@mnci/cli 4.1.5 → 4.2.1

package/dist/cli.js

@@ -38,8 +38,8 @@ module.exports = __toCommonJS(cli_exports);
 var import_commander = require("commander");
 
 // src/commands/add.ts
-var import_node_path13 = require("path");
-var import_prompts5 = require("@inquirer/prompts");
+var import_node_path14 = require("path");
+var import_prompts6 = require("@inquirer/prompts");
 
 // src/nx.ts
 var import_cross_spawn = __toESM(require("cross-spawn"));
@@ -291,13 +291,10 @@ function assertValidProjectName(name, label) {
   }
 }
 
-// src/commands/add/flutter.ts
+// src/commands/add/csharp.ts
+var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
 
-// src/commands/add/shared.ts
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
-
 // src/overlay.ts
 var import_node_fs2 = require("fs");
 var import_node_path2 = require("path");
@@ -436,7 +433,8 @@ function devcontainerJson(workspaceName) {
     image: `mcr.microsoft.com/devcontainers/typescript-node:${NODE_VERSION}-bookworm`,
     features: {
       "ghcr.io/devcontainers/features/python:1": { version: "3.12" },
-      "ghcr.io/devcontainers/features/go:1": { version: "latest" }
+      "ghcr.io/devcontainers/features/go:1": { version: "latest" },
+      "ghcr.io/devcontainers/features/dotnet:2": { version: DOTNET_SDK_VERSION.replace(/\.x$/, "") }
     },
     // `npm ci` first: every guard after it runs through the workspace's own
     // scripts and Nx, which do not exist until the install completes.
@@ -501,7 +499,7 @@ var ESLINT_PEER_OVERRIDES = {
   // both — and forcing those to v5 breaks them. So the blast radius is one
   // dependency edge per named parent, and a test asserts there is no top-level
   // entry.
-  "nx": { "brace-expansion": "^5.0.9" },
+  "nx": { "brace-expansion": "^5.0.9", "smol-toml": "^1.7.1" },
   "@nx/js": { "brace-expansion": "^5.0.9" },
   "@nx/eslint": { "brace-expansion": "^5.0.9" },
   "@nx/eslint-plugin": { "brace-expansion": "^5.0.9" },
@@ -779,6 +777,65 @@ function pythonPublishUrl(registry) {
   }
   return void 0;
 }
+function nugetFeedUrl(registry) {
+  if (registry.kind === "azure-artifacts") {
+    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/nuget/v3/index.json`;
+  }
+  return void 0;
+}
+var NUGET_AZURE_SOURCE = "AzureArtifacts";
+function nugetConfigContent(registry, scope) {
+  if (registry.kind === "npm") {
+    return `<?xml version="1.0" encoding="utf-8"?>
+<!-- Publish authentication for NuGet is deliberately UNCONFIGURED for the
+     public npm registry choice: publishing to public nuget.org needs a
+     nuget.org-issued API key, a credential mnci collects nowhere (the same
+     gap Python's PyPI publish has for this same registry choice). A
+     csharp-lib is still versioned and tagged; run "dotnet nuget push"
+     yourself with your own key, or regenerate choosing the azure-artifacts
+     registry instead. -->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+</configuration>
+`;
+  }
+  const pascalScope2 = scope.replace(/^@/, "").split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+  const feedUrl = nugetFeedUrl(registry);
+  return `<?xml version="1.0" encoding="utf-8"?>
+<!-- NuGet's own environment-variable syntax is '%VAR%' on every platform \u2014
+     never '\${VAR}'/'$VAR', which resolve on none of them. NUGET_PAT is the
+     RAW PAT (not base64 \u2014 unlike .npmrc's _password, NuGet's HTTP client
+     handles Basic auth itself from Username + ClearTextPassword), exported
+     only by the CI release step (see nugetPublishEnvFragment in mnci); an
+     ordinary build/test/lint step never needs it, since packageSourceMapping
+     below scopes this feed to ${pascalScope2}.* packages only. -->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+    <add key="${NUGET_AZURE_SOURCE}" value="${feedUrl}" />
+  </packageSources>
+  <packageSourceCredentials>
+    <${NUGET_AZURE_SOURCE}>
+      <add key="Username" value="AzureArtifacts" />
+      <add key="ClearTextPassword" value="%NUGET_PAT%" />
+    </${NUGET_AZURE_SOURCE}>
+  </packageSourceCredentials>
+  <packageSourceMapping>
+    <clear />
+    <packageSource key="${NUGET_AZURE_SOURCE}">
+      <package pattern="${pascalScope2}.*" />
+    </packageSource>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>
+`;
+}
 var PYTHON_INSTALL_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py+' -m pip install -r requirements-dev.txt',{stdio:'inherit',shell:true}).status ?? 1)"`;
 var PYTHON_WORKSPACE_INSTALL_GUARD = `node -e "const fs=require('node:fs'),path=require('node:path');const editableDirs=[...fs.globSync('apps/*/pyproject.toml'),...fs.globSync('python-packages/*/pyproject.toml'),...fs.globSync('libs/*/pyproject.toml')].map((p)=>path.dirname(p));const requirementsFiles=fs.globSync('apps/*/requirements.txt');if(editableDirs.length===0&&requirementsFiles.length===0){console.log('No Python projects - skipping.');process.exit(0)}const args=['-m','pip','install','--quiet',...editableDirs.flatMap((d)=>['-e',d]),...requirementsFiles.flatMap((f)=>['-r',f])];const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py,args,{stdio:'inherit'}).status ?? 1)"`;
 var PIP_AUDIT_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';require('node:child_process').spawnSync(py,['-m','pip_audit'],{stdio:'inherit'});process.exit(0)"`;
@@ -790,6 +847,8 @@ var GO_TOOL_PATH_GITHUB = `node -e "${GO_TOOL_PATH_PRELUDE}if(!process.env.GITHU
 var FLUTTER_SDK_VERSION = "3.44.8";
 var NODE_VERSION = "24";
 var NPM_VERSION = "11";
+var DOTNET_SDK_VERSION = "10.0.x";
+var DOTNET_DETECT_AZURE = `node -e "const fs=require('node:fs');const has=[...fs.globSync('apps/*/*.csproj'),...fs.globSync('packages/*/*.csproj'),...fs.globSync('libs/*/*.csproj')].length>0;console.log('##vso[task.setvariable variable=hasDotnetProjects]'+has)"`;
 var FLUTTER_SDK_DIRECTORY_EXPRESSION = `require('node:path').join(require('node:os').homedir(),'.mnci-flutter-${FLUTTER_SDK_VERSION}')`;
 var FLUTTER_SDK_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}if(cp.spawnSync('flutter',['--version'],{stdio:'ignore',shell:process.platform==='win32'}).status===0){console.log('Flutter SDK already on PATH - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(fs.existsSync(sdk)){console.log('Flutter SDK already installed at '+sdk+' - skipping.');process.exit(0)}process.exit(cp.spawnSync('git',['clone','--depth','1','--branch','${FLUTTER_SDK_VERSION}','https://github.com/flutter/flutter.git',sdk],{stdio:'inherit'}).status ?? 1)"`;
 var FLUTTER_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),path=require('node:path');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(!fs.existsSync(sdk)){console.log('Flutter SDK was not installed by mnci (already on PATH) - skipping.');process.exit(0)}const bin=path.join(sdk,'bin');`;
@@ -799,20 +858,23 @@ var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsS
 var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('npm',['audit','--json'],{encoding:'utf8',shell:process.platform==='win32',maxBuffer:33554432});let d;try{d=JSON.parse(r.stdout)}catch{console.log('npm audit produced no JSON (exit '+r.status+') - not blocking on a broken audit.');process.exit(0)}const all=Object.values(d.vulnerabilities||{});const BLOCK=['critical','high','moderate'];const act=all.filter(v=>v.fixAvailable&&BLOCK.includes(v.severity));const rest=all.filter(v=>!act.includes(v));for(const v of rest)console.log('  note ['+v.severity+'] '+v.name+(v.fixAvailable?' - fix available, below the blocking threshold':' - NO fix available upstream, nothing to do here'));if(act.length===0){console.log('npm audit - '+all.length+' advisory(ies), none actionable at moderate or above.');process.exit(0)}for(const v of act)console.log('  BLOCKING ['+v.severity+'] '+v.name+' - fix available'+(v.fixAvailable&&v.fixAvailable.isSemVerMajor?' (semver-major)':''));console.log('Each has a published fix. Add a targeted overrides entry in package.json rather than npm audit fix --force.');process.exit(1)"`;
 var VERIFY_TARGETS = "lint,typecheck,test,build";
 var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
-var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});if(!hasProjectJson&&!hasInlineNx){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
-function releaseGuard(pythonPublishEnv) {
-  return `node -e "const fs=require('node:fs'),cp=require('node:child_process');const hasNpm=fs.globSync('packages/*/package.json').length>0;const hasPython=fs.globSync('python-packages/*/pyproject.toml').length>0;if(!hasNpm&&!hasPython){console.log('Nothing to release - skipping.');process.exit(0)}const env={...process.env};${pythonPublishEnv}process.exit(cp.spawnSync('npx nx release --yes',{stdio:'inherit',shell:true,env}).status ?? 1)"`;
+var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});const hasCsproj=fs.globSync('apps/*/*.csproj').length>0;if(!hasProjectJson&&!hasInlineNx&&!hasCsproj){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
+function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
+  return `node -e "const fs=require('node:fs'),cp=require('node:child_process');const hasNpm=fs.globSync('packages/*/package.json').length>0;const hasPython=fs.globSync('python-packages/*/pyproject.toml').length>0;const hasCsharp=fs.globSync('packages/*/*.csproj').length>0;if(!hasNpm&&!hasPython&&!hasCsharp){console.log('Nothing to release - skipping.');process.exit(0)}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync('npx nx release --yes',{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
 function pythonPublishEnvFragment(pythonPublishUrl2) {
   return pythonPublishUrl2 ? `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}` : "";
 }
+function nugetPublishEnvFragment(nugetFeedUrl2) {
+  return nugetFeedUrl2 ? "if(hasCsharp){env.NUGET_PAT=Buffer.from(process.env.PAT,'base64').toString()}" : "";
+}
 function npmAuthEnvVariable(registryKind, variableReference) {
   return registryKind === "npm" ? ["NODE_AUTH_TOKEN", variableReference("NPM_TOKEN")] : ["PAT", variableReference("PAT")];
 }
 function poolBlock(agent) {
   return /^(?:ubuntu|windows|macos)-/i.test(agent) ? `  vmImage: ${agent}` : `  name: ${agent}`;
 }
-function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts") {
+function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKind = "azure-artifacts", nugetFeedUrl2) {
   const onMain = "and(succeeded(), in(variables['Build.Reason'], 'IndividualCI', 'BatchedCI'), eq(variables['Build.SourceBranchName'], 'main'))";
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(registryKind, (name) => `$(${name})`);
   return `name: monorepo-ci-$(Date:yyyyMMdd)$(Rev:.r)
@@ -984,6 +1046,20 @@ steps:
   - script: ${FLUTTER_PUB_GET_GUARD}
     displayName: Resolve Dart dependencies (one pub get for the whole workspace)
 
