@databricks-solutions/lakebase-scm-utils 0.2.50 → 0.3.0

package/templates/project/common/.github/workflows/pr.yml

@@ -102,6 +102,18 @@ jobs:
           fi
           npm install
 
+      - name: Set up .NET
+        if: steps.detect-lang.outputs.lang == 'dotnet'
+        uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Restore .NET packages and tools
+        if: steps.detect-lang.outputs.lang == 'dotnet'
+        run: |
+          dotnet restore
+          if [ -f .config/dotnet-tools.json ]; then dotnet tool restore; fi
+
       # Install frontend dependencies when a `client/` workspace is present
       # (Python+React layouts etc.). Gated on client/package.json so projects
       # without a frontend skip this transparently.
@@ -301,10 +313,12 @@ jobs:
           BODY="⚠️ **No Lakebase CI branch** was created. This run is not using a dedicated database branch. Open the [workflow run](${RUN_URL}), expand **Create CI database branch (Lakebase)** and check the step **Summary** (or log) for the reason and how to fix it."
           gh pr comment "$PR" --body "$BODY" 2>/dev/null || true
 
-      # Install Flyway CLI for Java/Kotlin projects only. The substrate's
-      # migrate runner spawns the standalone `flyway` binary; non-Java
-      # projects don't need it. Runtime-gated on pom.xml so the YAML is
-      # one shape for every language.
+      # Install Flyway CLI for Java/Kotlin projects and .NET projects that use
+      # Flyway (db/migrations/). The substrate's migrate runner spawns the
+      # standalone `flyway` binary; other projects don't need it. Runtime-gated
+      # on pom.xml / any file under db/migrations/ (what the adapter checks; a
+      # fresh scaffold has only its README there) so the YAML is one shape for
+      # every language.
       #
       # Resolution order:
       #   1. `flyway` already on PATH (self-hosted runner with brew /
@@ -315,7 +329,7 @@ jobs:
       #   3. Default https://repo1.maven.org/maven2 for GitHub-hosted
       #      runners with public internet.
       - name: Install Flyway CLI
-        if: steps.lakebase-db.outputs.url != '' && hashFiles('pom.xml') != ''
+        if: steps.lakebase-db.outputs.url != '' && (hashFiles('pom.xml') != '' || hashFiles('db/migrations/**') != '')
         env:
           FLYWAY_DOWNLOAD_BASE_URL: ${{ vars.FLYWAY_DOWNLOAD_BASE_URL }}
         run: |
@@ -388,6 +402,8 @@ jobs:
               uv run pytest
             elif [ "$LANG" = "nodejs" ]; then
               npm test
+            elif [ "$LANG" = "dotnet" ]; then
+              dotnet test --no-restore
             fi
           else
             echo "::error::No CI branch URL – cannot run tests without a database. Check the 'Create CI database branch' step for details."
@@ -570,6 +586,10 @@ jobs:
               desc=$(echo "$base" | sed 's/^[^_]*_//' | sed 's/\.py$//' | tr '_' ' ')
               [ -n "$rev" ] && echo "| $rev | $desc |" >> "$MD"
             done
+          elif [ "$LANG" = "dotnet" ]; then
+            # EF Core or Flyway: the kit's canonical discovery picks the tool + files.
+            npx --yes --package="${SCM_UTILS_NPX_PKG}" lakebase-schema-migrate list \
+              | jq -r '.[] | if .tool == "flyway" then "| V\(.version) | \(.description) |" else "| \(.version) | \(.description) (EF Core) |" end' >> "$MD"
           elif [ "$LANG" = "nodejs" ]; then
             for f in migrations/*.js; do
               [ -f "$f" ] || continue

