feat(migrate): CLI wiring and full LINQ support for JSONB

.github/workflows/release.yml

@@ -202,4 +202,4 @@ jobs:
     uses: ./.github/workflows/nuget-publish.yml
     with:
       tag: v${{ needs.version.outputs.semver }}
-    secrets: inherit
+    # No secrets needed - workflow uses OIDC trusted publishing

.github/workflows/reusable-quality.yml

@@ -147,6 +147,7 @@ jobs:
             /d:sonar.token="${SONAR_TOKEN}" \
             /d:sonar.host.url="https://sonarcloud.io" \
             /d:sonar.exclusions="**/samples/**,**/benchmarks/**,**/*Generated.cs,**/.whizbang-generated/**" \
+            /d:sonar.cpd.exclusions="**/tests/**,**/tools/**,**/samples/**,**/benchmarks/**,src/Whizbang.Generators/**,src/Whizbang.Generators.Shared/**,src/Whizbang.Data.EFCore.Postgres.Generators/**,src/Whizbang.Transports.HotChocolate.Generators/**,src/Whizbang.Transports.FastEndpoints.Generators/**" \
             /d:sonar.coverage.exclusions="**/samples/**,**/benchmarks/**,**/tests/**,**/tools/**,src/Whizbang.Generators/**,src/Whizbang.Generators.Shared/**,src/Whizbang.Data.Schema/**,src/Whizbang.Data.EFCore.Postgres.Generators/**,src/Whizbang.Transports.HotChocolate.Generators/**,src/Whizbang.Transports.FastEndpoints.Generators/**,src/Whizbang.Hosting.Azure.ServiceBus/**,src/Whizbang.Hosting.RabbitMQ/**,src/Whizbang.Data.Dapper.Postgres/**,src/Whizbang.Transports.RabbitMQ/**,src/Whizbang.Data.EFCore.Postgres/**,src/Whizbang.Transports.AzureServiceBus/**,src/Whizbang.Data.Dapper.Sqlite/**,src/Whizbang.Data.Dapper.Custom/**,src/Whizbang.Data.EFCore.Custom/**,src/Whizbang.Data.Postgres/**,src/Whizbang.Testing/**,src/Whizbang.Observability/**,src/Whizbang.SignalR/**" \
             /d:sonar.coverageReportPaths="coverage/sonarqube/SonarQube.xml" \
             /d:sonar.issue.ignore.multicriteria="e1,e2,e3,e4,e5,e6" \

.github/workflows/security-secrets.yml

@@ -23,6 +23,6 @@ jobs:
         fetch-depth: 0  # Full history for comprehensive scanning
 
     - name: Run TruffleHog
-      uses: trufflesecurity/trufflehog@main
+      uses: trufflesecurity/trufflehog@7635b24fd512a2e817dd3e9dd661caaf035a079d # v3.93.1
       with:
         extra_args: --only-verified

ai-docs/efcore-10-usage.md

@@ -213,7 +213,7 @@ await context.SaveChangesAsync();
 
 ## Querying JSON Properties
 
-EF Core 10 provides rich querying capabilities for JsonB columns.
+EF Core 10 provides rich querying capabilities for JsonB columns via `ComplexProperty().ToJson()`.
 
 ### Filter by JSON Properties
 
@@ -228,6 +228,52 @@ var seattleOrders = await context.Orders
 // WHERE "ShippingAddress"->>'City' = 'Seattle'
 ```
 
+### Collection Operations (Any, Contains, Count)
+
+**EF Core 10's `ComplexProperty().ToJson()` supports full LINQ on collections:**
+
+```csharp
+// Model with collection inside JSON
+public class Order {
+    public List<OrderItem> Items { get; set; } = [];
+    public List<string> Tags { get; set; } = [];
+}
+
+// Configuration
+builder.ComplexProperty(o => o.Data, d => d.ToJson("data"));
+
+// ✅ Any() with predicate - translates to server-side SQL
+var highValueOrders = await context.Orders
+    .Where(o => o.Items.Any(i => i.Price > 100))
+    .ToListAsync();
+
+// ✅ Contains() on primitive collections
+var taggedOrders = await context.Orders
+    .Where(o => o.Tags.Contains("priority"))
+    .ToListAsync();
+
+// ✅ Count() on collections
+var bulkOrders = await context.Orders
+    .Where(o => o.Items.Count > 10)
+    .ToListAsync();
+```
+
+**Important**: These collection operations work **server-side** with `ComplexProperty().ToJson()` pattern. The old `Property().HasColumnType("jsonb")` pattern requires client-side evaluation for collection queries.
+
+### String Functions
+
+```csharp
+// String Contains - server-side
+var matchingOrders = await context.Orders
+    .Where(o => o.CustomerName.Contains("Corp"))
+    .ToListAsync();
+
+// String StartsWith
+var prefixOrders = await context.Orders
+    .Where(o => o.CustomerName.StartsWith("Acme"))
+    .ToListAsync();
+```
+
 ### Projection from JSON
 
