From a7c5b02fd2ab4c51a27f61b4f71ac41434f54a26 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Mon, 16 Jun 2025 10:22:45 -0400
Subject: [PATCH 01/64] feat: add an action that handles git checkouts for all
 workflows (#1644)

---
 .github/actions/shared-checkout/action.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 .github/actions/shared-checkout/action.yml

diff --git a/.github/actions/shared-checkout/action.yml b/.github/actions/shared-checkout/action.yml
new file mode 100644
index 000000000..59a236db8
--- /dev/null
+++ b/.github/actions/shared-checkout/action.yml
@@ -0,0 +1,12 @@
+name: Checkout
+description: Checkout repository for pull requests and branches
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+        ref: ${{ github.event.pull_request.head.sha || github.sha }}
+        fetch-depth: 0
+        fetch-tags: true

From 2bdd0f95f5fa5673849349e4ff761be1c56c2afe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Tue, 17 Jun 2025 14:35:39 +0200
Subject: [PATCH 02/64] feat: allow checkout of fork repository on workflow
 approval (#1643)

* feat: allow checkout of fork repository on workflow approval

Based on #1635

* Do not use secrets if they are not available

In the forks, secrets are not available.
---
 .github/workflows/ami-release-nix-single.yml  |  2 +-
 .github/workflows/ami-release-nix.yml         |  6 ++---
 .github/workflows/check-shellscripts.yml      |  3 ++-
 .github/workflows/ci.yml                      |  2 +-
 .../workflows/dockerhub-release-matrix.yml    | 14 ++++++----
 .github/workflows/manual-docker-release.yml   | 14 ++++++----
 .github/workflows/mirror-postgrest.yml        |  3 ++-
 .github/workflows/nix-build.yml               | 12 +++------
 .github/workflows/publish-migrations-prod.yml |  4 +--
 .../workflows/publish-migrations-staging.yml  |  3 +--
 ...ublish-nix-pgupgrade-bin-flake-version.yml | 10 +++----
 .../publish-nix-pgupgrade-scripts.yml         |  8 +++---
 .github/workflows/qemu-image-build.yml        |  4 +--
 .github/workflows/test.yml                    |  7 ++---
 .github/workflows/testinfra-ami-build.yml     |  4 +--
 docker/nix/build_nix.sh                       | 27 +++++++++++--------
 16 files changed, 67 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/ami-release-nix-single.yml b/.github/workflows/ami-release-nix-single.yml
index 86a1d40fc..863135ef3 100644
--- a/.github/workflows/ami-release-nix-single.yml
+++ b/.github/workflows/ami-release-nix-single.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
         with:
           ref: ${{ github.event.inputs.branch }}
 
diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml
index 004a597d7..ee78de99c 100644
--- a/.github/workflows/ami-release-nix.yml
+++ b/.github/workflows/ami-release-nix.yml
@@ -22,8 +22,8 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
-      
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Set PostgreSQL versions
@@ -48,7 +48,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - uses: DeterminateSystems/nix-installer-action@main
 
diff --git a/.github/workflows/check-shellscripts.yml b/.github/workflows/check-shellscripts.yml
index ab0f59b87..aabf17413 100644
--- a/.github/workflows/check-shellscripts.yml
+++ b/.github/workflows/check-shellscripts.yml
@@ -14,7 +14,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - name: Checkout Repo
+      uses: supabase/postgres/.github/actions/shared-checkout@HEAD
     - name: Run ShellCheck
       uses: ludeeus/action-shellcheck@master
       env:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 93a2afdc5..f10f5f58e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - name: Load postgres_release values
         id: load_postgres_release
diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml
index ed7075d1d..1ac5b2ccc 100644
--- a/.github/workflows/dockerhub-release-matrix.yml
+++ b/.github/workflows/dockerhub-release-matrix.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
       - uses: DeterminateSystems/nix-installer-action@main
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - name: Generate build matrix
         id: set-matrix
         run: |
@@ -53,7 +53,8 @@ jobs:
     outputs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
@@ -77,7 +78,8 @@ jobs:
     runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest' || 'arm-runner' }}
     timeout-minutes: 180
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
       - run: docker context create builders
       - uses: docker/setup-buildx-action@v3
@@ -132,7 +134,8 @@ jobs:
         include: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v2
@@ -175,7 +178,8 @@ jobs:
     needs: [prepare, merge_manifest]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Debug Input from Prepare
diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml
index 8948324db..e702014dc 100644
--- a/.github/workflows/manual-docker-release.yml
+++ b/.github/workflows/manual-docker-release.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - uses: DeterminateSystems/nix-installer-action@main
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - name: Generate build matrix
         id: set-matrix
         run: |
@@ -50,7 +50,8 @@ jobs:
     outputs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
@@ -74,7 +75,8 @@ jobs:
     runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest' || 'arm-runner' }}
     timeout-minutes: 180
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
       - run: docker context create builders
       - uses: docker/setup-buildx-action@v3
@@ -141,7 +143,8 @@ jobs:
         include: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v2
@@ -184,7 +187,8 @@ jobs:
     needs: [prepare, merge_manifest]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Debug Input from Prepare
diff --git a/.github/workflows/mirror-postgrest.yml b/.github/workflows/mirror-postgrest.yml
index 1658730f7..0195ab695 100644
--- a/.github/workflows/mirror-postgrest.yml
+++ b/.github/workflows/mirror-postgrest.yml
@@ -17,7 +17,8 @@ jobs:
     outputs:
       postgrest_release: ${{ steps.args.outputs.result }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - id: args
         uses: mikefarah/yq@master
         with:
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index c1811fd00..b6458a807 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -27,15 +27,11 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 180
     steps:
-
-      - name: Check out code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
-          fetch-depth: 0
-          fetch-tags: true
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - name: aws-creds
         uses: aws-actions/configure-aws-credentials@v4
+        if: ${{ github.secret_source == 'Actions' }}
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: "us-east-1"
@@ -48,7 +44,7 @@ jobs:
         env:
           NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
       - name: Log in to Docker Hub
-        if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13'
+        if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13' && github.secret_source == 'Actions'
         uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
diff --git a/.github/workflows/publish-migrations-prod.yml b/.github/workflows/publish-migrations-prod.yml
index d7e813667..e3d7365cb 100644
--- a/.github/workflows/publish-migrations-prod.yml
+++ b/.github/workflows/publish-migrations-prod.yml
@@ -21,8 +21,8 @@ jobs:
         env:
           GITHUB_REF: ${{ github.ref }}
 
-      - name: Checkout Repo
-        uses: actions/checkout@v2
+      - name: Checkout repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - name: Merging migration files
         run: cat $(ls -1) > ../migration-output.sql
diff --git a/.github/workflows/publish-migrations-staging.yml b/.github/workflows/publish-migrations-staging.yml
index 72b28e927..9cef8be4b 100644
--- a/.github/workflows/publish-migrations-staging.yml
+++ b/.github/workflows/publish-migrations-staging.yml
@@ -16,8 +16,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
-
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - name: Merging migration files
         run: cat $(ls -1) > ../migration-output.sql
         working-directory: ${{ github.workspace }}/migrations/db/migrations
diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
index bec85166e..847e6d47c 100644
--- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
+++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
@@ -17,8 +17,8 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
-      
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Set PostgreSQL versions
@@ -36,8 +36,8 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
-      
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+
       - uses: DeterminateSystems/nix-installer-action@main  
 
       - name: Grab release version
@@ -88,7 +88,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - name: Grab release version
         id: process_release_version
diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml
index ece3e5966..19e255fca 100644
--- a/.github/workflows/publish-nix-pgupgrade-scripts.yml
+++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml
@@ -24,7 +24,7 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       
       - uses: DeterminateSystems/nix-installer-action@main
 
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - uses: DeterminateSystems/nix-installer-action@main
 
@@ -94,8 +94,8 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
-      
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+
       - uses: DeterminateSystems/nix-installer-action@main
   
       - name: Grab release version
diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index 708c7faf2..8abee1461 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -23,7 +23,7 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - uses: DeterminateSystems/nix-installer-action@main
 
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - uses: DeterminateSystems/nix-installer-action@main
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a218ef882..ac285af26 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,7 +17,7 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - name: Clear Nix cache
         run: |
@@ -49,7 +49,8 @@ jobs:
       POSTGRES_PORT: 5478
       POSTGRES_PASSWORD: password
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       - name: Clear Nix cache
         run: |
           sudo rm -rf /home/runner/.cache/nix
@@ -86,4 +87,4 @@ jobs:
             echo "Detected changes in schema.sql:"
             git diff migrations/schema-${{ env.PGMAJOR }}.sql
             exit 1
-          fi
\ No newline at end of file
+          fi
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index 2b07e716f..752bc3938 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -15,7 +15,7 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
       
       - uses: DeterminateSystems/nix-installer-action@main
 
@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
       - id: args
         uses: mikefarah/yq@master
diff --git a/docker/nix/build_nix.sh b/docker/nix/build_nix.sh
index efaafbe89..8e7d9cfa8 100644
--- a/docker/nix/build_nix.sh
+++ b/docker/nix/build_nix.sh
@@ -18,11 +18,13 @@ nix build .#wal-g-2 -o wal-g-2 -L
 nix build .#wal-g-3 -o wal-g-3 -L
 
 # Copy to S3
-nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./wal-g-2
-nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./wal-g-3
-nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_15
-nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_orioledb_17
-nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_17
+if [[ -n "${AWS_ACCESS_KEY_ID-}" && -n "${AWS_SECRET_ACCESS_KEY-}" ]]; then
+    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./wal-g-2
+    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./wal-g-3
+    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_15
+    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_orioledb_17
+    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_17
+fi
 
 if [ "$SYSTEM" = "aarch64-linux" ]; then
     nix build .#postgresql_15_debug -o ./postgresql_15_debug
@@ -31,10 +33,13 @@ if [ "$SYSTEM" = "aarch64-linux" ]; then
     nix build .#postgresql_orioledb-17_src -o ./postgresql_orioledb-17_src
     nix build .#postgresql_17_debug -o ./postgresql_17_debug
     nix build .#postgresql_17_src -o ./postgresql_17_src
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_15_debug-debug
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_15_src
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_orioledb-17_debug-debug
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_orioledb-17_src
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_17_debug-debug
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_17_src
+
+    if [[ -n "${AWS_ACCESS_KEY_ID-}" && -n "${AWS_SECRET_ACCESS_KEY-}" ]]; then
+        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_15_debug-debug
+        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_15_src
+        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_orioledb-17_debug-debug
+        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_orioledb-17_src
+        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_17_debug-debug
+        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_17_src
+    fi
 fi

From 521a9746cb3afd1b93efb3acd520be903e16308f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Wed, 18 Jun 2025 03:53:44 +0200
Subject: [PATCH 03/64] Use nix-fast-build to build all checks (#1642)

* Use nix-fast-build to build all checks

CI build the required nix packages defined in flake checks. We use the
`nix-fast-build` tool to speed up the evaluation and build process.

We now use the same GitHub action to install nix.

We upload the build results to the cache using a post build hook.

* Run nix-fast-build from the GH Actions workflow

No need to run an extra shell script to run nix-fast-build.

* Upgrade the runners

* Fix issue with simultaneous pg build on darwin

Make sure each build use different port per version.
Make sure they use different pgsodium directories.
---
 .github/workflows/nix-build.yml | 65 +++++++++++++++++----------------
 docker/nix/build_nix.sh         | 38 +------------------
 flake.nix                       | 43 +++++++++++-----------
 3 files changed, 56 insertions(+), 90 deletions(-)
 mode change 100644 => 100755 docker/nix/build_nix.sh

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index b6458a807..e95d65a43 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -18,11 +18,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: larger-runner-4cpu
+          - runner: large-linux-x86
             arch: amd64
-          - runner: arm-runner
+          - runner: large-linux-arm
             arch: arm64
-          - runner: macos-latest
+          - runner: macos-latest-xlarge
             arch: arm64
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 180
@@ -43,37 +43,38 @@ jobs:
           python -c "import os; file = open('nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
         env:
           NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
-      - name: Log in to Docker Hub
-        if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13' && github.secret_source == 'Actions'
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build psql bundle with nix
-        if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13'
-        run: docker build -t base_nix -f docker/nix/Dockerfile .
-      - name: Run build psql bundle
-        if: matrix.runner != 'macos-latest' && matrix.runner != 'macos-13'
-        run:  |
-          docker run -e AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }} \
-                    -e AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }} \
-                    -e AWS_SESSION_TOKEN=${{ env.AWS_SESSION_TOKEN }} \
-                    base_nix bash -c "./workspace/docker/nix/build_nix.sh"
-      - name: Build psql bundle on macos
-        if: matrix.runner == 'macos-latest' || matrix.runner == 'macos-13'
+      - name: Setup cache script
+        if: ${{ github.secret_source == 'Actions' }}
         run: |
-          curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install --no-confirm \
-          --extra-conf "substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com" \
-          --extra-conf "trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          cp ./docker/nix/build_nix.sh ./build_nix.sh
-          sed -i '' '1s|^#!/bin/env bash|#!/usr/bin/env bash|' ./build_nix.sh
-          chmod +x ./build_nix.sh
-          ./build_nix.sh
+          mkdir -p /etc/nix
+          cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null
+          #!/usr/bin/env bash
+          set -eouf
+          export IFS=' '
+          echo /nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=nix-secret-key' \$OUT_PATHS
+          EOF
+          chmod +x /etc/nix/upload-to-cache.sh
+      - name: Install nix
+        uses: DeterminateSystems/nix-installer-action@main
+        if: ${{ github.secret_source == 'Actions' }}
+        with:
+          extra-conf: |
+            substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
+            trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+            post-build-hook = /etc/nix/upload-to-cache.sh
+      - name: Install nix
+        uses: DeterminateSystems/nix-installer-action@main
+        if: ${{ github.secret_source == 'None' }}
+        with:
+          extra-conf: |
+            substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
+            trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+      - name: Build psql bundle
+        run: >
+            nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48" 
+            -- --skip-cached --no-nom 
+            --flake ".#checks.$(nix eval --raw --impure --expr 'builtins.currentSystem')"
         env:
           AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
           AWS_SESSION_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
-
-    name: build psql bundle on ${{ matrix.arch }}
-    
diff --git a/docker/nix/build_nix.sh b/docker/nix/build_nix.sh
old mode 100644
new mode 100755
index 8e7d9cfa8..118fdf61d
--- a/docker/nix/build_nix.sh
+++ b/docker/nix/build_nix.sh
@@ -6,40 +6,4 @@ if [ -d "/workspace" ]; then
     cd /workspace
 fi
 
-SYSTEM=$(nix-instantiate --eval -E builtins.currentSystem | tr -d '"')
-
-nix build .#checks.$SYSTEM.psql_15 -L --no-link
-nix build .#checks.$SYSTEM.psql_orioledb-17 -L --no-link
-nix build .#checks.$SYSTEM.psql_17 -L --no-link
-nix build .#psql_15/bin -o psql_15 -L
-nix build .#psql_orioledb-17/bin -o psql_orioledb_17 -L
-nix build .#psql_17/bin -o psql_17 -L
-nix build .#wal-g-2 -o wal-g-2 -L
-nix build .#wal-g-3 -o wal-g-3 -L
-
-# Copy to S3
-if [[ -n "${AWS_ACCESS_KEY_ID-}" && -n "${AWS_SECRET_ACCESS_KEY-}" ]]; then
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./wal-g-2
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./wal-g-3
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_15
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_orioledb_17
-    nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./psql_17
-fi
-
-if [ "$SYSTEM" = "aarch64-linux" ]; then
-    nix build .#postgresql_15_debug -o ./postgresql_15_debug
-    nix build .#postgresql_15_src -o ./postgresql_15_src
-    nix build .#postgresql_orioledb-17_debug -o ./postgresql_orioledb-17_debug
-    nix build .#postgresql_orioledb-17_src -o ./postgresql_orioledb-17_src
-    nix build .#postgresql_17_debug -o ./postgresql_17_debug
-    nix build .#postgresql_17_src -o ./postgresql_17_src
-
-    if [[ -n "${AWS_ACCESS_KEY_ID-}" && -n "${AWS_SECRET_ACCESS_KEY-}" ]]; then
-        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_15_debug-debug
-        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_15_src
-        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_orioledb-17_debug-debug
-        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_orioledb-17_src
-        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key ./postgresql_17_debug-debug
-        nix copy --to s3://nix-postgres-artifacts?secret-key=nix-secret-key  ./postgresql_17_src
-    fi
-fi
+nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48" -- --skip-cached --no-nom --flake ".#checks"
diff --git a/flake.nix b/flake.nix
index f22415789..a7f48d58c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1125,11 +1125,7 @@
 
                 TMPDIR_BASE=$(mktemp -d)
 
-                if [[ "$(uname)" == "Darwin" ]]; then
-                  KEY_DIR="/private/tmp/pgsodium"
-                else
-                  KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
-                fi
+                KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
                 KEY_FILE="$KEY_DIR/pgsodium.key"
 
                 if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
@@ -1165,6 +1161,7 @@
               name = "start-postgres-server-test";
               extraSubstitutions = {
                 PGSODIUM_GETKEY = "${getkey-script}/bin/pgsodium-getkey";
+                PGSQL_DEFAULT_PORT = pgPort;
               };
             };
 
@@ -1217,6 +1214,12 @@
             # Filter SQL test files
             filteredSqlTests = filterTestFiles majorVersion ./nix/tests/sql;
 
+            pgPort = if (majorVersion == "17") then
+                "5535"
+                else if (majorVersion == "15") then
+                "5536"
+                else "5537";
+
             # Convert filtered tests to a sorted list of basenames (without extension)
             testList = pkgs.lib.mapAttrsToList
               (name: _:
@@ -1251,7 +1254,7 @@
             substitute ${./nix/tests/postgresql.conf.in} "$PGTAP_CLUSTER"/postgresql.conf \
               --subst-var-by PGSODIUM_GETKEY_SCRIPT "${getkey-script}/bin/pgsodium-getkey"
             echo "listen_addresses = '*'" >> "$PGTAP_CLUSTER"/postgresql.conf
-            echo "port = ${pgsqlDefaultPort}" >> "$PGTAP_CLUSTER"/postgresql.conf
+            echo "port = ${pgPort}" >> "$PGTAP_CLUSTER"/postgresql.conf
             echo "host all all 127.0.0.1/32 trust" >> $PGTAP_CLUSTER/pg_hba.conf
             echo "Checking shared_preload_libraries setting:"
             grep -rn "shared_preload_libraries" "$PGTAP_CLUSTER"/postgresql.conf
@@ -1272,10 +1275,10 @@
 
             # PostgreSQL startup
             if [[ "$(uname)" == "Darwin" ]]; then
-            pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k "$PGTAP_CLUSTER" -p ${pgsqlDefaultPort} -d 5" start 2>&1
+            pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k "$PGTAP_CLUSTER" -p ${pgPort} -d 5" start 2>&1
             else
             mkdir -p "$PGTAP_CLUSTER/sockets"
-            pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k $PGTAP_CLUSTER/sockets -p ${pgsqlDefaultPort} -d 5" start 2>&1
+            pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k $PGTAP_CLUSTER/sockets -p ${pgPort} -d 5" start 2>&1
             fi || {
             echo "pg_ctl failed to start PostgreSQL"
             echo "Contents of postgresql.log:"
@@ -1283,7 +1286,7 @@
             exit 1
             }
             for i in {1..60}; do
-              if pg_isready -h ${pgsqlDefaultHost} -p ${pgsqlDefaultPort}; then
+              if pg_isready -h ${pgsqlDefaultHost} -p ${pgPort}; then
                 echo "PostgreSQL is ready"
                 break
               fi
@@ -1297,8 +1300,8 @@
                 exit 1
               fi
             done
-            createdb -p ${pgsqlDefaultPort} -h ${pgsqlDefaultHost} --username=supabase_admin testing
-            if ! psql -p ${pgsqlDefaultPort} -h ${pgsqlDefaultHost} --username=supabase_admin -d testing -v ON_ERROR_STOP=1 -Xaf ${./nix/tests/prime.sql}; then
+            createdb -p ${pgPort} -h ${pgsqlDefaultHost} --username=supabase_admin testing
+            if ! psql -p ${pgPort} -h ${pgsqlDefaultHost} --username=supabase_admin -d testing -v ON_ERROR_STOP=1 -Xf ${./nix/tests/prime.sql}; then
               echo "Error executing SQL file. PostgreSQL log content:"
               cat "$PGTAP_CLUSTER"/postgresql.log
               pg_ctl -D "$PGTAP_CLUSTER" stop
@@ -1306,7 +1309,7 @@
             fi
             SORTED_DIR=$(mktemp -d)
             for t in $(printf "%s\n" ${builtins.concatStringsSep " " sortedTestList}); do
-              psql -p ${pgsqlDefaultPort} -h ${pgsqlDefaultHost} --username=supabase_admin -d testing -f "${./nix/tests/sql}/$t.sql" || true
+              psql -p ${pgPort} -h ${pgsqlDefaultHost} --username=supabase_admin -d testing -f "${./nix/tests/sql}/$t.sql" || true
             done
             rm -rf "$SORTED_DIR"
             pg_ctl -D "$PGTAP_CLUSTER" stop
@@ -1317,16 +1320,11 @@
             # which is start by the start-postgres-server-bin script
             # start-postgres-server-bin script closely matches our AMI setup, configurations and migrations
 
-            # Ensure pgsodium key directory exists with proper permissions
-            if [[ "$(uname)" == "Darwin" ]]; then
-              mkdir -p /private/tmp/pgsodium
-              chmod 1777 /private/tmp/pgsodium
-            fi
             unset GRN_PLUGINS_DIR
             ${start-postgres-server-bin}/bin/start-postgres-server ${getVersionArg pgpkg} --daemonize
 
             for i in {1..60}; do
-                if pg_isready -h ${pgsqlDefaultHost} -p ${pgsqlDefaultPort} -U supabase_admin -q; then
+                if pg_isready -h ${pgsqlDefaultHost} -p ${pgPort} -U supabase_admin -q; then
                     echo "PostgreSQL is ready"
                     break
                 fi
@@ -1337,7 +1335,7 @@
                 fi
             done
 
-            if ! psql -p ${pgsqlDefaultPort} -h ${pgsqlDefaultHost} --no-password --username=supabase_admin -d postgres -v ON_ERROR_STOP=1 -Xaf ${./nix/tests/prime.sql}; then
+            if ! psql -p ${pgPort} -h ${pgsqlDefaultHost} --no-password --username=supabase_admin -d postgres -v ON_ERROR_STOP=1 -Xf ${./nix/tests/prime.sql}; then
               echo "Error executing SQL file"
               exit 1
             fi
@@ -1349,7 +1347,7 @@
               --inputdir=${./nix/tests} \
               --outputdir=$out/regression_output \
               --host=${pgsqlDefaultHost} \
-              --port=${pgsqlDefaultPort} \
+              --port=${pgPort} \
               --user=supabase_admin \
               ${builtins.concatStringsSep " " sortedTestList}; then
               echo "pg_regress tests failed"
@@ -1358,7 +1356,7 @@
             fi
 
             echo "Running migrations tests"
-            pg_prove -p ${pgsqlDefaultPort} -U supabase_admin -h ${pgsqlDefaultHost} -d postgres -v ${./migrations/tests}/test.sql
+            pg_prove -p ${pgPort} -U supabase_admin -h ${pgsqlDefaultHost} -d postgres -v ${./migrations/tests}/test.sql
 
             # Copy logs to output
             for logfile in $(find /tmp -name postgresql.log -type f); do
@@ -1382,6 +1380,9 @@
           psql_15 = makeCheckHarness basePackages.psql_15.bin;
           psql_17 = makeCheckHarness basePackages.psql_17.bin;
           psql_orioledb-17 = makeCheckHarness basePackages.psql_orioledb-17.bin;
+          inherit (basePackages) wal-g-2 wal-g-3;
+        } // pkgs.lib.optionalAttrs (system == "aarch64-linux") {
+          inherit (basePackages) postgresql_15_debug postgresql_15_src postgresql_orioledb-17_debug postgresql_orioledb-17_src postgresql_17_debug postgresql_17_src;
         };
 
         # Apps is a list of names of things that can be executed with 'nix run';

From 4b77682885802d019a669fe66f404d7628e571f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Wed, 18 Jun 2025 08:58:33 +0200
Subject: [PATCH 04/64] ci: fix nix cache configuration

---
 .github/workflows/nix-build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index e95d65a43..f641b7306 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -46,14 +46,14 @@ jobs:
       - name: Setup cache script
         if: ${{ github.secret_source == 'Actions' }}
         run: |
-          mkdir -p /etc/nix
+          sudo mkdir -p /etc/nix
           cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null
           #!/usr/bin/env bash
           set -eouf
           export IFS=' '
           echo /nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=nix-secret-key' \$OUT_PATHS
           EOF
-          chmod +x /etc/nix/upload-to-cache.sh
+          sudo chmod +x /etc/nix/upload-to-cache.sh
       - name: Install nix
         uses: DeterminateSystems/nix-installer-action@main
         if: ${{ github.secret_source == 'Actions' }}

From e9e60ba5ced9a5262e81083900ee8b9aaa975078 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Thu, 19 Jun 2025 12:17:06 +0200
Subject: [PATCH 05/64] ci: Use larger runner for other workflows and wait for
 the nix workflow to succeed (#1652)

* ci: use larger runner for the test and testinfra-ami-build workflows

* ci: wait for the nix workflow to succeed before running the test and testinfra-ami-build workflow

* ci: use larger runner for other workflows

* chore: be less verbose when building postgresql dev setup

* ci: build and cache more packages in the Nix CI workflow

* ci: run nix copy

* ci: do not run nix as root
---
 .github/workflows/ami-release-nix-single.yml  |  4 +--
 .github/workflows/ami-release-nix.yml         | 12 +++----
 .../workflows/dockerhub-release-matrix.yml    | 12 +++----
 .github/workflows/manual-docker-release.yml   | 12 +++----
 .github/workflows/nix-build.yml               | 16 ++++++---
 .github/workflows/publish-migrations-prod.yml |  2 +-
 .../workflows/publish-migrations-staging.yml  |  2 +-
 ...ublish-nix-pgupgrade-bin-flake-version.yml |  8 ++---
 .../publish-nix-pgupgrade-scripts.yml         |  6 ++--
 .github/workflows/qemu-image-build.yml        |  6 ++--
 .github/workflows/test.yml                    | 25 ++++++--------
 .github/workflows/testinfra-ami-build.yml     | 33 +++++--------------
 flake.nix                                     |  4 +--
 13 files changed, 62 insertions(+), 80 deletions(-)

diff --git a/.github/workflows/ami-release-nix-single.yml b/.github/workflows/ami-release-nix-single.yml
index 863135ef3..0534a98d0 100644
--- a/.github/workflows/ami-release-nix-single.yml
+++ b/.github/workflows/ami-release-nix-single.yml
@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: arm-runner
+    runs-on: large-linux-arm
     timeout-minutes: 150
 
     steps:
@@ -40,7 +40,7 @@ jobs:
 
       - name: Generate common-nix.vars.pkr.hcl
         run: |
-          PG_VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ env.POSTGRES_MAJOR_VERSION }}'"]' ansible/vars.yml)
+          PG_VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ env.POSTGRES_MAJOR_VERSION }}'"]' ansible/vars.yml)
           PG_VERSION=$(echo "$PG_VERSION" | tr -d '"')  # Remove any surrounding quotes
           echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
           # Ensure there's a newline at the end of the file
diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml
index ee78de99c..449903484 100644
--- a/.github/workflows/ami-release-nix.yml
+++ b/.github/workflows/ami-release-nix.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
@@ -38,11 +38,7 @@ jobs:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
         include:
-          - runner: arm-runner
-            arch: arm64
-            ubuntu_release: focal
-            ubuntu_version: 20.04
-            mcpu: neoverse-n1
+          - runner: large-linux-arm
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 150
 
@@ -55,7 +51,7 @@ jobs:
       - name: Run checks if triggered manually
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: |
-          SUFFIX=$(sudo nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
+          SUFFIX=$(nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
           if [[ -z "$SUFFIX" ]] ; then
             echo "Version must include non-numeric characters if built manually."
             exit 1
@@ -66,7 +62,7 @@ jobs:
 
       - name: Generate common-nix.vars.pkr.hcl
         run: |
-          PG_VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
+          PG_VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
           PG_VERSION=$(echo "$PG_VERSION" | tr -d '"')  # Remove any surrounding quotes
           echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
           # Ensure there's a newline at the end of the file
diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml
index 1ac5b2ccc..263b0112a 100644
--- a/.github/workflows/dockerhub-release-matrix.yml
+++ b/.github/workflows/dockerhub-release-matrix.yml
@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
     steps:
@@ -49,7 +49,7 @@ jobs:
     needs: prepare
     strategy:
       matrix: ${{ fromJson(needs.prepare.outputs.matrix_config) }}
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
@@ -75,7 +75,7 @@ jobs:
       matrix:
         postgres: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
         arch: [amd64, arm64]
-    runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest' || 'arm-runner' }}
+    runs-on: ${{ matrix.arch == 'amd64' && 'large-linux-x86' || 'large-linux-arm' }}
     timeout-minutes: 180
     steps:
       - name: Checkout Repo
@@ -93,7 +93,7 @@ jobs:
         id: image
         run: |
           if [[ "${{ matrix.arch }}" == "arm64" ]]; then
-            pg_version=$(sudo nix run nixpkgs#nushell -- -c '
+            pg_version=$(nix run nixpkgs#nushell -- -c '
               let version = "${{ matrix.postgres.version }}"
               let release_key = if ($version | str contains "orioledb") {
                 $"postgresorioledb-17"
@@ -132,7 +132,7 @@ jobs:
     strategy:
       matrix:
         include: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
@@ -176,7 +176,7 @@ jobs:
           ${{ steps.get_version.outputs.pg_version }}_arm64
   combine_results:
     needs: [prepare, merge_manifest]
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml
index e702014dc..3f86643ff 100644
--- a/.github/workflows/manual-docker-release.yml
+++ b/.github/workflows/manual-docker-release.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
     steps:
@@ -46,7 +46,7 @@ jobs:
     needs: prepare
     strategy:
       matrix: ${{ fromJson(needs.prepare.outputs.matrix_config) }}
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
@@ -72,7 +72,7 @@ jobs:
       matrix:
         postgres: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
         arch: [amd64, arm64]
-    runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest' || 'arm-runner' }}
+    runs-on: ${{ matrix.arch == 'amd64' && 'large-linux-x86' || 'large-linux-arm' }}
     timeout-minutes: 180
     steps:
       - name: Checkout Repo
@@ -90,7 +90,7 @@ jobs:
         id: image
         run: |
           if [[ "${{ matrix.arch }}" == "arm64" ]]; then
-            pg_version=$(sudo nix run nixpkgs#nushell -- -c '
+            pg_version=$(nix run nixpkgs#nushell -- -c '
               let version = "${{ matrix.postgres.version }}"
               let release_key = if ($version | str contains "orioledb") {
                 $"postgresorioledb-17"
@@ -141,7 +141,7 @@ jobs:
     strategy:
       matrix:
         include: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
@@ -185,7 +185,7 @@ jobs:
           ${{ steps.get_version.outputs.pg_version }}_arm64
   combine_results:
     needs: [prepare, merge_manifest]
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index f641b7306..82aab37f7 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -10,8 +10,8 @@ on:
 
 permissions:
   contents: read
-  id-token: write    
-    
+  id-token: write
+
 jobs:
   build-run-image:
     strategy:
@@ -37,21 +37,27 @@ jobs:
           aws-region: "us-east-1"
           output-credentials: true
           role-duration-seconds: 7200
+      - name: Setup AWS credentials for Nix
+        if: ${{ github.secret_source == 'Actions' }}
+        run: |
+          sudo -H aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
+          sudo -H aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
+          sudo -H aws configure set aws_session_token $AWS_SESSION_TOKEN
       - name: write secret key
         # use python so we don't interpolate the secret into the workflow logs, in case of bugs
         run: |
-          python -c "import os; file = open('nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
+          sudo mkdir -p /etc/nix
+          sudo -E python -c "import os; file = open('/etc/nix/nix-secret-key', 'w'); file.write(os.environ['NIX_SIGN_SECRET_KEY']); file.close()"
         env:
           NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}
       - name: Setup cache script
         if: ${{ github.secret_source == 'Actions' }}
         run: |
-          sudo mkdir -p /etc/nix
           cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null
           #!/usr/bin/env bash
           set -eouf
           export IFS=' '
-          echo /nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=nix-secret-key' \$OUT_PATHS
+          /nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS
           EOF
           sudo chmod +x /etc/nix/upload-to-cache.sh
       - name: Install nix
diff --git a/.github/workflows/publish-migrations-prod.yml b/.github/workflows/publish-migrations-prod.yml
index e3d7365cb..ffb633683 100644
--- a/.github/workflows/publish-migrations-prod.yml
+++ b/.github/workflows/publish-migrations-prod.yml
@@ -5,7 +5,7 @@ on:
 
 jobs:
   build:
-    runs-on: [self-hosted, linux]
+    runs-on: large-linux-arm
     timeout-minutes: 15
     permissions:
       id-token: write
diff --git a/.github/workflows/publish-migrations-staging.yml b/.github/workflows/publish-migrations-staging.yml
index 9cef8be4b..7acb46d22 100644
--- a/.github/workflows/publish-migrations-staging.yml
+++ b/.github/workflows/publish-migrations-staging.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   build:
-    runs-on: [self-hosted, linux]
+    runs-on: large-linux-arm
     timeout-minutes: 15
     permissions:
       id-token: write
diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
index 847e6d47c..f816415b3 100644
--- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
+++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
@@ -12,7 +12,7 @@ permissions:
     
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
@@ -29,7 +29,7 @@ jobs:
 
   publish-staging:
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     strategy:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
@@ -79,7 +79,7 @@ jobs:
           SLACK_FOOTER: ''
 
   publish-prod:
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     if: github.ref_name == 'develop' || contains( github.ref, 'release' )
     needs: prepare
     strategy:
@@ -93,7 +93,7 @@ jobs:
       - name: Grab release version
         id: process_release_version
         run: |
-          VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
+          VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
           VERSION=$(echo $VERSION | tr -d '"')  # Remove any surrounding quotes
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml
index 19e255fca..c58e90d83 100644
--- a/.github/workflows/publish-nix-pgupgrade-scripts.yml
+++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml
@@ -19,7 +19,7 @@ permissions:
     
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
@@ -36,7 +36,7 @@ jobs:
 
   publish-staging:
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     strategy:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
@@ -84,7 +84,7 @@ jobs:
           SLACK_FOOTER: ''
   publish-prod:
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     if: github.ref_name == 'develop' || contains( github.ref, 'release' )
 
     strategy:
diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index 8abee1461..35b7a583a 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
@@ -38,7 +38,7 @@ jobs:
     strategy:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
-    runs-on: arm-native-runner
+    runs-on: large-linux-arm
     timeout-minutes: 150
     permissions:
       contents: write
@@ -54,7 +54,7 @@ jobs:
       - name: Run checks if triggered manually
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: |
-          SUFFIX=$(sudo nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
+          SUFFIX=$(nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
           if [[ -z $SUFFIX ]] ; then
             echo "Version must include non-numeric characters if built manually."
             exit 1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ac285af26..b907c85d7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,9 +1,10 @@
 name: Test Database
 on:
-  push:
-    branches:
-      - develop
-  pull_request:
+  # Trigger this workflow when the "Nix CI" workflow completes
+  workflow_run:
+    workflows: ["Nix CI"]
+    types:
+      - completed
   workflow_dispatch:
 
 permissions:
@@ -12,17 +13,13 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
+    runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-
-      - name: Clear Nix cache
-        run: |
-          sudo rm -rf /home/runner/.cache/nix
-
       - uses: DeterminateSystems/nix-installer-action@main
         with:
           extra-conf: |
@@ -34,14 +31,15 @@ jobs:
           VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c "split(\"\n\")[:-1]")
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
   build:
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     needs: prepare
     strategy:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
         include:
-          - runner: ubuntu-22.04
+          - runner: large-linux-x86
             arch: amd64
-          - runner: ubuntu-22.04
+          - runner: large-linux-arm
             arch: arm64
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 180
@@ -51,9 +49,6 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      - name: Clear Nix cache
-        run: |
-          sudo rm -rf /home/runner/.cache/nix
       - uses: DeterminateSystems/nix-installer-action@main
         with:
           extra-conf: |
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index 752bc3938..2e1edda45 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -1,7 +1,11 @@
 name: Testinfra Integration Tests Nix
 
 on:
-  pull_request:
+  # Trigger this workflow when the "Nix CI" workflow completes
+  workflow_run:
+    workflows: ["Nix CI"]
+    types:
+      - completed
   workflow_dispatch:
 
 permissions:
@@ -10,20 +14,15 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: ubuntu-latest
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
+    runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-      
-      - uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Clean Nix store before build
-        run: |
-          sudo nix-collect-garbage -d || true
-          sudo nix-store --optimize || true
-          df -h /  # Display available space
+      - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Set PostgreSQL versions
         id: set-versions
@@ -32,6 +31,7 @@ jobs:
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   test-ami-nix:
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     needs: prepare
     strategy:
       fail-fast: false
@@ -71,7 +71,6 @@ jobs:
 
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV
-      
 
       - name: Generate common-nix.vars.pkr.hcl
         run: |
@@ -87,26 +86,12 @@ jobs:
           GIT_SHA=${{github.sha}}
           packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=" -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "ansible_arguments=-e postgresql_major=${POSTGRES_MAJOR_VERSION}" amazon-arm64-nix.pkr.hcl
 
-      - name: Clean up after AMI stage 1
-        if: always()  # Run even if previous steps fail
-        run: |
-          sudo nix-collect-garbage -d  # Delete old generations of all profiles
-          sudo rm -rf /tmp/*  # Clean temporary files
-          df -h /  # Display available space
-
       - name: Build AMI stage 2
         run: |
           packer init stage2-nix-psql.pkr.hcl
           GIT_SHA=${{github.sha}}
           packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl"  -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "git_sha=${GITHUB_SHA}"  stage2-nix-psql.pkr.hcl 
 
-      - name: Clean up after AMI stage 2
-        if: always()  # Run even if previous steps fail
-        run: |
-          sudo nix-collect-garbage -d  # Delete old generations of all profiles
-          sudo rm -rf /tmp/*  # Clean temporary files
-          df -h /  # Display available space
-
       - name: Run tests
         timeout-minutes: 10
         env:
diff --git a/flake.nix b/flake.nix
index a7f48d58c..335ccdf42 100644
--- a/flake.nix
+++ b/flake.nix
@@ -356,7 +356,6 @@
             {
               inherit (paths) migrationsDir postgresqlSchemaSql pgbouncerAuthSchemaSql statExtensionSql;
             } ''
-            set -x
             mkdir -p $out/bin $out/etc/postgresql-custom $out/etc/postgresql $out/extension-custom-scripts
 
             # Copy config files with error handling
@@ -1380,7 +1379,7 @@
           psql_15 = makeCheckHarness basePackages.psql_15.bin;
           psql_17 = makeCheckHarness basePackages.psql_17.bin;
           psql_orioledb-17 = makeCheckHarness basePackages.psql_orioledb-17.bin;
-          inherit (basePackages) wal-g-2 wal-g-3;
+          inherit (basePackages) wal-g-2 wal-g-3 dbmate-tool pg_regress;
         } // pkgs.lib.optionalAttrs (system == "aarch64-linux") {
           inherit (basePackages) postgresql_15_debug postgresql_15_src postgresql_orioledb-17_debug postgresql_orioledb-17_src postgresql_17_debug postgresql_17_src;
         };
@@ -1456,6 +1455,7 @@
                 dbmate
                 nushell
                 pythonEnv
+                nix-fast-build
               ];
               shellHook = ''
                 export HISTFILE=.history

From 4a073c2f272b816b64513c4ed879364a21544c87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Thu, 19 Jun 2025 16:08:18 +0200
Subject: [PATCH 06/64] ci: fix CI regressions (#1655)

* ci: revert change to qemu image build workflow

The workflow requires KVM on ARM. This is not available on the large
GitHub Actions runners. We revert the change to the workflow.