package/templates/project/common/.gitignore.base

@@ -15,6 +15,10 @@ application-local.properties
 .consort/agent-log.jsonl
 .consort/run-config.json
 .consort/drive-live.log
+# The detached drive's live pid file (consort-drive --detach writes it, consort-watch reads it).
+# Per-run scratch; an untracked drive.pid otherwise re-dirties the tree and re-blocks the next
+# experiment cut's clean-tree check.
+.consort/drive.pid
 .consort/diagnostics/
 # next.json is the drive's stop-state pointer, rewritten on EVERY stop. Committing it dirties the
 # tree on the next stop and re-blocks the experiment cut's clean-tree check , it is per-run state,
@@ -46,6 +50,9 @@ application-local.properties
 .consort/.recorder-state.json
 .consort/routing-decisions.jsonl
 .consort/turns/
+# Playwright-MCP's browser scratch (screenshots/traces a UX/review turn drops). Transient
+# tool output, not corpus; ignore it so it never dirties the tree before an experiment cut.
+.playwright-mcp/
 .sftdd/agent-log.jsonl
 .sftdd/run-config.json
 .tdd/agent-log.jsonl

package/templates/project/common/scripts/flyway-migrate.sh

@@ -66,10 +66,63 @@ elif [ -f "$REPO_ROOT/requirements.txt" ] || [ -f "$REPO_ROOT/pyproject.toml" ];
     source .venv/bin/activate
   fi
   alembic upgrade head "$@"
+elif [ -n "$(find "$REPO_ROOT" -maxdepth 1 \( -name '*.sln' -o -name '*.slnx' -o -name '*.csproj' \) -print -quit 2>/dev/null)" ]; then
+  # .NET: EF Core or Flyway (db/migrations/).
+  if [ -n "${DATABASE_URL:-}" ]; then
+    # Explicit target (CI secret, ephemeral-verify DSN): run the tool directly.
+    if [ -d "$REPO_ROOT/db/migrations" ]; then
+      _np="${DATABASE_URL#postgresql://}"; _cr="${_np%%@*}"; _hp="${_np#*@}"
+      # Decode %XX only ('+' is literal in URL userinfo, and backslashes in a
+      # credential must not be interpreted as escapes).
+      _urldecode() {
+        local s="$1" out="" c
+        while [ -n "$s" ]; do
+          c="${s:0:1}"; s="${s:1}"
+          if [ "$c" = "%" ] && [ "${#s}" -ge 2 ]; then
+            out+="$(printf "\\x${s:0:2}")"; s="${s:2}"
+          else
+            out+="$c"
+          fi
+        done
+        printf '%s' "$out"
+      }
+      FLYWAY_URL="jdbc:postgresql://${_hp}" \
+      FLYWAY_USER="$(_urldecode "${_cr%%:*}")" \
+      FLYWAY_PASSWORD="$(_urldecode "${_cr#*:}")" \
+        flyway "-locations=filesystem:$REPO_ROOT/db/migrations" \
+          -baselineOnMigrate=true -baselineVersion=0 migrate "$@"
+    else
+      # Relative to the repo root (the cwd here): an absolute path through a
+      # symlinked directory (e.g. macOS /tmp -> /private/tmp) makes MSBuild see
+      # two different project paths and dotnet ef then loses the build output.
+      _csproj="$(grep -l "Microsoft.EntityFrameworkCore.Design" \
+        $(find . -maxdepth 3 -name '*.csproj' -not -path '*/tests/*' -not -path '*/test/*' \
+            -not -path '*/client/*' -not -path '*/bin/*' -not -path '*/obj/*' -not -path '*/node_modules/*' | sort) \
+        2>/dev/null | head -1)"
+      [ -n "$_csproj" ] || { echo "No *.csproj references Microsoft.EntityFrameworkCore.Design." >&2; exit 1; }
+      # dotnet ef reads project metadata before it builds, so restore first
+      # (a fresh clone or a cleaned obj/ has no assets file).
+      if [ -f .config/dotnet-tools.json ]; then dotnet tool restore >/dev/null; fi
+      dotnet restore "$_csproj" >/dev/null
+      # The design-time DbContext factory reads DATABASE_URL, so no password
+      # is passed on the command line.
+      dotnet ef database update --project "$_csproj" "$@"
+    fi
+  else
+    # Paired branch from .env metadata: the kit's tool-agnostic migrate CLI
+    # picks the tool, mints a fresh credential, and refuses protected tiers,
+    # exactly as CI does.
+    if [ ! -x "$SCRIPT_DIR/lk" ] || [ -z "${LAKEBASE_PROJECT_ID:-}" ] || [ -z "${LAKEBASE_BRANCH_ID:-}" ]; then
+      echo "Cannot migrate: need scripts/lk plus LAKEBASE_PROJECT_ID and LAKEBASE_BRANCH_ID (written to .env by the post-checkout hook), or DATABASE_URL." >&2
+      exit 1
+    fi
+    "$SCRIPT_DIR/lk" lakebase-schema-migrate apply \
+      --instance "$LAKEBASE_PROJECT_ID" --branch "$LAKEBASE_BRANCH_ID" "$@"
+  fi
 elif [ -f "$REPO_ROOT/package.json" ]; then
   # Node.js / Knex
   npx knex migrate:latest "$@"
 else
-  echo "Could not detect project language. Expected pom.xml (Java), pyproject.toml/requirements.txt (Python), or package.json (Node.js)."
+  echo "Could not detect project language. Expected pom.xml (Java), pyproject.toml/requirements.txt (Python), *.sln/*.csproj (.NET), or package.json (Node.js)."
   exit 1
 fi

