@juangcarmona/lighthouse 0.5.0 → 0.7.0

package/assets/profiles/react-web-platform/structure.md

@@ -0,0 +1,36 @@
+# React web structure
+
+Keep the repository source under `src/` and keep the primary architecture feature-oriented.
+
+```text
+src/
+  app/                         routes and application shell
+  features/
+    <bounded-context>/
+      <feature>/
+        screen/
+        api/
+        queries/
+        mutations/
+        components/
+        types/
+        tests/
+  shared/
+    http/
+    auth/
+    query/
+    errors/
+    telemetry/
+  api/
+  i18n/
+  design-system/
+tests/                          browser and cross-feature evidence
+```
+
+Routes compose screens and policy; they do not become a second application layer.
+
+Features follow bounded contexts and use cases. Extract shared code only when more than one feature has a real common contract.
+
+The API client exposes typed contracts and maps transport failures into application errors without leaking transport details into screens.
+
+The profile can run as a Vite SPA or another approved React framework when its output and verification commands remain explicit.

package/assets/profiles/react-web-platform/testing.md

@@ -0,0 +1,15 @@
+# React web testing
+
+Use a short feedback loop: typecheck and unit tests first, then integration and browser evidence for the behavior that crosses boundaries.
+
+| Layer | Purpose | Evidence |
+| --- | --- | --- |
+| Typecheck and lint | Catch static contract and style errors | CI output |
+| Unit and component | Exercise feature behavior and interaction states | Vitest and Testing Library |
+| Integration | Exercise API and BFF contracts where a boundary matters | Project-selected test harness |
+| Browser | Prove login, navigation, query, mutation and failure states | Playwright with catalogued evidence |
+| Accessibility | Catch critical semantic and keyboard regressions | axe plus human review when required |
+
+The first vertical slice covers session, an authenticated screen, a query, a mutation, loading, empty, error and authentication failure.
+
+Keep browser journeys few and valuable. Do not replace application tests with end-to-end tests or mock away the boundary being verified.

package/assets/profiles/web-bff/README.md

@@ -0,0 +1,22 @@
+# Lighthouse web BFF profile
+
+Use this profile for authenticated web applications that need a same-origin browser session and a server-side boundary for tokens and API calls.
+
+## Start here
+
+| Need | Read |
+| --- | --- |
+| New private web application | [adoption](adoption.md) → [security](security.md) → [testing](testing.md) |
+| Existing web application | [adoption](adoption.md) → [security](security.md) |
+| Implement a session change | [security](security.md) → [testing](testing.md) |
+| Diagnose an authentication failure | [security](security.md) |
+
+## Defaults
+
+Keep OAuth tokens outside browser JavaScript and use a Secure, HttpOnly session cookie with an explicit SameSite policy.
+
+Use Authorization Code with PKCE, CSRF protection, logout and revocation, destination and route allowlists, correlation IDs, ProblemDetails and rate limiting.
+
+Keep the BFF inside the ASP.NET Core host unless a product decision requires another deployment boundary.
+
+Treat direct browser-to-API access as a recorded exception for public or otherwise suitable APIs.

package/assets/profiles/web-bff/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: lighthouse-web-bff
+description: Apply the Lighthouse web BFF profile when a repository selects web-bff for an authenticated web application.
+---
+
+# Lighthouse web BFF profile
+
+Read the profile guide before changing an authenticated web adopter.
+
+Keep OAuth tokens on the server side. Use Authorization Code with PKCE and a Secure, HttpOnly session cookie with an explicit SameSite policy.
+
+Validate origin and CSRF state, allow only declared destinations and routes, and expose stable ProblemDetails with correlation IDs.
+
+Implement logout, revocation, expiry and user switching as tested behavior. Keep rate limiting and observability at the BFF boundary.
+
+Run the session, API, browser and security checks after a focused change. Treat a missing security check as a repair action.

package/assets/profiles/web-bff/adoption.md

@@ -0,0 +1,9 @@
+# Adopt the Lighthouse web BFF profile
+
+Select `web-bff` with `react-web-platform` and `dotnet-backend` for an authenticated private web application.
+
+Set the session, identity provider, callback routes, logout route, allowed destinations and CSRF policy before exposing an authenticated screen.
+
+Start with one vertical slice: sign in, load the session, call one API query, submit one mutation, handle expiry and sign out.
+
+Existing authentication code remains product-owned. Map its behavior to the profile and record a narrow exception when migration would change a security boundary.