* ci: fix missing step to login to AWS after switching runner

Since the runner was switched to a Github-hosted runner, we need to
add a step to log in to AWS.
---
 .github/workflows/ami-release-nix-single.yml | 7 +++++++
 .github/workflows/ami-release-nix.yml        | 8 +++++++-
 .github/workflows/qemu-image-build.yml       | 6 +++---
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ami-release-nix-single.yml b/.github/workflows/ami-release-nix-single.yml
index 0534a98d0..d99939f1d 100644
--- a/.github/workflows/ami-release-nix-single.yml
+++ b/.github/workflows/ami-release-nix-single.yml
@@ -27,6 +27,13 @@ jobs:
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
         with:
           ref: ${{ github.event.inputs.branch }}
+      - name: aws-creds
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
+          aws-region: "us-east-1"
+          output-credentials: true
+          role-duration-seconds: 7200
 
       - name: Get current branch SHA
         id: get_sha
diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml
index 449903484..bf2df0c96 100644
--- a/.github/workflows/ami-release-nix.yml
+++ b/.github/workflows/ami-release-nix.yml
@@ -45,7 +45,13 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
-
+      - name: aws-creds
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
+          aws-region: "us-east-1"
+          output-credentials: true
+          role-duration-seconds: 7200
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Run checks if triggered manually
diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index 35b7a583a..8abee1461 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   prepare:
-    runs-on: large-linux-x86
+    runs-on: ubuntu-latest
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
@@ -38,7 +38,7 @@ jobs:
     strategy:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
-    runs-on: large-linux-arm
+    runs-on: arm-native-runner
     timeout-minutes: 150
     permissions:
       contents: write
@@ -54,7 +54,7 @@ jobs:
       - name: Run checks if triggered manually
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: |
-          SUFFIX=$(nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
+          SUFFIX=$(sudo nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
           if [[ -z $SUFFIX ]] ; then
             echo "Version must include non-numeric characters if built manually."
             exit 1

From 2b07c9c86dfed6e092ade291f035ee87dfeccc17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Thu, 19 Jun 2025 19:44:29 +0200
Subject: [PATCH 07/64] ci: fix workflow dependencies (#1659)

We want to run test.yaml and testinfra-ami-build.yaml after
nix-build.yaml. We start using reusable workflow instead of relying on
workflow_run which doesn't work well with pull requests.
---
 .github/workflows/nix-build.yml           | 14 +++++++++++++-
 .github/workflows/test.yml                |  8 +-------
 .github/workflows/testinfra-ami-build.yml |  8 +-------
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 82aab37f7..d562ab6ca 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -9,8 +9,10 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
   id-token: write
+  # required by testinfra-ami-build dependent workflows
+  contents: write
+  packages: write
 
 jobs:
   build-run-image:
@@ -84,3 +86,13 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
           AWS_SESSION_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
+  
+  run-testinfra:
+    needs: build-run-image
+    if: ${{ success() }}
+    uses: ./.github/workflows/testinfra-ami-build.yml
+    
+  run-tests:
+    needs: build-run-image
+    if: ${{ success() }}
+    uses: ./.github/workflows/test.yml
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b907c85d7..6be368784 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,11 +1,7 @@
 name: Test Database
 on:
-  # Trigger this workflow when the "Nix CI" workflow completes
-  workflow_run:
-    workflows: ["Nix CI"]
-    types:
-      - completed
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
@@ -13,7 +9,6 @@ permissions:
 
 jobs:
   prepare:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
@@ -31,7 +26,6 @@ jobs:
           VERSIONS=$(nix run nixpkgs#yq -- '.postgres_major[]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c "split(\"\n\")[:-1]")
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
   build:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     needs: prepare
     strategy:
       matrix:
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index 2e1edda45..8544f1b85 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -1,12 +1,8 @@
 name: Testinfra Integration Tests Nix
 
 on:
-  # Trigger this workflow when the "Nix CI" workflow completes
-  workflow_run:
-    workflows: ["Nix CI"]
-    types:
-      - completed
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
@@ -14,7 +10,6 @@ permissions:
 
 jobs:
   prepare:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: large-linux-x86
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
@@ -31,7 +26,6 @@ jobs:
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   test-ami-nix:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     needs: prepare
     strategy:
       fail-fast: false

From 7d78f1453b3b729a0addb5ddf2d5dd3ff05a3904 Mon Sep 17 00:00:00 2001
From: Yvan Sraka <yvan@sraka.xyz>
Date: Fri, 20 Jun 2025 17:52:02 +0200
Subject: [PATCH 08/64] chore: fix and add a check for the nix devshell (#1656)

* chore: fix nix devshell (`nix develop`)

* chore: add a `nix flake check` for the devShell
---
 flake.lock | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++---
 flake.nix  |  5 ++-
 2 files changed, 88 insertions(+), 6 deletions(-)

diff --git a/flake.lock b/flake.lock
index d593fa3dc..bea404a1f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,26 @@
 {
   "nodes": {
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nix-fast-build",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -55,10 +76,30 @@
         "type": "github"
       }
     },
+    "nix-fast-build": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": "nixpkgs_2",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1749427739,
+        "narHash": "sha256-Nm0oMqFNRnJsiZYeNChmefmjeVCOzngikpSQhgs7iXI=",
+        "owner": "Mic92",
+        "repo": "nix-fast-build",
+        "rev": "b1dae483ab7d4139a6297e02b6de9e5d30e43d48",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "nix-fast-build",
+        "type": "github"
+      }
+    },
     "nix2container": {
       "inputs": {
         "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
         "lastModified": 1708764364,
@@ -91,6 +132,22 @@
       }
     },
     "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1749411262,
+        "narHash": "sha256-gRBkeW9l5lb/90lv1waQFNT+18OhITs11HENarh6vNo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0fc422d6c394191338c9d6a05786c63fc52a0f29",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
       "locked": {
         "lastModified": 1697269602,
         "narHash": "sha256-dSzV7Ud+JH4DPVD9od53EgDrxUVQOcSj4KGjggCDVJI=",
@@ -105,7 +162,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1712666087,
         "narHash": "sha256-WwjUkWsjlU8iUImbivlYxNyMB1L5YVqE8QotQdL9jWc=",
@@ -121,7 +178,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1744536153,
         "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@@ -141,14 +198,15 @@
       "inputs": {
         "flake-utils": "flake-utils",
         "nix-editor": "nix-editor",
+        "nix-fast-build": "nix-fast-build",
         "nix2container": "nix2container",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "rust-overlay": "rust-overlay"
       }
     },
     "rust-overlay": {
       "inputs": {
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
         "lastModified": 1746758179,
@@ -194,6 +252,27 @@
         "type": "github"
       }
     },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-fast-build",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1749194973,
+        "narHash": "sha256-eEy8cuS0mZ2j/r/FE0/LYBSBcIs/MKOIVakwHVuqTfk=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "a05be418a1af1198ca0f63facb13c985db4cb3c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "utils": {
       "locked": {
         "lastModified": 1667395993,
diff --git a/flake.nix b/flake.nix
index 335ccdf42..18cd9ba13 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,9 +7,10 @@
     nix2container.url = "github:nlewo/nix2container";
     nix-editor.url = "github:snowfallorg/nix-editor";
     rust-overlay.url = "github:oxalica/rust-overlay";
+    nix-fast-build.url = "github:Mic92/nix-fast-build";
   };
 
-  outputs = { self, nixpkgs, flake-utils, nix-editor, rust-overlay, nix2container, ... }:
+  outputs = { self, nixpkgs, flake-utils, nix-editor, rust-overlay, nix2container, ... }@inputs:
     let
       gitRev = "vcs=${self.shortRev or "dirty"}+${builtins.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}";
 
@@ -1380,6 +1381,7 @@
           psql_17 = makeCheckHarness basePackages.psql_17.bin;
           psql_orioledb-17 = makeCheckHarness basePackages.psql_orioledb-17.bin;
           inherit (basePackages) wal-g-2 wal-g-3 dbmate-tool pg_regress;
+          devShell = devShells.default;
         } // pkgs.lib.optionalAttrs (system == "aarch64-linux") {
           inherit (basePackages) postgresql_15_debug postgresql_15_src postgresql_orioledb-17_debug postgresql_orioledb-17_src postgresql_17_debug postgresql_17_src;
         };
@@ -1429,6 +1431,7 @@
                 export HISTFILE=.history
               '';
             };
+            nix-fast-build = inputs.nix-fast-build.packages.${system}.default;
           in
           {
             default = pkgs.mkShell {

From 51ddf76b2cfc72ed302e2fa99b79ae3a9c8c59f9 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Mon, 23 Jun 2025 17:22:16 -0400
Subject: [PATCH 09/64] fix: pin version of libpq to 17.x (#1649)

* fix: pin version of libpq to the major version installed

* fix: the variable is postgresql_major_version

* fix: using the correct var

* fix: default to postgres 15 major version

* fix: default to 15

* fix: supposedly main contains all releases for libpq5

* fix: syntax

* fix: different syntax

* fix: rely on ppa

* fix: ppa removal

* fix: change to trigger workflow

* fix: adding a test to see postgres version

* fix: testing for failure related to libpq5 version issue

* test: include read-only test for postgrest

* test: reduce log access time

* test: make sure to fail if version wrong

* chore: bump vars
---
 ansible/tasks/setup-postgrest.yml |  29 ++--
 ansible/vars.yml                  |   6 +-
 testinfra/test_ami_nix.py         | 230 ++++++++++++++++++++++++++++++
 3 files changed, 250 insertions(+), 15 deletions(-)

diff --git a/ansible/tasks/setup-postgrest.yml b/ansible/tasks/setup-postgrest.yml
index a98d1990f..b6e0f951c 100644
--- a/ansible/tasks/setup-postgrest.yml
+++ b/ansible/tasks/setup-postgrest.yml
@@ -6,22 +6,28 @@
     url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
     state: present
 
-- name: PostgREST - add Postgres PPA
+- name: PostgREST - add Postgres PPA main
   apt_repository:
-    repo: "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg {{ postgresql_major }}"
+    repo: "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg main"
     state: present
+    filename: postgresql-pgdg
 
-- name: PostgREST - update apt cache
+- name: PostgREST - install system dependencies
   apt:
-    update_cache: yes
-
-# libpq is a C library that enables user programs to communicate with
-# the PostgreSQL database server.
-- name: PostgREST - system dependencies
-  apt:
-    pkg:
+    package:
       - libpq5
       - libnuma-dev
+    update_cache: yes
+    state: present
+
+- name: PostgREST - verify libpq5 version
+  shell: dpkg -l libpq5 | grep '^ii' | awk '{print $3}'
+  register: libpq5_version
+  changed_when: false
+
+- name: Show installed libpq5 version
+  debug:
+    msg: "Installed libpq5 version: {{ libpq5_version.stdout }}"
 
 - name: PostgREST - remove Postgres PPA gpg key
   apt_key:
@@ -30,7 +36,7 @@
 
 - name: PostgREST - remove Postgres PPA
   apt_repository:
-    repo: "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg {{ postgresql_major }}"
+    repo: "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg main"
     state: absent
 
 - name: postgis - ensure dependencies do not get autoremoved
@@ -88,7 +94,6 @@
       #! /usr/bin/env bash
       set -euo pipefail
       set -x
-
       cd "$(dirname "$0")"
       cat $@ > merged.conf
     dest: /etc/postgrest/merge.sh
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 2838d6f92..f23aaf2ab 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.093-orioledb"
-  postgres17: "17.4.1.043"
-  postgres15: "15.8.1.100"
+  postgresorioledb-17: "17.0.1.094-orioledb"
+  postgres17: "17.4.1.044"
+  postgres15: "15.8.1.101"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/testinfra/test_ami_nix.py b/testinfra/test_ami_nix.py
index 1975818d6..864ab2861 100644
--- a/testinfra/test_ami_nix.py
+++ b/testinfra/test_ami_nix.py
@@ -507,3 +507,233 @@ def test_postgrest_ending_empty_key_query_parameter_is_removed(host):
         },
     )
     assert res.ok
+
+
+def test_postgresql_version(host):
+    """Print the PostgreSQL version being tested and ensure it's >= 14."""
+    result = run_ssh_command(host['ssh'], "sudo -u postgres psql -c 'SELECT version();'")
+    if result['succeeded']:
+        print(f"\nPostgreSQL Version:\n{result['stdout']}")
+        # Extract version number from the output
+        version_line = result['stdout'].strip().split('\n')[2]  # Skip header and get the actual version
+        # Extract major version number (e.g., "15.8" -> 15)
+        import re
+        version_match = re.search(r'PostgreSQL (\d+)\.', version_line)
+        if version_match:
+            major_version = int(version_match.group(1))
+            print(f"PostgreSQL major version: {major_version}")
+            assert major_version >= 14, f"PostgreSQL version {major_version} is less than 14"
+        else:
+            assert False, "Could not parse PostgreSQL version number"
+    else:
+        print(f"\nFailed to get PostgreSQL version: {result['stderr']}")
+        assert False, "Failed to get PostgreSQL version"
+    
+    # Also get the version from the command line
+    result = run_ssh_command(host['ssh'], "sudo -u postgres psql --version")
+    if result['succeeded']:
+        print(f"PostgreSQL Client Version: {result['stdout'].strip()}")
+    else:
+        print(f"Failed to get PostgreSQL client version: {result['stderr']}")
+    
+    print("✓ PostgreSQL version is >= 14")
+
+
+def test_libpq5_version(host):
+    """Print the libpq5 version installed and ensure it's >= 14."""
+    # Try different package managers to find libpq5
+    result = run_ssh_command(host['ssh'], "dpkg -l | grep libpq5 || true")
+    if result['succeeded'] and result['stdout'].strip():
+        print(f"\nlibpq5 package info:\n{result['stdout']}")
+        # Extract version from dpkg output (format: ii libpq5:arm64 17.5-1.pgdg20.04+1)
+        import re
+        version_match = re.search(r'libpq5[^ ]* +(\d+)\.', result['stdout'])
+        if version_match:
+            major_version = int(version_match.group(1))
+            print(f"libpq5 major version: {major_version}")
+            assert major_version >= 14, f"libpq5 version {major_version} is less than 14"
+        else:
+            print("Could not parse libpq5 version from dpkg output")
+    else:
+        print("\nlibpq5 not found via dpkg")
+    
+    # Also try to find libpq.so files
+    result = run_ssh_command(host['ssh'], "find /usr -name '*libpq*' -type f 2>/dev/null | head -10")
+    if result['succeeded'] and result['stdout'].strip():
+        print(f"\nlibpq files found:\n{result['stdout']}")
+    else:
+        print("\nNo libpq files found")
+    
+    # Check if we can get version from a libpq file
+    result = run_ssh_command(host['ssh'], "ldd /usr/bin/psql | grep libpq || true")
+    if result['succeeded'] and result['stdout'].strip():
+        print(f"\npsql libpq dependency:\n{result['stdout']}")
+    else:
+        print("\nCould not find libpq dependency for psql")
+    
+    # Try to get version from libpq directly
+    result = run_ssh_command(host['ssh'], "psql --version 2>&1 | head -1")
+    if result['succeeded'] and result['stdout'].strip():
+        print(f"\npsql version output: {result['stdout'].strip()}")
+        # The psql version should match the libpq version
+        import re
+        version_match = re.search(r'psql \(PostgreSQL\) (\d+)\.', result['stdout'])
+        if version_match:
+            major_version = int(version_match.group(1))
+            print(f"psql/libpq major version: {major_version}")
+            assert major_version >= 14, f"psql/libpq version {major_version} is less than 14"
+        else:
+            print("Could not parse psql version")
+    
+    print("✓ libpq5 version is >= 14")
+
+
+def test_postgrest_read_only_session_attrs(host):
+    """Test PostgREST with target_session_attrs=read-only and check for session errors."""
+    # First, check if PostgreSQL is configured for read-only mode
+    result = run_ssh_command(host['ssh'], "sudo -u postgres psql -c \"SHOW default_transaction_read_only;\"")
+    if result['succeeded']:
+        default_read_only = result['stdout'].strip()
+        print(f"PostgreSQL default_transaction_read_only: {default_read_only}")
+    else:
+        print("Could not check PostgreSQL read-only setting")
+        default_read_only = "unknown"
+    
+    # Check if PostgreSQL is in recovery mode (standby)
+    result = run_ssh_command(host['ssh'], "sudo -u postgres psql -c \"SELECT pg_is_in_recovery();\"")
+    if result['succeeded']:
+        in_recovery = result['stdout'].strip()
+        print(f"PostgreSQL pg_is_in_recovery: {in_recovery}")
+    else:
+        print("Could not check PostgreSQL recovery status")
+        in_recovery = "unknown"
+    
+    # Find PostgreSQL configuration file
+    result = run_ssh_command(host['ssh'], "sudo -u postgres psql -c \"SHOW config_file;\"")
+    if result['succeeded']:
+        config_file = result['stdout'].strip().split('\n')[2].strip()  # Skip header and get the actual path
+        print(f"PostgreSQL config file: {config_file}")
+    else:
+        print("Could not find PostgreSQL config file")
+        config_file = "/etc/postgresql/15/main/postgresql.conf"  # Default fallback
+    
+    # Backup PostgreSQL config
+    result = run_ssh_command(host['ssh'], f"sudo cp {config_file} {config_file}.backup")
+    assert result['succeeded'], "Failed to backup PostgreSQL config"
+    
+    # Add read-only setting to PostgreSQL config
+    result = run_ssh_command(host['ssh'], f"echo 'default_transaction_read_only = on' | sudo tee -a {config_file}")
+    assert result['succeeded'], "Failed to add read-only setting to PostgreSQL config"
+    
+    # Restart PostgreSQL to apply the new configuration
+    result = run_ssh_command(host['ssh'], "sudo systemctl restart postgresql")
+    assert result['succeeded'], "Failed to restart PostgreSQL"
+    
+    # Wait for PostgreSQL to start up
+    sleep(5)
+    
+    # Verify the change took effect
+    result = run_ssh_command(host['ssh'], "sudo -u postgres psql -c \"SHOW default_transaction_read_only;\"")
+    if result['succeeded']:
+        new_default_read_only = result['stdout'].strip()
+        print(f"PostgreSQL default_transaction_read_only after change: {new_default_read_only}")
+    else:
+        print("Could not verify PostgreSQL read-only setting change")
+    
+    # First, backup the current PostgREST config
+    result = run_ssh_command(host['ssh'], "sudo cp /etc/postgrest/base.conf /etc/postgrest/base.conf.backup")
+    assert result['succeeded'], "Failed to backup PostgREST config"
+    
+    try:
+        # Read the current config to get the db-uri
+        result = run_ssh_command(host['ssh'], "sudo cat /etc/postgrest/base.conf | grep '^db-uri'")
+        assert result['succeeded'], "Failed to read current db-uri"
+        
+        current_db_uri = result['stdout'].strip()
+        print(f"Current db-uri: {current_db_uri}")
+        
+        # Extract just the URI part (remove the db-uri = " prefix and trailing quote)
+        uri_start = current_db_uri.find('"') + 1
+        uri_end = current_db_uri.rfind('"')
+        base_uri = current_db_uri[uri_start:uri_end]
+        
+        # Modify the URI to add target_session_attrs=read-only
+        if '?' in base_uri:
+            # URI already has parameters, add target_session_attrs
+            modified_uri = base_uri + "&target_session_attrs=read-only"
+        else:
+            # URI has no parameters, add target_session_attrs
+            modified_uri = base_uri + "?target_session_attrs=read-only"
+        
+        print(f"Modified URI: {modified_uri}")
+        
+        # Use awk to replace the db-uri line more reliably
+        result = run_ssh_command(host['ssh'], f"sudo awk '{{if ($1 == \"db-uri\") print \"db-uri = \\\"{modified_uri}\\\"\"; else print $0}}' /etc/postgrest/base.conf > /tmp/new_base.conf && sudo mv /tmp/new_base.conf /etc/postgrest/base.conf")
+        assert result['succeeded'], "Failed to update db-uri in config"
+        
+        # Verify the change was made correctly
+        result = run_ssh_command(host['ssh'], "sudo cat /etc/postgrest/base.conf | grep '^db-uri'")
+        print(f"Updated db-uri line: {result['stdout'].strip()}")
+        
+        # Also show the full config to debug
+        result = run_ssh_command(host['ssh'], "sudo cat /etc/postgrest/base.conf")
+        print(f"Full config after change:\n{result['stdout']}")
+        
+        # Restart PostgREST to apply the new configuration
+        result = run_ssh_command(host['ssh'], "sudo systemctl restart postgrest")
+        assert result['succeeded'], "Failed to restart PostgREST"
+        
+        # Wait a moment for PostgREST to start up
+        sleep(5)
+        
+        # Check if PostgREST is running
+        result = run_ssh_command(host['ssh'], "sudo systemctl is-active postgrest")
+        if not (result['succeeded'] and result['stdout'].strip() == 'active'):
+            # If PostgREST failed to start, check the logs to see why
+            log_result = run_ssh_command(host['ssh'], "sudo journalctl -u postgrest --since '5 seconds ago' --no-pager")
+            print(f"PostgREST failed to start. Recent logs:\n{log_result['stdout']}")
+            assert False, "PostgREST failed to start after config change"
+        
+        # Make a test request to trigger any potential session errors
+        try:
+            response = requests.get(
+                f"http://{host['ip']}/rest/v1/",
+                headers={"apikey": anon_key, "authorization": f"Bearer {anon_key}"},
+                timeout=10
+            )
+            print(f"Test request status: {response.status_code}")
+        except Exception as e:
+            print(f"Test request failed: {str(e)}")
+        
+        # Check PostgREST logs for "session is not read-only" errors
+        result = run_ssh_command(host['ssh'], "sudo journalctl -u postgrest --since '5 seconds ago' | grep -i 'session is not read-only' || true")
+        
+        if result['stdout'].strip():
+            print(f"\nFound 'session is not read-only' errors in PostgREST logs:\n{result['stdout']}")
+            assert False, "PostgREST logs contain 'session is not read-only' errors even though PostgreSQL is configured for read-only mode"
+        else:
+            print("\nNo 'session is not read-only' errors found in PostgREST logs")
+            
+    finally:
+        # Restore the original configuration
+        result = run_ssh_command(host['ssh'], "sudo cp /etc/postgrest/base.conf.backup /etc/postgrest/base.conf")
+        if result['succeeded']:
+            result = run_ssh_command(host['ssh'], "sudo systemctl restart postgrest")
+            if result['succeeded']:
+                print("Restored original PostgREST configuration")
+            else:
+                print("Warning: Failed to restart PostgREST after restoring config")
+        else:
+            print("Warning: Failed to restore original PostgREST configuration")
+        
+        # Restore PostgreSQL to original configuration
+        result = run_ssh_command(host['ssh'], f"sudo cp {config_file}.backup {config_file}")
+        if result['succeeded']:
+            result = run_ssh_command(host['ssh'], "sudo systemctl restart postgresql")
+            if result['succeeded']:
+                print("Restored PostgreSQL to original configuration")
+            else:
+                print("Warning: Failed to restart PostgreSQL after restoring config")
+        else:
+            print("Warning: Failed to restore PostgreSQL configuration")
+

From f5a13429d4a299c81ac26855ebbf00ae51475552 Mon Sep 17 00:00:00 2001
From: Div Arora <root@darora.com>
Date: Tue, 24 Jun 2025 11:30:49 +0800
Subject: [PATCH 10/64] ci: no longer build Oriole QEMU artifact

Said artifact is no longer being used. If needed in the future, it can
be trivially reintroduced, but in the meantime there's no reason to
expend resources on them.
---
 .github/workflows/qemu-image-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index 8abee1461..97bc92a1c 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -30,7 +30,7 @@ jobs:
       - name: Set PostgreSQL versions - only builds pg17 atm
         id: set-versions
         run: |
-          VERSIONS=$(nix run nixpkgs#yq --  '.postgres_major[1,2]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
+          VERSIONS=$(nix run nixpkgs#yq --  '.postgres_major[1]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   build:

From 4f454709dc4f93046d6baaee12591246036260a8 Mon Sep 17 00:00:00 2001
From: Div Arora <root@darora.com>
Date: Tue, 24 Jun 2025 11:18:59 +0800
Subject: [PATCH 11/64] chore: disable auth config reloading within qemu
 artifact

The QEMU artifact is not running with a filesystem that supports the
inotify API, resulting in spurious error messages, and broken config
reloading.
---
 ansible/files/gotrue.service.j2 | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ansible/files/gotrue.service.j2 b/ansible/files/gotrue.service.j2
index 272e5b871..2478e99e6 100644
--- a/ansible/files/gotrue.service.j2
+++ b/ansible/files/gotrue.service.j2
@@ -4,7 +4,12 @@ Description=Gotrue
 [Service]
 Type=simple
 WorkingDirectory=/opt/gotrue
+{% if qemu_mode is defined and qemu_mode %}
+ExecStart=/opt/gotrue/gotrue
+{% else %}
 ExecStart=/opt/gotrue/gotrue --config-dir /etc/auth.d
+{% endif %}
+
 User=gotrue
 Restart=always
 RestartSec=3

From f5ba2a5c02d97b7ed679f11c6d9be6eda072ada4 Mon Sep 17 00:00:00 2001
From: Div Arora <root@darora.com>
Date: Sun, 4 May 2025 11:25:49 +0800
Subject: [PATCH 12/64] chore: strip out unnecessary dependencies from QEMU
 builds

Also upgrades to Alpine 3.22.
---
 .github/workflows/qemu-image-build.yml     |  1 +
 Dockerfile-kubernetes                      | 11 +++++++----
 ansible/vars.yml                           |  6 +++---
 ebssurrogate/scripts/qemu-bootstrap-nix.sh |  2 +-
 scripts/90-cleanup-qemu.sh                 |  5 ++++-
 5 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index 97bc92a1c..ffd12683c 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -10,6 +10,7 @@ on:
       - 'qemu-arm64-nix.pkr.hcl'
       - 'common-nix.vars.pkr.hcl'
       - 'ansible/vars.yml'
+      - 'scripts/*'
   workflow_dispatch:
 
 permissions:
diff --git a/Dockerfile-kubernetes b/Dockerfile-kubernetes
index a1a39e498..2a5e1ca1e 100644
--- a/Dockerfile-kubernetes
+++ b/Dockerfile-kubernetes
@@ -1,9 +1,12 @@
-FROM alpine:3.21
+FROM alpine:3.22
 
 ADD ./output-cloudimg/packer-cloudimg /disk/focal.qcow2
 
-RUN apk add --no-cache qemu-system-aarch64 qemu-img openssh-client nftables cloud-utils-localds aavmf virtiofsd
-# dev stuff
-# RUN apk add --no-cache iproute2
+RUN apk add --no-cache qemu-system-aarch64 qemu-img openssh-client aavmf virtiofsd \
+    && truncate -s 64M /root/varstore.img \
+    && truncate -s 64M /root/efi.img \
+    && dd if=/usr/share/AAVMF/QEMU_EFI.fd of=/root/efi.img conv=notrunc \
+    && qemu-img create -f qcow2 /tmp/disk.qcow2 -b /disk/focal.qcow2 -F qcow2 \
+    && apk del --no-cache aavmf qemu-img
 
 CMD exec /bin/sh -c "trap : TERM INT; sleep 9999999999d & wait"
diff --git a/ansible/vars.yml b/ansible/vars.yml
index f23aaf2ab..2d6465832 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.094-orioledb"
-  postgres17: "17.4.1.044"
-  postgres15: "15.8.1.101"
+  postgresorioledb-17: "17.0.1.095-orioledb"
+  postgres17: "17.4.1.45"
+  postgres15: "15.8.1.102"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh
index ad5c2744c..b52b85789 100755
--- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh
@@ -155,6 +155,6 @@ execute_stage2_playbook
 # we do not want to ship an initialized DB as this is performed as needed
 mkdir -p /db/template
 mv /data/pgdata /db/template
+cloud-init clean --logs
 clean_legacy_things
 clean_system
-cloud-init clean --logs
diff --git a/scripts/90-cleanup-qemu.sh b/scripts/90-cleanup-qemu.sh
index d6c6ade05..50d8d956f 100644
--- a/scripts/90-cleanup-qemu.sh
+++ b/scripts/90-cleanup-qemu.sh
@@ -43,7 +43,10 @@ elif [ -n "$(command -v apt-get)" ]; then
   add-apt-repository --yes --remove ppa:ansible/ansible
 
   source /etc/os-release
-  apt-get -y remove --purge linux-headers-5.11.0-1021-aws
+
+  apt-mark manual libevent-2.1-7 # required for pgbouncer
+  apt-get -y remove --purge ansible-core apport appstream bash-completion bcache-tools bind9-dnsutils bind9-host bind9-libs bolt btrfs-progs byobu command-not-found console-setup distro-info eject fonts-ubuntu-console friendly-recovery ftp fwupd gawk gdisk keyboard-configuration libvolume-key1 libicu66 libssl-dev lvm2 lxd-agent-loader man-db mdadm modemmanager mtd-utils nano netcat-openbsd nfs-common ntfs-3g parted pastebinit screen strace thin-provisioning-tools tmux usb-modeswitch vim vim-runtime wget whiptail xfsprogs
+  apt remove -y --purge libc6-dev linux-libc-dev libevent-dev libpcre3-dev libsystemd-dev
 
   apt-get -y update
   apt-get -y upgrade

From e321760fb40e1af3266a64768432a1d5c695aa26 Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Wed, 25 Jun 2025 08:33:19 +0100
Subject: [PATCH 13/64] feat: Install gandalf, salt-wrapper for infra (#1657)

* feat: Install gandalf, salt-wrapper for infra

* chore: version bumps

* bumping oriole build also

* fix: create the Gandalf group

* fix: implicitly create the gandalf group

* fix: correct gandalf archive path

* fix: unpack gandalf build correctly

* fix: reorganise order for gandalf installs

* fix: point to the correct path

* chore: bump vars due to conflicts

* fix: pin version of libpq to 17.x (#1649)

* fix: pin version of libpq to the major version installed

* fix: the variable is postgresql_major_version

* fix: using the correct var

* fix: default to postgres 15 major version

* fix: default to 15

* fix: supposedly main contains all releases for libpq5

* fix: syntax

* fix: different syntax

* fix: rely on ppa

* fix: ppa removal

* fix: change to trigger workflow

* fix: adding a test to see postgres version

* fix: testing for failure related to libpq5 version issue

* test: include read-only test for postgrest

* test: reduce log access time

* test: make sure to fail if version wrong

* chore: bump vars

* ci: no longer build Oriole QEMU artifact

Said artifact is no longer being used. If needed in the future, it can
be trivially reintroduced, but in the meantime there's no reason to
expend resources on them.