package/templates/project/common/scripts/prepare-schema-diff.sh

@@ -107,6 +107,11 @@ if [ -d src/main/resources/db/migration ]; then
     desc="$(echo "$base" | sed -n 's/^V[0-9.]*__\(.*\)\.sql$/\1/p' | tr '_' ' ')"
     [ -n "$ver" ] && echo "| V$ver | $desc |" >> "$MD"
   done
+elif [ -n "$(find . -maxdepth 1 \( -name '*.sln' -o -name '*.slnx' -o -name '*.csproj' \) -print -quit 2>/dev/null)" ] \
+    && [ -x "$WORK_TREE/scripts/lk" ]; then
+  # .NET (EF Core or Flyway): the kit's canonical discovery picks the tool + files.
+  "$WORK_TREE/scripts/lk" lakebase-schema-migrate list 2>/dev/null \
+    | jq -r '.[] | if .tool == "flyway" then "| V\(.version) | \(.description) |" else "| \(.version) | \(.description) (EF Core) |" end' >> "$MD" || true
 elif [ -d alembic/versions ]; then
   # Alembic / Python
   for f in alembic/versions/*.py; do

package/templates/project/common/scripts/run-dev.sh

@@ -209,6 +209,15 @@ for r in getattr(app, 'routes', []):
   fi
 
   uv run uvicorn app.main:app --reload --host "$HOST" --port "$PORT" "$@"
+elif [ -n "$(find "$REPO_ROOT" -maxdepth 1 \( -name '*.sln' -o -name '*.slnx' -o -name '*.csproj' \) -print -quit 2>/dev/null)" ]; then
+  # .NET / ASP.NET Core. The app reads .env itself and mints its own credential.
+  PORT="$(resolve_port 8000)"
+  export PORT HOST
+  # Relative paths (cwd is the repo root): see the symlink note in flyway-migrate.sh.
+  _app="$(find src -maxdepth 2 -name '*.csproj' 2>/dev/null | head -1)"
+  _app="${_app:-$(find . -maxdepth 1 -name '*.csproj' 2>/dev/null | head -1)}"
+  echo "Serving on http://${HOST}:${PORT}  (Ctrl-C to stop). Open it in your browser."
+  dotnet watch --project "$_app" run -- --urls "http://${HOST}:${PORT}" "$@"
 elif [ -f "$REPO_ROOT/package.json" ]; then
   # Node.js – prefer a "dev" script, fall back to "start".
   PORT="$(resolve_port 8000)"
@@ -220,6 +229,6 @@ elif [ -f "$REPO_ROOT/package.json" ]; then
     npm start -- "$@"
   fi
 else
-  echo "Could not detect project language. Expected pom.xml (Java), pyproject.toml/requirements.txt (Python), or package.json (Node.js)."
+  echo "Could not detect project language. Expected pom.xml (Java), pyproject.toml/requirements.txt (Python), *.sln/*.csproj (.NET), or package.json (Node.js)."
   exit 1
 fi