package/assets/profiles/web-bff/security.md

@@ -0,0 +1,16 @@
+# Web BFF security contract
+
+| Boundary | Contract | Required evidence |
+| --- | --- | --- |
+| Browser session | Secure, HttpOnly cookie with explicit SameSite policy | Cookie inspection and browser session test |
+| Authorization | Authorization Code with PKCE | Provider configuration and callback test |
+| CSRF | Origin and request-token policy for state-changing requests | Negative and positive mutation tests |
+| Destinations | Explicit allowlist for outbound targets and routes | Rejected destination test |
+| Proxying | Fixed routes and typed upstream calls | No arbitrary proxy path |
+| Logout | Session removal and provider revocation when supported | Logout and expired-session test |
+| Failure | Stable ProblemDetails and correlation ID | Error response and trace evidence |
+| Abuse | Rate limiting at the boundary | Configured limit and response test |
+
+Do not place access or refresh tokens in localStorage, sessionStorage or IndexedDB.
+
+The BFF may be hosted inside the ASP.NET Core application host. A separate service requires a product and architecture decision with its own deployment evidence.

package/assets/profiles/web-bff/testing.md

@@ -0,0 +1,14 @@
+# Web BFF testing
+
+Test the session boundary before the browser journey: callback, cookie flags, CSRF, allowlists, logout, expiry and user switching.
+
+| Layer | Purpose | Evidence |
+| --- | --- | --- |
+| Unit | Validate policy and mapping rules | Deterministic test output |
+| Integration | Exercise the BFF and upstream contract | Real host or approved provider fixture |
+| Browser | Prove sign in, authenticated query, mutation and sign out | Playwright evidence |
+| Security review | Confirm storage, routes and failure handling | axe is complementary; security review remains explicit |
+
+The first vertical slice must fail closed when the session is absent, expired or assigned to another user.
+
+Keep provider credentials out of fixtures. Use a deterministic identity or approved test provider that exercises the same cookie and callback boundaries.

package/assets/schemas/lighthouse-manifest.schema.json

@@ -10,16 +10,19 @@
     "schemaVersion": {"const": 1},
     "baseline": {"const": "0.1.0"},
     "product": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$"},
+    "application": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["shape", "stacks"],
+      "properties": {
+        "shape": {"enum": ["unknown", "frontend", "backend", "full-stack", "service", "library", "tooling", "cli", "worker", "mobile"]},
+        "stacks": {"type": "array", "items": {"type": "string", "minLength": 1}, "uniqueItems": true}
+      }
+    },
     "profiles": {"type": "array", "items": {"enum": ["node-tooling", "dotnet-backend", "visual-theme"]}, "uniqueItems": true},
     "integrations": {"type": "object", "additionalProperties": false, "required": ["productShape", "arcShape"], "properties": {"productShape": {"$ref": "#/$defs/pin"}, "arcShape": {"$ref": "#/$defs/pin"}}},
     "packages": {"type": "object", "additionalProperties": false, "required": ["sdlc"], "properties": {"sdlc": {"type": "object", "additionalProperties": false, "required": ["name", "version"], "properties": {"name": {"const": "@juangcarmona/lighthouse-sdlc"}, "version": {"$ref": "#/$defs/pin"}}}, "ui": {"type": "object", "additionalProperties": false, "required": ["name", "version"], "properties": {"name": {"const": "@juangcarmona/lighthouse-ui"}, "version": {"$ref": "#/$defs/pin"}}}}},
-    "managed": {"anyOf": [
-      {"const": ["LIGHTHOUSE.md"]},
-      {"const": ["LIGHTHOUSE.md", "scripts/lighthouse-guard.mjs", ".husky/commit-msg", ".husky/pre-push", ".github/workflows/lighthouse.yml"]},
-      {"const": ["LIGHTHOUSE.md", "scripts/lighthouse-guard.mjs", ".husky/commit-msg", ".husky/pre-push", ".github/workflows/lighthouse.yml", ".lighthouse/sdlc.json"]},
-      {"const": ["LIGHTHOUSE.md", "scripts/lighthouse-guard.mjs", ".husky/commit-msg", ".husky/pre-push", ".github/workflows/lighthouse.yml", ".lighthouse/sdlc.json", ".lighthouse/upgrade.json"]},
-      {"const": ["LIGHTHOUSE.md", "scripts/lighthouse-guard.mjs", ".husky/commit-msg", ".husky/pre-push", ".github/workflows/lighthouse.yml", ".lighthouse/sdlc.json", ".lighthouse/upgrade.json", "docs/design/DESIGN.md", ".agents/skills/lighthouse-ui/SKILL.md"]}
-    ]},
+    "managed": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}, "uniqueItems": true},
     "repository": {
       "type": "object",
       "additionalProperties": false,