* chore: disable auth config reloading within qemu artifact

The QEMU artifact is not running with a filesystem that supports the
inotify API, resulting in spurious error messages, and broken config
reloading.

* chore: strip out unnecessary dependencies from QEMU builds

Also upgrades to Alpine 3.22.

* chore: version bumps

* tests: update user and group test adding gandalf

* chore: add gandalf user to user list

---------

Co-authored-by: Crispy1975 <12525875+Crispy1975@users.noreply.github.com>
Co-authored-by: samrose <samuel@supabase.io>
Co-authored-by: Div Arora <root@darora.com>
---
 .../files/gandalf_config/gandalf.sudoers.conf |  2 +
 .../files/gandalf_config/gandalf_salt.service | 19 ++++
 .../files/gandalf_config/gandalf_salt.timer   | 13 +++
 ansible/files/permission_check.py             | 10 +++
 ansible/manifest-playbook.yml                 | 18 ++++
 ansible/tasks/internal/gandalf.yml            | 87 +++++++++++++++++++
 ansible/tasks/setup-supabase-internal.yml     |  5 ++
 ansible/vars.yml                              |  8 +-
 8 files changed, 159 insertions(+), 3 deletions(-)
 create mode 100644 ansible/files/gandalf_config/gandalf.sudoers.conf
 create mode 100644 ansible/files/gandalf_config/gandalf_salt.service
 create mode 100644 ansible/files/gandalf_config/gandalf_salt.timer
 create mode 100644 ansible/tasks/internal/gandalf.yml

diff --git a/ansible/files/gandalf_config/gandalf.sudoers.conf b/ansible/files/gandalf_config/gandalf.sudoers.conf
new file mode 100644
index 000000000..bf2517490
--- /dev/null
+++ b/ansible/files/gandalf_config/gandalf.sudoers.conf
@@ -0,0 +1,2 @@
+%gandalf ALL= NOPASSWD: /usr/bin/salt-call
+%gandalf ALL= NOPASSWD: /usr/bin/gpg --homedir /etc/salt/gpgkeys --import, /usr/bin/gpg --homedir /etc/salt/gpgkeys --list-secret-keys *
diff --git a/ansible/files/gandalf_config/gandalf_salt.service b/ansible/files/gandalf_config/gandalf_salt.service
new file mode 100644
index 000000000..c70db7ed8
--- /dev/null
+++ b/ansible/files/gandalf_config/gandalf_salt.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Configuration management via gandalf salt
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/opt/gandalf/gandalf --config /opt/gandalf/config.yaml salt --apply --store-result
+User=gandalf
+Group=gandalf
+StandardOutput=journal
+StandardError=journal
+StateDirectory=gandalf
+CacheDirectory=gandalf
+
+# Security hardening
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/ansible/files/gandalf_config/gandalf_salt.timer b/ansible/files/gandalf_config/gandalf_salt.timer
new file mode 100644
index 000000000..6862ca402
--- /dev/null
+++ b/ansible/files/gandalf_config/gandalf_salt.timer
@@ -0,0 +1,13 @@
+[Unit]
+Description=Run Supabase gandalf salt on a schedule
+Requires=gandalf_salt.service
+
+[Timer]
+OnCalendar=*:0/10
+# Random delay up to 30 seconds splay
+RandomizedDelaySec=30
+AccuracySec=1s
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/ansible/files/permission_check.py b/ansible/files/permission_check.py
index a753f69ec..b34a56bb4 100644
--- a/ansible/files/permission_check.py
+++ b/ansible/files/permission_check.py
@@ -94,11 +94,17 @@
     "systemd-coredump": [
         {"groupname": "systemd-coredump", "username": "systemd-coredump"}
     ],
+    "gandalf": [
+        {"groupname": "gandalf", "username": "gandalf"},
+        {"groupname": "admin", "username": "gandalf"},
+        {"groupname": "salt", "username": "gandalf"},
+    ],
 }
 
 # postgresql.service is expected to mount /etc as read-only
 expected_mount = "/etc ro"
 
+
 # This program depends on osquery being installed on the system
 # Function to run osquery
 def run_osquery(query):
@@ -154,6 +160,7 @@ def check_nixbld_users():
 
     print("All nixbld users are in the 'nixbld' group.")
 
+
 def check_postgresql_mount():
     # processes table has the nix .postgres-wrapped path as the
     # binary path, rather than /usr/lib/postgresql/bin/postgres which
@@ -182,6 +189,7 @@ def check_postgresql_mount():
 
     print("postgresql.service mounts /etc as read-only.")
 
+
 def main():
     parser = argparse.ArgumentParser(
         prog="Supabase Postgres Artifact Permissions Checker",
@@ -234,6 +242,7 @@ def main():
         "postgrest",
         "tcpdump",
         "systemd-coredump",
+        "gandalf",
     ]
     if not qemu_artifact:
         usernames.append("ec2-instance-connect")
@@ -251,5 +260,6 @@ def main():
     # Check if postgresql.service is using a read-only mount for /etc
     check_postgresql_mount()
 
+
 if __name__ == "__main__":
     main()
diff --git a/ansible/manifest-playbook.yml b/ansible/manifest-playbook.yml
index 5c1c65053..583e3596c 100644
--- a/ansible/manifest-playbook.yml
+++ b/ansible/manifest-playbook.yml
@@ -61,6 +61,22 @@
       shell: |
         cd /tmp && tar -cJf admin-mgr-{{ adminmgr_release }}-arm64.tar.xz admin-mgr
 
+    - name: Download gandalf archive
+      get_url:
+        url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf_{{ gandalf_release }}_linux_arm64.tar.gz"
+        dest: "/tmp/gandalf.tar.gz"
+        timeout: 90
+
+    - name: gandalf - unpack archive in /tmp
+      unarchive:
+        remote_src: yes
+        src: /tmp/gandalf.tar.gz
+        dest: /tmp
+
+    - name: gandalf - pack archive
+      shell: |
+        cd /tmp && tar -cJf gandalf-{{ gandalf_release }}-arm64.tar.xz gandalf
+
     - name: upload archives
       shell: |
         aws s3 cp /tmp/{{ item.file }} s3://{{ internal_artifacts_bucket }}/upgrades/{{ item.service }}/{{ item.file }}
@@ -73,3 +89,5 @@
           file: supabase-admin-api-{{ adminapi_release }}-arm64.tar.xz
         - service: admin-mgr
           file: admin-mgr-{{ adminmgr_release }}-arm64.tar.xz
+        - service: gandalf
+          file: gandalf-{{ gandalf_release }}-arm64.tar.xz
diff --git a/ansible/tasks/internal/gandalf.yml b/ansible/tasks/internal/gandalf.yml
new file mode 100644
index 000000000..2c0d03fba
--- /dev/null
+++ b/ansible/tasks/internal/gandalf.yml
@@ -0,0 +1,87 @@
+- name: gandalf - system group
+  group:
+    name: gandalf
+    system: yes
+
+- name: gandalf - system user
+  user:
+    name: gandalf
+    group: gandalf
+    groups: admin,salt
+    append: yes
+    system: yes
+    shell: /bin/sh
+
+- name: gandalf - config dir
+  file:
+    path: /opt/gandalf
+    owner: gandalf
+    state: directory
+
+- name: gandalf - gpg dir
+  file:
+    path: /etc/salt/gpgkeys
+    owner: root
+    group: salt
+    state: directory
+
+- name: give gandalf user permissions
+  copy:
+    src: files/gandalf_config/gandalf.sudoers.conf
+    dest: /etc/sudoers.d/gandalf
+    mode: "0644"
+
+- name: Setting arch (x86)
+  set_fact:
+    arch: "x86"
+  when: platform == "amd64"
+
+- name: Setting arch (arm)
+  set_fact:
+    arch: "arm64"
+  when: platform == "arm64"
+
+- name: Download gandalf archive
+  get_url:
+    url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf-{{ gandalf_release }}-linux-{{ arch }}.tar.gz"
+    dest: "/tmp/gandalf.tar.gz"
+    timeout: 90
+
+- name: gandalf - unpack archive in /opt
+  unarchive:
+    remote_src: yes
+    src: /tmp/gandalf.tar.gz
+    dest: /opt/gandalf/
+    owner: gandalf
+    extra_opts:
+      - --strip-components=1
+
+- name: gandalf - create symlink
+  ansible.builtin.file:
+    path: /opt/gandalf/gandalf
+    src: "/opt/gandalf/gandalf-linux-{{ arch }}"
+    state: link
+    owner: gandalf
+    mode: "0755"
+    force: yes
+
+- name: gandalf - create salt systemd timer file
+  copy:
+    src: files/gandalf_config/gandalf_salt.timer
+    dest: /etc/systemd/system/gandalf_salt.timer
+
+- name: gandalf - create salt service file
+  copy:
+    src: files/gandalf_config/gandalf_salt.service
+    dest: /etc/systemd/system/gandalf_salt.service
+
+- name: gandalf - reload systemd
+  systemd:
+    daemon_reload: yes
+
+# Initially ensure gandalf is installed but not started
+- name: gandalf - DISABLE service
+  systemd:
+    name: gandalf_salt
+    enabled: no
+    state: stopped
diff --git a/ansible/tasks/setup-supabase-internal.yml b/ansible/tasks/setup-supabase-internal.yml
index 7aa931763..5a37dbaa0 100644
--- a/ansible/tasks/setup-supabase-internal.yml
+++ b/ansible/tasks/setup-supabase-internal.yml
@@ -115,5 +115,10 @@
   tags:
     - aws-only
 
+- name: Install gandalf
+  import_tasks: internal/gandalf.yml
+  tags:
+    - aws-only
+
 - name: Envoy - use lds.supabase.yaml for /etc/envoy/lds.yaml
   command: mv /etc/envoy/lds.supabase.yaml /etc/envoy/lds.yaml
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 2d6465832..939c892d1 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.095-orioledb"
-  postgres17: "17.4.1.45"
-  postgres15: "15.8.1.102"
+  postgresorioledb-17: "17.0.1.096-orioledb"
+  postgres17: "17.4.1.046"
+  postgres15: "15.8.1.103"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -57,3 +57,5 @@ adminmgr_release: 0.25.1
 
 vector_x86_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_amd64.deb"
 vector_arm_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_arm64.deb"
+
+gandalf_release: 1.4.30

From 00cb0aa88617b2606a971d1d73d28fda89f41ffc Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <bobbie@soedirgo.dev>
Date: Thu, 26 Jun 2025 01:01:21 +0800
Subject: [PATCH 14/64] fix: gandalf path name

Should use `-` instead of `_`
---
 ansible/manifest-playbook.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/manifest-playbook.yml b/ansible/manifest-playbook.yml
index 583e3596c..a7d004ee0 100644
--- a/ansible/manifest-playbook.yml
+++ b/ansible/manifest-playbook.yml
@@ -63,7 +63,7 @@
 
     - name: Download gandalf archive
       get_url:
-        url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf_{{ gandalf_release }}_linux_arm64.tar.gz"
+        url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf-{{ gandalf_release }}-linux-arm64.tar.gz"
         dest: "/tmp/gandalf.tar.gz"
         timeout: 90
 

From 58024c1f1ccc9925f59930e3f96e84c2a7b400fc Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Wed, 25 Jun 2025 18:21:33 -0400
Subject: [PATCH 15/64] Sam/revert wandelf (#1673)

* Revert "fix: gandalf path name"

This reverts commit 00cb0aa88617b2606a971d1d73d28fda89f41ffc.

* Revert "feat: Install gandalf, salt-wrapper for infra (#1657)"

This reverts commit e321760fb40e1af3266a64768432a1d5c695aa26.

* chore: bump versions
---
 .../files/gandalf_config/gandalf.sudoers.conf |  2 -
 .../files/gandalf_config/gandalf_salt.service | 19 ----
 .../files/gandalf_config/gandalf_salt.timer   | 13 ---
 ansible/files/permission_check.py             | 10 ---
 ansible/manifest-playbook.yml                 | 18 ----
 ansible/tasks/internal/gandalf.yml            | 87 -------------------
 ansible/tasks/setup-supabase-internal.yml     |  5 --
 ansible/vars.yml                              |  8 +-
 8 files changed, 3 insertions(+), 159 deletions(-)
 delete mode 100644 ansible/files/gandalf_config/gandalf.sudoers.conf
 delete mode 100644 ansible/files/gandalf_config/gandalf_salt.service
 delete mode 100644 ansible/files/gandalf_config/gandalf_salt.timer
 delete mode 100644 ansible/tasks/internal/gandalf.yml

diff --git a/ansible/files/gandalf_config/gandalf.sudoers.conf b/ansible/files/gandalf_config/gandalf.sudoers.conf
deleted file mode 100644
index bf2517490..000000000
--- a/ansible/files/gandalf_config/gandalf.sudoers.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-%gandalf ALL= NOPASSWD: /usr/bin/salt-call
-%gandalf ALL= NOPASSWD: /usr/bin/gpg --homedir /etc/salt/gpgkeys --import, /usr/bin/gpg --homedir /etc/salt/gpgkeys --list-secret-keys *
diff --git a/ansible/files/gandalf_config/gandalf_salt.service b/ansible/files/gandalf_config/gandalf_salt.service
deleted file mode 100644
index c70db7ed8..000000000
--- a/ansible/files/gandalf_config/gandalf_salt.service
+++ /dev/null
@@ -1,19 +0,0 @@
-[Unit]
-Description=Configuration management via gandalf salt
-After=network.target
-
-[Service]
-Type=oneshot
-ExecStart=/opt/gandalf/gandalf --config /opt/gandalf/config.yaml salt --apply --store-result
-User=gandalf
-Group=gandalf
-StandardOutput=journal
-StandardError=journal
-StateDirectory=gandalf
-CacheDirectory=gandalf
-
-# Security hardening
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ansible/files/gandalf_config/gandalf_salt.timer b/ansible/files/gandalf_config/gandalf_salt.timer
deleted file mode 100644
index 6862ca402..000000000
--- a/ansible/files/gandalf_config/gandalf_salt.timer
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Run Supabase gandalf salt on a schedule
-Requires=gandalf_salt.service
-
-[Timer]
-OnCalendar=*:0/10
-# Random delay up to 30 seconds splay
-RandomizedDelaySec=30
-AccuracySec=1s
-Persistent=true
-
-[Install]
-WantedBy=timers.target
diff --git a/ansible/files/permission_check.py b/ansible/files/permission_check.py
index b34a56bb4..a753f69ec 100644
--- a/ansible/files/permission_check.py
+++ b/ansible/files/permission_check.py
@@ -94,17 +94,11 @@
     "systemd-coredump": [
         {"groupname": "systemd-coredump", "username": "systemd-coredump"}
     ],
-    "gandalf": [
-        {"groupname": "gandalf", "username": "gandalf"},
-        {"groupname": "admin", "username": "gandalf"},
-        {"groupname": "salt", "username": "gandalf"},
-    ],
 }
 
 # postgresql.service is expected to mount /etc as read-only
 expected_mount = "/etc ro"
 
-
 # This program depends on osquery being installed on the system
 # Function to run osquery
 def run_osquery(query):
@@ -160,7 +154,6 @@ def check_nixbld_users():
 
     print("All nixbld users are in the 'nixbld' group.")
 
-
 def check_postgresql_mount():
     # processes table has the nix .postgres-wrapped path as the
     # binary path, rather than /usr/lib/postgresql/bin/postgres which
@@ -189,7 +182,6 @@ def check_postgresql_mount():
 
     print("postgresql.service mounts /etc as read-only.")
 
-
 def main():
     parser = argparse.ArgumentParser(
         prog="Supabase Postgres Artifact Permissions Checker",
@@ -242,7 +234,6 @@ def main():
         "postgrest",
         "tcpdump",
         "systemd-coredump",
-        "gandalf",
     ]
     if not qemu_artifact:
         usernames.append("ec2-instance-connect")
@@ -260,6 +251,5 @@ def main():
     # Check if postgresql.service is using a read-only mount for /etc
     check_postgresql_mount()
 
-
 if __name__ == "__main__":
     main()
diff --git a/ansible/manifest-playbook.yml b/ansible/manifest-playbook.yml
index a7d004ee0..5c1c65053 100644
--- a/ansible/manifest-playbook.yml
+++ b/ansible/manifest-playbook.yml
@@ -61,22 +61,6 @@
       shell: |
         cd /tmp && tar -cJf admin-mgr-{{ adminmgr_release }}-arm64.tar.xz admin-mgr
 
-    - name: Download gandalf archive
-      get_url:
-        url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf-{{ gandalf_release }}-linux-arm64.tar.gz"
-        dest: "/tmp/gandalf.tar.gz"
-        timeout: 90
-
-    - name: gandalf - unpack archive in /tmp
-      unarchive:
-        remote_src: yes
-        src: /tmp/gandalf.tar.gz
-        dest: /tmp
-
-    - name: gandalf - pack archive
-      shell: |
-        cd /tmp && tar -cJf gandalf-{{ gandalf_release }}-arm64.tar.xz gandalf
-
     - name: upload archives
       shell: |
         aws s3 cp /tmp/{{ item.file }} s3://{{ internal_artifacts_bucket }}/upgrades/{{ item.service }}/{{ item.file }}
@@ -89,5 +73,3 @@
           file: supabase-admin-api-{{ adminapi_release }}-arm64.tar.xz
         - service: admin-mgr
           file: admin-mgr-{{ adminmgr_release }}-arm64.tar.xz
-        - service: gandalf
-          file: gandalf-{{ gandalf_release }}-arm64.tar.xz
diff --git a/ansible/tasks/internal/gandalf.yml b/ansible/tasks/internal/gandalf.yml
deleted file mode 100644
index 2c0d03fba..000000000
--- a/ansible/tasks/internal/gandalf.yml
+++ /dev/null
@@ -1,87 +0,0 @@
-- name: gandalf - system group
-  group:
-    name: gandalf
-    system: yes
-
-- name: gandalf - system user
-  user:
-    name: gandalf
-    group: gandalf
-    groups: admin,salt
-    append: yes
-    system: yes
-    shell: /bin/sh
-
-- name: gandalf - config dir
-  file:
-    path: /opt/gandalf
-    owner: gandalf
-    state: directory
-
-- name: gandalf - gpg dir
-  file:
-    path: /etc/salt/gpgkeys
-    owner: root
-    group: salt
-    state: directory
-
-- name: give gandalf user permissions
-  copy:
-    src: files/gandalf_config/gandalf.sudoers.conf
-    dest: /etc/sudoers.d/gandalf
-    mode: "0644"
-
-- name: Setting arch (x86)
-  set_fact:
-    arch: "x86"
-  when: platform == "amd64"
-
-- name: Setting arch (arm)
-  set_fact:
-    arch: "arm64"
-  when: platform == "arm64"
-
-- name: Download gandalf archive
-  get_url:
-    url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/gandalf/v{{ gandalf_release }}/gandalf-{{ gandalf_release }}-linux-{{ arch }}.tar.gz"
-    dest: "/tmp/gandalf.tar.gz"
-    timeout: 90
-
-- name: gandalf - unpack archive in /opt
-  unarchive:
-    remote_src: yes
-    src: /tmp/gandalf.tar.gz
-    dest: /opt/gandalf/
-    owner: gandalf
-    extra_opts:
-      - --strip-components=1
-
-- name: gandalf - create symlink
-  ansible.builtin.file:
-    path: /opt/gandalf/gandalf
-    src: "/opt/gandalf/gandalf-linux-{{ arch }}"
-    state: link
-    owner: gandalf
-    mode: "0755"
-    force: yes
-
-- name: gandalf - create salt systemd timer file
-  copy:
-    src: files/gandalf_config/gandalf_salt.timer
-    dest: /etc/systemd/system/gandalf_salt.timer
-
-- name: gandalf - create salt service file
-  copy:
-    src: files/gandalf_config/gandalf_salt.service
-    dest: /etc/systemd/system/gandalf_salt.service
-
-- name: gandalf - reload systemd
-  systemd:
-    daemon_reload: yes
-
-# Initially ensure gandalf is installed but not started
-- name: gandalf - DISABLE service
-  systemd:
-    name: gandalf_salt
-    enabled: no
-    state: stopped
diff --git a/ansible/tasks/setup-supabase-internal.yml b/ansible/tasks/setup-supabase-internal.yml
index 5a37dbaa0..7aa931763 100644
--- a/ansible/tasks/setup-supabase-internal.yml
+++ b/ansible/tasks/setup-supabase-internal.yml
@@ -115,10 +115,5 @@
   tags:
     - aws-only
 
-- name: Install gandalf
-  import_tasks: internal/gandalf.yml
-  tags:
-    - aws-only
-
 - name: Envoy - use lds.supabase.yaml for /etc/envoy/lds.yaml
   command: mv /etc/envoy/lds.supabase.yaml /etc/envoy/lds.yaml
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 939c892d1..446bf6be7 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.096-orioledb"
-  postgres17: "17.4.1.046"
-  postgres15: "15.8.1.103"
+  postgresorioledb-17: "17.0.1.097-orioledb"
+  postgres17: "17.4.1.47"
+  postgres15: "15.8.1.104"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -57,5 +57,3 @@ adminmgr_release: 0.25.1
 
 vector_x86_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_amd64.deb"
 vector_arm_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_arm64.deb"
-
-gandalf_release: 1.4.30

From 0271bfe9d773e36c8bece342c72d0eaba064f563 Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <31685197+soedirgo@users.noreply.github.com>
Date: Thu, 26 Jun 2025 17:16:32 +0800
Subject: [PATCH 16/64] fix: allow postgres to grant storage privs to other
 roles (#1666)

* fix: allow postgres to grant storage privs to other roles

Temporary fix until STORAGE-211 is completed

* chore: bump AMI versions

* chore: bump AMI versions
---
 ansible/vars.yml                              |  6 ++--
 ...e_tables_to_postgres_with_grant_option.sql |  6 ++++
 nix/tests/expected/storage.out                | 28 +++++++++----------
 3 files changed, 23 insertions(+), 17 deletions(-)
 create mode 100644 migrations/db/migrations/20250623125453_tmp_grant_storage_tables_to_postgres_with_grant_option.sql

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 446bf6be7..7a7147353 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.097-orioledb"
-  postgres17: "17.4.1.47"
-  postgres15: "15.8.1.104"
+  postgresorioledb-17: "17.0.1.098-orioledb"
+  postgres17: "17.4.1.048"
+  postgres15: "15.8.1.105"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/migrations/db/migrations/20250623125453_tmp_grant_storage_tables_to_postgres_with_grant_option.sql b/migrations/db/migrations/20250623125453_tmp_grant_storage_tables_to_postgres_with_grant_option.sql
new file mode 100644
index 000000000..465aee226
--- /dev/null
+++ b/migrations/db/migrations/20250623125453_tmp_grant_storage_tables_to_postgres_with_grant_option.sql
@@ -0,0 +1,6 @@
+-- migrate:up
+-- TODO: remove this migration once STORAGE-211 is completed
+-- DRI: bobbie
+grant all on storage.buckets, storage.objects to postgres with grant option;
+
+-- migrate:down
diff --git a/nix/tests/expected/storage.out b/nix/tests/expected/storage.out
index 353604ec8..fc1882923 100644
--- a/nix/tests/expected/storage.out
+++ b/nix/tests/expected/storage.out
@@ -81,13 +81,13 @@ order by
  storage     | buckets    | authenticated          | TRIGGER        | f
  storage     | buckets    | authenticated          | TRUNCATE       | f
  storage     | buckets    | authenticated          | UPDATE         | f
- storage     | buckets    | postgres               | DELETE         | f
- storage     | buckets    | postgres               | INSERT         | f
- storage     | buckets    | postgres               | REFERENCES     | f
- storage     | buckets    | postgres               | SELECT         | f
- storage     | buckets    | postgres               | TRIGGER        | f
- storage     | buckets    | postgres               | TRUNCATE       | f
- storage     | buckets    | postgres               | UPDATE         | f
+ storage     | buckets    | postgres               | DELETE         | t
+ storage     | buckets    | postgres               | INSERT         | t
+ storage     | buckets    | postgres               | REFERENCES     | t
+ storage     | buckets    | postgres               | SELECT         | t
+ storage     | buckets    | postgres               | TRIGGER        | t
+ storage     | buckets    | postgres               | TRUNCATE       | t
+ storage     | buckets    | postgres               | UPDATE         | t
  storage     | buckets    | service_role           | DELETE         | f
  storage     | buckets    | service_role           | INSERT         | f
  storage     | buckets    | service_role           | REFERENCES     | f
@@ -123,13 +123,13 @@ order by
  storage     | objects    | authenticated          | TRIGGER        | f
  storage     | objects    | authenticated          | TRUNCATE       | f
  storage     | objects    | authenticated          | UPDATE         | f
- storage     | objects    | postgres               | DELETE         | f
- storage     | objects    | postgres               | INSERT         | f
- storage     | objects    | postgres               | REFERENCES     | f
- storage     | objects    | postgres               | SELECT         | f
- storage     | objects    | postgres               | TRIGGER        | f
- storage     | objects    | postgres               | TRUNCATE       | f
- storage     | objects    | postgres               | UPDATE         | f
+ storage     | objects    | postgres               | DELETE         | t
+ storage     | objects    | postgres               | INSERT         | t
+ storage     | objects    | postgres               | REFERENCES     | t
+ storage     | objects    | postgres               | SELECT         | t
+ storage     | objects    | postgres               | TRIGGER        | t
+ storage     | objects    | postgres               | TRUNCATE       | t
+ storage     | objects    | postgres               | UPDATE         | t
  storage     | objects    | service_role           | DELETE         | f
  storage     | objects    | service_role           | INSERT         | f
  storage     | objects    | service_role           | REFERENCES     | f

From c57842fd08328761ca3877800eccd638fce0fc2d Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Thu, 26 Jun 2025 15:32:35 -0400
Subject: [PATCH 17/64] test: tests on various docs pages for supabase docs
 (#1675)

* test: tests on various docs pages for supabase docs

* tests: more docs tests

* tests: the rest of the postgres supabase docs tests`
---
 nix/tests/expected/docs-array-test.out       |  19 +
 nix/tests/expected/docs-cascades-deletes.out | 373 +++++++++++++++++++
 nix/tests/expected/docs-connections.out      |  26 ++
 nix/tests/expected/docs-enums.out            | 185 +++++++++
 nix/tests/expected/docs-full-text-search.out | 296 +++++++++++++++
 nix/tests/expected/docs-functions.out        | 230 ++++++++++++
 nix/tests/expected/docs-indexes.out          |  22 ++
 nix/tests/expected/docs-json.out             |  52 +++
 nix/tests/expected/docs-partitioning.out     | 110 ++++++
 nix/tests/expected/docs-tables-and-data.out  | 286 ++++++++++++++
 nix/tests/expected/docs-triggers.out         | 217 +++++++++++
 nix/tests/expected/docs-webhooks.out         | 266 +++++++++++++
 nix/tests/sql/docs-array-test.sql            |  14 +
 nix/tests/sql/docs-cascades-deletes.sql      | 262 +++++++++++++
 nix/tests/sql/docs-connections.sql           |  12 +
 nix/tests/sql/docs-enums.sql                 | 154 ++++++++
 nix/tests/sql/docs-full-text-search.sql      | 197 ++++++++++
 nix/tests/sql/docs-functions.sql             | 225 +++++++++++
 nix/tests/sql/docs-indexes.sql               |  26 ++
 nix/tests/sql/docs-json.sql                  |  47 +++
 nix/tests/sql/docs-partitioning.sql          |  89 +++++
 nix/tests/sql/docs-tables-and-data.sql       | 249 +++++++++++++
 nix/tests/sql/docs-triggers.sql              | 226 +++++++++++
 nix/tests/sql/docs-webhooks.sql              | 262 +++++++++++++
 24 files changed, 3845 insertions(+)
 create mode 100644 nix/tests/expected/docs-array-test.out
 create mode 100644 nix/tests/expected/docs-cascades-deletes.out
 create mode 100644 nix/tests/expected/docs-connections.out
 create mode 100644 nix/tests/expected/docs-enums.out
 create mode 100644 nix/tests/expected/docs-full-text-search.out
 create mode 100644 nix/tests/expected/docs-functions.out
 create mode 100644 nix/tests/expected/docs-indexes.out
 create mode 100644 nix/tests/expected/docs-json.out
 create mode 100644 nix/tests/expected/docs-partitioning.out
 create mode 100644 nix/tests/expected/docs-tables-and-data.out
 create mode 100644 nix/tests/expected/docs-triggers.out
 create mode 100644 nix/tests/expected/docs-webhooks.out
 create mode 100644 nix/tests/sql/docs-array-test.sql
 create mode 100644 nix/tests/sql/docs-cascades-deletes.sql
 create mode 100644 nix/tests/sql/docs-connections.sql
 create mode 100644 nix/tests/sql/docs-enums.sql
 create mode 100644 nix/tests/sql/docs-full-text-search.sql
 create mode 100644 nix/tests/sql/docs-functions.sql
 create mode 100644 nix/tests/sql/docs-indexes.sql
 create mode 100644 nix/tests/sql/docs-json.sql
 create mode 100644 nix/tests/sql/docs-partitioning.sql
 create mode 100644 nix/tests/sql/docs-tables-and-data.sql
 create mode 100644 nix/tests/sql/docs-triggers.sql
 create mode 100644 nix/tests/sql/docs-webhooks.sql

