Directory.Packages.props

<Project>

  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>

  <ItemGroup>
    <!-- DuckDB 2.0 may emit zero-field structs. This patched Arrow package accepts them
         while preserving null and other nested-type validation. -->
    <PackageVersion Include="QueryFarm.Arrow" Version="23.0.0-queryfarm.4" />
    <!-- Only used when the vgi-rpc-csharp sibling checkout isn't present (see
         Directory.Build.props); when it is, Apache.Arrow comes transitively from its vendored
         ProjectReference and this pinned version is irrelevant.
         MUST be >= 0.4.0: versions before that declared a broken transitive dependency on the
         real, unpatched, years-old official Apache.Arrow 1.0.0 instead of the patched
         QueryFarm.Arrow fork QueryFarm.Vgi actually needs — confirmed via a clean-restore
         reproduction against 0.3.0 (CS0246 on Decimal128Type/IntegerType/Decimal128Array, CS1503
         on IArrowArray/Array), fixed in vgi-rpc-csharp 0.4.0 (see that repo's
         third_party/apache-arrow-dotnet/README.md's "Published as QueryFarm.Arrow" section). This
         package's own NuGet publish must not happen before 0.4.0 is live on nuget.org.
         MUST also be >= 0.12.1, a wire-correctness floor: before it, [LargeWidth] on a collection
         did not reach the elements, so the generated InitRequest/TableFunctionPlanRequest
         join_keys/split_tokens derived list<binary> where the protocol declares
         list<large_binary> (Protocol/GeneratedProtocolConformanceTests catches it). -->
    <PackageVersion Include="QueryFarm.VgiRpc" Version="0.18.3" />
    <PackageVersion Include="QueryFarm.VgiRpc.Http" Version="0.18.3" />

    <!-- Same sibling-source-vs-NuGet split as QueryFarm.VgiRpc above; only used when the
         vgi-rpc-csharp checkout isn't present. QueryFarm.VgiRpc.Client's first-ever NuGet publish
         was 0.8.0 (it started as a package split out of QueryFarm.VgiRpc later than that repo's
         own version history — nuget.org has no 0.7.0 or earlier for it), and it depends on
         QueryFarm.VgiRpc >= its own version, so the two pins must move together and neither may
         be older than 0.8.0 — confirmed via nuget.org's flat-container version index for both
         packages, not assumed. All three now sit on the 0.10.x family, which is wire-breaking
         against 0.9.x (Reflection.v1 replaces __describe__, the `vgi_rpc.protocol` routing key is
         required on raw transports, RFC 8785 canonical JSON moved the protocol hash, and the
         protocol name lost C#'s `I` prefix). A worker built on 0.9.x cannot talk to a 0.10.x
         peer, so these do not float independently.
         MUST be >= 0.10.1, not 0.10.0: 0.10.1 adds `[ProtocolName]`, the server-side wire-name
         declaration this port's `vgi.v3` needs (IVgiService carries it). 0.10.0 derived the
         server's name from the C# type and offered no override at all, so against it this repo
         does not compile. The bump is additive on the wire — a contract that declares nothing
         keeps the name it already answered to.
         MUST be >= 0.10.2, and this one is a CORRECTNESS floor rather than a compile floor: on
         0.10.1 and earlier, HTTP dispatch never read `OutputCollector.EmittedMetadata`, so every
         per-batch key this worker emits — the whole `vgi.cache.*` family,
         `vgi_partition_values#b64`, `vgi_batch_index`, `vgi_rpc.parent_row#b64` — was silently
         dropped over HTTP and the extension rejected the batches that declared those features;
         `ValueCodec.EmptyRow` also threw (500) for FixedSizeBinary/Union/Interval columns and for
         any ENUM whose dictionary index was not Int16. This repo builds and its unit tests pass
         against 0.10.1; it is the HTTP integration lane that does not, which is precisely why
         that lane now exists (ci/README.md). Do not lower this pin to make a restore resolve.
         MUST be >= 0.11.1, also a CORRECTNESS floor: it ships QueryFarm.Arrow
         23.0.0-queryfarm.3, whose ArrowStreamWriter keeps a batch reachable until its bodies are
         copied. Before it, a batch built only to be written could be finalized mid-write — an
         intermittent NullReferenceException in WriteBufferData, or a silent copy of memory the
         native pool had already reused (see RecordBatchIpc.Write, which still guards this repo's
         own writes). 0.11.0's removals (introspection rate limiting, the __introspect_token__
         route) touch nothing here.
         0.12.0 passes the reference's full server-role conformance and ENFORCES each method's
         declared parameter contract (extra/missing/renamed/reordered parameters, nullability,
         request_version). Every request this SDK's worker receives from the DuckDB extension
         already conforms — the 338-file integration suite passes unchanged against it, direct
         and through Rowfence — so the stricter server changes nothing for real clients.
         MUST be >= 0.16.0, a compile floor: it makes QueryFarm.VgiRpc.Identity.XChaCha20Poly1305
         public, which AttachTickets and Internal/OpaqueSealing seal with instead of a copy. -->
    <PackageVersion Include="QueryFarm.VgiRpc.Client" Version="0.18.3" />
    <PackageVersion Include="QueryFarm.VgiRpc.Client.Http" Version="0.18.3" />