 ```csharp
@@ -267,6 +313,65 @@ var orders = await context.Orders
 
 ---
 
+## GIN Indexes for JsonB
+
+For efficient JsonB queries, add GIN indexes. EF Core doesn't support `HasIndex` on `ComplexProperty` directly (GitHub #28605), so create indexes via SQL.
+
+### ✅ CORRECT - Create GIN indexes via raw SQL
+
+```sql
+-- In migration or schema initialization
+CREATE INDEX idx_orders_data_gin ON orders USING gin (data);
+CREATE INDEX idx_orders_metadata_gin ON orders USING gin (metadata);
+CREATE INDEX idx_orders_scope_gin ON orders USING gin (scope);
+```
+
+**GIN indexes enable:**
+- ✅ Efficient containment queries (`@>`, `<@`)
+- ✅ Key/value lookups on JsonB data
+- ✅ Path expression queries (`->`, `->>`)
+
+**Whizbang Note**: The `EFCoreServiceRegistrationGenerator` automatically creates GIN indexes in the generated `_generatePerspectiveTablesSchema()` method.
+
+---
+
+## Limitations with ComplexProperty().ToJson()
+
+### ❌ Dictionary<K,V> NOT Supported
+
+EF Core does NOT support `Dictionary<TKey, TValue>` with `ToJson()` (GitHub #29825).
+
+```csharp
+// ❌ WON'T WORK with ToJson()
+public class BadModel {
+    public Dictionary<string, string> Extensions { get; set; } = new();
+}
+
+// ✅ USE List of key-value objects instead
+public class GoodModel {
+    public List<KeyValuePair> Extensions { get; set; } = [];
+}
+
+public class KeyValuePair {
+    public string Key { get; set; } = string.Empty;
+    public string? Value { get; set; }
+}
+```
+
+### ❌ Collections of Structs NOT Supported
+
+```csharp
+// ❌ WON'T WORK - struct in collection
+public struct Point { public int X; public int Y; }
+public List<Point> Points { get; set; } = [];
+
+// ✅ USE classes instead
+public class Point { public int X { get; set; } public int Y { get; set; } }
+public List<Point> Points { get; set; } = [];
+```
+
+---
+
 ## Virtual Generated Columns
 
 PostgreSQL 18+ supports **virtual generated columns** (computed columns that aren't stored).