diff --git a/nix/tests/expected/docs-array-test.out b/nix/tests/expected/docs-array-test.out
new file mode 100644
index 000000000..5b27d9ba5
--- /dev/null
+++ b/nix/tests/expected/docs-array-test.out
@@ -0,0 +1,19 @@
+-- testing sql found in https://supabase.com/docs/guides/database/arrays
+create table arraytest (
+  id integer not null,
+  textarray text array
+);
+INSERT INTO arraytest (id, textarray) VALUES (1, ARRAY['Harry', 'Larry', 'Moe']);;
+select * from arraytest;
+ id |     textarray     
+----+-------------------
+  1 | {Harry,Larry,Moe}
+(1 row)
+
+SELECT textarray[1], array_length(textarray, 1) FROM arraytest;
+ textarray | array_length 
+-----------+--------------
+ Harry     |            3
+(1 row)
+
+drop table arraytest cascade;
diff --git a/nix/tests/expected/docs-cascades-deletes.out b/nix/tests/expected/docs-cascades-deletes.out
new file mode 100644
index 000000000..1f5d5f777
--- /dev/null
+++ b/nix/tests/expected/docs-cascades-deletes.out
@@ -0,0 +1,373 @@
+-- testing sql found in https://supabase.com/docs/guides/database/postgres/cascades-deletes
+-- all of the errors produced by this file are expected
+create table grandparent (
+  id serial primary key,
+  name text
+);
+create table parent (
+  id serial primary key,
+  name text,
+  parent_id integer references grandparent (id)
+    on delete cascade
+);
+create table child (
+  id serial primary key,
+  name text,
+  father integer references parent (id)
+    on delete restrict
+);
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+select count(*) from grandparent;
+ count 
+-------
+     1
+(1 row)
+
+select count(*) from parent;
+ count 
+-------
+     2
+(1 row)
+
+select count(*) from child;
+ count 
+-------
+     1
+(1 row)
+
+delete from grandparent;
+ERROR:  update or delete on table "parent" violates foreign key constraint "child_father_fkey" on table "child"
+DETAIL:  Key (id)=(1) is still referenced from table "child".
+select count(*) from grandparent;
+ count 
+-------
+     1
+(1 row)
+
+select count(*) from parent;
+ count 
+-------
+     2
+(1 row)
+
+select count(*) from child;
+ count 
+-------
+     1
+(1 row)
+
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+ERROR:  duplicate key value violates unique constraint "grandparent_pkey"
+DETAIL:  Key (id)=(1) already exists.
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+ERROR:  duplicate key value violates unique constraint "parent_pkey"
+DETAIL:  Key (id)=(1) already exists.
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+ERROR:  duplicate key value violates unique constraint "parent_pkey"
+DETAIL:  Key (id)=(2) already exists.
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+ERROR:  duplicate key value violates unique constraint "child_pkey"
+DETAIL:  Key (id)=(1) already exists.
+alter table child
+drop constraint child_father_fkey;
+alter table child
+add constraint child_father_fkey foreign key (father) references parent (id)
+  on delete no action;
+delete from grandparent;
+ERROR:  update or delete on table "parent" violates foreign key constraint "child_father_fkey" on table "child"
+DETAIL:  Key (id)=(1) is still referenced from table "child".
+select count(*) from grandparent;
+ count 
+-------
+     1
+(1 row)
+
+select count(*) from parent;
+ count 
+-------
+     2
+(1 row)
+
+select count(*) from child;
+ count 
+-------
+     1
+(1 row)
+
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+ERROR:  duplicate key value violates unique constraint "grandparent_pkey"
+DETAIL:  Key (id)=(1) already exists.
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+ERROR:  duplicate key value violates unique constraint "parent_pkey"
+DETAIL:  Key (id)=(1) already exists.
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+ERROR:  duplicate key value violates unique constraint "parent_pkey"
+DETAIL:  Key (id)=(2) already exists.
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+ERROR:  duplicate key value violates unique constraint "child_pkey"
+DETAIL:  Key (id)=(1) already exists.
+alter table child
+drop constraint child_father_fkey;
+alter table child
+add constraint child_father_fkey foreign key (father) references parent (id)
+  on delete no action initially deferred;
+delete from grandparent;
+ERROR:  update or delete on table "parent" violates foreign key constraint "child_father_fkey" on table "child"
+DETAIL:  Key (id)=(1) is still referenced from table "child".
+select count(*) from grandparent;
+ count 
+-------
+     1
+(1 row)
+
+select count(*) from parent;
+ count 
+-------
+     2
+(1 row)
+
+select count(*) from child;
+ count 
+-------
+     1
+(1 row)
+
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+ERROR:  duplicate key value violates unique constraint "grandparent_pkey"
+DETAIL:  Key (id)=(1) already exists.
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+ERROR:  duplicate key value violates unique constraint "parent_pkey"
+DETAIL:  Key (id)=(1) already exists.
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+ERROR:  duplicate key value violates unique constraint "parent_pkey"
+DETAIL:  Key (id)=(2) already exists.
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+ERROR:  duplicate key value violates unique constraint "child_pkey"
+DETAIL:  Key (id)=(1) already exists.
+alter table child
+add column mother integer references parent (id)
+  on delete cascade;
+update child
+set mother = 2
+where id = 1;
+delete from grandparent;
+select count(*) from grandparent;
+ count 
+-------
+     0
+(1 row)
+
+select count(*) from parent;
+ count 
+-------
+     0
+(1 row)
+
+select count(*) from child;
+ count 
+-------
+     0
+(1 row)
+
+create table test_cascade (
+  id serial primary key,
+  name text
+);
+create table test_cascade_child (
+  id serial primary key,
+  parent_id integer references test_cascade (id) on delete cascade,
+  name text
+);
+insert into test_cascade (name) values ('Parent');
+insert into test_cascade_child (parent_id, name) values (1, 'Child');
+delete from test_cascade;
+select count(*) from test_cascade;
+ count 
+-------
+     0
+(1 row)
+
+select count(*) from test_cascade_child;
+ count 
+-------
+     0
+(1 row)
+
+create table test_restrict (
+  id serial primary key,
+  name text
+);
+create table test_restrict_child (
+  id serial primary key,
+  parent_id integer references test_restrict (id) on delete restrict,
+  name text
+);
+insert into test_restrict (name) values ('Parent');
+insert into test_restrict_child (parent_id, name) values (1, 'Child');
+delete from test_restrict;
+ERROR:  update or delete on table "test_restrict" violates foreign key constraint "test_restrict_child_parent_id_fkey" on table "test_restrict_child"
+DETAIL:  Key (id)=(1) is still referenced from table "test_restrict_child".
+select count(*) from test_restrict;
+ count 
+-------
+     1
+(1 row)
+
+select count(*) from test_restrict_child;
+ count 
+-------
+     1
+(1 row)
+
+create table test_set_null (
+  id serial primary key,
+  name text
+);
+create table test_set_null_child (
+  id serial primary key,
+  parent_id integer references test_set_null (id) on delete set null,
+  name text
+);
+insert into test_set_null (name) values ('Parent');
+insert into test_set_null_child (parent_id, name) values (1, 'Child');
+delete from test_set_null;
+select count(*) from test_set_null;
+ count 
+-------
+     0
+(1 row)
+
+select count(*) from test_set_null_child;
+ count 
+-------
+     1
+(1 row)
+
+select parent_id from test_set_null_child;
+ parent_id 
+-----------
+          
+(1 row)
+
+create table test_set_default (
+  id serial primary key,
+  name text
+);
+create table test_set_default_child (
+  id serial primary key,
+  parent_id integer default 999 references test_set_default (id) on delete set default,
+  name text
+);
+insert into test_set_default (name) values ('Parent');
+insert into test_set_default_child (parent_id, name) values (1, 'Child');
+delete from test_set_default;
+ERROR:  insert or update on table "test_set_default_child" violates foreign key constraint "test_set_default_child_parent_id_fkey"
+DETAIL:  Key (parent_id)=(999) is not present in table "test_set_default".
+select count(*) from test_set_default;
+ count 
+-------
+     1
+(1 row)
+
+select count(*) from test_set_default_child;
+ count 
+-------
+     1
+(1 row)
+
+select parent_id from test_set_default_child;
+ parent_id 
+-----------
+         1
+(1 row)
+
+create table test_no_action (
+  id serial primary key,
+  name text
+);
+create table test_no_action_child (
+  id serial primary key,
+  parent_id integer references test_no_action (id) on delete no action,
+  name text
+);
+insert into test_no_action (name) values ('Parent');
+insert into test_no_action_child (parent_id, name) values (1, 'Child');
+delete from test_no_action;
+ERROR:  update or delete on table "test_no_action" violates foreign key constraint "test_no_action_child_parent_id_fkey" on table "test_no_action_child"
+DETAIL:  Key (id)=(1) is still referenced from table "test_no_action_child".
+select count(*) from test_no_action;
+ count 
+-------
+     1
+(1 row)
+
+select count(*) from test_no_action_child;
+ count 
+-------
+     1
+(1 row)
+
+drop table if exists test_cascade_child;
+drop table if exists test_cascade;
+drop table if exists test_restrict_child;
+drop table if exists test_restrict;
+drop table if exists test_set_null_child;
+drop table if exists test_set_null;
+drop table if exists test_set_default_child;
+drop table if exists test_set_default;
+drop table if exists test_no_action_child;
+drop table if exists test_no_action;
+drop table if exists child;
+drop table if exists parent;
+drop table if exists grandparent;
diff --git a/nix/tests/expected/docs-connections.out b/nix/tests/expected/docs-connections.out
new file mode 100644
index 000000000..d4e6d1106
--- /dev/null
+++ b/nix/tests/expected/docs-connections.out
@@ -0,0 +1,26 @@
+-- testing sql found in https://supabase.com/docs/guides/database/connection-management
+-- we can't test every sql statement in this doc because their results won't be deterministic
+select
+  ssl,
+  datname as database,
+  usename as connected_role,
+  application_name,
+  query,
+  state
+from pg_stat_ssl
+join pg_stat_activity
+on pg_stat_ssl.pid = pg_stat_activity.pid;
+ ssl | database | connected_role |      application_name       |                   query                    | state  
+-----+----------+----------------+-----------------------------+--------------------------------------------+--------
+ f   | postgres | supabase_admin | pg_regress/docs-connections | select                                    +| active
+     |          |                |                             |   ssl,                                    +| 
+     |          |                |                             |   datname as database,                    +| 
+     |          |                |                             |   usename as connected_role,              +| 
+     |          |                |                             |   application_name,                       +| 
+     |          |                |                             |   query,                                  +| 
+     |          |                |                             |   state                                   +| 
+     |          |                |                             | from pg_stat_ssl                          +| 
+     |          |                |                             | join pg_stat_activity                     +| 
+     |          |                |                             | on pg_stat_ssl.pid = pg_stat_activity.pid; | 
+(1 row)
+
diff --git a/nix/tests/expected/docs-enums.out b/nix/tests/expected/docs-enums.out
new file mode 100644
index 000000000..da2d06d42
--- /dev/null
+++ b/nix/tests/expected/docs-enums.out
@@ -0,0 +1,185 @@
+-- testing sql found in https://supabase.com/docs/guides/database/postgresenums
+create type mood as enum (
+  'happy',
+  'sad',
+  'excited',
+  'calm'
+);
+create table person (
+  id serial primary key,
+  name text,
+  current_mood mood
+);
+insert into person
+  (name, current_mood)
+values
+  ('Alice', 'happy');
+insert into person
+  (name, current_mood)
+values
+  ('Bob', 'sad');
+insert into person
+  (name, current_mood)
+values
+  ('Charlie', 'excited');
+select * 
+from person 
+where current_mood = 'sad';
+ id | name | current_mood 
+----+------+--------------
+  2 | Bob  | sad
+(1 row)
+
+select * 
+from person 
+where current_mood = 'happy';
+ id | name  | current_mood 
+----+-------+--------------
+  1 | Alice | happy
+(1 row)
+
+update person
+set current_mood = 'excited'
+where name = 'Alice';
+select * 
+from person 
+where name = 'Alice';
+ id | name  | current_mood 
+----+-------+--------------
+  1 | Alice | excited
+(1 row)
+
+alter type mood add value 'content';
+insert into person
+  (name, current_mood)
+values
+  ('David', 'content');
+select enum_range(null::mood);
+            enum_range            
+----------------------------------
+ {happy,sad,excited,calm,content}
+(1 row)
+
+select * 
+from person 
+where current_mood = 'content';
+ id | name  | current_mood 
+----+-------+--------------
+  4 | David | content
+(1 row)
+
+create type status as enum (
+  'active',
+  'inactive',
+  'pending'
+);
+create table orders (
+  id serial primary key,
+  order_number text,
+  status status
+);
+insert into orders
+  (order_number, status)
+values
+  ('ORD-001', 'active'),
+  ('ORD-002', 'pending'),
+  ('ORD-003', 'inactive');
+select * 
+from orders 
+where status = 'active';
+ id | order_number | status 
+----+--------------+--------
+  1 | ORD-001      | active
+(1 row)
+
+update orders
+set status = 'inactive'
+where order_number = 'ORD-002';
+select * 
+from orders 
+where order_number = 'ORD-002';
+ id | order_number |  status  
+----+--------------+----------
+  2 | ORD-002      | inactive
+(1 row)
+
+alter type status add value 'cancelled';
+insert into orders
+  (order_number, status)
+values
+  ('ORD-004', 'cancelled');
+select enum_range(null::status);
+             enum_range              
+-------------------------------------
+ {active,inactive,pending,cancelled}
+(1 row)
+
+select * 
+from orders 
+where status = 'cancelled';
+ id | order_number |  status   
+----+--------------+-----------
+  4 | ORD-004      | cancelled
+(1 row)
+
+create type priority as enum (
+  'low',
+  'medium',
+  'high',
+  'critical'
+);
+create table tasks (
+  id serial primary key,
+  title text,
+  priority priority
+);
+insert into tasks
+  (title, priority)
+values
+  ('Fix bug', 'high'),
+  ('Update docs', 'low'),
+  ('Security audit', 'critical');
+select * 
+from tasks 
+where priority = 'critical';
+ id |     title      | priority 
+----+----------------+----------
+  3 | Security audit | critical
+(1 row)
+
+update tasks
+set priority = 'medium'
+where title = 'Update docs';
+select * 
+from tasks 
+where title = 'Update docs';
+ id |    title    | priority 
+----+-------------+----------
+  2 | Update docs | medium
+(1 row)
+
+alter type priority add value 'urgent';
+insert into tasks
+  (title, priority)
+values
+  ('Server maintenance', 'urgent');
+select enum_range(null::priority);
+            enum_range             
+-----------------------------------
+ {low,medium,high,critical,urgent}
+(1 row)
+
+select * 
+from tasks 
+where priority = 'urgent';
+ id |       title        | priority 
+----+--------------------+----------
+  4 | Server maintenance | urgent
+(1 row)
+
+drop table tasks;
+drop table orders;
+drop table person;
+drop type priority;
+drop type status;
+drop type mood;
diff --git a/nix/tests/expected/docs-full-text-search.out b/nix/tests/expected/docs-full-text-search.out
new file mode 100644
index 000000000..476c1ca02
--- /dev/null
+++ b/nix/tests/expected/docs-full-text-search.out
@@ -0,0 +1,296 @@
+-- testing sql found in https://supabase.com/docs/guides/database/full-text-search
+create table books (
+  id serial primary key,
+  title text,
+  author text,
+  description text
+);
+insert into books
+  (title, author, description)
+values
+  (
+    'The Poky Little Puppy',
+    'Janette Sebring Lowrey',
+    'Puppy is slower than other, bigger animals.'
+  ),
+  ('The Tale of Peter Rabbit', 'Beatrix Potter', 'Rabbit eats some vegetables.'),
+  ('Tootle', 'Gertrude Crampton', 'Little toy train has big dreams.'),
+  (
+    'Green Eggs and Ham',
+    'Dr. Seuss',
+    'Sam has changing food preferences and eats unusually colored food.'
+  ),
+  (
+    'Harry Potter and the Goblet of Fire',
+    'J.K. Rowling',
+    'Fourth year of school starts, big drama ensues.'
+  );
+select to_tsvector('green eggs and ham');
+        to_tsvector        
+---------------------------
+ 'egg':2 'green':1 'ham':4
+(1 row)
+
+select to_tsvector('english', 'green eggs and ham');
+        to_tsvector        
+---------------------------
+ 'egg':2 'green':1 'ham':4
+(1 row)
+
+select *
+from books
+where title = 'Harry';
+ id | title | author | description 
+----+-------+--------+-------------
+(0 rows)
+
+select *
+from books
+where to_tsvector(title) @@ to_tsquery('Harry');
+ id |                title                |    author    |                   description                   
+----+-------------------------------------+--------------+-------------------------------------------------
+  5 | Harry Potter and the Goblet of Fire | J.K. Rowling | Fourth year of school starts, big drama ensues.
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description)
+  @@ to_tsquery('big');
+ id |                title                |      author       |                   description                   
+----+-------------------------------------+-------------------+-------------------------------------------------
+  3 | Tootle                              | Gertrude Crampton | Little toy train has big dreams.
+  5 | Harry Potter and the Goblet of Fire | J.K. Rowling      | Fourth year of school starts, big drama ensues.
+(2 rows)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description || ' ' || title)
+  @@ to_tsquery('little');
+ id |         title         |         author         |                 description                 
+----+-----------------------+------------------------+---------------------------------------------
+  1 | The Poky Little Puppy | Janette Sebring Lowrey | Puppy is slower than other, bigger animals.
+  3 | Tootle                | Gertrude Crampton      | Little toy train has big dreams.
+(2 rows)
+
+create function title_description(books) returns text as $$
+  select $1.title || ' ' || $1.description;
+$$ language sql immutable;
+select
+  *
+from
+  books
+where
+  to_tsvector(title_description(books.*))
+  @@ to_tsquery('little');
+ id |         title         |         author         |                 description                 
+----+-----------------------+------------------------+---------------------------------------------
+  1 | The Poky Little Puppy | Janette Sebring Lowrey | Puppy is slower than other, bigger animals.
+  3 | Tootle                | Gertrude Crampton      | Little toy train has big dreams.
+(2 rows)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description)
+  @@ to_tsquery('little & big');
+ id | title  |      author       |           description            
+----+--------+-------------------+----------------------------------
+  3 | Tootle | Gertrude Crampton | Little toy train has big dreams.
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description)
+  @@ to_tsquery('little | big');
+ id |                title                |      author       |                   description                   
+----+-------------------------------------+-------------------+-------------------------------------------------
+  3 | Tootle                              | Gertrude Crampton | Little toy train has big dreams.
+  5 | Harry Potter and the Goblet of Fire | J.K. Rowling      | Fourth year of school starts, big drama ensues.
+(2 rows)
+
+select title from books where to_tsvector(title) @@ to_tsquery('Lit:*');
+         title         
+-----------------------
+ The Poky Little Puppy
+(1 row)
+
+create or replace function search_books_by_title_prefix(prefix text)
+returns setof books AS $$
+begin
+  return query
+  select * from books where to_tsvector('english', title) @@ to_tsquery(prefix || ':*');
+end;
+$$ language plpgsql;
+select * from search_books_by_title_prefix('Lit');
+ id |         title         |         author         |                 description                 
+----+-----------------------+------------------------+---------------------------------------------
+  1 | The Poky Little Puppy | Janette Sebring Lowrey | Puppy is slower than other, bigger animals.
+(1 row)
+
+select * from search_books_by_title_prefix('Little+Puppy');
+ id |         title         |         author         |                 description                 
+----+-----------------------+------------------------+---------------------------------------------
+  1 | The Poky Little Puppy | Janette Sebring Lowrey | Puppy is slower than other, bigger animals.
+(1 row)
+
+alter table
+  books
+add column
+  fts tsvector generated always as (to_tsvector('english', description || ' ' || title)) stored;
+create index books_fts on books using gin (fts);
+select id, fts
+from books;
+ id |                                                       fts                                                       
+----+-----------------------------------------------------------------------------------------------------------------
+  1 | 'anim':7 'bigger':6 'littl':10 'poki':9 'puppi':1,11 'slower':3
+  2 | 'eat':2 'peter':8 'rabbit':1,9 'tale':6 'veget':4
+  3 | 'big':5 'dream':6 'littl':1 'tootl':7 'toy':2 'train':3
+  4 | 'chang':3 'color':9 'eat':7 'egg':12 'food':4,10 'green':11 'ham':14 'prefer':5 'sam':1 'unusu':8
+  5 | 'big':6 'drama':7 'ensu':8 'fire':15 'fourth':1 'goblet':13 'harri':9 'potter':10 'school':4 'start':5 'year':2
+(5 rows)
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('little & big');
+ id | title  |      author       |           description            |                           fts                           
+----+--------+-------------------+----------------------------------+---------------------------------------------------------
+  3 | Tootle | Gertrude Crampton | Little toy train has big dreams. | 'big':5 'dream':6 'littl':1 'tootl':7 'toy':2 'train':3
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('big <-> dreams');
+ id | title  |      author       |           description            |                           fts                           
+----+--------+-------------------+----------------------------------+---------------------------------------------------------
+  3 | Tootle | Gertrude Crampton | Little toy train has big dreams. | 'big':5 'dream':6 'littl':1 'tootl':7 'toy':2 'train':3
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('year <2> school');
+ id |                title                |    author    |                   description                   |                                                       fts                                                       
+----+-------------------------------------+--------------+-------------------------------------------------+-----------------------------------------------------------------------------------------------------------------
+  5 | Harry Potter and the Goblet of Fire | J.K. Rowling | Fourth year of school starts, big drama ensues. | 'big':6 'drama':7 'ensu':8 'fire':15 'fourth':1 'goblet':13 'harri':9 'potter':10 'school':4 'start':5 'year':2
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('big & !little');
+ id |                title                |    author    |                   description                   |                                                       fts                                                       
+----+-------------------------------------+--------------+-------------------------------------------------+-----------------------------------------------------------------------------------------------------------------
+  5 | Harry Potter and the Goblet of Fire | J.K. Rowling | Fourth year of school starts, big drama ensues. | 'big':6 'drama':7 'ensu':8 'fire':15 'fourth':1 'goblet':13 'harri':9 'potter':10 'school':4 'start':5 'year':2
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(title) @@ to_tsquery('harry & potter');
+ id |                title                |    author    |                   description                   |                                                       fts                                                       
+----+-------------------------------------+--------------+-------------------------------------------------+-----------------------------------------------------------------------------------------------------------------
+  5 | Harry Potter and the Goblet of Fire | J.K. Rowling | Fourth year of school starts, big drama ensues. | 'big':6 'drama':7 'ensu':8 'fire':15 'fourth':1 'goblet':13 'harri':9 'potter':10 'school':4 'start':5 'year':2
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('food & !egg');
+ id |       title        |  author   |                            description                             |                                                fts                                                
+----+--------------------+-----------+--------------------------------------------------------------------+---------------------------------------------------------------------------------------------------
+  4 | Green Eggs and Ham | Dr. Seuss | Sam has changing food preferences and eats unusually colored food. | 'chang':3 'color':9 'eat':7 'egg':12 'food':4,10 'green':11 'ham':14 'prefer':5 'sam':1 'unusu':8
+(1 row)
+
+select
+  *
+from
+  books
+where
+  to_tsvector(title || ' ' || description) @@ to_tsquery('train & toy');
+ id | title  |      author       |           description            |                           fts                           
+----+--------+-------------------+----------------------------------+---------------------------------------------------------
+  3 | Tootle | Gertrude Crampton | Little toy train has big dreams. | 'big':5 'dream':6 'littl':1 'tootl':7 'toy':2 'train':3
+(1 row)
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('puppy & slow');
+ id | title | author | description | fts 
+----+-------+--------+-------------+-----
+(0 rows)
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('rabbit | peter');
+ id |          title           |     author     |         description          |                        fts                        
+----+--------------------------+----------------+------------------------------+---------------------------------------------------
+  2 | The Tale of Peter Rabbit | Beatrix Potter | Rabbit eats some vegetables. | 'eat':2 'peter':8 'rabbit':1,9 'tale':6 'veget':4
+(1 row)
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('harry <-> potter');
+ id |                title                |    author    |                   description                   |                                                       fts                                                       
+----+-------------------------------------+--------------+-------------------------------------------------+-----------------------------------------------------------------------------------------------------------------
+  5 | Harry Potter and the Goblet of Fire | J.K. Rowling | Fourth year of school starts, big drama ensues. | 'big':6 'drama':7 'ensu':8 'fire':15 'fourth':1 'goblet':13 'harri':9 'potter':10 'school':4 'start':5 'year':2
+(1 row)
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('fourth <3> year');
+ id | title | author | description | fts 
+----+-------+--------+-------------+-----
+(0 rows)
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('big & !drama');
+ id | title  |      author       |           description            |                           fts                           
+----+--------+-------------------+----------------------------------+---------------------------------------------------------
+  3 | Tootle | Gertrude Crampton | Little toy train has big dreams. | 'big':5 'dream':6 'littl':1 'tootl':7 'toy':2 'train':3
+(1 row)
+
+drop function search_books_by_title_prefix(text);
+drop function title_description(books);
+drop table books;
+ 
diff --git a/nix/tests/expected/docs-functions.out b/nix/tests/expected/docs-functions.out
new file mode 100644
index 000000000..1a2c6085c
--- /dev/null
+++ b/nix/tests/expected/docs-functions.out
@@ -0,0 +1,230 @@
+-- testing sql found in https://supabase.com/docs/guides/database/functions
+create or replace function hello_world()
+returns text
+language sql
+as $$
+  select 'hello world';
+$$;
+select hello_world();
+ hello_world 
+-------------
+ hello world
+(1 row)
+
+create table planets (
+  id serial primary key,
+  name text
+);
+insert into planets
+  (id, name)
+values
+  (1, 'Tattoine'),
+  (2, 'Alderaan'),
+  (3, 'Kashyyyk');
+create table people (
+  id serial primary key,
+  name text,
+  planet_id bigint references planets
+);
+insert into people
+  (id, name, planet_id)
+values
+  (1, 'Anakin Skywalker', 1),
+  (2, 'Luke Skywalker', 1),
+  (3, 'Princess Leia', 2),
+  (4, 'Chewbacca', 3);
+create or replace function get_planets()
+returns setof planets
+language sql
+as $$
+  select * from planets;
+$$;
+select *
+from get_planets()
+where id = 1;
+ id |   name   
+----+----------
+  1 | Tattoine
+(1 row)
+
+create or replace function add_planet(name text)
+returns bigint
+language plpgsql
+as $$
+declare
+  new_row bigint;
+begin
+  insert into planets(name)
+  values (add_planet.name)
+  returning id into new_row;
+
+  return new_row;
+end;
+$$;
+select * from add_planet('Jakku');
+ERROR:  duplicate key value violates unique constraint "planets_pkey"
+DETAIL:  Key (id)=(1) already exists.
+CONTEXT:  SQL statement "insert into planets(name)
+  values (add_planet.name)
+  returning id"
+PL/pgSQL function add_planet(text) line 5 at SQL statement
+create function hello_world_definer()
+returns text
+language plpgsql
+security definer set search_path = ''
+as $$
+begin
+  select 'hello world';
+end;
+$$;
+select hello_world_definer();
+ERROR:  query has no destination for result data
+HINT:  If you want to discard the results of a SELECT, use PERFORM instead.
+CONTEXT:  PL/pgSQL function public.hello_world_definer() line 3 at SQL statement
+revoke execute on function public.hello_world from public;
+revoke execute on function public.hello_world from anon;
+grant execute on function public.hello_world to authenticated;
+revoke execute on all functions in schema public from public;
+revoke execute on all functions in schema public from anon, authenticated;
+alter default privileges in schema public revoke execute on functions from public;
+alter default privileges in schema public revoke execute on functions from anon, authenticated;
+grant execute on function public.hello_world to authenticated;
+create function logging_example(
+  log_message text,
+  warning_message text,
+  error_message text
+)
+returns void
+language plpgsql
+as $$
+begin
+  raise log 'logging message: %', log_message;
+  raise warning 'logging warning: %', warning_message;
+  raise exception 'logging error: %', error_message;
+end;
+$$;
+select logging_example('LOGGED MESSAGE', 'WARNING MESSAGE', 'ERROR MESSAGE');
+WARNING:  logging warning: WARNING MESSAGE
+ERROR:  logging error: ERROR MESSAGE
+CONTEXT:  PL/pgSQL function logging_example(text,text,text) line 5 at RAISE
+create or replace function error_if_null(some_val text)
+returns text
+language plpgsql
+as $$
+begin
+  if some_val is null then
+    raise exception 'some_val should not be NULL';
+  end if;
+  return some_val;
+end;
+$$;
+select error_if_null('not null');
+ error_if_null 
+---------------
+ not null
+(1 row)
+
+create table attendance_table (
+  id uuid primary key,
+  student text
+);
+insert into attendance_table (id, student) values ('123e4567-e89b-12d3-a456-426614174000', 'Harry Potter');
+create function assert_example(name text)
+returns uuid
+language plpgsql
+as $$
+declare
+  student_id uuid;
+begin
+  select
+    id into student_id
+  from attendance_table
+  where student = name;
+
+  assert student_id is not null, 'assert_example() ERROR: student not found';
+
+  return student_id;
+end;
+$$;
+select assert_example('Harry Potter');
+            assert_example            
+--------------------------------------
+ 123e4567-e89b-12d3-a456-426614174000
+(1 row)
+
+create function error_example()
+returns void
+language plpgsql
+as $$
+begin
+  select * from table_that_does_not_exist;
+
+  exception
+      when others then
+          raise exception 'An error occurred in function <function name>: %', sqlerrm;
+end;
+$$;
+select error_example();
+ERROR:  An error occurred in function <function name>: relation "table_that_does_not_exist" does not exist
+CONTEXT:  PL/pgSQL function error_example() line 7 at RAISE
+create table some_table (
+  col_1 int,
+  col_2 text
+);
+insert into some_table (col_1, col_2) values (42, 'test value');
+create or replace function advanced_example(num int default 10)
+returns text
+language plpgsql
+as $$
+declare
+    var1 int := 20;
+    var2 text;
+begin
+    raise log 'logging start of function call: (%)', (select now());
+
+    select
+      col_1 into var1
+    from some_table
+    limit 1;
+    raise log 'logging a variable (%)', var1;
+
+    raise log 'logging a query with a single return value(%)', (select col_1 from some_table limit 1);
+
+    raise log 'logging an entire row as JSON (%)', (select to_jsonb(some_table.*) from some_table limit 1);
+
+    insert into some_table (col_2)
+    values ('new val')
+    returning col_2 into var2;
+
+    raise log 'logging a value from an INSERT (%)', var2;
+
+    return var1 || ',' || var2;
+exception
+    when others then
+        raise exception 'An error occurred in function <advanced_example>: %', sqlerrm;
+end;
+$$;
+select advanced_example();
+ advanced_example 
+------------------
+ 42,new val
+(1 row)
+
+drop function advanced_example(int);
+drop function error_example();
+drop function assert_example(text);
+drop function error_if_null(text);
+drop function logging_example(text, text, text);
+drop function hello_world_definer();
+drop function add_planet(text);
+drop function get_planets();
+drop function hello_world();
+drop table people;
+drop table planets;
+drop table attendance_table;
+drop table some_table;
+grant execute on all functions in schema public to public;
+grant execute on all functions in schema public to anon, authenticated;
+alter default privileges in schema public grant execute on functions to public;
+alter default privileges in schema public grant execute on functions to anon, authenticated;
+ 
diff --git a/nix/tests/expected/docs-indexes.out b/nix/tests/expected/docs-indexes.out
new file mode 100644
index 000000000..fbdaeab79
--- /dev/null
+++ b/nix/tests/expected/docs-indexes.out
@@ -0,0 +1,22 @@
+-- testing sql found in https://supabase.com/docs/guides/database/indexes
+create table persons (
+  id bigint generated by default as identity primary key,
+  age int,
+  height int,
+  weight int,
+  name text,
+  deceased boolean
+);
+insert into persons (age, height, weight, name, deceased) values (32, 180, 70, 'John Doe', false);
+select name from persons where age = 32;
+   name   
+----------
+ John Doe
+(1 row)
+
+create index idx_persons_age on persons (age);
+create index idx_living_persons_age on persons (age) where deceased is false;
+create index idx_persons_age_desc on persons (age desc nulls last);
+reindex index concurrently idx_persons_age;
+reindex table concurrently persons;
+drop table persons cascade;
diff --git a/nix/tests/expected/docs-json.out b/nix/tests/expected/docs-json.out
new file mode 100644
index 000000000..c77a86b74
--- /dev/null
+++ b/nix/tests/expected/docs-json.out
@@ -0,0 +1,52 @@
+-- testing sql found in https://supabase.com/docs/guides/database/json
+create table books (
+  id serial primary key,
+  title text,
+  author text,
+  metadata jsonb
+);
+insert into books
+  (title, author, metadata)
+values
+  (
+    'The Poky Little Puppy',
+    'Janette Sebring Lowrey',
+    '{"description":"Puppy is slower than other, bigger animals.","price":5.95,"ages":[3,6]}'
+  ),
+  (
+    'The Tale of Peter Rabbit',
+    'Beatrix Potter',
+    '{"description":"Rabbit eats some vegetables.","price":4.49,"ages":[2,5]}'
+  ),
+  (
+    'Tootle',
+    'Gertrude Crampton',
+    '{"description":"Little toy train has big dreams.","price":3.99,"ages":[2,5]}'
+  ),
+  (
+    'Green Eggs and Ham',
+    'Dr. Seuss',
+    '{"description":"Sam has changing food preferences and eats unusually colored food.","price":7.49,"ages":[4,8]}'
+  ),
+  (
+    'Harry Potter and the Goblet of Fire',
+    'J.K. Rowling',
+    '{"description":"Fourth year of school starts, big drama ensues.","price":24.95,"ages":[10,99]}'
+  );
+select
+  title,
+  metadata ->> 'description' as description, -- returned as text
+  metadata -> 'price' as price,
+  metadata -> 'ages' -> 0 as low_age,
+  metadata -> 'ages' -> 1 as high_age
+from books;
+                title                |                            description                             | price | low_age | high_age 
+-------------------------------------+--------------------------------------------------------------------+-------+---------+----------
+ The Poky Little Puppy               | Puppy is slower than other, bigger animals.                        | 5.95  | 3       | 6
+ The Tale of Peter Rabbit            | Rabbit eats some vegetables.                                       | 4.49  | 2       | 5
+ Tootle                              | Little toy train has big dreams.                                   | 3.99  | 2       | 5
+ Green Eggs and Ham                  | Sam has changing food preferences and eats unusually colored food. | 7.49  | 4       | 8
+ Harry Potter and the Goblet of Fire | Fourth year of school starts, big drama ensues.                    | 24.95 | 10      | 99
+(5 rows)
+
+drop table books cascade;
diff --git a/nix/tests/expected/docs-partitioning.out b/nix/tests/expected/docs-partitioning.out
new file mode 100644
index 000000000..9ab265c17
--- /dev/null
+++ b/nix/tests/expected/docs-partitioning.out
@@ -0,0 +1,110 @@
+-- testing sql found in https://supabase.com/docs/guides/database/partitioning
+create table sales (
+    id bigint generated by default as identity,
+    order_date date not null,
+    customer_id bigint,
+    amount bigint,
+    primary key (order_date, id)
+)
+partition by range (order_date);
+create table sales_2000_01
+	partition of sales
+  for values from ('2000-01-01') to ('2000-02-01');
+create table sales_2000_02
+	partition of sales
+	for values from ('2000-02-01') to ('2000-03-01');
+insert into sales (order_date, customer_id, amount) values
+  ('2000-01-15', 1, 100),
+  ('2000-01-20', 2, 200),
+  ('2000-02-10', 3, 150),
+  ('2000-02-25', 4, 300);
+select * from sales where order_date >= '2000-01-01' and order_date < '2000-03-01';
+ id | order_date | customer_id | amount 
+----+------------+-------------+--------
+  1 | 01-15-2000 |           1 |    100
+  2 | 01-20-2000 |           2 |    200
+  3 | 02-10-2000 |           3 |    150
+  4 | 02-25-2000 |           4 |    300
+(4 rows)
+
+select * from sales_2000_02;
+ id | order_date | customer_id | amount 
+----+------------+-------------+--------
+  3 | 02-10-2000 |           3 |    150
+  4 | 02-25-2000 |           4 |    300
+(2 rows)
+
+drop table sales cascade;
+create table customers (
+    id bigint generated by default as identity,
+    name text,
+    country text,
+    primary key (country, id)
+)
+partition by list(country);
+create table customers_americas
+	partition of customers
+	for values in ('US', 'CANADA');
+create table customers_asia
+	partition of customers
+  for values in ('INDIA', 'CHINA', 'JAPAN');
+insert into customers (name, country) values
+  ('John Doe', 'US'),
+  ('Jane Smith', 'CANADA'),
+  ('Li Wei', 'CHINA'),
+  ('Priya Patel', 'INDIA'),
+  ('Yuki Tanaka', 'JAPAN');
+select * from customers where country in ('US', 'CANADA');
+ id |    name    | country 
+----+------------+---------
+  1 | John Doe   | US
+  2 | Jane Smith | CANADA
+(2 rows)
+
+select * from customers_asia;
+ id |    name     | country 
+----+-------------+---------
+  3 | Li Wei      | CHINA
+  4 | Priya Patel | INDIA
+  5 | Yuki Tanaka | JAPAN
+(3 rows)
+
+drop table customers cascade;
+create table products (
+    id bigint generated by default as identity,
+    name text,
+    category text,
+    price bigint
+)
+partition by hash (id);
+create table products_one
+	partition of products
+  for values with (modulus 2, remainder 1);
+create table products_two
+	partition of products
+  for values with (modulus 2, remainder 0);
+insert into products (name, category, price) values
+  ('Laptop', 'Electronics', 999),
+  ('Phone', 'Electronics', 599),
+  ('Book', 'Education', 29),
+  ('Chair', 'Furniture', 199);
+select * from products where category = 'Electronics';
+ id |  name  |  category   | price 
+----+--------+-------------+-------
+  1 | Laptop | Electronics |   999
+  2 | Phone  | Electronics |   599
+(2 rows)
+
+select count(*) from products_one;
+ count 
+-------
+     2
+(1 row)
+
+select count(*) from products_two;
+ count 
+-------
+     2
+(1 row)
+
+drop table products cascade; 
diff --git a/nix/tests/expected/docs-tables-and-data.out b/nix/tests/expected/docs-tables-and-data.out
new file mode 100644
index 000000000..5412b55f8
--- /dev/null
+++ b/nix/tests/expected/docs-tables-and-data.out
@@ -0,0 +1,286 @@
+-- Test file for "Tables and Data" documentation
+-- This file contains all SQL statements from https://supabase.com/docs/guides/database/tables-and-data
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+select table_name, column_name, data_type, is_nullable, column_default
+from information_schema.columns 
+where table_name = 'movies' 
+order by ordinal_position;
+ table_name | column_name | data_type | is_nullable | column_default 
+------------+-------------+-----------+-------------+----------------
+ movies     | id          | bigint    | NO          | 
+ movies     | name        | text      | YES         | 
+ movies     | description | text      | YES         | 
+(3 rows)
+
+drop table if exists movies;
+create table movies (
+  id bigint generated always as identity primary key
+);
+select column_name, data_type, is_nullable, column_default, is_identity, identity_generation
+from information_schema.columns 
+where table_name = 'movies' and column_name = 'id';
+ column_name | data_type | is_nullable | column_default | is_identity | identity_generation 
+-------------+-----------+-------------+----------------+-------------+---------------------
+ id          | bigint    | NO          |                | YES         | ALWAYS
+(1 row)
+
+drop table if exists movies;
+create table movies (
+  id bigint generated by default as identity primary key
+);
+select column_name, data_type, is_nullable, column_default, is_identity, identity_generation
+from information_schema.columns 
+where table_name = 'movies' and column_name = 'id';
+ column_name | data_type | is_nullable | column_default | is_identity | identity_generation 
+-------------+-----------+-------------+----------------+-------------+---------------------
+ id          | bigint    | NO          |                | YES         | BY DEFAULT
+(1 row)
+
+drop table if exists movies;
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+insert into movies
+  (name, description)
+values
+  (
+    'The Empire Strikes Back',
+    'After the Rebels are brutally overpowered by the Empire on the ice planet Hoth, Luke Skywalker begins Jedi training with Yoda.'
+  ),
+  (
+    'Return of the Jedi',
+    'After a daring mission to rescue Han Solo from Jabba the Hutt, the Rebels dispatch to Endor to destroy the second Death Star.'
+  );
+select id, name, description from movies order by id;
+ id |          name           |                                                          description                                                           
+----+-------------------------+--------------------------------------------------------------------------------------------------------------------------------
+  1 | The Empire Strikes Back | After the Rebels are brutally overpowered by the Empire on the ice planet Hoth, Luke Skywalker begins Jedi training with Yoda.
+  2 | Return of the Jedi      | After a daring mission to rescue Han Solo from Jabba the Hutt, the Rebels dispatch to Endor to destroy the second Death Star.
+(2 rows)
+
+drop table if exists movies;
+drop table if exists categories;
+NOTICE:  table "categories" does not exist, skipping
+create table categories (
+  id bigint generated always as identity primary key,
+  name text 
+);
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+alter table movies
+  add column category_id bigint references categories;
+select 
+  tc.table_name, 
+  kcu.column_name, 
+  ccu.table_name as foreign_table_name,
+  ccu.column_name as foreign_column_name 
+from information_schema.table_constraints as tc 
+join information_schema.key_column_usage as kcu
+  on tc.constraint_name = kcu.constraint_name
+  and tc.table_schema = kcu.table_schema
+join information_schema.constraint_column_usage as ccu
+  on ccu.constraint_name = tc.constraint_name
+  and ccu.table_schema = tc.table_schema
+where tc.constraint_type = 'FOREIGN KEY' and tc.table_name='movies';
+ table_name | column_name | foreign_table_name | foreign_column_name 
+------------+-------------+--------------------+---------------------
+ movies     | category_id | categories         | id
+(1 row)
+
+drop table if exists performances;
+NOTICE:  table "performances" does not exist, skipping
+drop table if exists actors;
+NOTICE:  table "actors" does not exist, skipping
+drop table if exists movies;
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+create table actors (
+  id bigint generated by default as identity primary key,
+  name text
+);
+create table performances (
+  id bigint generated by default as identity primary key,
+  movie_id bigint not null references movies,
+  actor_id bigint not null references actors
+);
+select table_name from information_schema.tables 
+where table_name in ('movies', 'actors', 'performances') 
+order by table_name;
+  table_name  
+--------------
+ actors
+ movies
+ performances
+(3 rows)
+
+create schema private;
+select schema_name from information_schema.schemata where schema_name = 'private';
+ schema_name 
+-------------
+ private
+(1 row)
+
+drop table if exists private.salaries;
+NOTICE:  table "salaries" does not exist, skipping
+drop table if exists actors cascade;
+NOTICE:  drop cascades to constraint performances_actor_id_fkey on table performances
+create table actors (
+  id bigint generated by default as identity primary key,
+  name text
+);
+create table private.salaries (
+  id bigint generated by default as identity primary key,
+  salary bigint not null,
+  actor_id bigint not null references public.actors
+);
+select table_schema, table_name from information_schema.tables 
+where table_schema = 'private' and table_name = 'salaries';
+ table_schema | table_name 
+--------------+------------
+ private      | salaries
+(1 row)
+
+drop table if exists grades;
+NOTICE:  table "grades" does not exist, skipping
+drop table if exists courses;
+NOTICE:  table "courses" does not exist, skipping
+drop table if exists students;
+NOTICE:  table "students" does not exist, skipping
+drop view if exists transcripts;
+NOTICE:  view "transcripts" does not exist, skipping
+create table students (
+  id bigint generated by default as identity primary key,
+  name text,
+  type text
+);
+create table courses (
+  id bigint generated by default as identity primary key,
+  title text,
+  code text
+);
+create table grades (
+  id bigint generated by default as identity primary key,
+  student_id bigint not null references students,
+  course_id bigint not null references courses,
+  result text
+);
+-- Insert test data
+insert into students (name, type) values
+  ('Princess Leia', 'undergraduate'),
+  ('Yoda', 'graduate'),
+  ('Anakin Skywalker', 'graduate');
+insert into courses (title, code) values
+  ('Introduction to Postgres', 'PG101'),
+  ('Authentication Theories', 'AUTH205'),
+  ('Fundamentals of Supabase', 'SUP412');
+insert into grades (student_id, course_id, result) values
+  (1, 1, 'B+'),
+  (1, 3, 'A+'),
+  (2, 2, 'A'),
+  (3, 1, 'A-'),
+  (3, 2, 'A'),
+  (3, 3, 'B-');
+-- Create view
+create view transcripts as
+    select
+        students.name,
+        students.type,
+        courses.title,
+        courses.code,
+        grades.result
+    from grades
+    left join students on grades.student_id = students.id
+    left join courses on grades.course_id = courses.id;
+grant all on table transcripts to authenticated;
+select name, type, title, code, result from transcripts order by name, code;
+       name       |     type      |          title           |  code   | result 
+------------------+---------------+--------------------------+---------+--------
+ Anakin Skywalker | graduate      | Authentication Theories  | AUTH205 | A
+ Anakin Skywalker | graduate      | Introduction to Postgres | PG101   | A-
+ Anakin Skywalker | graduate      | Fundamentals of Supabase | SUP412  | B-
+ Princess Leia    | undergraduate | Introduction to Postgres | PG101   | B+
+ Princess Leia    | undergraduate | Fundamentals of Supabase | SUP412  | A+
+ Yoda             | graduate      | Authentication Theories  | AUTH205 | A
+(6 rows)
+
+drop materialized view if exists transcripts_materialized;
+NOTICE:  materialized view "transcripts_materialized" does not exist, skipping
+create materialized view transcripts_materialized as
+  select
+    students.name,
+    students.type,
+    courses.title,
+    courses.code,
+    grades.result
+  from
+    grades
+    left join students on grades.student_id = students.id
+    left join courses on grades.course_id = courses.id;
+select name, type, title, code, result from transcripts_materialized order by name, code;
+       name       |     type      |          title           |  code   | result 
+------------------+---------------+--------------------------+---------+--------
+ Anakin Skywalker | graduate      | Authentication Theories  | AUTH205 | A
+ Anakin Skywalker | graduate      | Introduction to Postgres | PG101   | A-
+ Anakin Skywalker | graduate      | Fundamentals of Supabase | SUP412  | B-
+ Princess Leia    | undergraduate | Introduction to Postgres | PG101   | B+
+ Princess Leia    | undergraduate | Fundamentals of Supabase | SUP412  | A+
+ Yoda             | graduate      | Authentication Theories  | AUTH205 | A
+(6 rows)
+
+refresh materialized view transcripts_materialized;
+select count(*) from transcripts_materialized;
+ count 
+-------
+     6
+(1 row)
+
+drop view if exists secure_transcripts;
+NOTICE:  view "secure_transcripts" does not exist, skipping
+create view secure_transcripts with(security_invoker=true) as (
+  select name, type, title, code, result from transcripts
+);
+select schemaname, viewname 
+from pg_views 
+where viewname = 'secure_transcripts';
+ schemaname |      viewname      
+------------+--------------------
+ public     | secure_transcripts
+(1 row)
+
+drop view if exists test_view;
+NOTICE:  view "test_view" does not exist, skipping
+create view test_view as select 1 as test_col;
+alter view test_view set (security_invoker = true);
+select schemaname, viewname 
+from pg_views 
+where viewname = 'test_view';
+ schemaname | viewname  
+------------+-----------
+ public     | test_view
+(1 row)
+
+drop materialized view if exists transcripts_materialized;
+drop view if exists secure_transcripts;
+drop view if exists transcripts;
+drop view if exists test_view;
+drop table if exists grades;
+drop table if exists courses;
+drop table if exists students;
+drop table if exists private.salaries;
+drop table if exists actors;
+drop table if exists performances;
+drop table if exists movies;
+drop table if exists categories;
+drop schema if exists private;
diff --git a/nix/tests/expected/docs-triggers.out b/nix/tests/expected/docs-triggers.out
new file mode 100644
index 000000000..a3a850925
--- /dev/null
+++ b/nix/tests/expected/docs-triggers.out
@@ -0,0 +1,217 @@
+-- testing sql found in https://supabase.com/docs/guides/database/postgres/triggers
+create table employees (
+  id serial primary key,
+  name text,
+  salary numeric
+);
+create table salary_log (
+  id serial primary key,
+  employee_id integer,
+  old_salary numeric,
+  new_salary numeric,
+  created_at timestamp default now()
+);
+create function update_salary_log()
+returns trigger
+language plpgsql
+as $$
+begin
+  insert into salary_log(employee_id, old_salary, new_salary)
+  values (new.id, old.salary, new.salary);
+  return new;
+end;
+$$;
+create trigger salary_update_trigger
+after update on employees
+for each row
+execute function update_salary_log();
+insert into employees (name, salary) values ('John Doe', 50000);
+insert into employees (name, salary) values ('Jane Smith', 60000);
+update employees set salary = 55000 where name = 'John Doe';
+select id, employee_id, old_salary, new_salary from salary_log;
+ id | employee_id | old_salary | new_salary 
+----+-------------+------------+------------
+  1 |           1 |      50000 |      55000
+(1 row)
+
+create table orders (
+  id serial primary key,
+  customer_id integer,
+  amount numeric,
+  status text
+);
+create table customers (
+  id serial primary key,
+  name text,
+  email text
+);
+create function before_insert_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  if new.amount <= 0 then
+    raise exception 'Order amount must be greater than 0';
+  end if;
+  return new;
+end;
+$$;
+create trigger before_insert_trigger
+before insert on orders
+for each row
+execute function before_insert_function();
+create table customer_audit (
+  id serial primary key,
+  customer_id integer,
+  action text,
+  customer_name text,
+  deleted_at timestamp default now()
+);
+create function after_delete_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  insert into customer_audit(customer_id, action, customer_name)
+  values (old.id, 'DELETE', old.name);
+  return old;
+end;
+$$;
+create trigger after_delete_trigger
+after delete on customers
+for each row
+execute function after_delete_function();
+insert into customers (name, email) values ('Alice Johnson', 'alice@example.com');
+insert into customers (name, email) values ('Bob Wilson', 'bob@example.com');
+insert into orders (customer_id, amount, status) values (1, 100.50, 'pending');
+insert into orders (customer_id, amount, status) values (2, 250.75, 'pending');
+delete from customers where name = 'Alice Johnson';
+select id, customer_id, action, customer_name from customer_audit;
+ id | customer_id | action | customer_name 
+----+-------------+--------+---------------
+  1 |           1 | DELETE | Alice Johnson
+(1 row)
+
+create table trigger_events (
+  id serial primary key,
+  trigger_name text,
+  operation text,
+  table_name text,
+  event_time timestamp default now()
+);
+create function statement_level_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  insert into trigger_events(trigger_name, operation, table_name)
+  values (tg_name, tg_op, tg_table_name);
+  return null;
+end;
+$$;
+create trigger statement_level_trigger
+after insert on orders
+for each statement
+execute function statement_level_function();
+insert into orders (customer_id, amount, status) values (2, 150.25, 'pending');
+select id, trigger_name, operation, table_name from trigger_events;
+ id |      trigger_name       | operation | table_name 
+----+-------------------------+-----------+------------
+  1 | statement_level_trigger | INSERT    | orders
+(1 row)
+
+create table trigger_variables_log (
+  id serial primary key,
+  trigger_name text,
+  trigger_when text,
+  operation text,
+  table_name text,
+  table_schema text,
+  row_id integer,
+  event_time timestamp default now()
+);
+create function trigger_variables_example()
+returns trigger
+language plpgsql
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into trigger_variables_log(trigger_name, trigger_when, operation, table_name, table_schema, row_id)
+    values (tg_name, tg_when, tg_op, tg_table_name, tg_table_schema, new.id);
+  elsif tg_op = 'UPDATE' then
+    insert into trigger_variables_log(trigger_name, trigger_when, operation, table_name, table_schema, row_id)
+    values (tg_name, tg_when, tg_op, tg_table_name, tg_table_schema, new.id);