+  # .NET, if the workspace has any. Azure's 'condition:' expression language
+  # has no glob function, so this script step detects C# projects first and
+  # hands the answer to the install task below through a pipeline variable \u2014
+  # see DOTNET_DETECT_AZURE's remarks for why this differs from every other
+  # toolchain's self-gating 'node -e' guard.
+  - script: ${DOTNET_DETECT_AZURE}
+    displayName: Detect .NET projects
+
+  - task: UseDotNet@2
+    displayName: Install the .NET SDK (${DOTNET_SDK_VERSION})
+    condition: eq(variables['hasDotnetProjects'], 'true')
+    inputs:
+      version: ${DOTNET_SDK_VERSION}
+
   # Fails fast, with an unambiguous message, when a stale TypeScript project
   # reference (or another sync generator's drift) was never synced+committed
   # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
@@ -1024,13 +1100,14 @@ steps:
     displayName: Tag the run per app (type-name)
     condition: ${onMain}
 
-  # Version + tag + publish, in one release, for npm (packages/*) AND Python
-  # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
-  # nx release errors on an empty scope, so skip cleanly when there is nothing
-  # to release. When there are Python packages and an Azure feed, twine
-  # publish credentials are exported (raw PAT, decoded from the base64 variable).
-  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
-    displayName: Release \u2014 version, tag and publish (npm + Python)
+  # Version + tag + publish, in one release, for npm (packages/*), Python
+  # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional commits,
+  # tag-only push. Portable guard: nx release errors on an empty scope, so
+  # skip cleanly when there is nothing to release. When there are Python or
+  # C# packages and an Azure feed, twine/NuGet publish credentials are
+  # exported (raw PAT, decoded from the base64 variable).
+  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2), nugetPublishEnvFragment(nugetFeedUrl2))}
+    displayName: Release \u2014 version, tag and publish (npm + Python + C#)
     condition: ${onMain}
     env:
       ${npmAuthName}: ${npmAuthValue}
@@ -1045,7 +1122,7 @@ steps:
     condition: ${onMain}
 `;
 }
-function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github") {
+function githubActionsYaml(agent, pythonPublishUrl2, registryKind = "azure-artifacts", ci = "github", nugetFeedUrl2) {
   const onMain = "github.event_name == 'push' && github.ref_name == 'main'";
   const [npmAuthName, npmAuthValue] = npmAuthEnvVariable(
     registryKind,
@@ -1180,6 +1257,16 @@ jobs:
       - run: ${FLUTTER_PUB_GET_GUARD}
         name: Resolve Dart dependencies (one pub get for the whole workspace)
 
+      # .NET, if the workspace has any. actions/setup-dotnet is the
+      # maintained, cached installer GitHub itself ships, so this uses it
+      # directly rather than a hand-rolled 'node -e' guard \u2014 see
+      # DOTNET_DETECT_AZURE's remarks for the full reasoning. hashFiles()
+      # gates it inline, so a JS-only workspace pays nothing.
+      - uses: actions/setup-dotnet@v4
+        if: \${{ hashFiles('apps/*/*.csproj', 'packages/*/*.csproj', 'libs/*/*.csproj') != '' }}
+        with:
+          dotnet-version: ${DOTNET_SDK_VERSION}
+
       # Fails fast, with an unambiguous message, when a stale TypeScript project
       # reference (or another sync generator's drift) was never synced+committed
       # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
@@ -1214,18 +1301,19 @@ jobs:
           path: dist/drop
           if-no-files-found: ignore
 
-      # Version + tag + publish, in one release, for npm (packages/*) AND Python
-      # (python-packages/*) \u2014 conventional commits, tag-only push. Portable guard:
-      # nx release errors on an empty scope, so skip cleanly when there is nothing
-      # to release. When there are Python packages and an Azure feed, twine
-      # publish credentials are exported (raw PAT, decoded from the base64 secret).${githubReleases ? `
+      # Version + tag + publish, in one release, for npm (packages/*), Python
+      # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional
+      # commits, tag-only push. Portable guard: nx release errors on an empty
+      # scope, so skip cleanly when there is nothing to release. When there
+      # are Python or C# packages and an Azure feed, twine/NuGet publish
+      # credentials are exported (raw PAT, decoded from the base64 secret).${githubReleases ? `
       # This provider also creates a per-project GitHub Release (changelog
       # generated from conventional commits since that project's last tag),
       # which is why 'nx release' pushes the tag itself here \u2014 see
       # releaseConfig's remarks for why that is safe on this Nx version and
       # why every other provider combination keeps the explicit push step below.` : ""}
-      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2))}
-        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python)
+      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2), nugetPublishEnvFragment(nugetFeedUrl2))}
+        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C#)
         if: \${{ ${onMain} }}
         env:
           ${npmAuthName}: ${npmAuthValue}${githubReleases ? `
@@ -1407,24 +1495,27 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
     (0, import_node_fs2.rmSync)((0, import_node_path2.join)(workspaceRoot, "undefined.code-workspace"), { force: true });
   }
   const publishUrl = pythonPublishUrl(options.registry);
+  const nugetUrl = nugetFeedUrl(options.registry);
   if (options.ci === "azure" || options.ci === "both") {
     onProgress("azure-pipelines.yml \u2014 build, verify, pack and release");
     writeFileEnsured(
       (0, import_node_path2.join)(workspaceRoot, "azure-pipelines.yml"),
-      azurePipelinesYaml(options.agent, options.variableGroup, publishUrl, options.registry.kind)
+      azurePipelinesYaml(options.agent, options.variableGroup, publishUrl, options.registry.kind, nugetUrl)
     );
   }
   if (options.ci === "github" || options.ci === "both") {
     onProgress(".github/workflows/ci.yml and dependabot.yml");
     writeFileEnsured(
       (0, import_node_path2.join)(workspaceRoot, ".github/workflows/ci.yml"),
-      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci)
+      githubActionsYaml(options.agent, publishUrl, options.registry.kind, options.ci, nugetUrl)
     );
     writeFileEnsured((0, import_node_path2.join)(workspaceRoot, ".github/dependabot.yml"), dependabotConfig(workspaceRoot));
   }
 }
 
 // src/commands/add/shared.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
 function hasPlugin(workspaceRoot, packageName) {
   const manifest = readJson((0, import_node_path3.join)(workspaceRoot, "package.json"));
   const installed = { ...manifest.dependencies, ...manifest.devDependencies };
@@ -1671,6 +1762,11 @@ function addNxTargets(manifestPath, newTargets) {
     toJson({ ...manifest, nx: { ...nx, targets: { ...targets, ...newTargets } } })
   );
 }
+function addProjectJsonTargets(projectJsonPath, newTargets) {
+  const project = fileExists(projectJsonPath) ? readJson(projectJsonPath) : {};
+  const targets = project.targets ?? {};
+  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
+}
 var ESLINT_CONFIG_FILENAMES = [
   "eslint.config.js",
   "eslint.config.mjs",
@@ -1798,12 +1894,261 @@ function relocateRootRuntimeDependencies(workspaceRoot, projectName, before) {
   }
 }
 
