:
+      - develop
+      - staging
+      - main
+  paths:
+    include:
+      - "{{PROJECT_PATH}}/**"    # e.g., Api/**, Client/**, src/**
+
+pool:
+  vmImage: "windows-latest"      # Use "ubuntu-latest" for Linux-based builds
+
+variables:
+  buildConfiguration: "Release"
+  projectName: "{{PROJECT_NAME}}"                          # e.g., CompassAPI, CSIPayAPI
+  solutionFile: "{{SOLUTION_FILE}}"                        # e.g., CompassPOC.sln, CSIPay.sln
+  WebsitePhysicalPath: "{{PHYSICAL_PATH}}"                 # e.g., F:\Compass\Api
+
+  # Dev environment
+  devWebsiteName: "{{DEV_WEBSITE_NAME}}"                   # e.g., dev.api.compass.caresolutions.com
+  devAppPoolName: "{{DEV_APP_POOL}}"                       # e.g., dev.api.compass.com
+
+  # Staging environment
+  stagingWebsiteName: "{{STAGING_WEBSITE_NAME}}"           # e.g., staging.api.compass.caresolutions.com
+  stagingAppPoolName: "{{STAGING_APP_POOL}}"               # e.g., staging.api.compass.com
+
+  # Production environment
+  prodWebsiteName: "{{PROD_WEBSITE_NAME}}"                 # e.g., api.compass.caresolutions.com
+  prodAppPoolName: "{{PROD_APP_POOL}}"                     # e.g., api.compass.com
+
+stages:
+  # ── Build ──────────────────────────────────────────────
+  - stage: Build
+    displayName: "Build"
+    jobs:
+      - job: BuildJob
+        displayName: "Build and Publish"
+        steps:
+          - script: |
+              dotnet build $(solutionFile) --configuration $(buildConfiguration)
+              dotnet publish $(solutionFile) --configuration $(buildConfiguration) --output $(Build.ArtifactStagingDirectory)
+            displayName: "dotnet build and publish"
+
+          - task: ArchiveFiles@2
+            displayName: "Zip Published Files"
+            inputs:
+              rootFolderOrFile: "$(Build.ArtifactStagingDirectory)"
+              includeRootFolder: false
+              archiveType: "zip"
+              archiveFile: "$(Build.ArtifactStagingDirectory)/$(projectName).zip"
+
+          - publish: $(Build.ArtifactStagingDirectory)/$(projectName).zip
+            artifact: drop
+
+  # ── Dev ────────────────────────────────────────────────
+  - stage: Dev
+    displayName: "Deploy to Dev"
+    dependsOn: "Build"
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))
+    jobs:
+      - deployment: DeployDev
+        displayName: "Deploy to Dev"
+        environment:
+          name: "{{DEV_ENVIRONMENT_NAME}}"                 # e.g., Dev
+          resourceType: VirtualMachine
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - task: DownloadPipelineArtifact@2
+                  inputs:
+                    artifact: "drop"
+                    path: "$(Build.ArtifactStagingDirectory)"
+
+                - task: IISWebAppManagementOnMachineGroup@0
+                  displayName: "Configure IIS"
+                  inputs:
+                    IISDeploymentType: "IISWebsite"
+                    ActionIISWebsite: "CreateOrUpdateWebsite"
+                    WebsiteName: "$(devWebsiteName)"
+                    WebsitePhysicalPath: "$(WebsitePhysicalPath)"
+                    WebsitePhysicalPathAuth: "WebsiteUserPassThrough"
+                    AddBinding: false
+                    CreateOrUpdateAppPoolForWebsite: true
+                    AppPoolNameForWebsite: "$(devAppPoolName)"
+                    DotNetVersionForWebsite: "No Managed Code"
+                    PipeLineModeForWebsite: "Integrated"
+                    AppPoolIdentityForWebsite: "ApplicationPoolIdentity"
+
+                - task: IISWebAppDeploymentOnMachineGroup@0
+                  displayName: "Deploy to IIS"
+                  inputs:
+                    WebsiteName: "$(devWebsiteName)"
+                    Package: "$(Build.ArtifactStagingDirectory)/$(projectName).zip"