+  elsif tg_op = 'DELETE' then
+    insert into trigger_variables_log(trigger_name, trigger_when, operation, table_name, table_schema, row_id)
+    values (tg_name, tg_when, tg_op, tg_table_name, tg_table_schema, old.id);
+  end if;
+  
+  return coalesce(new, old);
+end;
+$$;
+create trigger variables_trigger
+after insert or update or delete on employees
+for each row
+execute function trigger_variables_example();
+insert into employees (name, salary) values ('Charlie Brown', 45000);
+update employees set salary = 47000 where name = 'Charlie Brown';
+delete from employees where name = 'Charlie Brown';
+select id, trigger_name, trigger_when, operation, table_name, table_schema, row_id from trigger_variables_log;
+ id |   trigger_name    | trigger_when | operation | table_name | table_schema | row_id 
+----+-------------------+--------------+-----------+------------+--------------+--------
+  1 | variables_trigger | AFTER        | INSERT    | employees  | public       |      3
+  2 | variables_trigger | AFTER        | UPDATE    | employees  | public       |      3
+  3 | variables_trigger | AFTER        | DELETE    | employees  | public       |      3
+(3 rows)
+
+create table high_salary_alerts (
+  id serial primary key,
+  employee_name text,
+  salary numeric,
+  alert_time timestamp default now()
+);
+create function conditional_trigger_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  if new.salary > 100000 then
+    insert into high_salary_alerts(employee_name, salary)
+    values (new.name, new.salary);
+  end if;
+  return new;
+end;
+$$;
+create trigger conditional_trigger
+after insert or update on employees
+for each row
+when (new.salary > 100000)
+execute function conditional_trigger_function();
+insert into employees (name, salary) values ('Executive', 150000);
+insert into employees (name, salary) values ('Intern', 30000);
+select id, employee_name, salary from high_salary_alerts;
+ id | employee_name | salary 
+----+---------------+--------
+  1 | Executive     | 150000
+(1 row)
+
+drop trigger conditional_trigger on employees;
+drop trigger variables_trigger on employees;
+drop trigger statement_level_trigger on orders;
+drop trigger after_delete_trigger on customers;
+drop trigger before_insert_trigger on orders;
+drop trigger salary_update_trigger on employees;
+drop function conditional_trigger_function();
+drop function trigger_variables_example();
+drop function statement_level_function();
+drop function after_delete_function();
+drop function before_insert_function();
+drop function update_salary_log();
+drop table high_salary_alerts;
+drop table trigger_variables_log;
+drop table trigger_events;
+drop table customer_audit;
+drop table salary_log;
+drop table employees;
+drop table orders;
+drop table customers;
diff --git a/nix/tests/expected/docs-webhooks.out b/nix/tests/expected/docs-webhooks.out
new file mode 100644
index 000000000..20e4b2fb1
--- /dev/null
+++ b/nix/tests/expected/docs-webhooks.out
@@ -0,0 +1,266 @@
+-- testing sql found in https://supabase.com/docs/guides/database/webhooks
+create table profiles (
+  id serial primary key,
+  name text,
+  email text,
+  created_at timestamp default now()
+);
+create table webhook_logs (
+  id serial primary key,
+  webhook_name text,
+  event_type text,
+  table_name text,
+  schema_name text,
+  record_data jsonb,
+  old_record_data jsonb,
+  created_at timestamp default now()
+);
+create function webhook_handler()
+returns trigger
+language plpgsql
+as $$
+declare
+  payload jsonb;
+begin
+  if tg_op = 'INSERT' then
+    payload := jsonb_build_object(
+      'type', 'INSERT',
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', to_jsonb(new),
+      'old_record', null
+    );
+  elsif tg_op = 'UPDATE' then
+    payload := jsonb_build_object(
+      'type', 'UPDATE',
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', to_jsonb(new),
+      'old_record', to_jsonb(old)
+    );
+  elsif tg_op = 'DELETE' then
+    payload := jsonb_build_object(
+      'type', 'DELETE',
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', null,
+      'old_record', to_jsonb(old)
+    );
+  end if;
+
+  insert into webhook_logs(webhook_name, event_type, table_name, schema_name, record_data, old_record_data)
+  values (tg_name, tg_op, tg_table_name, tg_table_schema, payload->'record', payload->'old_record');
+
+  return coalesce(new, old);
+end;
+$$;
+create trigger insert_webhook
+after insert on profiles
+for each row
+execute function webhook_handler();
+create trigger update_webhook
+after update on profiles
+for each row
+execute function webhook_handler();
+create trigger delete_webhook
+after delete on profiles
+for each row
+execute function webhook_handler();
+insert into profiles (name, email) values ('John Doe', 'john@example.com');
+insert into profiles (name, email) values ('Jane Smith', 'jane@example.com');
+select id, webhook_name, event_type, table_name, schema_name, record_data - 'created_at' from webhook_logs where event_type = 'INSERT';
+ id |  webhook_name  | event_type | table_name | schema_name |                           ?column?                           
+----+----------------+------------+------------+-------------+--------------------------------------------------------------
+  1 | insert_webhook | INSERT     | profiles   | public      | {"id": 1, "name": "John Doe", "email": "john@example.com"}
+  2 | insert_webhook | INSERT     | profiles   | public      | {"id": 2, "name": "Jane Smith", "email": "jane@example.com"}
+(2 rows)
+
+update profiles set email = 'john.doe@example.com' where name = 'John Doe';
+select id, webhook_name, event_type, table_name, schema_name, record_data - 'created_at', old_record_data - 'created_at' from webhook_logs where event_type = 'UPDATE';
+ id |  webhook_name  | event_type | table_name | schema_name |                            ?column?                            |                          ?column?                          
+----+----------------+------------+------------+-------------+----------------------------------------------------------------+------------------------------------------------------------
+  3 | update_webhook | UPDATE     | profiles   | public      | {"id": 1, "name": "John Doe", "email": "john.doe@example.com"} | {"id": 1, "name": "John Doe", "email": "john@example.com"}
+(1 row)
+
+delete from profiles where name = 'Jane Smith';
+select id, webhook_name, event_type, table_name, schema_name, old_record_data - 'created_at' from webhook_logs where event_type = 'DELETE';
+ id |  webhook_name  | event_type | table_name | schema_name |                           ?column?                           
+----+----------------+------------+------------+-------------+--------------------------------------------------------------
+  4 | delete_webhook | DELETE     | profiles   | public      | {"id": 2, "name": "Jane Smith", "email": "jane@example.com"}
+(1 row)
+
+create table orders (
+  id serial primary key,
+  customer_id integer,
+  amount numeric,
+  status text
+);
+create table webhook_requests (
+  id serial primary key,
+  webhook_name text,
+  url text,
+  method text,
+  headers jsonb,
+  payload jsonb,
+  response_status integer,
+  response_data jsonb,
+  created_at timestamp default now()
+);
+create function mock_http_response(url text)
+returns table(status integer, body jsonb)
+language plpgsql
+as $$
+begin
+  if url like '%dummyjson.com/products/1%' then
+    return query select 200, '{"id": 1, "title": "Essence Mascara Lash Princess", "price": 9.99, "category": "beauty"}'::jsonb;
+  elsif url like '%dummyjson.com/products/2%' then
+    return query select 200, '{"id": 2, "title": "Eyeshadow Palette with Mirror", "price": 19.99, "category": "beauty"}'::jsonb;
+  else
+    return query select 404, '{"error": "Product not found"}'::jsonb;
+  end if;
+end;
+$$;
+create function http_webhook_handler()
+returns trigger
+language plpgsql
+as $$
+declare
+  response_code integer;
+  response_body jsonb;
+begin
+  select status, body into response_code, response_body
+  from mock_http_response('https://dummyjson.com/products/1');
+  
+  insert into webhook_requests(webhook_name, url, method, headers, payload, response_status, response_data)
+  values (
+    'orders_webhook',
+    'https://dummyjson.com/products/1',
+    'GET',
+    '{"Content-Type": "application/json"}'::jsonb,
+    jsonb_build_object(
+      'type', tg_op,
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', to_jsonb(new),
+      'old_record', to_jsonb(old)
+    ),
+    response_code,
+    response_body
+  );
+  
+  return coalesce(new, old);
+end;
+$$;
+create trigger http_webhook
+after insert or update or delete on orders
+for each row
+execute function http_webhook_handler();
+insert into orders (customer_id, amount, status) values (1, 100.50, 'pending');
+insert into orders (customer_id, amount, status) values (2, 250.75, 'completed');
+select id, webhook_name, url, method, response_status, response_data from webhook_requests;
+ id |  webhook_name  |               url                | method | response_status |                                      response_data                                       
+----+----------------+----------------------------------+--------+-----------------+------------------------------------------------------------------------------------------
+  1 | orders_webhook | https://dummyjson.com/products/1 | GET    |             200 | {"id": 1, "price": 9.99, "title": "Essence Mascara Lash Princess", "category": "beauty"}
+  2 | orders_webhook | https://dummyjson.com/products/1 | GET    |             200 | {"id": 1, "price": 9.99, "title": "Essence Mascara Lash Princess", "category": "beauty"}
+(2 rows)
+
+create table webhook_config (
+  id serial primary key,
+  webhook_name text,
+  url text,
+  method text default 'GET',
+  headers jsonb default '{"Content-Type": "application/json"}'::jsonb,
+  timeout_ms integer default 1000
+);
+insert into webhook_config (webhook_name, url, method, headers, timeout_ms) 
+values ('product_webhook', 'https://dummyjson.com/products/2', 'GET', '{"Content-Type": "application/json"}'::jsonb, 5000);
+create function configurable_webhook_handler()
+returns trigger
+language plpgsql
+as $$
+declare
+  config webhook_config%rowtype;
+  payload jsonb;
+  response_code integer;
+  response_body jsonb;
+begin
+  select * into config from webhook_config where webhook_name = 'product_webhook' limit 1;
+  
+  if config.id is null then
+    raise exception 'Webhook configuration not found';
+  end if;
+
+  payload := jsonb_build_object(
+    'type', tg_op,
+    'table', tg_table_name,
+    'schema', tg_table_schema,
+    'record', to_jsonb(new),
+    'old_record', to_jsonb(old)
+  );
+
+  select status, body into response_code, response_body
+  from mock_http_response(config.url);
+
+  insert into webhook_requests(webhook_name, url, method, headers, payload, response_status, response_data)
+  values (config.webhook_name, config.url, config.method, config.headers, payload, response_code, response_body);
+
+  if response_code != 200 then
+    raise exception 'Configurable webhook failed with status: %', response_code;
+  end if;
+
+  return coalesce(new, old);
+end;
+$$;
+create trigger product_webhook
+after insert on profiles
+for each row
+execute function configurable_webhook_handler();
+insert into profiles (name, email) values ('Alice Johnson', 'alice@example.com');
+select id, webhook_name, url, method, response_status, response_data from webhook_requests where webhook_name = 'product_webhook';
+ id |  webhook_name   |               url                | method | response_status |                                       response_data                                       
+----+-----------------+----------------------------------+--------+-----------------+-------------------------------------------------------------------------------------------
+  3 | product_webhook | https://dummyjson.com/products/2 | GET    |             200 | {"id": 2, "price": 19.99, "title": "Eyeshadow Palette with Mirror", "category": "beauty"}
+(1 row)
+
+create function get_webhook_logs()
+returns table (
+  webhook_name text,
+  event_type text,
+  table_name text,
+  record_count bigint
+)
+language sql
+as $$
+  select 
+    webhook_name,
+    event_type,
+    table_name,
+    count(*) as record_count
+  from webhook_logs
+  group by webhook_name, event_type, table_name
+  order by webhook_name, event_type;
+$$;
+select * from get_webhook_logs();
+  webhook_name  | event_type | table_name | record_count 
+----------------+------------+------------+--------------
+ delete_webhook | DELETE     | profiles   |            1
+ insert_webhook | INSERT     | profiles   |            3
+ update_webhook | UPDATE     | profiles   |            1
+(3 rows)
+
+drop trigger product_webhook on profiles;
+drop trigger http_webhook on orders;
+drop trigger delete_webhook on profiles;
+drop trigger update_webhook on profiles;
+drop trigger insert_webhook on profiles;
+drop function configurable_webhook_handler();
+drop function http_webhook_handler();
+drop function mock_http_response(text);
+drop function get_webhook_logs();
+drop function webhook_handler();
+drop table webhook_config;
+drop table webhook_requests;
+drop table webhook_logs;
+drop table orders;
+drop table profiles;
+ 
diff --git a/nix/tests/sql/docs-array-test.sql b/nix/tests/sql/docs-array-test.sql
new file mode 100644
index 000000000..ee81d2ce0
--- /dev/null
+++ b/nix/tests/sql/docs-array-test.sql
@@ -0,0 +1,14 @@
+-- testing sql found in https://supabase.com/docs/guides/database/arrays
+
+create table arraytest (
+  id integer not null,
+  textarray text array
+);
+
+INSERT INTO arraytest (id, textarray) VALUES (1, ARRAY['Harry', 'Larry', 'Moe']);;
+
+select * from arraytest;
+
+SELECT textarray[1], array_length(textarray, 1) FROM arraytest;
+
+drop table arraytest cascade;
diff --git a/nix/tests/sql/docs-cascades-deletes.sql b/nix/tests/sql/docs-cascades-deletes.sql
new file mode 100644
index 000000000..5a3f75c73
--- /dev/null
+++ b/nix/tests/sql/docs-cascades-deletes.sql
@@ -0,0 +1,262 @@
+-- testing sql found in https://supabase.com/docs/guides/database/postgres/cascades-deletes
+-- all of the errors produced by this file are expected
+
+create table grandparent (
+  id serial primary key,
+  name text
+);
+
+create table parent (
+  id serial primary key,
+  name text,
+  parent_id integer references grandparent (id)
+    on delete cascade
+);
+
+create table child (
+  id serial primary key,
+  name text,
+  father integer references parent (id)
+    on delete restrict
+);
+
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+
+select count(*) from grandparent;
+select count(*) from parent;
+select count(*) from child;
+
+delete from grandparent;
+
+select count(*) from grandparent;
+select count(*) from parent;
+select count(*) from child;
+
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+
+alter table child
+drop constraint child_father_fkey;
+
+alter table child
+add constraint child_father_fkey foreign key (father) references parent (id)
+  on delete no action;
+
+delete from grandparent;
+
+select count(*) from grandparent;
+select count(*) from parent;
+select count(*) from child;
+
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+
+alter table child
+drop constraint child_father_fkey;
+
+alter table child
+add constraint child_father_fkey foreign key (father) references parent (id)
+  on delete no action initially deferred;
+
+delete from grandparent;
+
+select count(*) from grandparent;
+select count(*) from parent;
+select count(*) from child;
+
+insert into grandparent
+  (id, name)
+values
+  (1, 'Elizabeth');
+
+insert into parent
+  (id, name, parent_id)
+values
+  (1, 'Charles', 1);
+
+insert into parent
+  (id, name, parent_id)
+values
+  (2, 'Diana', 1);
+
+insert into child
+  (id, name, father)
+values
+  (1, 'William', 1);
+
+alter table child
+add column mother integer references parent (id)
+  on delete cascade;
+
+update child
+set mother = 2
+where id = 1;
+
+delete from grandparent;
+
+select count(*) from grandparent;
+select count(*) from parent;
+select count(*) from child;
+
+create table test_cascade (
+  id serial primary key,
+  name text
+);
+
+create table test_cascade_child (
+  id serial primary key,
+  parent_id integer references test_cascade (id) on delete cascade,
+  name text
+);
+
+insert into test_cascade (name) values ('Parent');
+insert into test_cascade_child (parent_id, name) values (1, 'Child');
+
+delete from test_cascade;
+
+select count(*) from test_cascade;
+select count(*) from test_cascade_child;
+
+create table test_restrict (
+  id serial primary key,
+  name text
+);
+
+create table test_restrict_child (
+  id serial primary key,
+  parent_id integer references test_restrict (id) on delete restrict,
+  name text
+);
+
+insert into test_restrict (name) values ('Parent');
+insert into test_restrict_child (parent_id, name) values (1, 'Child');
+
+delete from test_restrict;
+
+select count(*) from test_restrict;
+select count(*) from test_restrict_child;
+
+create table test_set_null (
+  id serial primary key,
+  name text
+);
+
+create table test_set_null_child (
+  id serial primary key,
+  parent_id integer references test_set_null (id) on delete set null,
+  name text
+);
+
+insert into test_set_null (name) values ('Parent');
+insert into test_set_null_child (parent_id, name) values (1, 'Child');
+
+delete from test_set_null;
+
+select count(*) from test_set_null;
+select count(*) from test_set_null_child;
+select parent_id from test_set_null_child;
+
+create table test_set_default (
+  id serial primary key,
+  name text
+);
+
+create table test_set_default_child (
+  id serial primary key,
+  parent_id integer default 999 references test_set_default (id) on delete set default,
+  name text
+);
+
+insert into test_set_default (name) values ('Parent');
+insert into test_set_default_child (parent_id, name) values (1, 'Child');
+
+delete from test_set_default;
+
+select count(*) from test_set_default;
+select count(*) from test_set_default_child;
+select parent_id from test_set_default_child;
+
+create table test_no_action (
+  id serial primary key,
+  name text
+);
+
+create table test_no_action_child (
+  id serial primary key,
+  parent_id integer references test_no_action (id) on delete no action,
+  name text
+);
+
+insert into test_no_action (name) values ('Parent');
+insert into test_no_action_child (parent_id, name) values (1, 'Child');
+
+delete from test_no_action;
+
+select count(*) from test_no_action;
+select count(*) from test_no_action_child;
+
+drop table if exists test_cascade_child;
+drop table if exists test_cascade;
+drop table if exists test_restrict_child;
+drop table if exists test_restrict;
+drop table if exists test_set_null_child;
+drop table if exists test_set_null;
+drop table if exists test_set_default_child;
+drop table if exists test_set_default;
+drop table if exists test_no_action_child;
+drop table if exists test_no_action;
+drop table if exists child;
+drop table if exists parent;
+drop table if exists grandparent;
diff --git a/nix/tests/sql/docs-connections.sql b/nix/tests/sql/docs-connections.sql
new file mode 100644
index 000000000..500d53ea6
--- /dev/null
+++ b/nix/tests/sql/docs-connections.sql
@@ -0,0 +1,12 @@
+-- testing sql found in https://supabase.com/docs/guides/database/connection-management
+-- we can't test every sql statement in this doc because their results won't be deterministic
+select
+  ssl,
+  datname as database,
+  usename as connected_role,
+  application_name,
+  query,
+  state
+from pg_stat_ssl
+join pg_stat_activity
+on pg_stat_ssl.pid = pg_stat_activity.pid;
diff --git a/nix/tests/sql/docs-enums.sql b/nix/tests/sql/docs-enums.sql
new file mode 100644
index 000000000..f9b54283a
--- /dev/null
+++ b/nix/tests/sql/docs-enums.sql
@@ -0,0 +1,154 @@
+-- testing sql found in https://supabase.com/docs/guides/database/postgresenums
+
+create type mood as enum (
+  'happy',
+  'sad',
+  'excited',
+  'calm'
+);
+
+create table person (
+  id serial primary key,
+  name text,
+  current_mood mood
+);
+
+insert into person
+  (name, current_mood)
+values
+  ('Alice', 'happy');
+
+insert into person
+  (name, current_mood)
+values
+  ('Bob', 'sad');
+
+insert into person
+  (name, current_mood)
+values
+  ('Charlie', 'excited');
+
+select * 
+from person 
+where current_mood = 'sad';
+
+select * 
+from person 
+where current_mood = 'happy';
+
+update person
+set current_mood = 'excited'
+where name = 'Alice';
+
+select * 
+from person 
+where name = 'Alice';
+
+alter type mood add value 'content';
+
+insert into person
+  (name, current_mood)
+values
+  ('David', 'content');
+
+select enum_range(null::mood);
+
+select * 
+from person 
+where current_mood = 'content';
+
+create type status as enum (
+  'active',
+  'inactive',
+  'pending'
+);
+
+create table orders (
+  id serial primary key,
+  order_number text,
+  status status
+);
+
+insert into orders
+  (order_number, status)
+values
+  ('ORD-001', 'active'),
+  ('ORD-002', 'pending'),
+  ('ORD-003', 'inactive');
+
+select * 
+from orders 
+where status = 'active';
+
+update orders
+set status = 'inactive'
+where order_number = 'ORD-002';
+
+select * 
+from orders 
+where order_number = 'ORD-002';
+
+alter type status add value 'cancelled';
+
+insert into orders
+  (order_number, status)
+values
+  ('ORD-004', 'cancelled');
+
+select enum_range(null::status);
+
+select * 
+from orders 
+where status = 'cancelled';
+
+create type priority as enum (
+  'low',
+  'medium',
+  'high',
+  'critical'
+);
+
+create table tasks (
+  id serial primary key,
+  title text,
+  priority priority
+);
+
+insert into tasks
+  (title, priority)
+values
+  ('Fix bug', 'high'),
+  ('Update docs', 'low'),
+  ('Security audit', 'critical');
+
+select * 
+from tasks 
+where priority = 'critical';
+
+update tasks
+set priority = 'medium'
+where title = 'Update docs';
+
+select * 
+from tasks 
+where title = 'Update docs';
+
+alter type priority add value 'urgent';
+
+insert into tasks
+  (title, priority)
+values
+  ('Server maintenance', 'urgent');
+
+select enum_range(null::priority);
+
+select * 
+from tasks 
+where priority = 'urgent';
+
+drop table tasks;
+drop table orders;
+drop table person;
+drop type priority;
+drop type status;
+drop type mood;
diff --git a/nix/tests/sql/docs-full-text-search.sql b/nix/tests/sql/docs-full-text-search.sql
new file mode 100644
index 000000000..d62521e15
--- /dev/null
+++ b/nix/tests/sql/docs-full-text-search.sql
@@ -0,0 +1,197 @@
+-- testing sql found in https://supabase.com/docs/guides/database/full-text-search
+create table books (
+  id serial primary key,
+  title text,
+  author text,
+  description text
+);
+
+insert into books
+  (title, author, description)
+values
+  (
+    'The Poky Little Puppy',
+    'Janette Sebring Lowrey',
+    'Puppy is slower than other, bigger animals.'
+  ),
+  ('The Tale of Peter Rabbit', 'Beatrix Potter', 'Rabbit eats some vegetables.'),
+  ('Tootle', 'Gertrude Crampton', 'Little toy train has big dreams.'),
+  (
+    'Green Eggs and Ham',
+    'Dr. Seuss',
+    'Sam has changing food preferences and eats unusually colored food.'
+  ),
+  (
+    'Harry Potter and the Goblet of Fire',
+    'J.K. Rowling',
+    'Fourth year of school starts, big drama ensues.'
+  );
+
+select to_tsvector('green eggs and ham');
+
+select to_tsvector('english', 'green eggs and ham');
+
+select *
+from books
+where title = 'Harry';
+
+select *
+from books
+where to_tsvector(title) @@ to_tsquery('Harry');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description)
+  @@ to_tsquery('big');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description || ' ' || title)
+  @@ to_tsquery('little');
+
+create function title_description(books) returns text as $$
+  select $1.title || ' ' || $1.description;
+$$ language sql immutable;
+
+select
+  *
+from
+  books
+where
+  to_tsvector(title_description(books.*))
+  @@ to_tsquery('little');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description)
+  @@ to_tsquery('little & big');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description)
+  @@ to_tsquery('little | big');
+
+select title from books where to_tsvector(title) @@ to_tsquery('Lit:*');
+
+create or replace function search_books_by_title_prefix(prefix text)
+returns setof books AS $$
+begin
+  return query
+  select * from books where to_tsvector('english', title) @@ to_tsquery(prefix || ':*');
+end;
+$$ language plpgsql;
+
+select * from search_books_by_title_prefix('Lit');
+
+select * from search_books_by_title_prefix('Little+Puppy');
+
+alter table
+  books
+add column
+  fts tsvector generated always as (to_tsvector('english', description || ' ' || title)) stored;
+
+create index books_fts on books using gin (fts);
+
+select id, fts
+from books;
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('little & big');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('big <-> dreams');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('year <2> school');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('big & !little');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(title) @@ to_tsquery('harry & potter');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(description) @@ to_tsquery('food & !egg');
+
+select
+  *
+from
+  books
+where
+  to_tsvector(title || ' ' || description) @@ to_tsquery('train & toy');
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('puppy & slow');
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('rabbit | peter');
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('harry <-> potter');
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('fourth <3> year');
+
+select
+  *
+from
+  books
+where
+  fts @@ to_tsquery('big & !drama');
+
+drop function search_books_by_title_prefix(text);
+drop function title_description(books);
+drop table books;
+ 
\ No newline at end of file
diff --git a/nix/tests/sql/docs-functions.sql b/nix/tests/sql/docs-functions.sql
new file mode 100644
index 000000000..f91f17261
--- /dev/null
+++ b/nix/tests/sql/docs-functions.sql
@@ -0,0 +1,225 @@
+-- testing sql found in https://supabase.com/docs/guides/database/functions
+
+create or replace function hello_world()
+returns text
+language sql
+as $$
+  select 'hello world';
+$$;
+
+select hello_world();
+
+create table planets (
+  id serial primary key,
+  name text
+);
+
+insert into planets
+  (id, name)
+values
+  (1, 'Tattoine'),
+  (2, 'Alderaan'),
+  (3, 'Kashyyyk');
+
+create table people (
+  id serial primary key,
+  name text,
+  planet_id bigint references planets
+);
+
+insert into people
+  (id, name, planet_id)
+values
+  (1, 'Anakin Skywalker', 1),
+  (2, 'Luke Skywalker', 1),
+  (3, 'Princess Leia', 2),
+  (4, 'Chewbacca', 3);
+
+create or replace function get_planets()
+returns setof planets
+language sql
+as $$
+  select * from planets;
+$$;
+
+select *
+from get_planets()
+where id = 1;
+
+create or replace function add_planet(name text)
+returns bigint
+language plpgsql
+as $$
+declare
+  new_row bigint;
+begin
+  insert into planets(name)
+  values (add_planet.name)
+  returning id into new_row;
+
+  return new_row;
+end;
+$$;
+
+select * from add_planet('Jakku');
+
+create function hello_world_definer()
+returns text
+language plpgsql
+security definer set search_path = ''
+as $$
+begin
+  select 'hello world';
+end;
+$$;
+
+select hello_world_definer();
+
+revoke execute on function public.hello_world from public;
+revoke execute on function public.hello_world from anon;
+
+grant execute on function public.hello_world to authenticated;
+
+revoke execute on all functions in schema public from public;
+revoke execute on all functions in schema public from anon, authenticated;
+
+alter default privileges in schema public revoke execute on functions from public;
+alter default privileges in schema public revoke execute on functions from anon, authenticated;
+
+grant execute on function public.hello_world to authenticated;
+
+create function logging_example(
+  log_message text,
+  warning_message text,
+  error_message text
+)
+returns void
+language plpgsql
+as $$
+begin
+  raise log 'logging message: %', log_message;
+  raise warning 'logging warning: %', warning_message;
+  raise exception 'logging error: %', error_message;
+end;
+$$;
+
+select logging_example('LOGGED MESSAGE', 'WARNING MESSAGE', 'ERROR MESSAGE');
+
+create or replace function error_if_null(some_val text)
+returns text
+language plpgsql
+as $$
+begin
+  if some_val is null then
+    raise exception 'some_val should not be NULL';
+  end if;
+  return some_val;
+end;
+$$;
+
+select error_if_null('not null');
+
+create table attendance_table (
+  id uuid primary key,
+  student text
+);
+
+insert into attendance_table (id, student) values ('123e4567-e89b-12d3-a456-426614174000', 'Harry Potter');
+
+create function assert_example(name text)
+returns uuid
+language plpgsql
+as $$
+declare
+  student_id uuid;
+begin
+  select
+    id into student_id
+  from attendance_table
+  where student = name;
+
+  assert student_id is not null, 'assert_example() ERROR: student not found';
+
+  return student_id;
+end;
+$$;
+
+select assert_example('Harry Potter');
+
+create function error_example()
+returns void
+language plpgsql
+as $$
+begin
+  select * from table_that_does_not_exist;
+
+  exception
+      when others then
+          raise exception 'An error occurred in function <function name>: %', sqlerrm;
+end;
+$$;
+
+select error_example();
+
+create table some_table (
+  col_1 int,
+  col_2 text
+);
+
+insert into some_table (col_1, col_2) values (42, 'test value');
+
+create or replace function advanced_example(num int default 10)
+returns text
+language plpgsql
+as $$
+declare
+    var1 int := 20;
+    var2 text;
+begin
+    raise log 'logging start of function call: (%)', (select now());
+
+    select
+      col_1 into var1
+    from some_table
+    limit 1;
+    raise log 'logging a variable (%)', var1;
+
+    raise log 'logging a query with a single return value(%)', (select col_1 from some_table limit 1);
+
+    raise log 'logging an entire row as JSON (%)', (select to_jsonb(some_table.*) from some_table limit 1);
+
+    insert into some_table (col_2)
+    values ('new val')
+    returning col_2 into var2;
+
+    raise log 'logging a value from an INSERT (%)', var2;
+
+    return var1 || ',' || var2;
+exception
+    when others then
+        raise exception 'An error occurred in function <advanced_example>: %', sqlerrm;
+end;
+$$;
+
+select advanced_example();
+
+drop function advanced_example(int);
+drop function error_example();
+drop function assert_example(text);
+drop function error_if_null(text);
+drop function logging_example(text, text, text);
+drop function hello_world_definer();
+drop function add_planet(text);
+drop function get_planets();
+drop function hello_world();
+drop table people;
+drop table planets;
+drop table attendance_table;
+drop table some_table;
+
+grant execute on all functions in schema public to public;
+grant execute on all functions in schema public to anon, authenticated;
+
+alter default privileges in schema public grant execute on functions to public;
+alter default privileges in schema public grant execute on functions to anon, authenticated;
+ 
\ No newline at end of file
diff --git a/nix/tests/sql/docs-indexes.sql b/nix/tests/sql/docs-indexes.sql
new file mode 100644
index 000000000..9d874adb0
--- /dev/null
+++ b/nix/tests/sql/docs-indexes.sql
@@ -0,0 +1,26 @@
+-- testing sql found in https://supabase.com/docs/guides/database/indexes
+
+create table persons (
+  id bigint generated by default as identity primary key,
+  age int,
+  height int,
+  weight int,
+  name text,
+  deceased boolean
+);
+
+insert into persons (age, height, weight, name, deceased) values (32, 180, 70, 'John Doe', false);
+
+select name from persons where age = 32;
+
+create index idx_persons_age on persons (age);
+
+create index idx_living_persons_age on persons (age) where deceased is false;
+
+create index idx_persons_age_desc on persons (age desc nulls last);
+
+reindex index concurrently idx_persons_age;
+
+reindex table concurrently persons;
+
+drop table persons cascade;
diff --git a/nix/tests/sql/docs-json.sql b/nix/tests/sql/docs-json.sql
new file mode 100644
index 000000000..49b62338c
--- /dev/null
+++ b/nix/tests/sql/docs-json.sql
@@ -0,0 +1,47 @@
+-- testing sql found in https://supabase.com/docs/guides/database/json
+
+create table books (
+  id serial primary key,
+  title text,
+  author text,
+  metadata jsonb
+);
+
+insert into books
+  (title, author, metadata)
+values
+  (
+    'The Poky Little Puppy',
+    'Janette Sebring Lowrey',
+    '{"description":"Puppy is slower than other, bigger animals.","price":5.95,"ages":[3,6]}'
+  ),
+  (
+    'The Tale of Peter Rabbit',
+    'Beatrix Potter',
+    '{"description":"Rabbit eats some vegetables.","price":4.49,"ages":[2,5]}'
+  ),
+  (
+    'Tootle',
+    'Gertrude Crampton',
+    '{"description":"Little toy train has big dreams.","price":3.99,"ages":[2,5]}'
+  ),
+  (
+    'Green Eggs and Ham',
+    'Dr. Seuss',
+    '{"description":"Sam has changing food preferences and eats unusually colored food.","price":7.49,"ages":[4,8]}'
+  ),
+  (
+    'Harry Potter and the Goblet of Fire',
+    'J.K. Rowling',
+    '{"description":"Fourth year of school starts, big drama ensues.","price":24.95,"ages":[10,99]}'
+  );
+
+select
+  title,
+  metadata ->> 'description' as description, -- returned as text
+  metadata -> 'price' as price,
+  metadata -> 'ages' -> 0 as low_age,
+  metadata -> 'ages' -> 1 as high_age
+from books;
+
+drop table books cascade;
diff --git a/nix/tests/sql/docs-partitioning.sql b/nix/tests/sql/docs-partitioning.sql
new file mode 100644
index 000000000..6037d526a
--- /dev/null
+++ b/nix/tests/sql/docs-partitioning.sql
@@ -0,0 +1,89 @@
+-- testing sql found in https://supabase.com/docs/guides/database/partitioning
+
+create table sales (
+    id bigint generated by default as identity,
+    order_date date not null,
+    customer_id bigint,
+    amount bigint,
+    primary key (order_date, id)
+)
+partition by range (order_date);
+
+create table sales_2000_01
+	partition of sales
+  for values from ('2000-01-01') to ('2000-02-01');
+
+create table sales_2000_02
+	partition of sales
+	for values from ('2000-02-01') to ('2000-03-01');
+
+insert into sales (order_date, customer_id, amount) values
+  ('2000-01-15', 1, 100),
+  ('2000-01-20', 2, 200),
+  ('2000-02-10', 3, 150),
+  ('2000-02-25', 4, 300);
+
+select * from sales where order_date >= '2000-01-01' and order_date < '2000-03-01';
+
+select * from sales_2000_02;
+
+drop table sales cascade;
+
+create table customers (
+    id bigint generated by default as identity,
+    name text,
+    country text,
+    primary key (country, id)
+)
+partition by list(country);
+
+create table customers_americas
+	partition of customers
+	for values in ('US', 'CANADA');
+
+create table customers_asia
+	partition of customers
+  for values in ('INDIA', 'CHINA', 'JAPAN');
+
+insert into customers (name, country) values
+  ('John Doe', 'US'),
+  ('Jane Smith', 'CANADA'),
+  ('Li Wei', 'CHINA'),
+  ('Priya Patel', 'INDIA'),
+  ('Yuki Tanaka', 'JAPAN');
+
+select * from customers where country in ('US', 'CANADA');
+
+select * from customers_asia;
+
+drop table customers cascade;
+
+create table products (
+    id bigint generated by default as identity,
+    name text,
+    category text,
+    price bigint
+)
+partition by hash (id);
+
+create table products_one
+	partition of products
+  for values with (modulus 2, remainder 1);
+
+create table products_two
+	partition of products
+  for values with (modulus 2, remainder 0);
+
+insert into products (name, category, price) values
+  ('Laptop', 'Electronics', 999),
+  ('Phone', 'Electronics', 599),
+  ('Book', 'Education', 29),
+  ('Chair', 'Furniture', 199);
+
+select * from products where category = 'Electronics';
+
+select count(*) from products_one;
+
+select count(*) from products_two;
+
+drop table products cascade; 
diff --git a/nix/tests/sql/docs-tables-and-data.sql b/nix/tests/sql/docs-tables-and-data.sql
new file mode 100644
index 000000000..30a2a3cb9
--- /dev/null
+++ b/nix/tests/sql/docs-tables-and-data.sql
@@ -0,0 +1,249 @@
+-- Test file for "Tables and Data" documentation
+-- This file contains all SQL statements from https://supabase.com/docs/guides/database/tables-and-data
+
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+
+select table_name, column_name, data_type, is_nullable, column_default
+from information_schema.columns 
+where table_name = 'movies' 
+order by ordinal_position;
+
+drop table if exists movies;
+create table movies (
+  id bigint generated always as identity primary key
+);
+
+select column_name, data_type, is_nullable, column_default, is_identity, identity_generation
+from information_schema.columns 
+where table_name = 'movies' and column_name = 'id';
+
+
+
+drop table if exists movies;
+create table movies (
+  id bigint generated by default as identity primary key
+);
+
+select column_name, data_type, is_nullable, column_default, is_identity, identity_generation
+from information_schema.columns 
+where table_name = 'movies' and column_name = 'id';
+
+drop table if exists movies;
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+
+insert into movies
+  (name, description)
+values
+  (
+    'The Empire Strikes Back',
+    'After the Rebels are brutally overpowered by the Empire on the ice planet Hoth, Luke Skywalker begins Jedi training with Yoda.'
+  ),
+  (
+    'Return of the Jedi',
+    'After a daring mission to rescue Han Solo from Jabba the Hutt, the Rebels dispatch to Endor to destroy the second Death Star.'
+  );
+
+select id, name, description from movies order by id;
+
+drop table if exists movies;
+drop table if exists categories;
+
+create table categories (
+  id bigint generated always as identity primary key,
+  name text 
+);
+
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+
+alter table movies
+  add column category_id bigint references categories;
+
+
+select 
+  tc.table_name, 
+  kcu.column_name, 
+  ccu.table_name as foreign_table_name,
+  ccu.column_name as foreign_column_name 
+from information_schema.table_constraints as tc 
+join information_schema.key_column_usage as kcu
+  on tc.constraint_name = kcu.constraint_name
+  and tc.table_schema = kcu.table_schema
+join information_schema.constraint_column_usage as ccu
+  on ccu.constraint_name = tc.constraint_name
+  and ccu.table_schema = tc.table_schema
+where tc.constraint_type = 'FOREIGN KEY' and tc.table_name='movies';
+
+
+drop table if exists performances;
+drop table if exists actors;
+drop table if exists movies;
+
+create table movies (
+  id bigint generated by default as identity primary key,
+  name text,
+  description text
+);
+
+create table actors (
+  id bigint generated by default as identity primary key,
+  name text
+);
+
+create table performances (
+  id bigint generated by default as identity primary key,
+  movie_id bigint not null references movies,
+  actor_id bigint not null references actors
+);
+
+select table_name from information_schema.tables 
+where table_name in ('movies', 'actors', 'performances') 
+order by table_name;
+
+
+
+create schema private;
+
+select schema_name from information_schema.schemata where schema_name = 'private';
+
+drop table if exists private.salaries;
+drop table if exists actors cascade;
+
+create table actors (
+  id bigint generated by default as identity primary key,
+  name text
+);
+
+create table private.salaries (
+  id bigint generated by default as identity primary key,
+  salary bigint not null,
+  actor_id bigint not null references public.actors
+);
+
+select table_schema, table_name from information_schema.tables 
+where table_schema = 'private' and table_name = 'salaries';
+
+drop table if exists grades;
+drop table if exists courses;
+drop table if exists students;
+drop view if exists transcripts;
+
+create table students (
+  id bigint generated by default as identity primary key,
+  name text,
+  type text
+);
+
+create table courses (
+  id bigint generated by default as identity primary key,
+  title text,
+  code text
+);
+
+create table grades (
+  id bigint generated by default as identity primary key,
+  student_id bigint not null references students,
+  course_id bigint not null references courses,
+  result text
+);
+
+-- Insert test data
+insert into students (name, type) values
+  ('Princess Leia', 'undergraduate'),
+  ('Yoda', 'graduate'),
+  ('Anakin Skywalker', 'graduate');
+
+insert into courses (title, code) values
+  ('Introduction to Postgres', 'PG101'),
+  ('Authentication Theories', 'AUTH205'),
+  ('Fundamentals of Supabase', 'SUP412');
+
+insert into grades (student_id, course_id, result) values
+  (1, 1, 'B+'),
+  (1, 3, 'A+'),
+  (2, 2, 'A'),
+  (3, 1, 'A-'),
+  (3, 2, 'A'),
+  (3, 3, 'B-');
+
+-- Create view
+create view transcripts as
+    select
+        students.name,
+        students.type,
+        courses.title,
+        courses.code,
+        grades.result
+    from grades
+    left join students on grades.student_id = students.id
+    left join courses on grades.course_id = courses.id;
+
+grant all on table transcripts to authenticated;
+
+select name, type, title, code, result from transcripts order by name, code;
+
+drop materialized view if exists transcripts_materialized;
+
+create materialized view transcripts_materialized as
+  select
+    students.name,
+    students.type,
+    courses.title,
+    courses.code,
+    grades.result
+  from
+    grades
+    left join students on grades.student_id = students.id
+    left join courses on grades.course_id = courses.id;
+
+
+select name, type, title, code, result from transcripts_materialized order by name, code;
+
+refresh materialized view transcripts_materialized;
+
+select count(*) from transcripts_materialized;
+
+drop view if exists secure_transcripts;
+
+create view secure_transcripts with(security_invoker=true) as (
+  select name, type, title, code, result from transcripts
+);
+
+
+select schemaname, viewname 
+from pg_views 
+where viewname = 'secure_transcripts';
+
+drop view if exists test_view;
+create view test_view as select 1 as test_col;
+
+alter view test_view set (security_invoker = true);
+
+select schemaname, viewname 
+from pg_views 
+where viewname = 'test_view';
+
+drop materialized view if exists transcripts_materialized;
+drop view if exists secure_transcripts;
+drop view if exists transcripts;
+drop view if exists test_view;
+drop table if exists grades;
+drop table if exists courses;
+drop table if exists students;
+drop table if exists private.salaries;
+drop table if exists actors;
+drop table if exists performances;
+drop table if exists movies;
+drop table if exists categories;
+drop schema if exists private;
diff --git a/nix/tests/sql/docs-triggers.sql b/nix/tests/sql/docs-triggers.sql
new file mode 100644
index 000000000..1f132bfae
--- /dev/null
+++ b/nix/tests/sql/docs-triggers.sql
@@ -0,0 +1,226 @@
+-- testing sql found in https://supabase.com/docs/guides/database/postgres/triggers
+
+create table employees (
+  id serial primary key,
+  name text,
+  salary numeric
+);
+
+create table salary_log (
+  id serial primary key,
+  employee_id integer,
+  old_salary numeric,
+  new_salary numeric,
+  created_at timestamp default now()
+);
+
+create function update_salary_log()
+returns trigger
+language plpgsql
+as $$
+begin
+  insert into salary_log(employee_id, old_salary, new_salary)
+  values (new.id, old.salary, new.salary);
+  return new;
+end;
+$$;
+
+create trigger salary_update_trigger
+after update on employees
+for each row
+execute function update_salary_log();
+
+insert into employees (name, salary) values ('John Doe', 50000);
+insert into employees (name, salary) values ('Jane Smith', 60000);
+
+update employees set salary = 55000 where name = 'John Doe';
+
+select id, employee_id, old_salary, new_salary from salary_log;
+
+create table orders (
+  id serial primary key,
+  customer_id integer,
+  amount numeric,
+  status text
+);
+
+create table customers (
+  id serial primary key,
+  name text,
+  email text
+);
+
+create function before_insert_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  if new.amount <= 0 then
+    raise exception 'Order amount must be greater than 0';
+  end if;
+  return new;
+end;
+$$;
+
+create trigger before_insert_trigger
+before insert on orders
+for each row
+execute function before_insert_function();
+
+create table customer_audit (
+  id serial primary key,
+  customer_id integer,
+  action text,
+  customer_name text,
+  deleted_at timestamp default now()
+);
+
+create function after_delete_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  insert into customer_audit(customer_id, action, customer_name)
+  values (old.id, 'DELETE', old.name);
+  return old;
+end;
+$$;
+
+create trigger after_delete_trigger
+after delete on customers
+for each row
+execute function after_delete_function();
+
+insert into customers (name, email) values ('Alice Johnson', 'alice@example.com');
+insert into customers (name, email) values ('Bob Wilson', 'bob@example.com');
+
+insert into orders (customer_id, amount, status) values (1, 100.50, 'pending');
+insert into orders (customer_id, amount, status) values (2, 250.75, 'pending');
+
+delete from customers where name = 'Alice Johnson';
+
+select id, customer_id, action, customer_name from customer_audit;
+
+create table trigger_events (
+  id serial primary key,
+  trigger_name text,
+  operation text,
+  table_name text,
+  event_time timestamp default now()
+);
+
+create function statement_level_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  insert into trigger_events(trigger_name, operation, table_name)
+  values (tg_name, tg_op, tg_table_name);
+  return null;
+end;
+$$;
+
+create trigger statement_level_trigger
+after insert on orders
+for each statement
+execute function statement_level_function();
+
+insert into orders (customer_id, amount, status) values (2, 150.25, 'pending');
+
+select id, trigger_name, operation, table_name from trigger_events;
+
+create table trigger_variables_log (
+  id serial primary key,
+  trigger_name text,
+  trigger_when text,
+  operation text,
+  table_name text,
+  table_schema text,
+  row_id integer,
+  event_time timestamp default now()
+);
+
+create function trigger_variables_example()
+returns trigger
+language plpgsql
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into trigger_variables_log(trigger_name, trigger_when, operation, table_name, table_schema, row_id)
+    values (tg_name, tg_when, tg_op, tg_table_name, tg_table_schema, new.id);
+  elsif tg_op = 'UPDATE' then
+    insert into trigger_variables_log(trigger_name, trigger_when, operation, table_name, table_schema, row_id)
+    values (tg_name, tg_when, tg_op, tg_table_name, tg_table_schema, new.id);
+  elsif tg_op = 'DELETE' then
+    insert into trigger_variables_log(trigger_name, trigger_when, operation, table_name, table_schema, row_id)
+    values (tg_name, tg_when, tg_op, tg_table_name, tg_table_schema, old.id);
+  end if;
+  
+  return coalesce(new, old);
+end;
+$$;
+
+create trigger variables_trigger
+after insert or update or delete on employees
+for each row
+execute function trigger_variables_example();
+
+insert into employees (name, salary) values ('Charlie Brown', 45000);
+update employees set salary = 47000 where name = 'Charlie Brown';
+delete from employees where name = 'Charlie Brown';
+
+select id, trigger_name, trigger_when, operation, table_name, table_schema, row_id from trigger_variables_log;
+
+create table high_salary_alerts (
+  id serial primary key,
+  employee_name text,
+  salary numeric,
+  alert_time timestamp default now()
+);
+
+create function conditional_trigger_function()
+returns trigger
+language plpgsql
+as $$
+begin
+  if new.salary > 100000 then
+    insert into high_salary_alerts(employee_name, salary)
+    values (new.name, new.salary);
+  end if;
+  return new;
+end;
+$$;
+
+create trigger conditional_trigger
+after insert or update on employees
+for each row
+when (new.salary > 100000)
+execute function conditional_trigger_function();
+
+insert into employees (name, salary) values ('Executive', 150000);
+insert into employees (name, salary) values ('Intern', 30000);
+
+select id, employee_name, salary from high_salary_alerts;
+
+drop trigger conditional_trigger on employees;
+drop trigger variables_trigger on employees;
+drop trigger statement_level_trigger on orders;
+drop trigger after_delete_trigger on customers;
+drop trigger before_insert_trigger on orders;
+drop trigger salary_update_trigger on employees;
+
+drop function conditional_trigger_function();
+drop function trigger_variables_example();
+drop function statement_level_function();
+drop function after_delete_function();
+drop function before_insert_function();
+drop function update_salary_log();
+
+drop table high_salary_alerts;
+drop table trigger_variables_log;
+drop table trigger_events;
+drop table customer_audit;
+drop table salary_log;
+drop table employees;
+drop table orders;
+drop table customers;
diff --git a/nix/tests/sql/docs-webhooks.sql b/nix/tests/sql/docs-webhooks.sql
new file mode 100644
index 000000000..56ce68144
--- /dev/null
+++ b/nix/tests/sql/docs-webhooks.sql
@@ -0,0 +1,262 @@
+-- testing sql found in https://supabase.com/docs/guides/database/webhooks
+
+create table profiles (
+  id serial primary key,
+  name text,
+  email text,
+  created_at timestamp default now()
+);
+
+create table webhook_logs (
+  id serial primary key,
+  webhook_name text,
+  event_type text,
+  table_name text,
+  schema_name text,
+  record_data jsonb,
+  old_record_data jsonb,
+  created_at timestamp default now()
+);
+
+create function webhook_handler()
+returns trigger
+language plpgsql
+as $$
+declare
+  payload jsonb;
+begin
+  if tg_op = 'INSERT' then
+    payload := jsonb_build_object(
+      'type', 'INSERT',
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', to_jsonb(new),
+      'old_record', null
+    );
+  elsif tg_op = 'UPDATE' then
+    payload := jsonb_build_object(
+      'type', 'UPDATE',
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', to_jsonb(new),
+      'old_record', to_jsonb(old)
+    );
+  elsif tg_op = 'DELETE' then
+    payload := jsonb_build_object(
+      'type', 'DELETE',
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', null,
+      'old_record', to_jsonb(old)
+    );
+  end if;
+
+  insert into webhook_logs(webhook_name, event_type, table_name, schema_name, record_data, old_record_data)
+  values (tg_name, tg_op, tg_table_name, tg_table_schema, payload->'record', payload->'old_record');
+
+  return coalesce(new, old);
+end;
+$$;
+
+create trigger insert_webhook
+after insert on profiles
+for each row
+execute function webhook_handler();
+
+create trigger update_webhook
+after update on profiles
+for each row
+execute function webhook_handler();
+
+create trigger delete_webhook
+after delete on profiles
+for each row
+execute function webhook_handler();
+
+insert into profiles (name, email) values ('John Doe', 'john@example.com');
+insert into profiles (name, email) values ('Jane Smith', 'jane@example.com');
+
+select id, webhook_name, event_type, table_name, schema_name, record_data - 'created_at' from webhook_logs where event_type = 'INSERT';
+
+update profiles set email = 'john.doe@example.com' where name = 'John Doe';
+
+select id, webhook_name, event_type, table_name, schema_name, record_data - 'created_at', old_record_data - 'created_at' from webhook_logs where event_type = 'UPDATE';
+
+delete from profiles where name = 'Jane Smith';
+
+select id, webhook_name, event_type, table_name, schema_name, old_record_data - 'created_at' from webhook_logs where event_type = 'DELETE';
+
+create table orders (
+  id serial primary key,
+  customer_id integer,
+  amount numeric,
+  status text
+);
+
+create table webhook_requests (
+  id serial primary key,
+  webhook_name text,
+  url text,
+  method text,
+  headers jsonb,
+  payload jsonb,
+  response_status integer,
+  response_data jsonb,
+  created_at timestamp default now()
+);
+
+create function mock_http_response(url text)
+returns table(status integer, body jsonb)
+language plpgsql
+as $$
+begin
+  if url like '%dummyjson.com/products/1%' then
+    return query select 200, '{"id": 1, "title": "Essence Mascara Lash Princess", "price": 9.99, "category": "beauty"}'::jsonb;
+  elsif url like '%dummyjson.com/products/2%' then
+    return query select 200, '{"id": 2, "title": "Eyeshadow Palette with Mirror", "price": 19.99, "category": "beauty"}'::jsonb;
+  else
+    return query select 404, '{"error": "Product not found"}'::jsonb;
+  end if;
+end;
+$$;
+
+create function http_webhook_handler()
+returns trigger
+language plpgsql
+as $$
+declare
+  response_code integer;
+  response_body jsonb;
+begin
+  select status, body into response_code, response_body
+  from mock_http_response('https://dummyjson.com/products/1');
+  
+  insert into webhook_requests(webhook_name, url, method, headers, payload, response_status, response_data)
+  values (
+    'orders_webhook',
+    'https://dummyjson.com/products/1',
+    'GET',
+    '{"Content-Type": "application/json"}'::jsonb,
+    jsonb_build_object(
+      'type', tg_op,
+      'table', tg_table_name,
+      'schema', tg_table_schema,
+      'record', to_jsonb(new),
+      'old_record', to_jsonb(old)
+    ),
+    response_code,
+    response_body
+  );
+  
+  return coalesce(new, old);
+end;
+$$;
+
+create trigger http_webhook
+after insert or update or delete on orders
+for each row
+execute function http_webhook_handler();
+
+insert into orders (customer_id, amount, status) values (1, 100.50, 'pending');
+insert into orders (customer_id, amount, status) values (2, 250.75, 'completed');
+
+select id, webhook_name, url, method, response_status, response_data from webhook_requests;
+
+create table webhook_config (
+  id serial primary key,
+  webhook_name text,
+  url text,
+  method text default 'GET',
+  headers jsonb default '{"Content-Type": "application/json"}'::jsonb,
+  timeout_ms integer default 1000
+);
+
+insert into webhook_config (webhook_name, url, method, headers, timeout_ms) 
+values ('product_webhook', 'https://dummyjson.com/products/2', 'GET', '{"Content-Type": "application/json"}'::jsonb, 5000);
+
+create function configurable_webhook_handler()
+returns trigger
+language plpgsql
+as $$
+declare
+  config webhook_config%rowtype;
+  payload jsonb;
+  response_code integer;
+  response_body jsonb;
+begin
+  select * into config from webhook_config where webhook_name = 'product_webhook' limit 1;
+  
+  if config.id is null then
+    raise exception 'Webhook configuration not found';
+  end if;
+
+  payload := jsonb_build_object(
+    'type', tg_op,
+    'table', tg_table_name,
+    'schema', tg_table_schema,
+    'record', to_jsonb(new),
+    'old_record', to_jsonb(old)
+  );
+
+  select status, body into response_code, response_body
+  from mock_http_response(config.url);
+
+  insert into webhook_requests(webhook_name, url, method, headers, payload, response_status, response_data)
+  values (config.webhook_name, config.url, config.method, config.headers, payload, response_code, response_body);
+
+  if response_code != 200 then
+    raise exception 'Configurable webhook failed with status: %', response_code;
+  end if;
+
+  return coalesce(new, old);
+end;
+$$;
+
+create trigger product_webhook
+after insert on profiles
+for each row
+execute function configurable_webhook_handler();
+
+insert into profiles (name, email) values ('Alice Johnson', 'alice@example.com');
+
+select id, webhook_name, url, method, response_status, response_data from webhook_requests where webhook_name = 'product_webhook';
+
+create function get_webhook_logs()
+returns table (
+  webhook_name text,
+  event_type text,
+  table_name text,
+  record_count bigint
+)
+language sql
+as $$
+  select 
+    webhook_name,
+    event_type,
+    table_name,
+    count(*) as record_count
+  from webhook_logs
+  group by webhook_name, event_type, table_name
+  order by webhook_name, event_type;
+$$;
+
+select * from get_webhook_logs();
+
+drop trigger product_webhook on profiles;
+drop trigger http_webhook on orders;
+drop trigger delete_webhook on profiles;
+drop trigger update_webhook on profiles;
+drop trigger insert_webhook on profiles;
+
+drop function configurable_webhook_handler();
+drop function http_webhook_handler();
+drop function mock_http_response(text);
+drop function get_webhook_logs();
+drop function webhook_handler();
+
+drop table webhook_config;
+drop table webhook_requests;
+drop table webhook_logs;
+drop table orders;
+drop table profiles;
+ 
\ No newline at end of file