scripts/Pack-LocalPackages.ps1

@@ -0,0 +1,142 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+    Packs all Whizbang NuGet packages to local-packages directory.
+
+.DESCRIPTION
+    Builds and packs all src/Whizbang.* projects to the local-packages directory
+    for local development and testing.
+
+.PARAMETER Configuration
+    Build configuration (Debug or Release). Default: Debug
+
+.PARAMETER Clean
+    Clean the local-packages directory before packing.
+
+.EXAMPLE
+    ./scripts/Pack-LocalPackages.ps1
+    Packs all packages in Debug configuration.
+
+.EXAMPLE
+    ./scripts/Pack-LocalPackages.ps1 -Configuration Release -Clean
+    Cleans local-packages and packs all packages in Release configuration.
+#>
+
+param(
+    [ValidateSet("Debug", "Release")]
+    [string]$Configuration = "Debug",
+
+    [switch]$Clean
+)
+
+$ErrorActionPreference = "Stop"
+
+# Find repo root
+$scriptDir = $PSScriptRoot
+if (-not $scriptDir) {
+    $scriptDir = Get-Location
+}
+$repoRoot = Split-Path $scriptDir -Parent
+
+$localPackagesDir = Join-Path $repoRoot "local-packages"
+$srcDir = Join-Path $repoRoot "src"
+
+Write-Host "Whizbang Local Package Builder" -ForegroundColor Cyan
+Write-Host "===============================" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "Repository: $repoRoot"
+Write-Host "Output:     $localPackagesDir"
+Write-Host "Config:     $Configuration"
+Write-Host ""
+
+# Clean if requested
+if ($Clean) {
+    Write-Host "Cleaning local-packages directory..." -ForegroundColor Yellow
+    if (Test-Path $localPackagesDir) {
+        Remove-Item "$localPackagesDir/*.nupkg" -Force -ErrorAction SilentlyContinue
+        Remove-Item "$localPackagesDir/*.snupkg" -Force -ErrorAction SilentlyContinue
+    }
+}
+
+# Ensure output directory exists
+if (-not (Test-Path $localPackagesDir)) {
+    New-Item -ItemType Directory -Path $localPackagesDir | Out-Null
+}
+
+# Find all Whizbang projects
+$projects = Get-ChildItem -Path $srcDir -Filter "Whizbang.*.csproj" -Recurse |
+    Where-Object { $_.FullName -notmatch "\\obj\\" -and $_.FullName -notmatch "\\bin\\" }
+
+Write-Host "Found $($projects.Count) projects to pack:" -ForegroundColor Green
+$projects | ForEach-Object { Write-Host "  - $($_.BaseName)" -ForegroundColor Gray }
+Write-Host ""
+
+$successCount = 0
+$failCount = 0
+$results = @()
+
+foreach ($project in $projects) {
+    $projectName = $project.BaseName
+    Write-Host "Packing $projectName..." -ForegroundColor Cyan -NoNewline
+
+    $output = dotnet pack $project.FullName -o $localPackagesDir -c $Configuration 2>&1
+    $exitCode = $LASTEXITCODE
+
+    # Check for success (package created)
+    $packageCreated = $output | Select-String "Successfully created package"
+
+    if ($packageCreated) {
+        Write-Host " OK" -ForegroundColor Green
+        $successCount++
+        $results += [PSCustomObject]@{
+            Project = $projectName
+            Status = "Success"
+        }
+    } else {
+        # Check if it's just the NU5017 error (no content) but package was still created
+        $nu5017 = $output | Select-String "NU5017"
+        if ($nu5017 -and ($output | Select-String "Successfully created package")) {
+            Write-Host " OK (analyzer package)" -ForegroundColor Green
+            $successCount++
+            $results += [PSCustomObject]@{
+                Project = $projectName
+                Status = "Success (analyzer)"
+            }
+        } elseif ($exitCode -ne 0) {
+            Write-Host " FAILED" -ForegroundColor Red
+            $failCount++
+            $results += [PSCustomObject]@{
+                Project = $projectName
+                Status = "Failed"
+            }
+            # Show error details
+            $output | Where-Object { $_ -match "error" } | ForEach-Object {
+                Write-Host "    $_" -ForegroundColor Red
+            }
+        } else {
+            Write-Host " OK" -ForegroundColor Green
+            $successCount++
+            $results += [PSCustomObject]@{
+                Project = $projectName
+                Status = "Success"
+            }
+        }
+    }
+}
+
+Write-Host ""
+Write-Host "===============================" -ForegroundColor Cyan
+Write-Host "Results: $successCount succeeded, $failCount failed" -ForegroundColor $(if ($failCount -gt 0) { "Yellow" } else { "Green" })
+Write-Host ""
+
+# List created packages
+$packages = Get-ChildItem -Path $localPackagesDir -Filter "*.nupkg" | Sort-Object LastWriteTime -Descending
+Write-Host "Packages in $localPackagesDir`:" -ForegroundColor Cyan
+$packages | ForEach-Object {
+    $size = [math]::Round($_.Length / 1KB, 1)
+    Write-Host "  $($_.Name) ($size KB)" -ForegroundColor Gray
+}
+
+if ($failCount -gt 0) {
+    exit 1
+}