package/assets/schemas/profile-catalog.schema.json

@@ -0,0 +1,329 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/juangcarmona/lighthouse/schemas/profile-catalog.schema.json",
+  "title": "Lighthouse profile catalog",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$schema",
+    "schemaVersion",
+    "profiles"
+  ],
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "schemaVersion": {
+      "const": 1
+    },
+    "profiles": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/profile"
+      }
+    }
+  },
+  "$defs": {
+    "profile": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "owner",
+        "purpose",
+        "appliesTo",
+        "surfaces",
+        "prerequisites",
+        "dependencies",
+        "incompatibleWith",
+        "libraries",
+        "structure",
+        "commands",
+        "guardrails",
+        "failureConsequence",
+        "repairHints",
+        "exceptions",
+        "combinations",
+        "consumerFixture",
+        "upgradeStrategy",
+        "verification"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+        },
+        "owner": {
+          "type": "string",
+          "minLength": 1
+        },
+        "purpose": {
+          "type": "string",
+          "minLength": 1
+        },
+        "appliesTo": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "shapes",
+            "stacks"
+          ],
+          "properties": {
+            "shapes": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "minItems": 1,
+              "uniqueItems": true
+            },
+            "stacks": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "uniqueItems": true
+            }
+          }
+        },
+        "surfaces": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "verification": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "layers"
+          ],
+          "properties": {
+            "layers": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/layer"
+              },
+              "minItems": 1,
+              "uniqueItems": true
+            }
+          }
+        },
+        "prerequisites": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "dependencies": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/profileId"
+          },
+          "uniqueItems": true
+        },
+        "incompatibleWith": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/profileId"
+          },
+          "uniqueItems": true
+        },
+        "libraries": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "structure": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "commands": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        },
+        "guardrails": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/guardrail"
+          },
+          "uniqueItems": true
+        },
+        "failureConsequence": {
+          "type": "string",
+          "minLength": 1
+        },
+        "repairHints": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "minItems": 1
+        },
+        "exceptions": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "minItems": 1
+        },
+        "combinations": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/combination"
+          },
+          "uniqueItems": true
+        },
+        "consumerFixture": {
+          "type": "string",
+          "minLength": 1
+        },
+        "upgradeStrategy": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "layer": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "level",
+        "kind",
+        "verification"
+      ],
+      "properties": {
+        "id": {
+          "enum": [
+            "static",
+            "unit",
+            "architecture",
+            "integration",
+            "functional",
+            "browser-e2e",
+            "operational"
+          ]
+        },
+        "level": {
+          "enum": [
+            "required",
+            "recommended",
+            "optional"
+          ]
+        },
+        "kind": {
+          "enum": [
+            "hard",
+            "soft"
+          ]
+        },
+        "verification": {
+          "enum": [
+            "deterministic",
+            "semantic",
+            "human"
+          ]
+        },
+        "command": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "profileId": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+    },
+    "guardrail": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "level",
+        "kind",
+        "verification",
+        "command",
+        "description"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "level": {
+          "enum": [
+            "required",
+            "recommended",
+            "optional"
+          ]
+        },
+        "kind": {
+          "enum": [
+            "hard",
+            "soft"
+          ]
+        },
+        "verification": {
+          "enum": [
+            "deterministic",
+            "semantic",
+            "human"
+          ]
+        },
+        "command": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "combination": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "with",
+        "purpose"
+      ],
+      "properties": {
+        "with": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/profileId"
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "purpose": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juangcarmona/lighthouse",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "Lighthouse adoption and verification CLI",
   "repository": {
@@ -23,13 +23,16 @@
     "@arcshape/cli": "0.1.3",
     "@juangcarmona/lighthouse-ui": "0.2.0",
     "@prodshape/cli": "0.22.0",
-    "@juangcarmona/lighthouse-sdlc": "0.5.0"
+    "@juangcarmona/lighthouse-sdlc": "0.6.0"
   },
   "files": [
     "src/lighthouse.mjs",
     "src/guardrails.mjs",
     "assets",
     "README.md",
+    "src/profiles.mjs",
+    "src/create-dotnet.mjs",
+    "src/verify-dotnet.mjs",
     "upgrades"
   ],
   "bin": {