+                    TakeAppOfflineFlag: true
+                    XmlVariableSubstitution: true
+
+  # ── Staging ────────────────────────────────────────────
+  - stage: Staging
+    displayName: "Deploy to Staging"
+    dependsOn: "Build"
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/staging'))
+    jobs:
+      - deployment: DeployStaging
+        displayName: "Deploy to Staging"
+        environment:
+          name: "{{STAGING_ENVIRONMENT_NAME}}"             # e.g., Staging
+          resourceType: VirtualMachine
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - task: DownloadPipelineArtifact@2
+                  inputs:
+                    artifact: "drop"
+                    path: "$(Build.ArtifactStagingDirectory)"
+
+                - task: IISWebAppManagementOnMachineGroup@0
+                  displayName: "Configure IIS"
+                  inputs:
+                    IISDeploymentType: "IISWebsite"
+                    ActionIISWebsite: "CreateOrUpdateWebsite"
+                    WebsiteName: "$(stagingWebsiteName)"
+                    WebsitePhysicalPath: "$(WebsitePhysicalPath)"
+                    WebsitePhysicalPathAuth: "WebsiteUserPassThrough"
+                    AddBinding: false
+                    CreateOrUpdateAppPoolForWebsite: true
+                    AppPoolNameForWebsite: "$(stagingAppPoolName)"
+                    DotNetVersionForWebsite: "No Managed Code"
+                    PipeLineModeForWebsite: "Integrated"
+                    AppPoolIdentityForWebsite: "ApplicationPoolIdentity"
+
+                - task: IISWebAppDeploymentOnMachineGroup@0
+                  displayName: "Deploy to IIS"
+                  inputs:
+                    WebsiteName: "$(stagingWebsiteName)"
+                    Package: "$(Build.ArtifactStagingDirectory)/$(projectName).zip"
+                    TakeAppOfflineFlag: true
+                    XmlVariableSubstitution: true
+
+  # ── Production ─────────────────────────────────────────
+  - stage: Production
+    displayName: "Deploy to Production"
+    dependsOn: "Build"
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+    jobs:
+      - deployment: DeployProd
+        displayName: "Deploy to Production"
+        environment:
+          name: "{{PROD_ENVIRONMENT_NAME}}"                # e.g., Production
+          resourceType: VirtualMachine
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - task: DownloadPipelineArtifact@2
+                  inputs:
+                    artifact: "drop"
+                    path: "$(Build.ArtifactStagingDirectory)"
+
+                - task: IISWebAppManagementOnMachineGroup@0
+                  displayName: "Configure IIS"
+                  inputs:
+                    IISDeploymentType: "IISWebsite"
+                    ActionIISWebsite: "CreateOrUpdateWebsite"
+                    WebsiteName: "$(prodWebsiteName)"
+                    WebsitePhysicalPath: "$(WebsitePhysicalPath)"
+                    WebsitePhysicalPathAuth: "WebsiteUserPassThrough"
+                    AddBinding: false
+                    CreateOrUpdateAppPoolForWebsite: true
+                    AppPoolNameForWebsite: "$(prodAppPoolName)"
+                    DotNetVersionForWebsite: "No Managed Code"
+                    PipeLineModeForWebsite: "Integrated"
+                    AppPoolIdentityForWebsite: "ApplicationPoolIdentity"
+
+                - task: IISWebAppDeploymentOnMachineGroup@0
+                  displayName: "Deploy to IIS"
+                  inputs:
+                    WebsiteName: "$(prodWebsiteName)"
+                    Package: "$(Build.ArtifactStagingDirectory)/$(projectName).zip"
+                    TakeAppOfflineFlag: true
+                    XmlVariableSubstitution: true