-// src/commands/add/flutter.ts
-function addProjectJsonTargets(projectJsonPath, newTargets) {
-  const project = readJson(projectJsonPath);
-  const targets = project.targets ?? {};
-  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
+// src/commands/add/csharp.ts
+function ensureDotnet(workspaceRoot) {
+  if (runShell("dotnet", ["--version"], workspaceRoot) !== 0) {
+    throw new Error(".NET SDK not found. Install .NET 8+ first: https://dotnet.microsoft.com/download");
+  }
+}
+function targetFramework() {
+  const [major, minor] = DOTNET_SDK_VERSION.split(".", 2);
+  return `net${major}.${minor}`;
+}
+function pascalCase(name) {
+  return name.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+}
+function scaffoldDotnetProject(workspaceRoot, projectRoot, identity, template) {
+  if (runShell(
+    "dotnet",
+    ["new", template, "-n", identity, "-o", projectRoot, "--framework", targetFramework()],
+    workspaceRoot
+  ) !== 0) {
+    throw new Error(`dotnet new ${template} failed for ${projectRoot}`);
+  }
+}
+function csharpAppPackageTarget(tag, projectRoot, name) {
+  const outDir = `dist/apps/${name}`;
+  const zip = `dist/drop/${tag}-${name}.zip`;
+  const command = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('dotnet',['publish','${projectRoot}','-c','Release','-o','${outDir}'],{stdio:'inherit',shell:true});if(r.status!==0)process.exit(r.status??1);const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const A=require('adm-zip');const z=new A();z.addLocalFolder('${outDir}');z.writeZip('${zip}')"`;
+  return {
+    executor: "nx:run-commands",
+    outputs: [`{workspaceRoot}/${zip}`],
+    options: { command }
+  };
+}
+function csharpAppStartTarget(projectRoot) {
+  return {
+    executor: "nx:run-commands",
+    continuous: true,
+    options: { command: "dotnet run", cwd: projectRoot }
+  };
+}
+function addCsharpApp(workspaceRoot, name, template = "console") {
+  ensureDotnet(workspaceRoot);
+  ensurePlugin(workspaceRoot, "@nx/dotnet");
+  ensureAdmZip(workspaceRoot);
+  const projectRoot = `apps/${name}`;
+  scaffoldDotnetProject(workspaceRoot, projectRoot, pascalCase(name), template);
+  addProjectJsonTargets((0, import_node_path4.join)(workspaceRoot, projectRoot, "project.json"), {
+    package: csharpAppPackageTarget("csharp-app", projectRoot, name),
+    start: csharpAppStartTarget(projectRoot)
+  });
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+}
+function pascalScope(scope) {
+  return pascalCase(scope.replace(/^@/, ""));
+}
+var CSHARP_VERSION_ACTIONS_PATH = "tools/csharp-version-actions.cjs";
+var CSHARP_VERSION_ACTIONS = `'use strict'
+
+const { join } = require('node:path')
+const { VersionActions } = require('nx/release')
+
+const VERSION_TAG = /<Version>([^<]*)<\\/Version>/
+
+function findCsproj (tree, root) {
+  const name = tree.children(root).find((entry) => entry.endsWith('.csproj'))
+  return name ? join(root, name) : null
+}
+
+/**
+ * Hand-written Nx release VersionActions for a publishable C# library: reads
+ * and writes the <Version> element of the project's own .csproj. Written by
+ * \`mnci add csharp-lib\` \u2014 see that command's source for why this is a
+ * workspace file rather than an npm package.
+ */
+class CsharpVersionActions extends VersionActions {
+  validManifestFilenames = ['*.csproj']
+
+  async readCurrentVersionFromSourceManifest (tree) {
+    const manifestPath = findCsproj(tree, this.projectGraphNode.data.root)
+    if (!manifestPath) {
+      return null
+    }
+    const contents = tree.read(manifestPath, 'utf8') ?? ''
+    const match = VERSION_TAG.exec(contents)
+    if (!match || !match[1]) {
+      throw new Error(\`Could not find a <Version> element in \${manifestPath}\`)
+    }
+
+    return { currentVersion: match[1], manifestPath }
+  }
+
+  async readCurrentVersionFromRegistry (_tree, _currentVersionResolverMetadata) {
+    return {
+      currentVersion: null,
+      logText:        'C# libraries resolve their current version from git tags, not a registry lookup',
+    }
+  }
+
+  async readCurrentVersionOfDependency (_tree, _projectGraph, _dependencyProjectName) {
+    return { currentVersion: null, dependencyCollection: null }
+  }
+
+  async updateProjectVersion (tree, newVersion) {
+    const manifestPath = findCsproj(tree, this.projectGraphNode.data.root)
+    if (!manifestPath) {
+      throw new Error(\`No .csproj found in \${this.projectGraphNode.data.root}\`)
+    }
+    const contents = tree.read(manifestPath, 'utf8') ?? ''
+    if (!VERSION_TAG.test(contents)) {
+      throw new Error(\`Could not find a <Version> element in \${manifestPath}\`)
+    }
+    tree.write(manifestPath, contents.replace(VERSION_TAG, () => \`<Version>\${newVersion}</Version>\`))
+
+    return [\`Updated \${manifestPath} to version \${newVersion}\`]
+  }
+
+  async updateProjectDependencies (_tree, _projectGraph, _dependenciesToUpdate) {
+    return []
+  }
+
+  async validate (tree) {
+    if (!findCsproj(tree, this.projectGraphNode.data.root)) {
+      throw new Error(\`The project "\${this.projectGraphNode.name}" does not have a .csproj file available in \${this.projectGraphNode.data.root}\`)
+    }
+  }
 }
+
+module.exports = CsharpVersionActions
+`;
+function writeCsharpVersionActions(workspaceRoot) {
+  writeFileEnsured((0, import_node_path4.join)(workspaceRoot, CSHARP_VERSION_ACTIONS_PATH), CSHARP_VERSION_ACTIONS);
+}
+function addProjectJsonReleaseVersionActions(projectJsonPath) {
+  const project = fileExists(projectJsonPath) ? readJson(projectJsonPath) : {};
+  const release = project.release ?? {};
+  const version = release.version ?? {};
+  writeFileEnsured(
+    projectJsonPath,
+    toJson({
+      ...project,
+      release: { ...release, version: { ...version, versionActions: CSHARP_VERSION_ACTIONS_PATH } }
+    })
+  );
+}
+function addInitialVersion(csprojPath) {
+  const contents = (0, import_node_fs4.readFileSync)(csprojPath, "utf8");
+  writeFileEnsured(csprojPath, contents.replace("<PropertyGroup>", "<PropertyGroup>\n    <Version>0.1.0</Version>"));
+}
+function csharpLibPublishTarget(projectRoot) {
+  const outDir = `${projectRoot}/dist`;
+  const command = `node -e "if(!process.env.NUGET_PAT){console.log('NuGet publish is not configured for this registry choice (no NUGET_PAT) - skipping. Regenerate with --registry azure-artifacts, or run dotnet nuget push manually.');process.exit(0)}const cp=require('node:child_process');const pack=cp.spawnSync('dotnet',['pack','${projectRoot}','-c','Release','-o','${outDir}'],{stdio:'inherit',shell:true});if(pack.status!==0)process.exit(pack.status??1);const fs=require('node:fs');for(const pkg of fs.globSync('${outDir}/*.nupkg')){const push=cp.spawnSync('dotnet',['nuget','push',pkg,'--source','${NUGET_AZURE_SOURCE}','--api-key','AZ'],{stdio:'inherit',shell:true});if(push.status!==0)process.exit(push.status??1)}"`;
+  return { executor: "nx:run-commands", options: { command } };
+}
+async function addCsharpLib(workspaceRoot, name, options, kindProvided) {
+  ensureDotnet(workspaceRoot);
+  ensurePlugin(workspaceRoot, "@nx/dotnet");
+  const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("NuGet package scope for the published library", defaultScope(workspaceRoot)));
+  const projectRoot = `packages/${name}`;
+  const identity = `${pascalScope(scope)}.${pascalCase(name)}`;
+  scaffoldDotnetProject(workspaceRoot, projectRoot, identity, "classlib");
+  addInitialVersion((0, import_node_path4.join)(workspaceRoot, projectRoot, `${identity}.csproj`));
+  writeCsharpVersionActions(workspaceRoot);
+  addProjectJsonReleaseVersionActions((0, import_node_path4.join)(workspaceRoot, projectRoot, "project.json"));
+  addProjectJsonTargets((0, import_node_path4.join)(workspaceRoot, projectRoot, "project.json"), {
+    "nx-release-publish": csharpLibPublishTarget(projectRoot)
+  });
+  const registry = readMnciConfig(workspaceRoot).registry ?? { kind: "npm" };
+  writeFileEnsured((0, import_node_path4.join)(workspaceRoot, "nuget.config"), nugetConfigContent(registry, scope));
+  registerProjectCommands(workspaceRoot, name, { build: true });
+}
+function addCsharpInternalLib(workspaceRoot, name) {
+  ensureDotnet(workspaceRoot);
+  ensurePlugin(workspaceRoot, "@nx/dotnet");
+  const projectRoot = `libs/${name}`;
+  const identity = pascalCase(name);
+  scaffoldDotnetProject(workspaceRoot, projectRoot, identity, "classlib");
+  registerProjectCommands(workspaceRoot, name, { build: false });
+  logger.step(
+    `Reference it from a consumer with: dotnet add <consumer>.csproj reference ${projectRoot}/${identity}.csproj`
+  );
+}
+var CSHARP_FUNCTION_APP_HOST_JSON = `{
+  "version": "2.0",
+  "extensionBundle": {
+    "id": "Microsoft.Azure.Functions.ExtensionBundle",
+    "version": "[4.*, 5.0.0)"
+  }
+}
+`;
+function csharpFunctionAppCsproj() {
+  return `<Project Sdk="Azure.Functions.Sdk/1.0.0">
+  <PropertyGroup>
+    <TargetFramework>${targetFramework()}</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Azure.Functions.Worker" Version="2.52.0" />
+    <PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http.AspNetCore" Version="2.1.0" />
+  </ItemGroup>
+</Project>
+`;
+}
+var CSHARP_FUNCTION_APP_PROGRAM = `using Microsoft.Azure.Functions.Worker.Builder;
+using Microsoft.Extensions.Hosting;
+
+var builder = FunctionsApplication.CreateBuilder(args);
+
+builder.ConfigureFunctionsWebApplication();
+
+builder.Build().Run();
+`;
+function csharpFunctionAppHello(identity) {
+  return `using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Azure.Functions.Worker;
+
+namespace ${identity};
+
+public class Hello
+{
+    [Function("Hello")]
+    public IActionResult Run([HttpTrigger(AuthorizationLevel.Anonymous, "get")] HttpRequest req)
+    {
+        return new OkObjectResult("Hello from mnci.");
+    }
+}
+`;
+}
+function csharpFunctionAppStartTarget(projectRoot) {
+  return {
+    executor: "nx:run-commands",
+    continuous: true,
+    options: { command: "dotnet run", cwd: projectRoot }
+  };
+}
+function addCsharpFunctionApp(workspaceRoot, name) {
+  ensureDotnet(workspaceRoot);
+  ensurePlugin(workspaceRoot, "@nx/dotnet");
+  ensureAdmZip(workspaceRoot);
+  const projectRoot = `apps/${name}`;
+  const identity = pascalCase(name);
+  scaffoldDotnetProject(workspaceRoot, projectRoot, identity, "console");
+  const absoluteRoot = (0, import_node_path4.join)(workspaceRoot, projectRoot);
+  writeFileEnsured((0, import_node_path4.join)(absoluteRoot, `${identity}.csproj`), csharpFunctionAppCsproj());
+  writeFileEnsured((0, import_node_path4.join)(absoluteRoot, "Program.cs"), CSHARP_FUNCTION_APP_PROGRAM);
+  writeFileEnsured((0, import_node_path4.join)(absoluteRoot, "Hello.cs"), csharpFunctionAppHello(identity));
+  writeFileEnsured((0, import_node_path4.join)(absoluteRoot, "host.json"), CSHARP_FUNCTION_APP_HOST_JSON);
+  addProjectJsonTargets((0, import_node_path4.join)(absoluteRoot, "project.json"), {
+    package: csharpAppPackageTarget("csharp-function-app", projectRoot, name),
+    start: csharpFunctionAppStartTarget(projectRoot)
+  });
+  registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
+}
+
+// src/commands/add/flutter.ts
+var import_node_path5 = require("path");
 function flutterAppStartTarget(name) {
   return {
     executor: "nx:run-commands",
@@ -1839,7 +2184,7 @@ function addFlutterApp(workspaceRoot, name) {
   prepareFlutter(workspaceRoot);
   ensureAdmZip(workspaceRoot);
   runNx(["g", "@mnci/nx-flutter:application", name, "--no-interactive"], workspaceRoot);
-  addProjectJsonTargets((0, import_node_path4.join)(workspaceRoot, "apps", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path5.join)(workspaceRoot, "apps", name, "project.json"), {
     start: flutterAppStartTarget(name)
   });
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:start` });
@@ -1856,8 +2201,8 @@ function addFlutterInternalLib(workspaceRoot, name) {
 }
 