package/src/create-dotnet.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, rmdir, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const packageRoot = fileURLToPath(new URL('../', import.meta.url));
+const templateRoot = resolve(packageRoot, 'assets/dotnet-template');
+const cliPackage = JSON.parse(await readFile(resolve(packageRoot, 'package.json'), 'utf8'));
+const require = createRequire(import.meta.url);
+const sdlcContract = JSON.parse(await readFile(require.resolve('@juangcarmona/lighthouse-sdlc/contract.json'), 'utf8'));
+const args = process.argv.slice(2);
+const target = args[0] ? resolve(args[0]) : null;
+const name = args.includes('--name') ? args[args.indexOf('--name') + 1] : null;
+
+if (!target || !name || !/^[A-Z][A-Za-z0-9]{1,47}$/.test(name) || args.length !== 3 || args[1] !== '--name') {
+  process.stderr.write('Usage: lighthouse create-dotnet <empty-target> --name Workshop\nUse a PascalCase product identifier of 2–48 letters/digits.\n');
+  process.exit(2);
+}
+
+let existing = false;
+try {
+  const info = await lstat(target);
+  if (!info.isDirectory() || info.isSymbolicLink() || (await readdir(target)).length > 0) throw new Error('The target must be a new directory or an empty directory.');
+  existing = true;
+} catch (error) {
+  if (error.code !== 'ENOENT') throw error;
+}
+
+const transform = (text) => text
+  .replaceAll('JuanGCarmona.Lighthouse.Example', `JuanGCarmona.${name}`)
+  .replaceAll('Lighthouse.Example', name)
+  .replaceAll('Lighthouse_Example', name)
+  .replaceAll('../../../../Lighthouse.Cqrs/', '../../dotnet/Lighthouse.Cqrs/')
+  .replaceAll('../../../../Lighthouse.Analyzers/', '../../dotnet/Lighthouse.Analyzers/')
+  .replaceAll('../../Lighthouse.Analyzers/', '../../../src/dotnet/Lighthouse.Analyzers/')
+  .replaceAll('../../examples/src/root/', '../../../src/root/');
+
+async function copy(from, to) {
+  const info = await lstat(from);
+  if (info.isDirectory()) {
+    await mkdir(to, { recursive: true });
+    for (const entry of await readdir(from)) {
+      if (['bin', 'obj'].includes(entry)) continue;
+      await copy(join(from, entry), join(to, entry.replaceAll('Lighthouse.Example', name)));
+    }
+    return;
+  }
+  if (!info.isFile()) throw new Error('Starter sources must be ordinary files and directories.');
+  await mkdir(dirname(to), { recursive: true });
+  await writeFile(to, transform(await readFile(from, 'utf8')));
+}
+
+const stage = await mkdtemp(join(dirname(target), '.lighthouse-create-dotnet-'));
+try {
+  for (const [from, to] of [
+    ['Lighthouse.Analyzers', 'src/dotnet/Lighthouse.Analyzers'],
+    ['Lighthouse.Cqrs', 'src/dotnet/Lighthouse.Cqrs'],
+    ['examples/src', 'src'],
+    ['tests', 'tests/dotnet'],
+    ['Directory.Build.props', 'Directory.Build.props'],
+    ['Directory.Packages.props', 'Directory.Packages.props'],
+    ['global.json', 'global.json'],
+    ['Lighthouse.slnx', `${name}.slnx`],
+  ]) await copy(resolve(templateRoot, from), resolve(stage, to));
+
+  const solutionFile = resolve(stage, `${name}.slnx`);
+  const solutionText = (await readFile(solutionFile, 'utf8'))
+    .replaceAll('examples/src/', 'src/')
+    .replaceAll('Lighthouse.Analyzers/', 'src/dotnet/Lighthouse.Analyzers/')
+    .replaceAll('Lighthouse.Cqrs/', 'src/dotnet/Lighthouse.Cqrs/')
+    .replaceAll('tests/', 'tests/dotnet/');
+  const projects = [...solutionText.matchAll(/<Project Path="[^"]+"\s*\/>/g)].map((match) => match[0]);
+  await writeFile(solutionFile, `<Solution>\n${projects.map((project) => `  ${project}`).join('\n')}\n</Solution>\n`);
+
+  await copy(resolve(packageRoot, 'src/lighthouse.mjs'), resolve(stage, 'scripts/lighthouse.mjs'));
+  await copy(resolve(packageRoot, 'src/guardrails.mjs'), resolve(stage, 'scripts/guardrails.mjs'));
+  await copy(resolve(packageRoot, 'src/profiles.mjs'), resolve(stage, 'scripts/profiles.mjs'));
+  await copy(resolve(packageRoot, 'src/verify-dotnet.mjs'), resolve(stage, 'scripts/verify-dotnet.mjs'));