src/Whizbang.Core/Lenses/PerspectiveMetadata.cs

@@ -5,43 +5,56 @@ namespace Whizbang.Core.Lenses;
 /// Contains information about the event that created/updated this perspective.
 /// Stored as JSONB/JSON in metadata column.
 /// </summary>
+/// <remarks>
+/// <para>
+/// <strong>EF Core 10 Compatibility:</strong>
+/// This type is a <c>class</c> (not <c>record</c>) with default values to enable
+/// <c>ComplexProperty().ToJson()</c> mapping. Records have generated copy-constructors
+/// that can cause NullReferenceException in EF Core query materialization.
+/// </para>
+/// </remarks>
 /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/OrderPerspectiveTests.cs:OrderPerspective_Update_StoresDefaultMetadataAsync</tests>
 /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs</tests>
-public record PerspectiveMetadata {
+public class PerspectiveMetadata {
+  /// <summary>
+  /// Parameterless constructor for EF Core ComplexProperty materialization.
+  /// </summary>
+  public PerspectiveMetadata() { }
+
   /// <summary>
   /// Fully qualified event type name (e.g., "ECommerce.Contracts.Events.OrderCreatedEvent").
   /// Used to filter perspectives by event source.
   /// </summary>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/OrderPerspectiveTests.cs:OrderPerspective_Update_StoresDefaultMetadataAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs</tests>
-  public required string EventType { get; init; }
+  public string EventType { get; set; } = string.Empty;
 
   /// <summary>
   /// Unique identifier for the event.
   /// </summary>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/OrderPerspectiveTests.cs:OrderPerspective_Update_StoresDefaultMetadataAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs</tests>
-  public required string EventId { get; init; }
+  public string EventId { get; set; } = string.Empty;
 
   /// <summary>
   /// When the event occurred.
   /// Useful for time-range queries (e.g., orders created in last 30 days).
   /// </summary>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/OrderPerspectiveTests.cs:OrderPerspective_Update_StoresDefaultMetadataAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs</tests>
-  public required DateTime Timestamp { get; init; }
+  public DateTime Timestamp { get; set; }
 
   /// <summary>
   /// Correlation ID for distributed tracing.
   /// Links related events across service boundaries.
   /// </summary>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs</tests>
-  public string? CorrelationId { get; init; }
+  public string? CorrelationId { get; set; }
 
   /// <summary>
   /// Causation ID (the event that caused this event).
   /// Builds event causality chains.
   /// </summary>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs</tests>
-  public string? CausationId { get; init; }
+  public string? CausationId { get; set; }
 }

src/Whizbang.Core/Lenses/PerspectiveRow.cs

@@ -49,22 +49,30 @@ public class PerspectiveRow<TModel> where TModel : class {
   /// Stored as JSONB/JSON.
   /// Useful for filtering by event source or time range.
   /// </summary>
+  /// <remarks>
+  /// Uses <c>set</c> accessor (not <c>init</c>) for EF Core ComplexProperty materialization compatibility.
+  /// </remarks>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/OrderPerspectiveTests.cs:OrderPerspective_Update_StoresDefaultMetadataAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs:Query_CanFilterByMetadataFields_ReturnsMatchingRowsAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs:Query_CanProjectAcrossColumns_ReturnsAnonymousTypeAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs:Query_SupportsCombinedFilters_FromAllColumnsAsync</tests>
-  public required PerspectiveMetadata Metadata { get; init; }
+  public required PerspectiveMetadata Metadata { get; set; }
 
   /// <summary>
   /// Multi-tenancy and security scope (tenant ID, user ID, org ID).
   /// Stored as JSONB/JSON.
   /// Enables efficient tenant isolation queries.
   /// </summary>
+  /// <remarks>
+  /// Uses <c>set</c> accessor (not <c>init</c>) for EF Core OwnsOne/ComplexProperty materialization compatibility.
+  /// The <c>required</c> keyword ensures the property is set during initialization while <c>set</c> allows
+  /// EF Core to populate the instance during query materialization.
+  /// </remarks>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/OrderPerspectiveTests.cs:OrderPerspective_Update_StoresDefaultScopeAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs:Query_CanFilterByScopeFields_ReturnsMatchingRowsAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs:Query_CanProjectAcrossColumns_ReturnsAnonymousTypeAsync</tests>
   /// <tests>tests/Whizbang.Data.EFCore.Postgres.Tests/EFCorePostgresLensQueryTests.cs:Query_SupportsCombinedFilters_FromAllColumnsAsync</tests>
-  public required PerspectiveScope Scope { get; init; }
+  public required PerspectiveScope Scope { get; set; }
 
   /// <summary>
   /// When this row was first created.