 // src/commands/add/go.ts
-var import_node_fs4 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs5 = require("fs");
+var import_node_path6 = require("path");
 function ensureGo(workspaceRoot) {
   if (runShell("go", ["version"], workspaceRoot) !== 0) {
     throw new Error("Go not found. Install Go 1.21+ first: https://go.dev/dl/");
@@ -1884,7 +2229,7 @@ function ensureNxGoPlugin(workspaceRoot) {
   }
 }
 function ensureGoModule(workspaceRoot) {
-  if (fileExists((0, import_node_path5.join)(workspaceRoot, "go.mod"))) {
+  if (fileExists((0, import_node_path6.join)(workspaceRoot, "go.mod"))) {
     return;
   }
   logger.step("Bootstrapping the workspace Go module (single root go.mod)");
@@ -1893,17 +2238,12 @@ function ensureGoModule(workspaceRoot) {
 }
 function goModulePath(workspaceRoot) {
   try {
-    const contents = (0, import_node_fs4.readFileSync)((0, import_node_path5.join)(workspaceRoot, "go.mod"), "utf8");
+    const contents = (0, import_node_fs5.readFileSync)((0, import_node_path6.join)(workspaceRoot, "go.mod"), "utf8");
     return /^module\s+(\S+)/m.exec(contents)?.[1];
   } catch {
     return void 0;
   }
 }
-function addProjectJsonTargets2(projectJsonPath, newTargets) {
-  const project = readJson(projectJsonPath);
-  const targets = project.targets ?? {};
-  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
-}
 function goTestTarget() {
   return { executor: "@nx-go/nx-go:test" };
 }
@@ -1958,7 +2298,7 @@ function addGoApp(workspaceRoot, name) {
     ],
     workspaceRoot
   );
-  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "apps", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "apps", name, "project.json"), {
     build: goBuildTarget(name),
     test: goTestTarget(),
     lint: goLintTarget(),
@@ -1981,7 +2321,7 @@ function addGoFunctionApp(workspaceRoot, name) {
     ],
     workspaceRoot
   );
-  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "apps", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "apps", name, "project.json"), {
     build: goBuildTarget(name),
     test: goTestTarget(),
     lint: goLintTarget(),
@@ -2002,7 +2342,7 @@ function addGoLib(workspaceRoot, name) {
     ],
     workspaceRoot
   );
-  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "packages", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "packages", name, "project.json"), {
     test: goTestTarget(),
     lint: goLintTarget()
   });
@@ -2025,7 +2365,7 @@ function addGoInternalLib(workspaceRoot, name) {
     ],
     workspaceRoot
   );
-  addProjectJsonTargets2((0, import_node_path5.join)(workspaceRoot, "libs", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path6.join)(workspaceRoot, "libs", name, "project.json"), {
     test: goTestTarget(),
     lint: goLintTarget()
   });
@@ -2037,7 +2377,7 @@ function addGoInternalLib(workspaceRoot, name) {
 }
 
 // src/commands/add/node.ts
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 function ensurePlugin2(workspaceRoot, packageName) {
   if (hasPlugin(workspaceRoot, packageName)) {
     return;
@@ -2075,7 +2415,7 @@ function nodeAppPackageTarget(name) {
 function addNodeApp(workspaceRoot, name, stack, framework = "none") {
   runNodeApp(workspaceRoot, name, stack, framework);
   ensureAdmZip(workspaceRoot);
-  addNxTargets((0, import_node_path6.join)(workspaceRoot, "apps", name, "package.json"), {
+  addNxTargets((0, import_node_path7.join)(workspaceRoot, "apps", name, "package.json"), {
     package: nodeAppPackageTarget(name)
   });
   removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
@@ -2131,10 +2471,10 @@ describe('buildGreeting', () => {
 })
 `;
 function repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot) {
-  const manifestPath = (0, import_node_path6.join)(nodeFunctionAppRoot, "package.json");
+  const manifestPath = (0, import_node_path7.join)(nodeFunctionAppRoot, "package.json");
   const manifest = readJson(manifestPath);
   const azureFunctionsVersion = readJson(
-    (0, import_node_path6.join)(workspaceRoot, "node_modules/@azure/functions/package.json")
+    (0, import_node_path7.join)(workspaceRoot, "node_modules/@azure/functions/package.json")
   ).version;
   const dependencies = manifest.dependencies ?? {};
   writeFileEnsured(
@@ -2168,21 +2508,21 @@ function nodeFunctionAppStartTarget(name) {
 function addNodeFunctionApp(workspaceRoot, name, stack) {
   runNodeApp(workspaceRoot, name, stack, "none");
   ensureAzureFunctionsPackage(workspaceRoot);
-  const nodeFunctionAppRoot = (0, import_node_path6.join)(workspaceRoot, "apps", name);
-  writeFileEnsured((0, import_node_path6.join)(nodeFunctionAppRoot, "src/main.ts"), NODE_FUNCTION_APP_MAIN);
-  writeFileEnsured((0, import_node_path6.join)(nodeFunctionAppRoot, "src/functions/hello.ts"), NODE_FUNCTION_APP_HELLO);
+  const nodeFunctionAppRoot = (0, import_node_path7.join)(workspaceRoot, "apps", name);
+  writeFileEnsured((0, import_node_path7.join)(nodeFunctionAppRoot, "src/main.ts"), NODE_FUNCTION_APP_MAIN);
+  writeFileEnsured((0, import_node_path7.join)(nodeFunctionAppRoot, "src/functions/hello.ts"), NODE_FUNCTION_APP_HELLO);
   writeFileEnsured(
-    (0, import_node_path6.join)(nodeFunctionAppRoot, "src/functions/greeting.ts"),
+    (0, import_node_path7.join)(nodeFunctionAppRoot, "src/functions/greeting.ts"),
     NODE_FUNCTION_APP_GREETING
   );
   writeFileEnsured(
-    (0, import_node_path6.join)(nodeFunctionAppRoot, "src/functions/greeting.spec.ts"),
+    (0, import_node_path7.join)(nodeFunctionAppRoot, "src/functions/greeting.spec.ts"),
     NODE_FUNCTION_APP_GREETING_SPEC
   );
-  writeFileEnsured((0, import_node_path6.join)(nodeFunctionAppRoot, "host.json"), NODE_FUNCTION_APP_HOST_JSON);
+  writeFileEnsured((0, import_node_path7.join)(nodeFunctionAppRoot, "host.json"), NODE_FUNCTION_APP_HOST_JSON);
   repairNodeFunctionAppManifest(nodeFunctionAppRoot, workspaceRoot);
   ensureAdmZip(workspaceRoot);
-  addNxTargets((0, import_node_path6.join)(nodeFunctionAppRoot, "package.json"), {
+  addNxTargets((0, import_node_path7.join)(nodeFunctionAppRoot, "package.json"), {
     package: nodeFunctionAppPackageTarget(name),
     start: nodeFunctionAppStartTarget(name)
   });
@@ -2191,7 +2531,7 @@ function addNodeFunctionApp(workspaceRoot, name, stack) {
 }
 