package/templates/project/common/scripts/run-tests.sh

@@ -140,13 +140,18 @@ elif [ -f "$REPO_ROOT/requirements.txt" ] || [ -f "$REPO_ROOT/pyproject.toml" ];
   else
     uv run --extra dev pytest "$@"
   fi
+elif [ -n "$(find "$REPO_ROOT" -maxdepth 1 \( -name '*.sln' -o -name '*.slnx' -o -name '*.csproj' \) -print -quit 2>/dev/null)" ]; then
+  # .NET / EF Core or Flyway + xUnit
+  echo "Running migrations..."
+  "$REPO_ROOT/scripts/flyway-migrate.sh"
+  dotnet test "$@"
 elif [ -f "$REPO_ROOT/package.json" ]; then
   # Node.js / Knex + Jest
   echo "Running Knex migrations..."
   npx knex migrate:latest
   npm test "$@"
 else
-  echo "Could not detect project language. Expected pom.xml (Java), pyproject.toml/requirements.txt (Python), or package.json (Node.js)."
+  echo "Could not detect project language. Expected pom.xml (Java), pyproject.toml/requirements.txt (Python), *.sln/*.csproj (.NET), or package.json (Node.js)."
   exit 1
 fi
 

package/templates/project/dotnet/.gitignore.extra

@@ -0,0 +1,8 @@
+# .NET
+bin/
+obj/
+*.user
+*.suo
+.vs/
+TestResults/
+*.trx

package/templates/project/dotnet/App.sln

@@ -0,0 +1,56 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.0.31903.59
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{827E0CD3-B72D-47B6-A68D-7590B98EB39B}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "App", "src\App\App.csproj", "{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{0AB3BF05-4346-4AA6-1389-037BE0695223}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "App.Tests", "tests\App.Tests\App.Tests.csproj", "{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|Any CPU = Release|Any CPU
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Debug|x64.Build.0 = Debug|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Debug|x86.Build.0 = Debug|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Release|Any CPU.Build.0 = Release|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Release|x64.ActiveCfg = Release|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Release|x64.Build.0 = Release|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Release|x86.ActiveCfg = Release|Any CPU
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2}.Release|x86.Build.0 = Release|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Debug|x64.Build.0 = Debug|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Debug|x86.Build.0 = Debug|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Release|Any CPU.Build.0 = Release|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Release|x64.ActiveCfg = Release|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Release|x64.Build.0 = Release|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Release|x86.ActiveCfg = Release|Any CPU
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E}.Release|x86.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(NestedProjects) = preSolution
+		{DCBDD7E2-BB16-483D-92E7-913AB5681AA2} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
+		{3E88FEDA-D8D3-4939-BD9C-CFDD1EEBBC1E} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
+	EndGlobalSection
+EndGlobal

package/templates/project/dotnet/Makefile

@@ -0,0 +1,13 @@
+.PHONY: install test migrate run
+
+install:
+	dotnet restore App.sln
+
+test:
+	dotnet test App.sln
+
+migrate:
+	./scripts/flyway-migrate.sh
+
+run:
+	dotnet run --project src/App -- --urls "http://127.0.0.1:$${PORT:-8000}"

package/templates/project/dotnet/global.json

@@ -0,0 +1,6 @@
+{
+  "sdk": {
+    "version": "10.0.100",
+    "rollForward": "latestFeature"
+  }
+}

package/templates/project/dotnet/src/App/Data/AppDbContext.cs

@@ -0,0 +1,12 @@
+using Microsoft.EntityFrameworkCore;
+
+namespace App.Data;
+
+/// <summary>
+/// Application DbContext. Add DbSet&lt;TEntity&gt; properties for your tables.
+/// Schema changes go through migrations (see the project README), never
+/// EnsureCreated().
+/// </summary>
+public class AppDbContext(DbContextOptions<AppDbContext> options) : DbContext(options)
+{
+}