From dcbaa6dd72fdd4c305ebd82301d9ec9582cbfd12 Mon Sep 17 00:00:00 2001
From: Crispy <12525875+Crispy1975@users.noreply.github.com>
Date: Thu, 3 Jul 2025 10:24:14 +0100
Subject: [PATCH 18/64] feat: add the supabase admin agent to the ami build
 (#1679)

* feat: add the supabase admin agent to the ami build

* chore: bump saa

* chore: underscore versus dashes

* chore: correc the uri

* chore: omg squash this later

* chore: xz to gz for saa
---
 .github/workflows/nix-build.yml               | 10 +--
 .github/workflows/testinfra-ami-build.yml     | 14 +--
 ansible/files/permission_check.py             | 10 +++
 .../supabase-admin-agent.sudoers.conf         |  2 +
 .../supabase-admin-agent_salt.service         | 19 ++++
 .../supabase-admin-agent_salt.timer           | 13 +++
 .../tasks/internal/supabase-admin-agent.yml   | 87 +++++++++++++++++++
 ansible/tasks/setup-supabase-internal.yml     | 17 ++--
 ansible/vars.yml                              |  7 +-
 9 files changed, 158 insertions(+), 21 deletions(-)
 create mode 100644 ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
 create mode 100644 ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service
 create mode 100644 ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer
 create mode 100644 ansible/tasks/internal/supabase-admin-agent.yml

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index d562ab6ca..36dc01d05 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -79,19 +79,19 @@ jobs:
             trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
       - name: Build psql bundle
         run: >
-            nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48" 
-            -- --skip-cached --no-nom 
-            --flake ".#checks.$(nix eval --raw --impure --expr 'builtins.currentSystem')"
+          nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48" 
+          -- --skip-cached --no-nom 
+          --flake ".#checks.$(nix eval --raw --impure --expr 'builtins.currentSystem')"
         env:
           AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
           AWS_SESSION_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
-  
+
   run-testinfra:
     needs: build-run-image
     if: ${{ success() }}
     uses: ./.github/workflows/testinfra-ami-build.yml
-    
+
   run-tests:
     needs: build-run-image
     if: ${{ success() }}
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index 8544f1b85..321430c86 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -37,7 +37,7 @@ jobs:
             ubuntu_release: focal
             ubuntu_version: 20.04
             mcpu: neoverse-n1
-    runs-on: ${{ matrix.runner }}    
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 150
     permissions:
       contents: write
@@ -73,7 +73,7 @@ jobs:
           echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
           # Ensure there's a newline at the end of the file
           echo "" >> common-nix.vars.pkr.hcl
-  
+
       - name: Build AMI stage 1
         run: |
           packer init amazon-arm64-nix.pkr.hcl
@@ -84,7 +84,7 @@ jobs:
         run: |
           packer init stage2-nix-psql.pkr.hcl
           GIT_SHA=${{github.sha}}
-          packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl"  -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "git_sha=${GITHUB_SHA}"  stage2-nix-psql.pkr.hcl 
+          packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl"  -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "git_sha=${GITHUB_SHA}"  stage2-nix-psql.pkr.hcl
 
       - name: Run tests
         timeout-minutes: 10
@@ -93,8 +93,8 @@ jobs:
         run: |
           # TODO: use poetry for pkg mgmt
           pip3 install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest pytest-testinfra[paramiko,docker] requests
-          pytest -vv -s testinfra/test_ami_nix.py 
-      
+          pytest -vv -s testinfra/test_ami_nix.py
+
       - name: Cleanup resources on build cancellation
         if: ${{ cancelled() }}
         run: |
@@ -111,7 +111,7 @@ jobs:
           # Define AMI name patterns
           STAGE1_AMI_NAME="supabase-postgres-ci-ami-test-stage-1"
           STAGE2_AMI_NAME="${{ steps.random.outputs.random_string }}"
-          
+
           # Function to deregister AMIs by name pattern
           deregister_ami_by_name() {
             local ami_name_pattern=$1
@@ -121,7 +121,7 @@ jobs:
               aws ec2 deregister-image --region ap-southeast-1 --image-id $ami_id
             done
           }
-          
+
           # Deregister AMIs
           deregister_ami_by_name "$STAGE1_AMI_NAME"
           deregister_ami_by_name "$STAGE2_AMI_NAME"
diff --git a/ansible/files/permission_check.py b/ansible/files/permission_check.py
index a753f69ec..46f458f9a 100644
--- a/ansible/files/permission_check.py
+++ b/ansible/files/permission_check.py
@@ -94,11 +94,17 @@
     "systemd-coredump": [
         {"groupname": "systemd-coredump", "username": "systemd-coredump"}
     ],
+    "supabase-admin-agent": [
+        {"groupname": "supabase-admin-agent", "username": "supabase-admin-agent"},
+        {"groupname": "admin", "username": "supabase-admin-agent"},
+        {"groupname": "salt", "username": "supabase-admin-agent"},
+    ],
 }
 
 # postgresql.service is expected to mount /etc as read-only
 expected_mount = "/etc ro"
 
+
 # This program depends on osquery being installed on the system
 # Function to run osquery
 def run_osquery(query):
@@ -154,6 +160,7 @@ def check_nixbld_users():
 
     print("All nixbld users are in the 'nixbld' group.")
 