 // src/commands/add/npmLib.ts
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
   const scope = options.scope ?? (kindProvided ? defaultScope(workspaceRoot) : await promptText("npm scope for the published package", defaultScope(workspaceRoot)));
   runNx(
@@ -2208,18 +2548,18 @@ async function addNpmLib(workspaceRoot, name, options, kindProvided, stack) {
     ],
     workspaceRoot
   );
-  const manifestPath = (0, import_node_path7.join)(workspaceRoot, "packages", name, "package.json");
+  const manifestPath = (0, import_node_path8.join)(workspaceRoot, "packages", name, "package.json");
   markPublic(manifestPath);
   repairPublishableManifest(manifestPath);
-  repairDeclarationSpecifiers((0, import_node_path7.join)(workspaceRoot, `packages/${name}`));
-  writeProjectReadme((0, import_node_path7.join)(workspaceRoot, `packages/${name}`), `${scope}/${name}`, stack.testRunner);
+  repairDeclarationSpecifiers((0, import_node_path8.join)(workspaceRoot, `packages/${name}`));
+  writeProjectReadme((0, import_node_path8.join)(workspaceRoot, `packages/${name}`), `${scope}/${name}`, stack.testRunner);
   removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
 
 // src/commands/add/python.ts
-var import_node_fs5 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path9 = require("path");
 function ensurePython(workspaceRoot) {
   const hasPython = runShell("python3", ["--version"], workspaceRoot) === 0 || runShell("python", ["--version"], workspaceRoot) === 0;
   if (!hasPython) {
@@ -2248,7 +2588,7 @@ pytest
 pip-audit
 `;
 function ensureRequirementsDev(workspaceRoot) {
-  const requirementsDevPath = (0, import_node_path8.join)(workspaceRoot, "requirements-dev.txt");
+  const requirementsDevPath = (0, import_node_path9.join)(workspaceRoot, "requirements-dev.txt");
   if (!fileExists(requirementsDevPath)) {
     writeFileEnsured(requirementsDevPath, PYTHON_REQUIREMENTS_DEV);
   }
@@ -2256,11 +2596,6 @@ function ensureRequirementsDev(workspaceRoot) {
 function pythonModuleDirectory(name) {
   return name.replaceAll("-", "_");
 }
-function addProjectJsonTargets3(projectJsonPath, newTargets) {
-  const project = readJson(projectJsonPath);
-  const targets = project.targets ?? {};
-  writeFileEnsured(projectJsonPath, toJson({ ...project, targets: { ...targets, ...newTargets } }));
-}
 function pythonAppMain(name) {
   return `def main() -> None:
     print('${name} is running')
@@ -2313,8 +2648,8 @@ function addPythonApp(workspaceRoot, name) {
     ["g", "@mnci/nx-python-pip:application", name, `--directory=apps/${name}`, "--no-interactive"],
     workspaceRoot
   );
-  writeFileEnsured((0, import_node_path8.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
-  addProjectJsonTargets3((0, import_node_path8.join)(workspaceRoot, "apps", name, "project.json"), {
+  writeFileEnsured((0, import_node_path9.join)(workspaceRoot, "apps", name, "main.py"), pythonAppMain(name));
+  addProjectJsonTargets((0, import_node_path9.join)(workspaceRoot, "apps", name, "project.json"), {
     package: pythonAppPackageTarget(name),
     start: pythonAppStartTarget(name)
   });
@@ -2336,7 +2671,7 @@ function addPythonFunctionApp(workspaceRoot, name) {
     workspaceRoot
   );
   const moduleDirectory = pythonModuleDirectory(name);
-  addProjectJsonTargets3((0, import_node_path8.join)(workspaceRoot, "apps", name, "project.json"), {
+  addProjectJsonTargets((0, import_node_path9.join)(workspaceRoot, "apps", name, "project.json"), {
     package: pythonFunctionAppPackageTarget(name, moduleDirectory),
     start: pythonFunctionAppStartTarget(name)
   });
@@ -2377,7 +2712,7 @@ function addPythonInternalLib(workspaceRoot, name) {
 var PYTHON_PROJECT_DIRS = ["apps", "python-packages", "libs"];
 function findPythonProjectDirectory(workspaceRoot, name) {
   return PYTHON_PROJECT_DIRS.find(
-    (directory) => fileExists((0, import_node_path8.join)(workspaceRoot, directory, name, "pyproject.toml"))
+    (directory) => fileExists((0, import_node_path9.join)(workspaceRoot, directory, name, "pyproject.toml"))
   );
 }
 function parseVendorEntries(pyprojectToml) {
@@ -2416,7 +2751,7 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
       `No Python project named '${consumer}' with a pyproject.toml found (checked apps/, python-packages/, libs/). A Python function app has no pyproject.toml \u2014 there is nothing to vendor into.`
     );
   }
-  if (!fileExists((0, import_node_path8.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
+  if (!fileExists((0, import_node_path9.join)(workspaceRoot, "libs", lib, "pyproject.toml"))) {
     throw new Error(
       `No internal Python library named '${lib}' found at libs/${lib}/pyproject.toml. Only an internal library (added via 'mnci add python-internal-lib') can be vendored.`
     );
@@ -2424,8 +2759,8 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
   if (consumerDirectory === "libs" && consumer === lib) {
     throw new Error(`'${consumer}' cannot vendor itself.`);
   }
-  const pyprojectPath = (0, import_node_path8.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
-  const pyprojectToml = (0, import_node_fs5.readFileSync)(pyprojectPath, "utf8");
+  const pyprojectPath = (0, import_node_path9.join)(workspaceRoot, consumerDirectory, consumer, "pyproject.toml");
+  const pyprojectToml = (0, import_node_fs6.readFileSync)(pyprojectPath, "utf8");
   if (parseVendorEntries(pyprojectToml).includes(lib)) {
     logger.info(`'${consumer}' already vendors '${lib}' \u2014 nothing to do.`);
     return;
@@ -2437,8 +2772,8 @@ async function addPythonVendor(workspaceRoot, consumer, options, kindProvided) {
 }
 
 // src/commands/add/reactApp.ts
-var import_node_fs6 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path10 = require("path");
 var REACT_ENVIRONMENTS = ["dev", "uat", "prod"];
 function reactEnvironmentFile(environment) {
   return `# Vite compiles VITE_-prefixed vars into the '${environment}' bundle at build time.
@@ -2475,12 +2810,12 @@ function reactAppTargets(name) {
   return targets;
 }
 function allowEnvFiles(workspaceRoot) {
-  const gitignorePath = (0, import_node_path9.join)(workspaceRoot, ".gitignore");
+  const gitignorePath = (0, import_node_path10.join)(workspaceRoot, ".gitignore");
   if (!fileExists(gitignorePath)) {
     return;
   }
   const marker = "# MoNecromanCI: keep the committed per-environment Vite config (public VITE_ values)";
-  const current = (0, import_node_fs6.readFileSync)(gitignorePath, "utf8");
+  const current = (0, import_node_fs7.readFileSync)(gitignorePath, "utf8");
   if (current.includes(marker)) {
     return;
   }
@@ -2507,18 +2842,18 @@ function addReactApp(workspaceRoot, name, stack) {
     workspaceRoot
   );
   ensureAdmZip(workspaceRoot);
-  const reactAppRoot = (0, import_node_path9.join)(workspaceRoot, "apps", name);
+  const reactAppRoot = (0, import_node_path10.join)(workspaceRoot, "apps", name);
   for (const environment of REACT_ENVIRONMENTS) {
-    writeFileEnsured((0, import_node_path9.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
+    writeFileEnsured((0, import_node_path10.join)(reactAppRoot, `.env.${environment}`), reactEnvironmentFile(environment));
   }
   allowEnvFiles(workspaceRoot);
-  addNxTargets((0, import_node_path9.join)(reactAppRoot, "package.json"), reactAppTargets(name));
+  addNxTargets((0, import_node_path10.join)(reactAppRoot, "package.json"), reactAppTargets(name));
   removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true, start: `nx run ${name}:serve` });
 }
 