package/templates/project/dotnet/src/App/Lakebase/DotEnv.cs

@@ -0,0 +1,48 @@
+namespace App.Lakebase;
+
+/// <summary>
+/// Minimal .env loader (KEY=VALUE lines, # comments, optional quotes). Never
+/// overwrites variables already set in the process environment.
+/// </summary>
+public static class DotEnv
+{
+    public static void LoadFromRepoRoot()
+    {
+        foreach (var start in new[] { Directory.GetCurrentDirectory(), AppContext.BaseDirectory })
+        {
+            for (var dir = new DirectoryInfo(start); dir is not null; dir = dir.Parent)
+            {
+                var candidate = Path.Combine(dir.FullName, ".env");
+                if (File.Exists(candidate))
+                {
+                    Load(candidate);
+                    return;
+                }
+            }
+        }
+    }
+
+    public static void Load(string path)
+    {
+        foreach (var raw in File.ReadAllLines(path))
+        {
+            var line = raw.Trim();
+            if (line.Length == 0 || line.StartsWith('#'))
+                continue;
+            if (line.StartsWith("export ", StringComparison.Ordinal))
+                line = line[7..].TrimStart();
+
+            var eq = line.IndexOf('=');
+            if (eq <= 0)
+                continue;
+
+            var key = line[..eq].Trim();
+            var value = line[(eq + 1)..].Trim();
+            if (value.Length >= 2 && (value[0] == '"' || value[0] == '\'') && value[^1] == value[0])
+                value = value[1..^1];
+
+            if (Environment.GetEnvironmentVariable(key) is null)
+                Environment.SetEnvironmentVariable(key, value);
+        }
+    }
+}