+
 def check_postgresql_mount():
     # processes table has the nix .postgres-wrapped path as the
     # binary path, rather than /usr/lib/postgresql/bin/postgres which
@@ -182,6 +189,7 @@ def check_postgresql_mount():
 
     print("postgresql.service mounts /etc as read-only.")
 
+
 def main():
     parser = argparse.ArgumentParser(
         prog="Supabase Postgres Artifact Permissions Checker",
@@ -234,6 +242,7 @@ def main():
         "postgrest",
         "tcpdump",
         "systemd-coredump",
+        "supabase-admin-agent",
     ]
     if not qemu_artifact:
         usernames.append("ec2-instance-connect")
@@ -251,5 +260,6 @@ def main():
     # Check if postgresql.service is using a read-only mount for /etc
     check_postgresql_mount()
 
+
 if __name__ == "__main__":
     main()
diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf b/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
new file mode 100644
index 000000000..6896e2f0c
--- /dev/null
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
@@ -0,0 +1,2 @@
+%supabase-admin-agent ALL= NOPASSWD: /usr/bin/salt-call
+%supabase-admin-agent ALL= NOPASSWD: /usr/bin/gpg --homedir {{ gpgdir }} --import, /usr/bin/gpg --homedir {{ gpgdir }} --list-secret-keys *
diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service
new file mode 100644
index 000000000..92f1d2e31
--- /dev/null
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Configuration management via supabase-admin-agent salt
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result
+User=supabase-admin-agent
+Group=supabase-admin-agent
+StandardOutput=journal
+StandardError=journal
+StateDirectory=supabase-admin-agent
+CacheDirectory=supabase-admin-agent
+
+# Security hardening
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer
new file mode 100644
index 000000000..8044c2e1a
--- /dev/null
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer
@@ -0,0 +1,13 @@
+[Unit]
+Description=Run Supabase supabase-admin-agent salt on a schedule
+Requires=supabase-admin-agent_salt.service
+
+[Timer]
+OnCalendar=*:0/10
+# Random delay up to {{ splay }} seconds splay
+RandomizedDelaySec={{ splay }}
+AccuracySec=1s
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml
new file mode 100644
index 000000000..4e5f87e5e
--- /dev/null
+++ b/ansible/tasks/internal/supabase-admin-agent.yml
@@ -0,0 +1,87 @@
+- name: supabase-admin-agent - system group
+  group:
+    name: supabase-admin-agent
+    system: yes
+
+- name: supabase-admin-agent - system user
+  user:
+    name: supabase-admin-agent
+    group: supabase-admin-agent
+    groups: admin,salt
+    append: yes
+    system: yes
+    shell: /bin/sh
+
+- name: supabase-admin-agent - config dir
+  file:
+    path: /opt/supabase-admin-agent
+    owner: supabase-admin-agent
+    state: directory
+
+- name: supabase-admin-agent - gpg dir
+  file:
+    path: /etc/salt/gpgkeys
+    owner: root
+    group: salt
+    state: directory
+
+- name: give supabase-admin-agent user permissions
+  copy:
+    src: files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
+    dest: /etc/sudoers.d/supabase-admin-agent
+    mode: "0644"
+
+- name: Setting arch (x86)
+  set_fact:
+    arch: "x86"
+  when: platform == "amd64"
+
+- name: Setting arch (arm)
+  set_fact:
+    arch: "arm64"
+  when: platform == "arm64"
+
+- name: Download supabase-admin-agent archive
+  get_url:
+    url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-agent/v{{ supabase_admin_agent_release }}/supabase-admin-agent-{{ supabase_admin_agent_release }}-linux-{{ arch }}.tar.gz"
+    dest: "/tmp/supabase-admin-agent.tar.gz"
+    timeout: 90
+
+- name: supabase-admin-agent - unpack archive in /opt
+  unarchive:
+    remote_src: yes
+    src: /tmp/supabase-admin-agent.tar.gz
+    dest: /opt/supabase-admin-agent/
+    owner: supabase-admin-agent
+    extra_opts:
+      - --strip-components=1
+
+- name: supabase-admin-agent - create symlink
+  ansible.builtin.file:
+    path: /opt/supabase-admin-agent/supabase-admin-agent
+    src: "/opt/supabase-admin-agent/supabase-admin-agent-linux-{{ arch }}"
+    state: link
+    owner: supabase-admin-agent
+    mode: "0755"
+    force: yes
+
+- name: supabase-admin-agent - create salt systemd timer file
+  copy:
+    src: files/supabase_admin_agent_config/supabase-admin-agent_salt.timer
+    dest: /etc/systemd/system/supabase-admin-agent_salt.timer
+
+- name: supabase-admin-agent - create salt service file
+  copy:
+    src: files/supabase_admin_agent_config/supabase-admin-agent_salt.service
+    dest: /etc/systemd/system/supabase-admin-agent_salt.service
+
+- name: supabase-admin-agent - reload systemd
+  systemd:
+    daemon_reload: yes
+
+# Initially ensure supabase-admin-agent is installed but not started
+- name: supabase-admin-agent - DISABLE service
+  systemd:
+    name: supabase-admin-agent_salt
+    enabled: no
+    state: stopped
diff --git a/ansible/tasks/setup-supabase-internal.yml b/ansible/tasks/setup-supabase-internal.yml
index 7aa931763..d5583b597 100644
--- a/ansible/tasks/setup-supabase-internal.yml
+++ b/ansible/tasks/setup-supabase-internal.yml
@@ -34,19 +34,19 @@
     aws configure set default.s3.use_dualstack_endpoint true
 
 - name: install Vector for logging
-  become: yes
+  become: true
   apt:
     deb: "{{ vector_x86_deb }}"
   when: platform == "amd64"
 
 - name: install Vector for logging
-  become: yes
+  become: true
   apt:
     deb: "{{ vector_arm_deb }}"
   when: platform == "arm64"
 
 - name: add Vector to postgres group
-  become: yes
+  become: true
   shell:
     cmd: |
       usermod -a -G postgres vector
@@ -72,21 +72,21 @@
     daemon_reload: yes
 
 - name: Create checkpoints dir
-  become: yes
+  become: true
   file:
     path: /var/lib/vector
     state: directory
     owner: vector
 
 - name: Include file for generated optimizations in postgresql.conf
-  become: yes
+  become: true
   replace:
     path: /etc/postgresql/postgresql.conf
     regexp: "#include = '/etc/postgresql-custom/generated-optimizations.conf'"
     replace: "include = '/etc/postgresql-custom/generated-optimizations.conf'"
 
 - name: Include file for custom overrides in postgresql.conf
-  become: yes
+  become: true
   replace:
     path: /etc/postgresql/postgresql.conf
     regexp: "#include = '/etc/postgresql-custom/custom-overrides.conf'"
@@ -115,5 +115,10 @@
   tags:
     - aws-only
 
+- name: Install supabase-admin-agent
+  import_tasks: internal/supabase-admin-agent.yml
+  tags:
+    - aws-only
+
 - name: Envoy - use lds.supabase.yaml for /etc/envoy/lds.yaml
   command: mv /etc/envoy/lds.supabase.yaml /etc/envoy/lds.yaml
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 7a7147353..1d24249ad 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.098-orioledb"
-  postgres17: "17.4.1.048"
-  postgres15: "15.8.1.105"
+  postgresorioledb-17: "17.0.1.099-orioledb"
+  postgres17: "17.4.1.049"
+  postgres15: "15.8.1.106"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -54,6 +54,7 @@ postgres_exporter_release_checksum:
 
 adminapi_release: 0.84.1
 adminmgr_release: 0.25.1
+supabase_admin_agent_release: 1.4.36
 
 vector_x86_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_amd64.deb"
 vector_arm_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_arm64.deb"

From d5599642a83e3bcaffc5941dece45ef8e6ea6f71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Thu, 3 Jul 2025 16:34:17 +0200
Subject: [PATCH 19/64] refactor(nix): split flake.nix using flake-parts
 (#1681)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* refactor(nix): split flake.nix using flake-parts

This commit introduces a modular Nix flake structure using flake-parts.
The monolithic flake.nix has been split into specialized modules.

Here is an overview of the new directory structure:

```
├── flake.nix                  # Root flake file only referencing modules
nix/
  ├── apps.nix                   # Application definitions
  ├── checks.nix                 # Build checks and tests
  ├── config.nix                 # Global configuration
  ├── devShells.nix              # Development environment shell
  ├── fmt.nix                    # Code formatting configuration
  ├── hooks.nix                  # Git hooks and pre-commit
  ├── ext/                       # PostgreSQL extensions
  ├── overlays/                  # Nixpkgs overlays
  ├── packages/                  # Custom packages
  └── postgresql/                # PostgreSQL packages
```

* refactor: move overlays to dedicated directory

The commit moves the overlay configuration from packages/default.nix to a new dedicated overlays/default.nix file for better organization, while keeping the same functionality. This change improves code structure and maintainability.

* refactor(nix): centralize postgresql configuration in config.nix

Moves postgresql version definitions and default settings into a centralized config.nix module.

* refactor(nix): generate postgresql packages into single module

Moves postgresql source and debug package generation into the postgresql module. This reduces duplication by generating packages dynamically based on supported versions.

* refactor: reorganize groonga package and cleanup dependencies

The changes reorganize the groonga-related packages by moving files to a dedicated directory and cleaning up dependencies. It also removes some unused variables and improves package structure.

* feat: configure formatter for nix files

* chore: format nix files

* feat: add git-hooks.nix for pre-commit formatting checks

Adds pre-commit hooks using git-hooks.nix to run treefmt formatting checks before commits.

* docs: generate documentation site with MkDocs

Add MkDocs configuration and assets for generating a documentation site.
This is more readable and provides a structured way to present information about the project.

We don't store the generated site in the repository, but instead use MkDocs to build it on demand.

In a development shell, one can run `mkdocs serve` to quickly preview the site locally.

* fix: add missing recommended direnv

We document the recommended `.envrc` file in the docs, but we forgot to
add it to the repository.

* doc: add documentation about formatting and directory structure

* doc: add helper to generate documentation using mkdocs

mkdocs renders the documentation present in the `nix/docs/` directory in HTML
format.
---
 .envrc.recommended                            |    3 +
 .gitignore                                    |    5 +
 flake.lock                                    |  119 +-
 flake.nix                                     | 1482 +----------------
 nix/apps.nix                                  |   32 +
 nix/cargo-pgrx/buildPgrxExtension.nix         |   82 +-
 nix/cargo-pgrx/default.nix                    |   42 +-
 nix/checks.nix                                |  311 ++++
 nix/config.nix                                |   62 +
 nix/devShells.nix                             |   81 +
 nix/docs/README.md                            |   32 +-
 nix/docs/adding-new-package.md                |    4 +-
 nix/docs/assets/images/logo.png               |  Bin 0 -> 2530 bytes
 nix/docs/documentation.md                     |   19 +
 nix/docs/new-major-postgres.md                |   17 +-
 nix/docs/nix-directory-structure.md           |  163 ++
 nix/docs/nix-formatter.md                     |   97 ++
 nix/docs/nix-overlays.md                      |    2 +-
 nix/docs/pre-commit-hooks.md                  |   69 +
 nix/docs/references.md                        |   56 +-
 nix/docs/site/.keep                           |    0
 nix/ext/default.nix                           |   11 +
 nix/ext/gdal.nix                              |   62 +-
 nix/ext/hypopg.nix                            |    7 +-
 nix/ext/index_advisor.nix                     |    7 +-
 nix/ext/mecab-naist-jdic/default.nix          |   17 +-
 nix/ext/orioledb.nix                          |   19 +-
 nix/ext/pg-safeupdate.nix                     |   23 +-
 nix/ext/pg_backtrace.nix                      |   19 +-
 nix/ext/pg_cron.nix                           |   21 +-
 nix/ext/pg_graphql.nix                        |   29 +-
 nix/ext/pg_hashids.nix                        |    7 +-
 nix/ext/pg_jsonschema.nix                     |   37 +-
 nix/ext/pg_net.nix                            |   13 +-
 nix/ext/pg_partman.nix                        |   23 +-
 nix/ext/pg_plan_filter.nix                    |    7 +-
 nix/ext/pg_regress.nix                        |    7 +-
 nix/ext/pg_repack.nix                         |   20 +-
 nix/ext/pg_stat_monitor.nix                   |   24 +-
 nix/ext/pg_tle.nix                            |   18 +-
 nix/ext/pgaudit.nix                           |   46 +-
 nix/ext/pgjwt.nix                             |   14 +-
 nix/ext/pgmq.nix                              |   19 +-
 nix/ext/pgroonga.nix                          |   51 +-
 nix/ext/pgrouting.nix                         |   55 +-
 nix/ext/pgsodium.nix                          |   13 +-
 nix/ext/pgsql-http.nix                        |   13 +-
 nix/ext/pgtap.nix                             |   17 +-
 nix/ext/pgvector.nix                          |    7 +-
 nix/ext/pljava.nix                            |   45 +-
 nix/ext/plpgsql-check.nix                     |    8 +-
 nix/ext/plv8.nix                              |  145 +-
 nix/ext/postgis.nix                           |   88 +-
 nix/ext/rum.nix                               |    7 +-
 nix/ext/sfcgal/sfcgal.nix                     |   32 +-
 nix/ext/supautils.nix                         |    7 +-
 nix/ext/timescaledb-2.9.1.nix                 |   25 +-
 nix/ext/timescaledb.nix                       |   24 +-
 nix/ext/vault.nix                             |   13 +-
 nix/ext/wal2json.nix                          |    9 +-
 nix/ext/wrappers/default.nix                  |  187 ++-
 nix/fmt.nix                                   |   12 +
 nix/hooks.nix                                 |   19 +
 nix/mkdocs.yml                                |  132 ++
 nix/nixpkgs.nix                               |   16 +
 nix/overlays/default.nix                      |   55 +
 nix/packages/build-test-ami.nix               |  158 ++
 nix/packages/cleanup-ami.nix                  |   61 +
 nix/packages/dbmate-tool.nix                  |   45 +
 nix/packages/default.nix                      |   78 +
 nix/packages/docs.nix                         |   22 +
 .../groonga/default.nix}                      |   68 +-
 .../do-not-use-vendored-libraries.patch       |    0
 .../groonga}/fix-cmake-install-path.patch     |    0
 nix/packages/lib.nix                          |  137 ++
 nix/packages/local-infra-bootstrap.nix        |    6 +
 .../local-infra-bootstrap.sh.in               |    0
 nix/packages/migrate-tool.nix                 |   18 +
 nix/packages/pg-restore.nix                   |    7 +
 nix/packages/postgres.nix                     |  176 ++
 nix/{tools => packages}/run-restore.sh.in     |    0
 nix/packages/run-testinfra.nix                |  146 ++
 nix/packages/show-commands.nix                |   23 +
 nix/packages/start-client.nix                 |   27 +
 nix/packages/start-replica.nix                |   12 +
 .../start-replica.sh.in}                      |    0
 nix/packages/sync-exts-versions.nix           |   17 +
 nix/packages/trigger-nix-build.nix            |  125 ++
 nix/packages/update-readme.nix                |   17 +
 nix/{ => packages}/wal-g.nix                  |   28 +-
 nix/postgresql/15.nix                         |    4 -
 nix/postgresql/17.nix                         |    4 -
 nix/postgresql/default.nix                    |   94 +-
 nix/postgresql/generic.nix                    |  663 ++++----
 nix/postgresql/orioledb-17.nix                |    4 -
 nix/postgresql/src.nix                        |   31 +
 96 files changed, 3775 insertions(+), 2304 deletions(-)
 create mode 100644 .envrc.recommended
 create mode 100644 nix/apps.nix
 create mode 100644 nix/checks.nix
 create mode 100644 nix/config.nix
 create mode 100644 nix/devShells.nix
 create mode 100644 nix/docs/assets/images/logo.png
 create mode 100644 nix/docs/documentation.md
 create mode 100644 nix/docs/nix-directory-structure.md
 create mode 100644 nix/docs/nix-formatter.md
 create mode 100644 nix/docs/pre-commit-hooks.md
 create mode 100644 nix/docs/site/.keep
 create mode 100644 nix/ext/default.nix
 create mode 100644 nix/fmt.nix
 create mode 100644 nix/hooks.nix
 create mode 100644 nix/mkdocs.yml
 create mode 100644 nix/nixpkgs.nix
 create mode 100644 nix/overlays/default.nix
 create mode 100644 nix/packages/build-test-ami.nix
 create mode 100644 nix/packages/cleanup-ami.nix
 create mode 100644 nix/packages/dbmate-tool.nix
 create mode 100644 nix/packages/default.nix
 create mode 100644 nix/packages/docs.nix
 rename nix/{supabase-groonga.nix => packages/groonga/default.nix} (65%)
 rename nix/{ => packages/groonga}/do-not-use-vendored-libraries.patch (100%)
 rename nix/{ => packages/groonga}/fix-cmake-install-path.patch (100%)
 create mode 100644 nix/packages/lib.nix
 create mode 100644 nix/packages/local-infra-bootstrap.nix
 rename nix/{tools => packages}/local-infra-bootstrap.sh.in (100%)
 create mode 100644 nix/packages/migrate-tool.nix
 create mode 100644 nix/packages/pg-restore.nix
 create mode 100644 nix/packages/postgres.nix
 rename nix/{tools => packages}/run-restore.sh.in (100%)
 create mode 100644 nix/packages/run-testinfra.nix
 create mode 100644 nix/packages/show-commands.nix
 create mode 100644 nix/packages/start-client.nix
 create mode 100644 nix/packages/start-replica.nix
 rename nix/{tools/run-replica.sh.in => packages/start-replica.sh.in} (100%)
 create mode 100644 nix/packages/sync-exts-versions.nix
 create mode 100644 nix/packages/trigger-nix-build.nix
 create mode 100644 nix/packages/update-readme.nix
 rename nix/{ => packages}/wal-g.nix (90%)
 delete mode 100644 nix/postgresql/15.nix
 delete mode 100644 nix/postgresql/17.nix
 delete mode 100644 nix/postgresql/orioledb-17.nix
 create mode 100644 nix/postgresql/src.nix

diff --git a/.envrc.recommended b/.envrc.recommended
new file mode 100644
index 000000000..a7aaf82ac
--- /dev/null
+++ b/.envrc.recommended
@@ -0,0 +1,3 @@
+watch_file nix/devShells.nix
+
+use flake
diff --git a/.gitignore b/.gitignore
index d32cc8f60..5372bfdeb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,6 +17,8 @@ __pycache__/
 result*
 .env-local
 .history
+.envrc
+.direnv
 