 // src/commands/add/reactLib.ts
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var REACT_LIB_BUNDLER = "rollup";
 async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
   ensurePlugin(workspaceRoot, "@nx/react");
@@ -2538,11 +2873,11 @@ async function addReactLib(workspaceRoot, name, options, kindProvided, stack) {
     ],
     workspaceRoot
   );
-  const publishableManifest = (0, import_node_path10.join)(workspaceRoot, "packages", name, "package.json");
+  const publishableManifest = (0, import_node_path11.join)(workspaceRoot, "packages", name, "package.json");
   markPublic(publishableManifest);
   repairPublishableManifest(publishableManifest);
-  repairDeclarationSpecifiers((0, import_node_path10.join)(workspaceRoot, "packages", name));
-  writeProjectReadme((0, import_node_path10.join)(workspaceRoot, "packages", name), `${scope}/${name}`, stack.testRunner);
+  repairDeclarationSpecifiers((0, import_node_path11.join)(workspaceRoot, "packages", name));
+  writeProjectReadme((0, import_node_path11.join)(workspaceRoot, "packages", name), `${scope}/${name}`, stack.testRunner);
   removeGeneratedEslintConfig(workspaceRoot, `packages/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
@@ -2561,22 +2896,22 @@ function addReactInternalLib(workspaceRoot, name, stack) {
     ],
     workspaceRoot
   );
-  const privateManifest = (0, import_node_path10.join)(workspaceRoot, "libs", name, "package.json");
+  const privateManifest = (0, import_node_path11.join)(workspaceRoot, "libs", name, "package.json");
   markPrivate(privateManifest);
   repairPublishableManifest(privateManifest);
-  repairDeclarationSpecifiers((0, import_node_path10.join)(workspaceRoot, "libs", name));
-  writeProjectReadme((0, import_node_path10.join)(workspaceRoot, "libs", name), name, stack.testRunner);
+  repairDeclarationSpecifiers((0, import_node_path11.join)(workspaceRoot, "libs", name));
+  writeProjectReadme((0, import_node_path11.join)(workspaceRoot, "libs", name), name, stack.testRunner);
   removeGeneratedEslintConfig(workspaceRoot, `libs/${name}`);
   registerProjectCommands(workspaceRoot, name, { build: true });
 }
 