package/templates/project/dotnet/src/App/Lakebase/LakebaseConnection.cs

@@ -0,0 +1,225 @@
+using System.Diagnostics;
+using System.Text.Json;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Npgsql;
+
+namespace App.Lakebase;
+
+/// <summary>
+/// Builds the app's Postgres connection. Credentials are minted at RUNTIME, never
+/// stored in .env: the data source is built from connection METADATA
+/// (LAKEBASE_HOST, LAKEBASE_PROJECT_ID, LAKEBASE_BRANCH_ID, DB_USERNAME) and a
+/// periodic password provider injects a short-lived Lakebase credential minted by
+/// the databricks CLI (the same credential source as the Python and Node templates).
+///
+/// An explicit DATABASE_URL (CI secret, Docker, the kit's ephemeral-verify DSN)
+/// OVERRIDES this and is used verbatim. postgresql:// URLs and Npgsql
+/// "Host=...;" strings are both accepted.
+/// </summary>
+public static class LakebaseConnection
+{
+    // Lakebase credentials live ~1h; re-mint after 40 min so a new physical
+    // connection never presents an expired token.
+    private static readonly TimeSpan MintTtl = TimeSpan.FromMinutes(40);
+    private static readonly SemaphoreSlim MintLock = new(1, 1);
+    private static string? _cachedToken;
+    private static DateTime _mintedAt = DateTime.MinValue;
+
+    /// <summary>
+    /// Registers one process-wide NpgsqlDataSource and a DbContext that uses it.
+    /// Never build a data source per DbContext: that creates a new pool and mints a
+    /// new credential on every request.
+    /// </summary>
+    public static IServiceCollection AddLakebaseDbContext<TContext>(this IServiceCollection services)
+        where TContext : DbContext
+    {
+        services.TryAddSingleton(_ => CreateDataSource());
+        services.AddDbContext<TContext>((sp, options) =>
+            options.UseNpgsql(sp.GetRequiredService<NpgsqlDataSource>()));
+        return services;
+    }
+
+    /// <summary>Data source for the app (and the EF Core design-time factory).</summary>
+    public static NpgsqlDataSource CreateDataSource()
+    {
+        var explicitUrl = Environment.GetEnvironmentVariable("DATABASE_URL");
+        if (!string.IsNullOrWhiteSpace(explicitUrl))
+            return NpgsqlDataSource.Create(Normalize(new NpgsqlConnectionStringBuilder(ToNpgsql(explicitUrl))).ConnectionString);
+
+        var host = Env("LAKEBASE_HOST") ?? Env("DB_HOST");
+        var endpoint = EndpointPathFromEnv();
+        var builder = new NpgsqlConnectionStringBuilder
+        {
+            Host = host ?? "localhost",
+            Port = 5432,
+            Database = Env("DB_NAME") ?? "databricks_postgres",
+        };
+
+        if (host is null || endpoint is null)
+            return NpgsqlDataSource.Create(Normalize(builder).ConnectionString); // pure-local fallback
+
+        // Resolve the user without failing here: design-time commands such as
+        // `dotnet ef migrations add` build a data source but never connect, so
+        // an offline or expired CLI session must only fail when a connection
+        // is actually opened.
+        Exception? userError = null;
+        var user = Env("DB_USERNAME");
+        if (user is null)
+        {
+            try { user = CurrentUser(); }
+            catch (Exception ex) { userError = ex; }
+        }
+
+        builder.Username = user ?? "unresolved-lakebase-user";
+        var dataSourceBuilder = new NpgsqlDataSourceBuilder(Normalize(builder).ConnectionString);
+        dataSourceBuilder.UsePeriodicPasswordProvider(
+            async (_, ct) => userError is null
+                ? await MintTokenAsync(endpoint, ct)
+                : throw new InvalidOperationException(
+                    "Could not resolve the Lakebase user. Set DB_USERNAME in .env or run 'databricks auth login'.", userError),
+            successRefreshInterval: TimeSpan.FromMinutes(5),
+            failureRefreshInterval: TimeSpan.FromSeconds(10));
+        return dataSourceBuilder.Build();
+    }
+
+    /// <summary>projects/&lt;id&gt;/branches/&lt;branch&gt;/endpoints/&lt;endpoint&gt;, or null without metadata.</summary>
+    public static string? EndpointPathFromEnv()
+    {
+        var project = Env("LAKEBASE_PROJECT_ID");
+        var branch = Env("LAKEBASE_BRANCH_ID");
+        if (project is null || branch is null)
+            return null;
+        return $"projects/{project}/branches/{branch}/endpoints/{Env("LAKEBASE_ENDPOINT") ?? "primary"}";
+    }
+
+    /// <summary>Convert a postgresql:// URL to an Npgsql connection string; pass Npgsql strings through.</summary>
+    public static string ToNpgsql(string databaseUrl)
+    {
+        var raw = databaseUrl.Trim();
+        if (!raw.StartsWith("postgres://", StringComparison.OrdinalIgnoreCase)
+            && !raw.StartsWith("postgresql://", StringComparison.OrdinalIgnoreCase))
+            return raw;
+
+        var uri = new Uri(raw);
+        var builder = new NpgsqlConnectionStringBuilder
+        {
+            Host = uri.Host,
+            Port = uri.Port > 0 ? uri.Port : 5432,
+            Database = Uri.UnescapeDataString(uri.AbsolutePath.TrimStart('/')),
+        };
+        var userInfo = uri.UserInfo.Split(':', 2);
+        if (userInfo[0].Length > 0)
+            builder.Username = Uri.UnescapeDataString(userInfo[0]);
+        if (userInfo.Length > 1)
+            builder.Password = Uri.UnescapeDataString(userInfo[1]);
+
+        foreach (var pair in uri.Query.TrimStart('?').Split('&', StringSplitOptions.RemoveEmptyEntries))
+        {
+            var kv = pair.Split('=', 2);
+            var value = kv.Length > 1 ? Uri.UnescapeDataString(kv[1]) : "";
+            switch (kv[0].ToLowerInvariant())
+            {
+                case "sslmode":
+                    builder.SslMode = value.ToLowerInvariant() switch
+                    {
+                        "disable" => SslMode.Disable,
+                        "allow" => SslMode.Allow,
+                        "prefer" => SslMode.Prefer,
+                        "verify-ca" => SslMode.VerifyCA,
+                        "verify-full" => SslMode.VerifyFull,
+                        _ => SslMode.Require,
+                    };
+                    break;
+                case "application_name":
+                    builder.ApplicationName = value;
+                    break;
+            }
+        }
+
+        return builder.ConnectionString;
+    }
+
+    // TLS on and a non-empty application_name, so every connection is
+    // identifiable in pg_stat_activity.
+    private static NpgsqlConnectionStringBuilder Normalize(NpgsqlConnectionStringBuilder builder)
+    {
+        var weakTls = builder.SslMode is SslMode.Disable or SslMode.Allow or SslMode.Prefer;
+        if (weakTls && builder.Host != "localhost")
+            builder.SslMode = SslMode.Require;
+        if (string.IsNullOrEmpty(builder.ApplicationName))
+        {
+            var consort = Env("CONSORT_VERSION");
+            builder.ApplicationName = Env("PGAPPNAME")
+                ?? (consort is not null ? $"consort/{consort}" : "scm-utils/{{LAKEBASE_SCM_UTILS_VERSION}}");
+        }
+
+        return builder;
+    }
+
+    private static async Task<string> MintTokenAsync(string endpoint, CancellationToken ct)
+    {
+        await MintLock.WaitAsync(ct);
+        try
+        {
+            if (_cachedToken is not null && DateTime.UtcNow - _mintedAt < MintTtl)
+                return _cachedToken;
+
+            var json = await RunDatabricksAsync(["postgres", "generate-database-credential", endpoint, "-o", "json"], ct);
+            using var doc = JsonDocument.Parse(json);
+            _cachedToken = doc.RootElement.GetProperty("token").GetString()
+                ?? throw new InvalidOperationException($"generate-database-credential returned no token for {endpoint}");
+            _mintedAt = DateTime.UtcNow;
+            return _cachedToken;
+        }
+        finally
+        {
+            MintLock.Release();
+        }
+    }
+
+    private static string CurrentUser()
+    {
+        var json = RunDatabricksAsync(["current-user", "me", "-o", "json"], CancellationToken.None).GetAwaiter().GetResult();
+        using var doc = JsonDocument.Parse(json);
+        return doc.RootElement.GetProperty("userName").GetString()
+            ?? throw new InvalidOperationException("databricks current-user me returned no userName; set DB_USERNAME in .env");
+    }
+
+    private static async Task<string> RunDatabricksAsync(IEnumerable<string> args, CancellationToken ct)
+    {
+        var psi = new ProcessStartInfo("databricks")
+        {
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+        };
+        foreach (var arg in args)
+            psi.ArgumentList.Add(arg);
+        if (Env("DATABRICKS_CONFIG_PROFILE") is { } profile)
+        {
+            psi.ArgumentList.Add("--profile");
+            psi.ArgumentList.Add(profile);
+        }
+
+        using var process = Process.Start(psi)
+            ?? throw new InvalidOperationException("Could not start the databricks CLI. Is it installed and on PATH?");
+        var stdout = process.StandardOutput.ReadToEndAsync(ct);
+        var stderr = process.StandardError.ReadToEndAsync(ct);
+        await process.WaitForExitAsync(ct);
+        if (process.ExitCode != 0)
+        {
+            var err = (await stderr).Trim();
+            var hint = err.Contains("auth login", StringComparison.OrdinalIgnoreCase)
+                || err.Contains("refresh token", StringComparison.OrdinalIgnoreCase)
+                    ? " Run 'databricks auth login' to re-authenticate."
+                    : "";
+            throw new InvalidOperationException($"databricks {string.Join(' ', psi.ArgumentList)} failed: {err}{hint}");
+        }
+
+        return await stdout;
+    }
+
+    private static string? Env(string name)
+        => Environment.GetEnvironmentVariable(name) is { Length: > 0 } value ? value : null;
+}