    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />

    <!-- Embedded-DuckDB engine used by Internal/ExpressionFilterEvaluator.cs to evaluate genuine
         expression-filter (function-call/spatial) pushdown — the same architecture vgi-python's
         table_filter_pushdown.py and vgi-go's expression_filter.go use (render the pushed bound
         expression tree to SQL text, execute it against an embedded engine with the candidate
         column loaded), rather than hand-writing per-function C# evaluation logic.
         MUST be >= 1.5.5, not older: empirically, both 1.4.1 and 1.5.3 fail to correctly bind a
         List<byte[]> parameter through UNNEST($1) (1.4.1: infers $1 as VARCHAR and throws a Binder
         Error; 1.5.3: throws "Cannot map type System.Byte[] to DuckDBType" outright) — needed for
         WKB/geometry columns (see SpatialFilterExampleFunction). 1.5.5 is the first version
         confirmed (by direct empirical testing, not changelog-reading) to bind it correctly.
         1.5.5 also declares a hard dependency on the OFFICIAL, unpatched `Apache.Arrow` NuGet
         package (added for its own optional Apache Arrow result-streaming feature,
         DuckDBCommand.ExecuteArrowStream/ExecuteArrowBatchesAsync, which this evaluator never
         uses — plain ADO.NET DbDataReader + UNNEST($1) list parameters instead) — that would
         collide at compile time with this repo's patched `QueryFarm.Arrow` fork (same AssemblyName
         "Apache.Arrow", different strong-name key: CS0433 "ambiguous between ...
         PublicKeyToken=204f54e5a45c07df ... PublicKeyToken=null"). QueryFarm.Vgi.csproj's explicit
         `<PackageReference Include="Apache.Arrow" ExcludeAssets="all" />` suppresses that
         transitive pull entirely — safe because nothing in this codebase calls the Arrow-streaming
         API that would need Apache.Arrow.dll loadable at runtime. -->
    <PackageVersion Include="DuckDB.NET.Data.Full" Version="1.5.5" />
    <!-- Both excluded repo-wide (root Directory.Build.props) — Apache.Arrow (official) is what
         DuckDB.NET.Data.Full 1.5.5 directly depends on, and Apache.Arrow (official) in turn
         depends on Apache.Arrow.Scalars (official), which collides with the patched
         QueryFarm.Arrow.Scalars fork the same way. -->
    <PackageVersion Include="Apache.Arrow" Version="23.0.0" />
    <PackageVersion Include="Apache.Arrow.Scalars" Version="23.0.0" />

    <!-- Testing -->
    <PackageVersion Include="xunit.v3" Version="1.1.0" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
  </ItemGroup>

</Project>