 // src/commands/sync.ts
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 
 // src/deps/inventory.ts
-var import_node_fs7 = require("fs");
-var import_node_path11 = require("path");
-var ECOSYSTEMS = ["npm", "pip", "pub", "go"];
+var import_node_fs8 = require("fs");
+var import_node_path12 = require("path");
+var ECOSYSTEMS = ["npm", "pip", "pub", "nuget", "go"];
 var ROOT_LABEL = "(root)";
 var MANIFEST_GLOBS = {
   // `libs/*` carries private internal libs; `packages/*` the publishable ones.
@@ -2584,6 +2919,10 @@ var MANIFEST_GLOBS = {
   // Matches PYTHON_PROJECT_DIRS in commands/add/python.ts.
   pip: ["apps/*/pyproject.toml", "python-packages/*/pyproject.toml", "libs/*/pyproject.toml"],
   pub: ["apps/*/pubspec.yaml", "packages/*/pubspec.yaml", "libs/*/pubspec.yaml"],
+  // Unlike every other ecosystem, the filename itself varies (the project's own
+  // PascalCase identity, not a fixed name) — the same three roots
+  // PACK_APPS_GUARD and add/csharp.ts already scan.
+  nuget: ["apps/*/*.csproj", "packages/*/*.csproj", "libs/*/*.csproj"],
   // Single root module by design — there are no per-project Go manifests.
   go: []
 };
@@ -2604,20 +2943,23 @@ function projectOf(manifestRelativePath) {
 }
 function hasEcosystem(workspaceRoot, ecosystem) {
   if (ecosystem === "go") {
-    return fileExists((0, import_node_path11.join)(workspaceRoot, "go.mod"));
+    return fileExists((0, import_node_path12.join)(workspaceRoot, "go.mod"));
+  }
+  if (ecosystem === "nuget") {
+    return (0, import_node_fs8.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
   }
   const rootMarker = {
     npm: "package.json",
     pip: "requirements-dev.txt",
     pub: "pubspec.yaml"
   };
-  return fileExists((0, import_node_path11.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs7.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
+  return fileExists((0, import_node_path12.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs8.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
 }
 function collectNpm(workspaceRoot) {
   const sites = [];
-  const relativePaths = ["package.json", ...(0, import_node_fs7.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
+  const relativePaths = ["package.json", ...(0, import_node_fs8.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
   for (const relativePath of relativePaths) {
-    const manifestPath = (0, import_node_path11.join)(workspaceRoot, relativePath);
+    const manifestPath = (0, import_node_path12.join)(workspaceRoot, relativePath);
     try {
       const manifest = readJson(manifestPath);
       sites.push(...npmManifestSites(manifest, relativePath, manifestPath));
@@ -2678,17 +3020,17 @@ function collectPip(workspaceRoot) {
       name: parsed.name,
       ecosystem: "pip",
       project: projectOf(relativePath),
-      manifestPath: (0, import_node_path11.join)(workspaceRoot, relativePath),
+      manifestPath: (0, import_node_path12.join)(workspaceRoot, relativePath),
       section,
       spec: parsed.spec,
       rewritable: parsed.rewritable && parsed.spec !== ""
     });
   };
-  const pyprojectPaths = (0, import_node_fs7.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
+  const pyprojectPaths = (0, import_node_fs8.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
   for (const relativePath of pyprojectPaths) {
     let content;
     try {
-      content = (0, import_node_fs7.readFileSync)((0, import_node_path11.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs8.readFileSync)((0, import_node_path12.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -2699,14 +3041,14 @@ function collectPip(workspaceRoot) {
   }
   const requirementsPaths = [
     "requirements-dev.txt",
-    ...(0, import_node_fs7.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
+    ...(0, import_node_fs8.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
   ];
   for (const relativePath of requirementsPaths) {
-    if (!fileExists((0, import_node_path11.join)(workspaceRoot, relativePath))) {
+    if (!fileExists((0, import_node_path12.join)(workspaceRoot, relativePath))) {
       continue;
     }
     const section = relativePath === "requirements-dev.txt" ? "devDep" : "dep";
-    const lines = (0, import_node_fs7.readFileSync)((0, import_node_path11.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
+    const lines = (0, import_node_fs8.readFileSync)((0, import_node_path12.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
     for (const line of lines) {
       push(relativePath, section, line);
     }
@@ -2744,11 +3086,11 @@ function pyprojectDependencies(content) {
 }
 function collectPub(workspaceRoot) {
   const sites = [];
-  const pubspecPaths = (0, import_node_fs7.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
+  const pubspecPaths = (0, import_node_fs8.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
   for (const relativePath of pubspecPaths) {
     let content;
     try {
-      content = (0, import_node_fs7.readFileSync)((0, import_node_path11.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs8.readFileSync)((0, import_node_path12.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -2758,7 +3100,7 @@ function collectPub(workspaceRoot) {
           name: entry.name,
           ecosystem: "pub",
           project: projectOf(relativePath),
-          manifestPath: (0, import_node_path11.join)(workspaceRoot, relativePath),
+          manifestPath: (0, import_node_path12.join)(workspaceRoot, relativePath),
           section: block === "dependencies" ? "dep" : "devDep",
           spec: entry.spec,
           rewritable: entry.spec !== ""
@@ -2806,14 +3148,53 @@ function pubspecBlockEntries(content, block) {
 function stripQuotes(value) {
   return /^(['"]).*\1$/.test(value) ? value.slice(1, -1) : value;
 }
+function collectNuget(workspaceRoot) {
+  const sites = [];
+  const csprojPaths = (0, import_node_fs8.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
+  for (const relativePath of csprojPaths) {
+    let content;
+    try {
+      content = (0, import_node_fs8.readFileSync)((0, import_node_path12.join)(workspaceRoot, relativePath), "utf8");
+    } catch {
+      continue;
+    }
+    for (const entry of csprojPackageReferences(content)) {
+      sites.push({
+        name: entry.name,
+        ecosystem: "nuget",
+        project: projectOf(relativePath),
+        manifestPath: (0, import_node_path12.join)(workspaceRoot, relativePath),
+        section: "dep",
+        spec: entry.spec,
+        // A plain SemVer string is rewritable; an MSBuild property reference
+        // ($(SharedVersion)) or an interval-notation range ([1.0,2.0)) is
+        // reported only — neither is a version this can safely overwrite.
+        rewritable: /^\d/.test(entry.spec)
+      });
+    }
+  }
+  return sites;
+}
+function csprojPackageReferences(content) {
+  const entries = [];
+  for (const tag of content.matchAll(/<PackageReference([^>]*)\/>/g)) {
+    const attributes = tag[1];
+    const name = /\bInclude\s*=\s*"([^"]*)"/.exec(attributes)?.[1];
+    const spec = /\bVersion\s*=\s*"([^"]*)"/.exec(attributes)?.[1];
+    if (name && spec) {
+      entries.push({ name, spec });
+    }
+  }
+  return entries;
+}
 function collectGo(workspaceRoot) {
-  const manifestPath = (0, import_node_path11.join)(workspaceRoot, "go.mod");
+  const manifestPath = (0, import_node_path12.join)(workspaceRoot, "go.mod");
   if (!fileExists(manifestPath)) {
     return [];
   }
   let content;
   try {
-    content = (0, import_node_fs7.readFileSync)(manifestPath, "utf8");
+    content = (0, import_node_fs8.readFileSync)(manifestPath, "utf8");
   } catch {
     return [];
   }
@@ -2835,6 +3216,7 @@ function collectInventory(workspaceRoot, ecosystems = ECOSYSTEMS) {
     npm: collectNpm,
     pip: collectPip,
     pub: collectPub,
+    nuget: collectNuget,
     go: collectGo
   };
   const inventory = /* @__PURE__ */ new Map();
@@ -2869,8 +3251,27 @@ function rewriteSpec(site, spec) {
     writeFileEnsured(site.manifestPath, toJson(manifest));
     return true;
   }
-  const before = (0, import_node_fs7.readFileSync)(site.manifestPath, "utf8");
-  const after = site.ecosystem === "pip" ? replacePipSpec(before, name, spec) : replacePubSpec(before, name, spec);
+  const before = (0, import_node_fs8.readFileSync)(site.manifestPath, "utf8");
+  const after = (() => {
+    switch (site.ecosystem) {
+      case "pip": {
+        return replacePipSpec(before, name, spec);
+      }
+      case "pub": {
+        return replacePubSpec(before, name, spec);
+      }
+      case "nuget": {
+        return replaceNugetSpec(before, name, spec);
+      }
+      // 'go' entries are never rewritable (see collectGo), so this is
+      // unreachable in practice — returning the text unchanged is the safe
+      // no-op if that invariant is ever broken, rather than guessing at a
+      // rewrite for a format this branch was never meant to handle.
+      default: {
+        return before;
+      }
+    }
+  })();
   if (after === before) {
     return false;
   }
@@ -2890,19 +3291,29 @@ function replacePubSpec(content, name, spec) {
     (match, lead) => `${lead}${spec}`
   );
 }
+function replaceNugetSpec(content, name, spec) {
+  const escaped = escapeForRegex(name);
+  const includePattern = new RegExp(String.raw`\bInclude\s*=\s*"${escaped}"`);
+  return content.replaceAll(/<PackageReference([^>]*)\/>/g, (tag, attributes) => {
+    if (!includePattern.test(attributes)) {
+      return tag;
+    }
+    return tag.replace(/\bVersion\s*=\s*"[^"]*"/, () => `Version="${spec}"`);
+  });
+}
 function escapeForRegex(value) {
   return value.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
 }
 function isWorkspaceProject(workspaceRoot, name) {
   const short = name.includes("/") ? name.split("/").at(-1) : name;
   return ["apps", "libs", "packages"].some(
-    (directory) => fileExists((0, import_node_path11.join)(workspaceRoot, directory, short ?? name, "package.json"))
+    (directory) => fileExists((0, import_node_path12.join)(workspaceRoot, directory, short ?? name, "package.json"))
   );
 }
 function isAliasedInstall(workspaceRoot, name) {
   try {
     const installed = readJson(
-      (0, import_node_path11.join)(workspaceRoot, "node_modules", name, "package.json")
+      (0, import_node_path12.join)(workspaceRoot, "node_modules", name, "package.json")
     );
     return installed.name !== void 0 && installed.name !== name;
   } catch {
@@ -2913,14 +3324,14 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
   if (ecosystem === "npm") {
     try {
       return readJson(
-        (0, import_node_path11.join)(workspaceRoot, "node_modules", name, "package.json")
+        (0, import_node_path12.join)(workspaceRoot, "node_modules", name, "package.json")
       ).version;
     } catch {
       return void 0;
     }
   }
   if (ecosystem === "pub") {
-    const lockPath = (0, import_node_path11.join)(workspaceRoot, "pubspec.lock");
+    const lockPath = (0, import_node_path12.join)(workspaceRoot, "pubspec.lock");
     if (!fileExists(lockPath)) {
       return void 0;
     }
@@ -2928,7 +3339,7 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
       const match = new RegExp(
         String.raw`^\s{2}${escapeForRegex(name)}:[^]*?^\s+version:\s*["']?([^"'\s]+)`,
         "m"
-      ).exec((0, import_node_fs7.readFileSync)(lockPath, "utf8"));
+      ).exec((0, import_node_fs8.readFileSync)(lockPath, "utf8"));
       return match?.[1];
     } catch {
       return void 0;
@@ -3120,7 +3531,7 @@ function describe(finding) {
   return `${finding.name} \u2192 ${finding.target} (${finding.reason}); disagreeing: ${sites}`;
 }
 function runSync(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path12.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path13.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci sync' from the workspace root.`
     );
@@ -3189,16 +3600,20 @@ var PROJECT_KINDS = [
   "go-internal-lib",
   "flutter-app",
   "flutter-lib",
-  "flutter-internal-lib"
+  "flutter-internal-lib",
+  "csharp-app",
+  "csharp-function-app",
+  "csharp-lib",
+  "csharp-internal-lib"
 ];
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path13.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path14.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
   const stack = readWorkspaceStack(workspaceRoot);
   const kindProvided = kind !== void 0;
-  const resolvedKind = kind ?? await (0, import_prompts5.select)({
+  const resolvedKind = kind ?? await (0, import_prompts6.select)({
     message: "What kind of project?",
     choices: PROJECT_KINDS.map((value) => ({ name: value, value }))
   });
@@ -3243,7 +3658,7 @@ async function runAdd(kind, name, options) {
         ],
         workspaceRoot
       );
-      markPrivate((0, import_node_path13.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      markPrivate((0, import_node_path14.join)(workspaceRoot, "libs", resolvedName, "package.json"));
       removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
@@ -3292,6 +3707,22 @@ async function runAdd(kind, name, options) {
       addFlutterInternalLib(workspaceRoot, resolvedName);
       break;
     }
+    case "csharp-app": {
+      addCsharpApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "csharp-function-app": {
+      addCsharpFunctionApp(workspaceRoot, resolvedName);
+      break;
+    }
+    case "csharp-lib": {
+      await addCsharpLib(workspaceRoot, resolvedName, options, kindProvided);
+      break;
+    }
+    case "csharp-internal-lib": {
+      addCsharpInternalLib(workspaceRoot, resolvedName);
+      break;
+    }
     case "python-vendor": {
       await addPythonVendor(workspaceRoot, resolvedName, options, kindProvided);
       syncProjectReferences(workspaceRoot);
@@ -3312,7 +3743,7 @@ async function runAdd(kind, name, options) {
 }
 function readWorkspaceStack(workspaceRoot) {
   const nxJson = readJson(
-    (0, import_node_path13.join)(workspaceRoot, "nx.json")
+    (0, import_node_path14.join)(workspaceRoot, "nx.json")
   );
   const stack = nxJson.mnci?.stack;
   return {
@@ -3321,15 +3752,15 @@ function readWorkspaceStack(workspaceRoot) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs8 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path15 = require("path");
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
 function toPosix2(path) {
   return path.replaceAll("\\", "/");
 }
 function checkEslintConfigs(workspaceRoot) {
-  const rootConfigs = (0, import_node_fs8.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
-  const projectConfigs = (0, import_node_fs8.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+  const rootConfigs = (0, import_node_fs9.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
+  const projectConfigs = (0, import_node_fs9.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return [
@@ -3350,7 +3781,7 @@ function checkEslintConfigs(workspaceRoot) {
 function declaredDevDependencies(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path14.join)(workspaceRoot, "package.json")
+      (0, import_node_path15.join)(workspaceRoot, "package.json")
     );
     return manifest.devDependencies ?? {};
   } catch {
@@ -3358,7 +3789,7 @@ function declaredDevDependencies(workspaceRoot) {
   }
 }
 function checkNoRetiredFormatter(workspaceRoot) {
-  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path14.join)(workspaceRoot, file)));
+  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path15.join)(workspaceRoot, file)));
   const declared = ["prettier", "eslint-config-prettier", "oxlint", "oxfmt", "@mnci/oxlint-config"].filter((name) => declaredDevDependencies(workspaceRoot)[name] !== void 0);
   const stale = [...files, ...declared];
   if (stale.length === 0) {
@@ -3384,7 +3815,7 @@ function checkEslintPlugin(nxJson) {
   };
 }
 function checkResolvedEslint(workspaceRoot) {
-  const manifestPath = (0, import_node_path14.join)(workspaceRoot, "node_modules/eslint/package.json");
+  const manifestPath = (0, import_node_path15.join)(workspaceRoot, "node_modules/eslint/package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -3402,11 +3833,11 @@ function checkResolvedEslint(workspaceRoot) {
   }
 }
 function checkNpmrc(workspaceRoot, registry, scope) {
-  const npmrcPath = (0, import_node_path14.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path15.join)(workspaceRoot, ".npmrc");
   if (!registry || !fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs8.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs9.readFileSync)(npmrcPath, "utf8");
   if (registry.kind === "npm") {
     return {
       check: ".npmrc authenticates the public registry",
@@ -3424,12 +3855,12 @@ function checkNpmrc(workspaceRoot, registry, scope) {
 }
 function checkVersionActions(workspaceRoot) {
   const candidates = [
-    ...(0, import_node_fs8.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
-    ...(0, import_node_fs8.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
+    ...(0, import_node_fs9.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs9.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
   ].map((manifest) => toPosix2(manifest));
   return candidates.flatMap((manifest) => {
     const projectRoot = manifest.slice(0, manifest.lastIndexOf("/"));
-    const projectJsonPath = (0, import_node_path14.join)(workspaceRoot, projectRoot, "project.json");
+    const projectJsonPath = (0, import_node_path15.join)(workspaceRoot, projectRoot, "project.json");
     let hasOverride = false;
     try {
       const projectJson = readJson(projectJsonPath);
@@ -3458,7 +3889,7 @@ function declaredTargets(workspaceRoot, projectRoot) {
   ]) {
     try {
       const targets = extract(
-        readJson((0, import_node_path14.join)(workspaceRoot, projectRoot, file))
+        readJson((0, import_node_path15.join)(workspaceRoot, projectRoot, file))
       );
       if (targets && typeof targets === "object") {
         sources.push({
@@ -3474,8 +3905,8 @@ function declaredTargets(workspaceRoot, projectRoot) {
 function checkTargetFilesExist(workspaceRoot) {
   const projectRoots = new Set(
     [
-      ...(0, import_node_fs8.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
-      ...(0, import_node_fs8.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
+      ...(0, import_node_fs9.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
+      ...(0, import_node_fs9.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
     ].map((manifest) => toPosix2(manifest).split("/").slice(0, 2).join("/"))
   );
   return [...projectRoots].flatMap(
@@ -3490,7 +3921,7 @@ function checkOneTargetsFiles(workspaceRoot, source, targetName, target) {
   return TARGET_FILE_OPTIONS.flatMap((option) => {
     const value = target?.options?.[option];
     const checkable = typeof value === "string" && !value.includes("{");
-    if (!checkable || fileExists((0, import_node_path14.join)(workspaceRoot, value))) {
+    if (!checkable || fileExists((0, import_node_path15.join)(workspaceRoot, value))) {
       return [];
     }
     return [
@@ -3512,7 +3943,7 @@ function checkSync(workspaceRoot) {
   };
 }
 function checkNoRootRuntimeDependencies(workspaceRoot) {
-  const manifestPath = (0, import_node_path14.join)(workspaceRoot, "package.json");
+  const manifestPath = (0, import_node_path15.join)(workspaceRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -3532,14 +3963,14 @@ function checkNoRootRuntimeDependencies(workspaceRoot) {
   };
 }
 function checkRollupSourceMaps(workspaceRoot) {
-  const configs = (0, import_node_fs8.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs9.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path14.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path15.join)(workspaceRoot, relativePath);
     let config;
     try {
-      config = (0, import_node_fs8.readFileSync)(configPath, "utf8");
+      config = (0, import_node_fs9.readFileSync)(configPath, "utf8");
     } catch {
       return [];
     }
@@ -3554,7 +3985,7 @@ function checkRollupSourceMaps(workspaceRoot) {
   });
 }
 function collectFindings(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path14.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path15.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci doctor' from the workspace root.`
@@ -3596,12 +4027,12 @@ function runDoctor(workspaceRoot) {
 }
 