package/templates/project/dotnet/src/App/Program.cs

@@ -0,0 +1,34 @@
+using App.Data;
+using App.Lakebase;
+
+// Load .env from the repo root so the Lakebase connection metadata written by
+// the post-checkout hook is available however the app is started. Variables
+// already set in the environment (CI secrets, Docker --env) always win.
+DotEnv.LoadFromRepoRoot();
+
+var builder = WebApplication.CreateBuilder(args);
+
+// One process-wide data source: a single connection pool whose password is a
+// short-lived Lakebase credential refreshed in the background.
+builder.Services.AddLakebaseDbContext<AppDbContext>();
+
+// OpenAPI description of the endpoints, browsable at /docs (like the Node template).
+builder.Services.AddOpenApi();
+
+var app = builder.Build();
+
+app.MapOpenApi("/openapi.json");
+app.UseSwaggerUI(options =>
+{
+    options.RoutePrefix = "docs";
+    options.SwaggerEndpoint("/openapi.json", "API");
+});
+
+app.MapGet("/health", () => Results.Ok(new { status = "ok" }));
+
+// Register API endpoints above this line.
+
+app.Run();
+
+// Exposed for WebApplicationFactory<Program> in tests.
+public partial class Program;

package/templates/project/dotnet/src/App/appsettings.json

@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "AllowedHosts": "*"
+}

package/templates/project/dotnet/tests/App.Tests/App.Tests.csproj

@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\src\App\App.csproj" />
+  </ItemGroup>
+
+</Project>