+  await copy(resolve(packageRoot, 'assets/guardrails'), resolve(stage, 'assets/guardrails'));
+  await copy(resolve(packageRoot, 'assets/profiles'), resolve(stage, 'assets/profiles'));
+  await copy(resolve(packageRoot, 'assets/schemas'), resolve(stage, 'schemas'));
+
+  await writeFile(resolve(stage, 'lighthouse.json'), `${JSON.stringify({
+    $schema: './schemas/lighthouse-manifest.schema.json', schemaVersion: 1, baseline: '0.1.0',
+    product: name, application: { shape: 'backend', stacks: ['dotnet'] }, profiles: ['dotnet-backend'],
+    integrations: { productShape: null, arcShape: null },
+    packages: { sdlc: { name: '@juangcarmona/lighthouse-sdlc', version: sdlcContract.version } },
+    managed: ['LIGHTHOUSE.md', 'scripts/lighthouse-guard.mjs', '.husky/commit-msg', '.husky/pre-push', '.github/workflows/lighthouse.yml', '.lighthouse/sdlc.json', '.lighthouse/upgrade.json', 'docs/profiles/dotnet/README.md', 'docs/profiles/dotnet/adoption.md', 'docs/profiles/dotnet/architecture.md', 'docs/profiles/dotnet/guardrails.md', 'docs/profiles/dotnet/practices.md', 'docs/profiles/dotnet/testing-and-development.md', 'docs/profiles/dotnet/use-cases.md', '.agents/skills/lighthouse-dotnet/SKILL.md'],
+    repository: {
+      layout: ['src', 'docs', 'infra', 'scripts'], publicSite: { enabled: true },
+      conventions: { commits: 'conventional', branchPattern: '^(feat|fix|docs|refactor|test|chore|build|ci|perf|revert)/[1-9]\\d*-[a-z0-9]+(?:-[a-z0-9]+)*$' },
+    },
+  }, null, 2)}\n`);
+  await writeFile(resolve(stage, 'package.json'), `${JSON.stringify({
+    name: `@juangcarmona/${name.toLowerCase()}`, private: true, type: 'module', engines: { node: '>=22' },
+    scripts: { verify: 'node scripts/lighthouse.mjs verify && node scripts/verify-dotnet.mjs' },
+  }, null, 2)}\n`);
+  await writeFile(resolve(stage, 'README.md'), `# ${name}\n\nBackend seeded from Lighthouse ${cliPackage.version}. Application and tooling sources are product-owned after creation.\n\nRun dotnet restore ${name}.slnx once to create lockfiles, then npm run verify. Commit lockfiles.\n\nStart dotnet run --project src/root/${name}.Api or the optional src/root/${name}.AppHost. Configure authentication using a trusted OIDC provider for manual API access. Test identities exist only in tests.\n\nThe sample catalog uses disposable in-memory storage. Add real persistence, data isolation, telemetry and deployment policy according to product requirements. Keep each command/query's endpoint, DTOs, validation and internal sealed handler together.\n`);
+  await writeFile(resolve(stage, 'AGENTS.md'), `# ${name} engineering guidance\n\nUse the Lighthouse .NET profile from the pinned baseline revision. Keep Minimal API commands/queries as complete single-file slices. Handlers remain internal sealed and independent of HTTP. Modules use sibling Contracts assemblies. Run npm run verify.\n\nApplication and tooling source is product-owned. Do not hand-edit LIGHTHOUSE.md. Record narrow, expiring exceptions for suppressed diagnostics.\n`);
+  await mkdir(resolve(stage, '.github/workflows'), { recursive: true });
+  await writeFile(resolve(stage, '.github/workflows/ci.yml'), `name: Backend verification\non: [push, pull_request]\npermissions:\n  contents: read\njobs:\n  dotnet:\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: '22'\n      - uses: actions/setup-dotnet@v4\n        with:\n          global-json-file: global.json\n      - run: npm run verify\n`);
+
+  const initialized = (await import('node:child_process')).spawnSync(process.execPath, [resolve(stage, 'scripts/lighthouse.mjs'), 'init'], { cwd: stage, encoding: 'utf8' });
+  if (initialized.status !== 0) throw new Error(initialized.stderr || 'Projection generation failed.');
+  if (existing) await rmdir(target);
+  await rename(stage, target);
+  process.stdout.write(`Created ${name} in ${target}. Run dotnet restore ${name}.slnx, then npm run verify.\n`);
+} catch (error) {
+  await rm(stage, { recursive: true, force: true });
+  throw error;
+}