 // src/commands/interactive.ts
-var import_node_path17 = require("path");
-var import_prompts8 = require("@inquirer/prompts");
+var import_node_path18 = require("path");
+var import_prompts9 = require("@inquirer/prompts");
 
 // src/commands/new.ts
-var import_node_fs9 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path16 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
 }
@@ -3662,7 +4093,7 @@ async function runNew(name, options) {
     ],
     process.cwd()
   );
-  const workspaceRoot = (0, import_node_path15.join)(process.cwd(), workspaceName);
+  const workspaceRoot = (0, import_node_path16.join)(process.cwd(), workspaceName);
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
   );
@@ -3671,8 +4102,8 @@ async function runNew(name, options) {
     { workspaceName, scope, registry, agent, variableGroup, ci, stack },
     logger.detail
   );
-  (0, import_node_fs9.rmSync)((0, import_node_path15.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
-  (0, import_node_fs9.rmSync)((0, import_node_path15.join)(workspaceRoot, "package-lock.json"), { force: true });
+  (0, import_node_fs10.rmSync)((0, import_node_path16.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
+  (0, import_node_fs10.rmSync)((0, import_node_path16.join)(workspaceRoot, "package-lock.json"), { force: true });
   logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
@@ -3702,8 +4133,8 @@ async function runNew(name, options) {
 }
 
 // src/commands/upgrade.ts
-var import_node_fs10 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path17 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -3732,7 +4163,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs10.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs11.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -3740,7 +4171,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path16.basename)(workspaceRoot);
+  return (0, import_node_path17.basename)(workspaceRoot);
 }
 function resolveOverlayOptions(workspaceRoot, options, persisted) {
   const scope = options.scope ?? persisted.scope;
@@ -3778,7 +4209,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path16.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path17.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -3803,14 +4234,14 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/commands/interactive.ts
 async function runInteractive() {
-  const inWorkspace = fileExists((0, import_node_path17.join)(process.cwd(), "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path18.join)(process.cwd(), "nx.json"));
   const choiceNew = { name: "Create a new monorepo", value: "new" };
   const choiceAdd = { name: "Add a project to this workspace", value: "add" };
   const choiceUpgrade = {
     name: "Upgrade this workspace (re-apply the latest overlay)",
     value: "upgrade"
   };
-  const action = await (0, import_prompts8.select)({
+  const action = await (0, import_prompts9.select)({
     message: "What would you like to do?",
     choices: inWorkspace ? [choiceAdd, choiceUpgrade, choiceNew] : [choiceNew, choiceAdd, choiceUpgrade]
   });
@@ -3824,8 +4255,8 @@ async function runInteractive() {
 }
 
 // src/commands/up.ts
-var import_node_path18 = require("path");
-var import_prompts9 = require("@inquirer/prompts");
+var import_node_path19 = require("path");
+var import_prompts10 = require("@inquirer/prompts");
 
 // src/deps/registry.ts
 var LOOKUP_CONCURRENCY = 8;
@@ -3897,6 +4328,27 @@ async function latestPubVersions(cwd) {
     return /* @__PURE__ */ new Map();
   }
 }
+async function latestNugetVersions(names, cwd) {
+  const results = await pool(names, LOOKUP_CONCURRENCY, async (name) => {
+    const result = await runCaptureAsync(
+      "dotnet",
+      ["package", "search", name, "--exact-match", "--format", "json"],
+      cwd
+    );
+    if (result.status !== 0) {
+      return;
+    }
+    try {
+      const parsed = JSON.parse(result.stdout);
+      const packages = parsed.searchResult?.flatMap((source) => source.packages ?? []) ?? [];
+      const match = packages.find((entry) => entry.id?.toLowerCase() === name.toLowerCase()) ?? packages[0];
+      return match?.latestVersion ? [name, match.latestVersion] : void 0;
+    } catch {
+      return;
+    }
+  });
+  return new Map(results.filter((entry) => entry !== void 0));
+}
 async function latestVersions(ecosystem, names, cwd) {
   switch (ecosystem) {
     case "npm": {
@@ -3905,10 +4357,17 @@ async function latestVersions(ecosystem, names, cwd) {
     case "pip": {
       return await latestPipVersions(names, cwd);
     }
+    case "nuget": {
+      return await latestNugetVersions(names, cwd);
+    }
     case "go": {
       return await latestGoVersions(cwd);
     }
-    default: {
+    // 'pub' explicitly, not a default: a future ecosystem added to the union
+    // without a case here should fail to compile, not silently resolve as
+    // Dart/Flutter's whole-graph query — exactly the trap this switch would
+    // otherwise have laid for 'nuget' itself.
+    case "pub": {
       return await latestPubVersions(cwd);
     }
   }
@@ -4025,13 +4484,13 @@ async function promptForUpdates(outdated) {
       continue;
     }
     const { title, blurb } = UPDATE_KIND_LABELS[kind];
-    choices.push(new import_prompts9.Separator(`
+    choices.push(new import_prompts10.Separator(`
 ${title}  ${blurb}`));
     for (const entry of section) {
       choices.push({ name: row(entry, widths), value: entry });
     }
   }
-  return await (0, import_prompts9.checkbox)({
+  return await (0, import_prompts10.checkbox)({
     message: "Choose which packages to update.",
     choices,
     pageSize: 20
@@ -4055,6 +4514,7 @@ function reinstall(workspaceRoot, ecosystems) {
     ["npm", "npm", ["install"]],
     ["pip", "npm", ["run", "python:install"]],
     ["pub", "flutter", ["pub", "get"]],
+    ["nuget", "npx", ["nx", "run-many", "-t", "restore"]],
     ["go", "go", ["mod", "tidy"]]
   ];
   for (const [ecosystem, command, arguments_] of commands) {
@@ -4078,7 +4538,7 @@ function reinstall(workspaceRoot, ecosystems) {
 function hasPythonInstallScript(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path18.join)(workspaceRoot, "package.json")
+      (0, import_node_path19.join)(workspaceRoot, "package.json")
     );
     return manifest.scripts?.["python:install"] !== void 0;
   } catch {
@@ -4094,7 +4554,7 @@ function applyGoUpdates(workspaceRoot, entries) {
   }
 }
 async function runUp(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path18.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path19.join)(workspaceRoot, "nx.json"))) {
     throw new Error(`No nx.json found in ${workspaceRoot} \u2014 run 'mnci up' from the workspace root.`);
   }
   const ecosystems = resolveEcosystems(options.ecosystem);
@@ -4142,8 +4602,8 @@ async function runUp(workspaceRoot, options) {
 }
 
 // src/util/versionChecker.ts
-var import_node_fs11 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path20 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
@@ -4199,8 +4659,8 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path19.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs11.readFileSync)(manifestPath, "utf8"));
+    const manifestPath = (0, import_node_path20.join)(packageDirectory, "..", "package.json");
+    const manifest = JSON.parse((0, import_node_fs12.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";