 
 #IDE
@@ -25,3 +27,6 @@ result*
 
 db/schema.sql
 common-nix.vars.pkr.hcl
+
+# pre-commit config is managed in nix
+.pre-commit-config.yaml
diff --git a/flake.lock b/flake.lock
index bea404a1f..167905994 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,6 +1,40 @@
 {
   "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": [
           "nix-fast-build",
@@ -57,6 +91,49 @@
         "type": "github"
       }
     },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1750779888,
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "nix-editor": {
       "inputs": {
         "nixpkgs": "nixpkgs",
@@ -78,7 +155,7 @@
     },
     "nix-fast-build": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs_2",
         "treefmt-nix": "treefmt-nix"
       },
@@ -131,6 +208,21 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1750555020,
+        "narHash": "sha256-/MjivcZIz8dyLOTFdJzS5Yazt2QCePQBh8uZooODaYw=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "6fb7349157ee1bffd053b1fdd454aa74ff7b4aee",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1749411262,
@@ -196,12 +288,15 @@
     },
     "root": {
       "inputs": {
+        "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
+        "git-hooks": "git-hooks",
         "nix-editor": "nix-editor",
         "nix-fast-build": "nix-fast-build",
         "nix2container": "nix2container",
         "nixpkgs": "nixpkgs_4",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay",
+        "treefmt-nix": "treefmt-nix_2"
       }
     },
     "rust-overlay": {
@@ -273,6 +368,26 @@
         "type": "github"
       }
     },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1750931469,
+        "narHash": "sha256-0IEdQB1nS+uViQw4k3VGUXntjkDp7aAlqcxdewb/hAc=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "ac8e6f32e11e9c7f153823abc3ab007f2a65d3e1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "utils": {
       "locked": {
         "lastModified": 1667395993,
diff --git a/flake.nix b/flake.nix
index 18cd9ba13..3aa651b09 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,1471 +8,33 @@
     nix-editor.url = "github:snowfallorg/nix-editor";
     rust-overlay.url = "github:oxalica/rust-overlay";
     nix-fast-build.url = "github:Mic92/nix-fast-build";
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    treefmt-nix.url = "github:numtide/treefmt-nix";
+    treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
+    git-hooks.url = "github:cachix/git-hooks.nix";
+    git-hooks.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { self, nixpkgs, flake-utils, nix-editor, rust-overlay, nix2container, ... }@inputs:
-    let
-      gitRev = "vcs=${self.shortRev or "dirty"}+${builtins.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}";
-
-      ourSystems = with flake-utils.lib; [
+  outputs =
+    { flake-utils, ... }@inputs:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } (_: {
+      systems = with flake-utils.lib; [
         system.x86_64-linux
         system.aarch64-linux
         system.aarch64-darwin
       ];
-    in
-    flake-utils.lib.eachSystem ourSystems (system:
-      let
-        pgsqlDefaultPort = "5435";
-        pgsqlDefaultHost = "localhost";
-        pgsqlSuperuser = "supabase_admin";
-
-        pkgs = import nixpkgs {
-          config = {
-            allowUnfree = true;
-            permittedInsecurePackages = [
-              "v8-9.7.106.18"
-            ];
-          };
-          inherit system;
-          overlays = [
-            # NOTE: add any needed overlays here. in theory we could
-            # pull them from the overlays/ directory automatically, but we don't
-            # want to have an arbitrary order, since it might matter. being
-            # explicit is better.
-            (final: prev: {
-              xmrig = throw "The xmrig package has been explicitly disabled in this flake.";
-            })
-            (import rust-overlay)
-            (final: prev: {
-              cargo-pgrx = final.callPackage ./nix/cargo-pgrx/default.nix {
-                inherit (final) lib;
-                inherit (final) darwin;
-                inherit (final) fetchCrate;
-                inherit (final) openssl;
-                inherit (final) pkg-config;
-                inherit (final) makeRustPlatform;
-                inherit (final) stdenv;
-                inherit (final) rust-bin;
-              };
-
-              buildPgrxExtension = final.callPackage ./nix/cargo-pgrx/buildPgrxExtension.nix {
-                inherit (final) cargo-pgrx;
-                inherit (final) lib;
-                inherit (final) Security;
-                inherit (final) pkg-config;
-                inherit (final) makeRustPlatform;
-                inherit (final) stdenv;
-                inherit (final) writeShellScriptBin;
-              };
-
-              buildPgrxExtension_0_11_3 = prev.buildPgrxExtension.override {
-                cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_11_3;
-              };
-
-              buildPgrxExtension_0_12_6 = prev.buildPgrxExtension.override {
-                cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_12_6;
-              };
-
-              buildPgrxExtension_0_12_9 = prev.buildPgrxExtension.override {
-                cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_12_9;
-              };
-
-              buildPgrxExtension_0_14_3 = prev.buildPgrxExtension.override {
-                cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_14_3;
-              };
-
-            })
-            (final: prev: {
-              postgresql = final.callPackage ./nix/postgresql/default.nix {
-                inherit (final) lib stdenv fetchurl makeWrapper callPackage buildEnv newScope;
-              };
-            })
-          ];
-        };
-        # Define pythonEnv here
-        pythonEnv = pkgs.python3.withPackages (ps: with ps; [
-          boto3
-          docker
-          pytest
-          pytest-testinfra
-          requests
-          ec2instanceconnectcli
-          paramiko
-        ]);
-        sfcgal = pkgs.callPackage ./nix/ext/sfcgal/sfcgal.nix { };
-        supabase-groonga = pkgs.callPackage ./nix/supabase-groonga.nix { };
-        mecab-naist-jdic = pkgs.callPackage ./nix/ext/mecab-naist-jdic/default.nix { };
-        inherit (pkgs.callPackage ./nix/wal-g.nix { }) wal-g-2 wal-g-3;
-        # Our list of PostgreSQL extensions which come from upstream Nixpkgs.
-        # These are maintained upstream and can easily be used here just by
-        # listing their name. Anytime the version of nixpkgs is upgraded, these
-        # may also bring in new versions of the extensions.
-        psqlExtensions = [
-          /* pljava */
-          /*"postgis"*/
-        ];
-
-        #FIXME for now, timescaledb is not included in the orioledb version of supabase extensions, as there is an issue
-        # with building timescaledb with the orioledb patched version of postgresql
-        orioledbPsqlExtensions = [
-          /* pljava */
-          /*"timescaledb"*/
-        ];
-
-        # Custom extensions that exist in our repository. These aren't upstream
-        # either because nobody has done the work, maintaining them here is
-        # easier and more expedient, or because they may not be suitable, or are
-        # too niche/one-off.
-        #
-        # Ideally, most of these should have copies upstream for third party
-        # use, but even if they did, keeping our own copies means that we can
-        # rollout new versions of these critical things easier without having to
-        # go through the upstream release engineering process.
-        ourExtensions = [
-          ./nix/ext/rum.nix
-          ./nix/ext/timescaledb.nix
-          ./nix/ext/timescaledb-2.9.1.nix
-          ./nix/ext/pgroonga.nix
-          ./nix/ext/index_advisor.nix
-          ./nix/ext/wal2json.nix
-          ./nix/ext/pgmq.nix
-          ./nix/ext/pg_repack.nix
-          ./nix/ext/pg-safeupdate.nix
-          ./nix/ext/plpgsql-check.nix
-          ./nix/ext/pgjwt.nix
-          ./nix/ext/pgaudit.nix
-          ./nix/ext/postgis.nix
-          ./nix/ext/pgrouting.nix
-          ./nix/ext/pgtap.nix
-          ./nix/ext/pg_cron.nix
-          ./nix/ext/pgsql-http.nix
-          ./nix/ext/pg_plan_filter.nix
-          ./nix/ext/pg_net.nix
-          ./nix/ext/pg_hashids.nix
-          ./nix/ext/pgsodium.nix
-          ./nix/ext/pg_graphql.nix
-          ./nix/ext/pg_stat_monitor.nix
-          ./nix/ext/pg_jsonschema.nix
-          ./nix/ext/pgvector.nix
-          ./nix/ext/vault.nix
-          ./nix/ext/hypopg.nix
-          ./nix/ext/pg_tle.nix
-          ./nix/ext/wrappers/default.nix
-          ./nix/ext/supautils.nix
-          ./nix/ext/plv8.nix
-        ];
-
-        #Where we import and build the orioledb extension, we add on our custom extensions
-        # plus the orioledb option
-        #we're not using timescaledb or plv8 in the orioledb-17 version or pg 17 of supabase extensions
-        orioleFilteredExtensions = builtins.filter
-          (
-            x:
-            x != ./nix/ext/timescaledb.nix &&
-            x != ./nix/ext/timescaledb-2.9.1.nix &&
-            x != ./nix/ext/plv8.nix
-        ) ourExtensions;
-
-        orioledbExtensions = orioleFilteredExtensions ++ [ ./nix/ext/orioledb.nix ];
-        dbExtensions17 = orioleFilteredExtensions;
-        getPostgresqlPackage = version:
-          pkgs.postgresql."postgresql_${version}";
-        # Create a 'receipt' file for a given postgresql package. This is a way
-        # of adding a bit of metadata to the package, which can be used by other
-        # tools to inspect what the contents of the install are: the PSQL
-        # version, the installed extensions, et cetera.
-        #
-        # This takes two arguments:
-        #  - pgbin: the postgresql package we are building on top of
-        #    not a list of packages, but an attrset containing extension names
-        #    mapped to versions.
-        #  - ourExts: the list of extensions from upstream nixpkgs. This is not
-        #    a list of packages, but an attrset containing extension names
-        #    mapped to versions.
-        #
-        # The output is a package containing the receipt.json file, which can be
-        # merged with the PostgreSQL installation using 'symlinkJoin'.
-        makeReceipt = pgbin: ourExts: pkgs.writeTextFile {
-          name = "receipt";
-          destination = "/receipt.json";
-          text = builtins.toJSON {
-            revision = gitRev;
-            psql-version = pgbin.version;
-            nixpkgs = {
-              revision = nixpkgs.rev;
-            };
-            extensions = ourExts;
-
-            # NOTE this field can be used to do cache busting (e.g.
-            # force a rebuild of the psql packages) but also to helpfully inform
-            # tools what version of the schema is being used, for forwards and
-            # backwards compatibility
-            receipt-version = "1";
-          };
-        };
-
-        makeOurPostgresPkgs = version:
-          let
-            postgresql = getPostgresqlPackage version;
-            extensionsToUse =
-              if (builtins.elem version [ "orioledb-17" ])
-              then orioledbExtensions
-              else if (builtins.elem version [ "17" ])
-              then dbExtensions17
-              else ourExtensions;
-          in
-          map (path: pkgs.callPackage path { inherit postgresql; }) extensionsToUse;
-
-        # Create an attrset that contains all the extensions included in a server.
-        makeOurPostgresPkgsSet = version:
-          (builtins.listToAttrs (map
-            (drv:
-              { name = drv.pname; value = drv; }
-            )
-            (makeOurPostgresPkgs version)))
-          // { recurseForDerivations = true; };
-
-
-        # Create a binary distribution of PostgreSQL, given a version.
-        #
-        # NOTE: The version here does NOT refer to the exact PostgreSQL version;
-        # it refers to the *major number only*, which is used to select the
-        # correct version of the package from nixpkgs. This is because we want
-        # to be able to do so in an open ended way. As an example, the version
-        # "15" passed in will use the nixpkgs package "postgresql_15" as the
-        # basis for building extensions, etc.
-        makePostgresBin = version:
-          let
-            postgresql = getPostgresqlPackage version;
-            ourExts = map (ext: { name = ext.pname; version = ext.version; }) (makeOurPostgresPkgs version);
-
-            pgbin = postgresql.withPackages (ps:
-              makeOurPostgresPkgs version
-            );
-          in
-          pkgs.symlinkJoin {
-            inherit (pgbin) name version;
-            paths = [ pgbin (makeReceipt pgbin ourExts) ];
-          };
-
-        # Create an attribute set, containing all the relevant packages for a
-        # PostgreSQL install, wrapped up with a bow on top. There are three
-        # packages:
-        #
-        #  - bin: the postgresql package itself, with all the extensions
-        #    installed, and a receipt.json file containing metadata about the
-        #    install.
-        #  - exts: an attrset containing all the extensions, mapped to their
-        #    package names.
-        makePostgres = version: rec {
-          bin = makePostgresBin version;
-          exts = makeOurPostgresPkgsSet version;
-          recurseForDerivations = true;
-        };
-
-        makePostgresDevSetup = { pkgs, name, extraSubstitutions ? { } }:
-          let
-            paths = {
-              migrationsDir = builtins.path {
-                name = "migrations";
-                path = ./migrations/db;
-              };
-              postgresqlSchemaSql = builtins.path {
-                name = "postgresql-schema";
-                path = ./nix/tools/postgresql_schema.sql;
-              };
-              pgbouncerAuthSchemaSql = builtins.path {
-                name = "pgbouncer-auth-schema";
-                path = ./ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql;
-              };
-              statExtensionSql = builtins.path {
-                name = "stat-extension";
-                path = ./ansible/files/stat_extension.sql;
-              };
-              pgconfigFile = builtins.path {
-                name = "postgresql.conf";
-                path = ./ansible/files/postgresql_config/postgresql.conf.j2;
-              };
-              supautilsConfigFile = builtins.path {
-                name = "supautils.conf";
-                path = ./ansible/files/postgresql_config/supautils.conf.j2;
-              };
-              loggingConfigFile = builtins.path {
-                name = "logging.conf";
-                path = ./ansible/files/postgresql_config/postgresql-csvlog.conf;
-              };
-              readReplicaConfigFile = builtins.path {
-                name = "readreplica.conf";
-                path = ./ansible/files/postgresql_config/custom_read_replica.conf.j2;
-              };
-              pgHbaConfigFile = builtins.path {
-                name = "pg_hba.conf";
-                path = ./ansible/files/postgresql_config/pg_hba.conf.j2;
-              };
-              pgIdentConfigFile = builtins.path {
-                name = "pg_ident.conf";
-                path = ./ansible/files/postgresql_config/pg_ident.conf.j2;
-              };
-              postgresqlExtensionCustomScriptsPath = builtins.path {
-                name = "extension-custom-scripts";
-                path = ./ansible/files/postgresql_extension_custom_scripts;
-              };
-              getkeyScript = builtins.path {
-                name = "pgsodium_getkey.sh";
-                path = ./nix/tests/util/pgsodium_getkey.sh;
-              };
-            };
-
-            localeArchive =
-              if pkgs.stdenv.isDarwin
-              then "${pkgs.darwin.locale}/share/locale"
-              else "${pkgs.glibcLocales}/lib/locale/locale-archive";
-
-            substitutions = {
-              SHELL_PATH = "${pkgs.bash}/bin/bash";
-              PGSQL_DEFAULT_PORT = "${pgsqlDefaultPort}";
-              PGSQL_SUPERUSER = "${pgsqlSuperuser}";
-              PSQL15_BINDIR = "${basePackages.psql_15.bin}";
-              PSQL17_BINDIR = "${basePackages.psql_17.bin}";
-              PSQL_CONF_FILE = "${paths.pgconfigFile}";
-              PSQLORIOLEDB17_BINDIR = "${basePackages.psql_orioledb-17.bin}";
-              PGSODIUM_GETKEY = "${paths.getkeyScript}";
-              READREPL_CONF_FILE = "${paths.readReplicaConfigFile}";
-              LOGGING_CONF_FILE = "${paths.loggingConfigFile}";
-              SUPAUTILS_CONF_FILE = "${paths.supautilsConfigFile}";
-              PG_HBA = "${paths.pgHbaConfigFile}";
-              PG_IDENT = "${paths.pgIdentConfigFile}";
-              LOCALES = "${localeArchive}";
-              EXTENSION_CUSTOM_SCRIPTS_DIR = "${paths.postgresqlExtensionCustomScriptsPath}";
-              MECAB_LIB = "${basePackages.psql_15.exts.pgroonga}/lib/groonga/plugins/tokenizers/tokenizer_mecab.so";
-              GROONGA_DIR = "${supabase-groonga}";
-              MIGRATIONS_DIR = "${paths.migrationsDir}";
-              POSTGRESQL_SCHEMA_SQL = "${paths.postgresqlSchemaSql}";
-              PGBOUNCER_AUTH_SCHEMA_SQL = "${paths.pgbouncerAuthSchemaSql}";
-              STAT_EXTENSION_SQL = "${paths.statExtensionSql}";
-              CURRENT_SYSTEM = "${system}";
-            } // extraSubstitutions; # Merge in any extra substitutions
-          in
-          pkgs.runCommand name
-            {
-              inherit (paths) migrationsDir postgresqlSchemaSql pgbouncerAuthSchemaSql statExtensionSql;
-            } ''
-            mkdir -p $out/bin $out/etc/postgresql-custom $out/etc/postgresql $out/extension-custom-scripts
-
-            # Copy config files with error handling
-            cp ${paths.supautilsConfigFile} $out/etc/postgresql-custom/supautils.conf || { echo "Failed to copy supautils.conf"; exit 1; }
-            cp ${paths.pgconfigFile} $out/etc/postgresql/postgresql.conf || { echo "Failed to copy postgresql.conf"; exit 1; }
-            cp ${paths.loggingConfigFile} $out/etc/postgresql-custom/logging.conf || { echo "Failed to copy logging.conf"; exit 1; }
-            cp ${paths.readReplicaConfigFile} $out/etc/postgresql-custom/read-replica.conf || { echo "Failed to copy read-replica.conf"; exit 1; }
-            cp ${paths.pgHbaConfigFile} $out/etc/postgresql/pg_hba.conf || { echo "Failed to copy pg_hba.conf"; exit 1; }
-            cp ${paths.pgIdentConfigFile} $out/etc/postgresql/pg_ident.conf || { echo "Failed to copy pg_ident.conf"; exit 1; }
-            cp -r ${paths.postgresqlExtensionCustomScriptsPath}/* $out/extension-custom-scripts/ || { echo "Failed to copy custom scripts"; exit 1; }
-
-            echo "Copy operation completed"
-            chmod 644 $out/etc/postgresql-custom/supautils.conf
-            chmod 644 $out/etc/postgresql/postgresql.conf
-            chmod 644 $out/etc/postgresql-custom/logging.conf
-            chmod 644 $out/etc/postgresql/pg_hba.conf
-
-            substitute ${./nix/tools/run-server.sh.in} $out/bin/start-postgres-server \
-              ${builtins.concatStringsSep " " (builtins.attrValues (builtins.mapAttrs
-                (name: value: "--subst-var-by '${name}' '${value}'")
-                substitutions
-              ))}
-            chmod +x $out/bin/start-postgres-server
-          '';
-
-        # The base set of packages that we export from this Nix Flake, that can
-        # be used with 'nix build'. Don't use the names listed below; check the
-        # name in 'nix flake show' in order to make sure exactly what name you
-        # want.
-        basePackages =
-          let
-            # Function to get the PostgreSQL version from the attribute name
-            getVersion = name:
-              let
-                match = builtins.match "psql_([0-9]+)" name;
-              in
-              if match == null then null else builtins.head match;
-
-            # Define the available PostgreSQL versions
-            postgresVersions = {
-              psql_15 = makePostgres "15";
-              psql_17 = makePostgres "17";
-              psql_orioledb-17 = makePostgres "orioledb-17";
-            };
-
-            # Find the active PostgreSQL version
-            activeVersion = getVersion (builtins.head (builtins.attrNames postgresVersions));
-
-            # Function to create the pg_regress package
-            makePgRegress = version:
-              let
-                postgresqlPackage = pkgs."postgresql_${version}";
-              in
-              pkgs.callPackage ./nix/ext/pg_regress.nix {
-                postgresql = postgresqlPackage;
-              };
-            postgresql_15 = getPostgresqlPackage "15";
-            postgresql_17 = getPostgresqlPackage "17";
-            postgresql_orioledb-17 = getPostgresqlPackage "orioledb-17";
-          in
-          postgresVersions // {
-            supabase-groonga = supabase-groonga;
-            cargo-pgrx_0_11_3 = pkgs.cargo-pgrx.cargo-pgrx_0_11_3;
-            cargo-pgrx_0_12_6 = pkgs.cargo-pgrx.cargo-pgrx_0_12_6;
-            cargo-pgrx_0_12_9 = pkgs.cargo-pgrx.cargo-pgrx_0_12_9;
-            cargo-pgrx_0_14_3 = pkgs.cargo-pgrx.cargo-pgrx_0_14_3;
-            # PostgreSQL versions.
-            psql_15 = postgresVersions.psql_15;
-            psql_17 = postgresVersions.psql_17;
-            psql_orioledb-17 = postgresVersions.psql_orioledb-17;
-            wal-g-2 = wal-g-2;
-            wal-g-3 = wal-g-3;
-            sfcgal = sfcgal;
-            pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
-            inherit postgresql_15 postgresql_17 postgresql_orioledb-17;
-            postgresql_15_debug = if pkgs.stdenv.isLinux then postgresql_15.debug else null;
-            postgresql_17_debug = if pkgs.stdenv.isLinux then postgresql_17.debug else null;
-            postgresql_orioledb-17_debug = if pkgs.stdenv.isLinux then postgresql_orioledb-17.debug else null;
-            postgresql_15_src = pkgs.stdenv.mkDerivation {
-              pname = "postgresql-15-src";
-              version = postgresql_15.version;
-
-              src = postgresql_15.src;
-
-              nativeBuildInputs = [ pkgs.bzip2 ];
-
-              phases = [ "unpackPhase" "installPhase" ];
-
-              installPhase = ''
-                mkdir -p $out
-                cp -r . $out
-              '';
-
-              meta = with pkgs.lib; {
-                description = "PostgreSQL 15 source files";
-                homepage = "https://www.postgresql.org/";
-                license = licenses.postgresql;
-                platforms = platforms.all;
-              };
-            };
-            postgresql_17_src = pkgs.stdenv.mkDerivation {
-              pname = "postgresql-17-src";
-              version = postgresql_17.version;
-              src = postgresql_17.src;
-
-              nativeBuildInputs = [ pkgs.bzip2 ];
-
-              phases = [ "unpackPhase" "installPhase" ];
-
-              installPhase = ''
-                mkdir -p $out
-                cp -r . $out
-              '';
-              meta = with pkgs.lib; {
-                description = "PostgreSQL 17 source files";
-                homepage = "https://www.postgresql.org/";
-                license = licenses.postgresql;
-                platforms = platforms.all;
-              };
-            };
-            postgresql_orioledb-17_src = pkgs.stdenv.mkDerivation {
-              pname = "postgresql-17-src";
-              version = postgresql_orioledb-17.version;
-
-              src = postgresql_orioledb-17.src;
-
-              nativeBuildInputs = [ pkgs.bzip2 ];
-
-              phases = [ "unpackPhase" "installPhase" ];
-
-              installPhase = ''
-                mkdir -p $out
-                cp -r . $out
-              '';
-
-              meta = with pkgs.lib; {
-                description = "PostgreSQL 15 source files";
-                homepage = "https://www.postgresql.org/";
-                license = licenses.postgresql;
-                platforms = platforms.all;
-              };
-            };
-            mecab_naist_jdic = mecab-naist-jdic;
-            supabase_groonga = supabase-groonga;
-            pg_regress = makePgRegress activeVersion;
-            # Start a version of the server.
-            start-server = makePostgresDevSetup {
-              inherit pkgs;
-              name = "start-postgres-server";
-            };
-
-            # Start a version of the client and runs migrations script on server.
-            start-client =
-              let
-                migrationsDir = ./migrations/db;
-                postgresqlSchemaSql = ./nix/tools/postgresql_schema.sql;
-                pgbouncerAuthSchemaSql = ./ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql;
-                statExtensionSql = ./ansible/files/stat_extension.sql;
-              in
-              pkgs.runCommand "start-postgres-client" { } ''
-                mkdir -p $out/bin
-                substitute ${./nix/tools/run-client.sh.in} $out/bin/start-postgres-client \
-                  --subst-var-by 'PGSQL_DEFAULT_PORT' '${pgsqlDefaultPort}' \
-                  --subst-var-by 'PGSQL_SUPERUSER' '${pgsqlSuperuser}' \
-                  --subst-var-by 'PSQL15_BINDIR' '${basePackages.psql_15.bin}' \
-                  --subst-var-by 'PSQL17_BINDIR' '${basePackages.psql_17.bin}' \
-                  --subst-var-by 'PSQLORIOLEDB17_BINDIR' '${basePackages.psql_orioledb-17.bin}' \
-                  --subst-var-by 'MIGRATIONS_DIR' '${migrationsDir}' \
-                  --subst-var-by 'POSTGRESQL_SCHEMA_SQL' '${postgresqlSchemaSql}' \
-                  --subst-var-by 'PGBOUNCER_AUTH_SCHEMA_SQL' '${pgbouncerAuthSchemaSql}' \
-                  --subst-var-by 'STAT_EXTENSION_SQL' '${statExtensionSql}'
-                chmod +x $out/bin/start-postgres-client
-              '';
-
-            # Migrate between two data directories.
-            migrate-tool =
-              let
-                configFile = ./nix/tests/postgresql.conf.in;
-                getkeyScript = ./nix/tests/util/pgsodium_getkey.sh;
-                primingScript = ./nix/tests/prime.sql;
-                migrationData = ./nix/tests/migrations/data.sql;
-              in
-              pkgs.runCommand "migrate-postgres" { } ''
-                mkdir -p $out/bin
-                substitute ${./nix/tools/migrate-tool.sh.in} $out/bin/migrate-postgres \
-                  --subst-var-by 'PSQL15_BINDIR' '${basePackages.psql_15.bin}' \
-                  --subst-var-by 'PSQL_CONF_FILE' '${configFile}' \
-                  --subst-var-by 'PGSODIUM_GETKEY' '${getkeyScript}' \
-                  --subst-var-by 'PRIMING_SCRIPT' '${primingScript}' \
-                  --subst-var-by 'MIGRATION_DATA' '${migrationData}'
-
-                chmod +x $out/bin/migrate-postgres
-              '';
-
-            start-replica = pkgs.runCommand "start-postgres-replica" { } ''
-              mkdir -p $out/bin
-              substitute ${./nix/tools/run-replica.sh.in} $out/bin/start-postgres-replica \
-                --subst-var-by 'PGSQL_SUPERUSER' '${pgsqlSuperuser}' \
-                --subst-var-by 'PSQL15_BINDIR' '${basePackages.psql_15.bin}'
-              chmod +x $out/bin/start-postgres-replica
-            '';
-            pg-restore =
-              pkgs.runCommand "run-pg-restore" { } ''
-                mkdir -p $out/bin
-                substitute ${./nix/tools/run-restore.sh.in} $out/bin/pg-restore \
-                  --subst-var-by PSQL15_BINDIR '${basePackages.psql_15.bin}'
-                chmod +x $out/bin/pg-restore
-              '';
-            sync-exts-versions = pkgs.runCommand "sync-exts-versions" { } ''
-              mkdir -p $out/bin
-              substitute ${./nix/tools/sync-exts-versions.sh.in} $out/bin/sync-exts-versions \
-                --subst-var-by 'YQ' '${pkgs.yq}/bin/yq' \
-                --subst-var-by 'JQ' '${pkgs.jq}/bin/jq' \
-                --subst-var-by 'NIX_EDITOR' '${nix-editor.packages.${system}.nix-editor}/bin/nix-editor' \
-                --subst-var-by 'NIXPREFETCHURL' '${pkgs.nixVersions.nix_2_20}/bin/nix-prefetch-url' \
-                --subst-var-by 'NIX' '${pkgs.nixVersions.nix_2_20}/bin/nix'
-              chmod +x $out/bin/sync-exts-versions
-            '';
-
-            local-infra-bootstrap = pkgs.runCommand "local-infra-bootstrap" { } ''
-              mkdir -p $out/bin
-              substitute ${./nix/tools/local-infra-bootstrap.sh.in} $out/bin/local-infra-bootstrap
-              chmod +x $out/bin/local-infra-bootstrap
-            '';
-            dbmate-tool =
-              let
-                migrationsDir = ./migrations/db;
-                ansibleVars = ./ansible/vars.yml;
-                pgbouncerAuthSchemaSql = ./ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql;
-                statExtensionSql = ./ansible/files/stat_extension.sql;
-              in
-              pkgs.runCommand "dbmate-tool"
-                {
-                  buildInputs = with pkgs; [
-                    overmind
-                    dbmate
-                    nix
-                    jq
-                    yq
-                  ];
-                  nativeBuildInputs = with pkgs; [
-                    makeWrapper
-                  ];
-                } ''
-                mkdir -p $out/bin $out/migrations
-                cp -r ${migrationsDir}/* $out
-                substitute ${./nix/tools/dbmate-tool.sh.in} $out/bin/dbmate-tool \
-                  --subst-var-by 'PGSQL_DEFAULT_PORT' '${pgsqlDefaultPort}' \
-                  --subst-var-by 'MIGRATIONS_DIR' $out \
-                  --subst-var-by 'PGSQL_SUPERUSER' '${pgsqlSuperuser}' \
-                  --subst-var-by 'ANSIBLE_VARS' ${ansibleVars} \
-                  --subst-var-by 'CURRENT_SYSTEM' '${system}' \
-                  --subst-var-by 'PGBOUNCER_AUTH_SCHEMA_SQL' '${pgbouncerAuthSchemaSql}' \
-                  --subst-var-by 'STAT_EXTENSION_SQL' '${statExtensionSql}'
-                chmod +x $out/bin/dbmate-tool
-                wrapProgram $out/bin/dbmate-tool \
-                  --prefix PATH : ${pkgs.lib.makeBinPath [ pkgs.overmind pkgs.dbmate pkgs.nix pkgs.jq pkgs.yq ]}
-              '';
-            show-commands = pkgs.runCommand "show-commands"
-              {
-                nativeBuildInputs = [ pkgs.makeWrapper ];
-                buildInputs = [ pkgs.nushell ];
-              } ''
-              mkdir -p $out/bin
-              cat > $out/bin/show-commands << 'EOF'
-              #!${pkgs.nushell}/bin/nu
-              let json_output = (nix flake show --json --quiet --all-systems | from json)
-              let apps = ($json_output | get apps.${system})
-              $apps | transpose name info | select name | each { |it| echo $"Run this app with: nix run .#($it.name)" }
-              EOF
-              chmod +x $out/bin/show-commands
-              wrapProgram $out/bin/show-commands \
-                --prefix PATH : ${pkgs.nushell}/bin
-            '';
-            update-readme = pkgs.runCommand "update-readme"
-              {
-                nativeBuildInputs = [ pkgs.makeWrapper ];
-                buildInputs = [ pkgs.nushell ];
-              } ''
-              mkdir -p $out/bin
-              cp ${./nix/tools/update_readme.nu} $out/bin/update-readme
-              chmod +x $out/bin/update-readme
-              wrapProgram $out/bin/update-readme \
-                --prefix PATH : ${pkgs.nushell}/bin
-            '';
-            # Script to run the AMI build and tests locally
-            build-test-ami = pkgs.runCommand "build-test-ami"
-              {
-                buildInputs = with pkgs; [
-                  packer
-                  awscli2
-                  yq
-                  jq
-                  openssl
-                  git
-                  coreutils
-                  aws-vault
-                ];
-              } ''
-                mkdir -p $out/bin
-                cat > $out/bin/build-test-ami << 'EOL'
-                #!/usr/bin/env bash
-                set -euo pipefail
-
-                show_help() {
-                  cat << EOF
-                Usage: build-test-ami [--help] <postgres-version>
-
-                Build AMI images for PostgreSQL testing.
-
-                This script will:
-                1. Check for required tools and AWS authentication
-                2. Build two AMI stages using Packer
-                3. Clean up any temporary instances
-                4. Output the final AMI name for use with run-testinfra
-
-                Arguments:
-                  postgres-version    PostgreSQL major version to build (required)
-
-                Options:
-                  --help    Show this help message and exit
-
-                Requirements:
-                  - AWS Vault profile must be set in AWS_VAULT environment variable
-                  - Packer, AWS CLI, yq, jq, and OpenSSL must be installed
-                  - Must be run from a git repository
-
-                Example:
-                  aws-vault exec <profile-name> -- nix run .#build-test-ami 15
-                EOF
-                }
-
-                # Handle help flag
-                if [[ "$#" -gt 0 && "$1" == "--help" ]]; then
-                  show_help
-                  exit 0
-                fi
-
-                export PATH="${pkgs.lib.makeBinPath (with pkgs; [
-                  packer
-                  awscli2
-                  yq
-                  jq
-                  openssl
-                  git
-                  coreutils
-                  aws-vault
-                ])}:$PATH"
-
-                # Check for required tools
-                for cmd in packer aws-vault yq jq openssl; do
-                  if ! command -v $cmd &> /dev/null; then
-                    echo "Error: $cmd is required but not found"
-                    exit 1
-                  fi
-                done
-
-                # Check AWS Vault profile
-                if [ -z "''${AWS_VAULT:-}" ]; then
-                  echo "Error: AWS_VAULT environment variable must be set with the profile name"
-                  echo "Usage: aws-vault exec <profile-name> -- nix run .#build-test-ami <postgres-version>"
-                  exit 1
-                fi
-
-                # Set values
-                REGION="ap-southeast-1"
-                POSTGRES_VERSION="$1"
-                RANDOM_STRING=$(openssl rand -hex 8)
-                GIT_SHA=$(git rev-parse HEAD)
-                RUN_ID=$(date +%s)
-
-                # Generate common-nix.vars.pkr.hcl
-                PG_VERSION=$(yq -r ".postgres_release[\"postgres$POSTGRES_VERSION\"]" ansible/vars.yml)
-                echo "postgres-version = \"$PG_VERSION\"" > common-nix.vars.pkr.hcl
-
-                # Build AMI Stage 1
-                packer init amazon-arm64-nix.pkr.hcl
-                packer build \
-                  -var "git-head-version=$GIT_SHA" \
-                  -var "packer-execution-id=$RUN_ID" \
-                  -var-file="development-arm.vars.pkr.hcl" \
-                  -var-file="common-nix.vars.pkr.hcl" \
-                  -var "ansible_arguments=" \
-                  -var "postgres-version=$RANDOM_STRING" \
-                  -var "region=$REGION" \
-                  -var 'ami_regions=["'"$REGION"'"]' \
-                  -var "force-deregister=true" \
-                  -var "ansible_arguments=-e postgresql_major=$POSTGRES_VERSION" \
-                  amazon-arm64-nix.pkr.hcl
-
-                # Build AMI Stage 2
-                packer init stage2-nix-psql.pkr.hcl
-                packer build \
-                  -var "git-head-version=$GIT_SHA" \
-                  -var "packer-execution-id=$RUN_ID" \
-                  -var "postgres_major_version=$POSTGRES_VERSION" \
-                  -var-file="development-arm.vars.pkr.hcl" \
-                  -var-file="common-nix.vars.pkr.hcl" \
-                  -var "postgres-version=$RANDOM_STRING" \
-                  -var "region=$REGION" \
-                  -var 'ami_regions=["'"$REGION"'"]' \
-                  -var "force-deregister=true" \
-                  -var "git_sha=$GIT_SHA" \
-                  stage2-nix-psql.pkr.hcl
-
-                # Cleanup instances from AMI builds
-                cleanup_instances() {
-                  echo "Terminating EC2 instances with tag testinfra-run-id=$RUN_ID..."
-                  aws ec2 --region $REGION describe-instances \
-                    --filters "Name=tag:testinfra-run-id,Values=$RUN_ID" \
-                    --query "Reservations[].Instances[].InstanceId" \
-                    --output text | xargs -r aws ec2 terminate-instances \
-                    --region $REGION --instance-ids || true
-                }
-
-                # Set up traps for various signals to ensure cleanup
-                trap cleanup_instances EXIT HUP INT QUIT TERM
-
-                # Create and activate virtual environment
-                VENV_DIR=$(mktemp -d)
-                trap 'rm -rf "$VENV_DIR"' EXIT HUP INT QUIT TERM
-                python3 -m venv "$VENV_DIR"
-                source "$VENV_DIR/bin/activate"
-
-                # Install required Python packages
-                echo "Installing required Python packages..."
-                pip install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest paramiko requests
-
-                # Run the tests with aws-vault
-                echo "Running tests for AMI: $RANDOM_STRING using AWS Vault profile: $AWS_VAULT_PROFILE"
-                aws-vault exec $AWS_VAULT_PROFILE -- pytest -vv -s testinfra/test_ami_nix.py
-
-                # Deactivate virtual environment (cleanup is handled by trap)
-                deactivate
-                EOL
-                chmod +x $out/bin/build-test-ami
-              '';
-
-            run-testinfra = pkgs.runCommand "run-testinfra"
-              {
-                buildInputs = with pkgs; [
-                  aws-vault
-                  python3
-                  python3Packages.pip
-                  coreutils
-                ];
-              } ''
-                mkdir -p $out/bin
-                cat > $out/bin/run-testinfra << 'EOL'
-                #!/usr/bin/env bash
-                set -euo pipefail
-
-                show_help() {
-                  cat << EOF
-                Usage: run-testinfra --ami-name NAME [--aws-vault-profile PROFILE]
-
-                Run the testinfra tests locally against a specific AMI.
-
-                This script will:
-                1. Check if aws-vault is installed and configured
-                2. Set up the required environment variables
-                3. Create and activate a virtual environment
-                4. Install required Python packages from pip
-                5. Run the tests with aws-vault credentials
-                6. Clean up the virtual environment
-
-                Required flags:
-                  --ami-name NAME              The name of the AMI to test
-
-                Optional flags:
-                  --aws-vault-profile PROFILE  AWS Vault profile to use (default: staging)
-                  --help                       Show this help message and exit
 
-                Requirements:
-                  - aws-vault installed and configured
-                  - Python 3 with pip
-                  - Must be run from the repository root
-
-                Examples:
-                  run-testinfra --ami-name supabase-postgres-abc123
-                  run-testinfra --ami-name supabase-postgres-abc123 --aws-vault-profile production
-                EOF
-                }
-
-                # Default values
-                AWS_VAULT_PROFILE="staging"
-                AMI_NAME=""
-
-                # Parse arguments
-                while [[ $# -gt 0 ]]; do
-                  case $1 in
-                    --aws-vault-profile)
-                      AWS_VAULT_PROFILE="$2"
-                      shift 2
-                      ;;
-                    --ami-name)
-                      AMI_NAME="$2"
-                      shift 2
-                      ;;
-                    --help)
-                      show_help
-                      exit 0
-                      ;;
-                    *)
-                      echo "Error: Unexpected argument: $1"
-                      show_help
-                      exit 1
-                      ;;
-                  esac
-                done
-
-                # Check for required tools
-                if ! command -v aws-vault &> /dev/null; then
-                  echo "Error: aws-vault is required but not found"
-                  exit 1
-                fi
-
-                # Check for AMI name argument
-                if [ -z "$AMI_NAME" ]; then
-                  echo "Error: --ami-name is required"
-                  show_help
-                  exit 1
-                fi
-
-                # Set environment variables
-                export AWS_REGION="ap-southeast-1"
-                export AWS_DEFAULT_REGION="ap-southeast-1"
-                export AMI_NAME="$AMI_NAME"  # Export AMI_NAME for pytest
-                export RUN_ID="local-$(date +%s)"  # Generate a unique RUN_ID
-
-                # Function to terminate EC2 instances
-                terminate_instances() {
-                  echo "Terminating EC2 instances with tag testinfra-run-id=$RUN_ID..."
-                  aws-vault exec $AWS_VAULT_PROFILE -- aws ec2 --region ap-southeast-1 describe-instances \
-                    --filters "Name=tag:testinfra-run-id,Values=$RUN_ID" \
-                    --query "Reservations[].Instances[].InstanceId" \
-                    --output text | xargs -r aws-vault exec $AWS_VAULT_PROFILE -- aws ec2 terminate-instances \
-                    --region ap-southeast-1 --instance-ids || true
-                }
-
-                # Set up traps for various signals to ensure cleanup
-                trap terminate_instances EXIT HUP INT QUIT TERM
-
-                # Create and activate virtual environment
-                VENV_DIR=$(mktemp -d)
-                trap 'rm -rf "$VENV_DIR"' EXIT HUP INT QUIT TERM
-                python3 -m venv "$VENV_DIR"
-                source "$VENV_DIR/bin/activate"
-
-                # Install required Python packages
-                echo "Installing required Python packages..."
-                pip install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest paramiko requests
-
-                # Function to run tests and ensure cleanup
-                run_tests() {
-                  local exit_code=0
-                  echo "Running tests for AMI: $AMI_NAME using AWS Vault profile: $AWS_VAULT_PROFILE"
-                  aws-vault exec "$AWS_VAULT_PROFILE" -- pytest -vv -s testinfra/test_ami_nix.py || exit_code=$?
-                  return $exit_code
-                }
-
-                # Run tests and capture exit code
-                run_tests
-                test_exit_code=$?
-
-                # Deactivate virtual environment
-                deactivate
-
-                # Explicitly call cleanup
-                terminate_instances
-
-                # Exit with the test exit code
-                exit $test_exit_code
-                EOL
-                chmod +x $out/bin/run-testinfra
-              '';
-
-            cleanup-ami = pkgs.runCommand "cleanup-ami"
-              {
-                buildInputs = with pkgs; [
-                  awscli2
-                  aws-vault
-                ];
-              } ''
-                mkdir -p $out/bin
-                cat > $out/bin/cleanup-ami << 'EOL'
-                #!/usr/bin/env bash
-                set -euo pipefail
-
-                export PATH="${pkgs.lib.makeBinPath (with pkgs; [
-                  awscli2
-                  aws-vault
-                ])}:$PATH"
-
-                # Check for required tools
-                for cmd in aws-vault; do
-                  if ! command -v $cmd &> /dev/null; then
-                    echo "Error: $cmd is required but not found"
-                    exit 1
-                  fi
-                done
-
-                # Check AWS Vault profile
-                if [ -z "''${AWS_VAULT:-}" ]; then
-                  echo "Error: AWS_VAULT environment variable must be set with the profile name"
-                  echo "Usage: aws-vault exec <profile-name> -- nix run .#cleanup-ami <ami-name>"
-                  exit 1
-                fi
-
-                # Check for AMI name argument
-                if [ -z "''${1:-}" ]; then
-                  echo "Error: AMI name must be provided"
-                  echo "Usage: aws-vault exec <profile-name> -- nix run .#cleanup-ami <ami-name>"
-                  exit 1
-                fi
-
-                AMI_NAME="$1"
-                REGION="ap-southeast-1"
-
-                # Deregister AMIs
-                for AMI_PATTERN in "supabase-postgres-ci-ami-test-stage-1" "$AMI_NAME"; do
-                  aws ec2 describe-images --region $REGION --owners self \
-                    --filters "Name=name,Values=$AMI_PATTERN" \
-                    --query 'Images[*].ImageId' --output text | while read -r ami_id; do
-                      echo "Deregistering AMI: $ami_id"
-                      aws ec2 deregister-image --region $REGION --image-id "$ami_id" || true
-                    done
-                done
-                EOL
-                chmod +x $out/bin/cleanup-ami
-              '';
-
-            trigger-nix-build = pkgs.runCommand "trigger-nix-build"
-              {
-                buildInputs = with pkgs; [
-                  gh
-                  git
-                  coreutils
-                ];
-              } ''
-                mkdir -p $out/bin
-                cat > $out/bin/trigger-nix-build << 'EOL'
-                #!/usr/bin/env bash
-                set -euo pipefail
-
-                show_help() {
-                  cat << EOF
-                Usage: trigger-nix-build [--help]
-
-                Trigger the nix-build workflow for the current branch and watch its progress.
-
-                This script will:
-                1. Check if you're authenticated with GitHub
-                2. Get the current branch and commit
-                3. Verify you're on a standard branch (develop or release/*) or prompt for confirmation
-                4. Trigger the nix-build workflow
-                5. Watch the workflow progress until completion
-
-                Options:
-                  --help    Show this help message and exit
-
-                Requirements:
-                  - GitHub CLI (gh) installed and authenticated
-                  - Git installed
-                  - Must be run from a git repository
-
-                Example:
-                  trigger-nix-build
-                EOF
-                }
-
-                # Handle help flag
-                if [[ "$#" -gt 0 && "$1" == "--help" ]]; then
-                  show_help
-                  exit 0
-                fi
-
-                export PATH="${pkgs.lib.makeBinPath (with pkgs; [
-                  gh
-                  git
-                  coreutils
-                ])}:$PATH"
-
-                # Check for required tools
-                for cmd in gh git; do
-                  if ! command -v $cmd &> /dev/null; then
-                    echo "Error: $cmd is required but not found"
-                    exit 1
-                  fi
-                done
-
-                # Check if user is authenticated with GitHub
-                if ! gh auth status &>/dev/null; then
-                  echo "Error: Not authenticated with GitHub. Please run 'gh auth login' first."
-                  exit 1
-                fi
-
-                # Get current branch and commit
-                BRANCH=$(git rev-parse --abbrev-ref HEAD)
-                COMMIT=$(git rev-parse HEAD)
-
-                # Check if we're on a standard branch
-                if [[ "$BRANCH" != "develop" && ! "$BRANCH" =~ ^release/ ]]; then
-                  echo "Warning: Running workflow from non-standard branch: $BRANCH"
-                  echo "This is supported for testing purposes."
-                  read -p "Continue? [y/N] " -n 1 -r
-                  echo
-                  if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-                    echo "Aborted."
-                    exit 1
-                  fi
-                fi
-
-                # Trigger the workflow
-                echo "Triggering nix-build workflow for branch $BRANCH (commit: $COMMIT)"
-                gh workflow run nix-build.yml --ref "$BRANCH"
-
-                # Wait for workflow to start and get the run ID
-                echo "Waiting for workflow to start..."
-                sleep 5
-
-                # Get the latest run ID for this workflow
-                RUN_ID=$(gh run list --workflow=nix-build.yml --limit 1 --json databaseId --jq '.[0].databaseId')
-
-                if [ -z "$RUN_ID" ]; then
-                  echo "Error: Could not find workflow run ID"
-                  exit 1
-                fi
-
-                echo "Watching workflow run $RUN_ID..."
-                echo "The script will automatically exit when the workflow completes."
-                echo "Press Ctrl+C to stop watching (workflow will continue running)"
-                echo "----------------------------------------"
-
-                # Try to watch the run, but handle network errors gracefully
-                while true; do
-                  if gh run watch "$RUN_ID" --exit-status; then
-                    break
-                  else
-                    echo "Network error while watching workflow. Retrying in 5 seconds..."
-                    echo "You can also check the status manually with: gh run view $RUN_ID"
-                    sleep 5
-                  fi
-                done
-                EOL
-                chmod +x $out/bin/trigger-nix-build
-              '';
-          };
-
-
-        # Create a testing harness for a PostgreSQL package. This is used for
-        # 'nix flake check', and works with any PostgreSQL package you hand it.
-
-        makeCheckHarness = pgpkg:
-          let
-            sqlTests = ./nix/tests/smoke;
-            pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
-            pg_regress = basePackages.pg_regress;
-            getkey-script = pkgs.stdenv.mkDerivation {
-              name = "pgsodium-getkey";
-              buildCommand = ''
-                mkdir -p $out/bin
-                cat > $out/bin/pgsodium-getkey << 'EOF'
-                #!${pkgs.bash}/bin/bash
-                set -euo pipefail
-
-                TMPDIR_BASE=$(mktemp -d)
-
-                KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
-                KEY_FILE="$KEY_DIR/pgsodium.key"
-
-                if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
-                  echo "Error: Could not create key directory $KEY_DIR" >&2
-                  exit 1
-                fi
-                chmod 1777 "$KEY_DIR"
-
-                if [[ ! -f "$KEY_FILE" ]]; then
-                  if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
-                    if ! (openssl rand -hex 32 > "$KEY_FILE"); then
-                      echo "00000000000000000000000000000000" > "$KEY_FILE"
-                      echo "Warning: Using fallback key" >&2
-                    fi
-                  fi
-                  chmod 644 "$KEY_FILE"
-                fi
-
-                if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
-                  cat "$KEY_FILE"
-                else
-                  echo "Error: Cannot read key file $KEY_FILE" >&2
-                  exit 1
-                fi
-                EOF
-                chmod +x $out/bin/pgsodium-getkey
-              '';
-            };
-
-            # Use the shared setup but with a test-specific name
-            start-postgres-server-bin = makePostgresDevSetup {
-              inherit pkgs;
-              name = "start-postgres-server-test";
-              extraSubstitutions = {
-                PGSODIUM_GETKEY = "${getkey-script}/bin/pgsodium-getkey";
-                PGSQL_DEFAULT_PORT = pgPort;
-              };
-            };
-
-            getVersionArg = pkg:
-              let
-                name = pkg.version;
-              in
-              if builtins.match "15.*" name != null then "15"
-              else if builtins.match "17.*" name != null then "17"
-              else if builtins.match "orioledb-17.*" name != null then "orioledb-17"
-              else throw "Unsupported PostgreSQL version: ${name}";
-
-            # Helper function to filter SQL files based on version
-            filterTestFiles = version: dir:
-              let
-                files = builtins.readDir dir;
-                isValidFile = name:
-                  let
-                    isVersionSpecific = builtins.match "z_.*" name != null;
-                    matchesVersion =
-                      if isVersionSpecific
-                      then
-                        if version == "orioledb-17"
-                        then builtins.match "z_orioledb-17_.*" name != null
-                        else if version == "17"
-                        then builtins.match "z_17_.*" name != null
-                        else builtins.match "z_15_.*" name != null
-                      else true;
-                  in
-                  pkgs.lib.hasSuffix ".sql" name && matchesVersion;
-              in
-              pkgs.lib.filterAttrs (name: _: isValidFile name) files;
-
-            # Get the major version for filtering
-            majorVersion =
-              let
-                version = builtins.trace "pgpkg.version is: ${pgpkg.version}" pgpkg.version;
-                _ = builtins.trace "Entering majorVersion logic";
-                isOrioledbMatch = builtins.match "^17_[0-9]+$" version != null;
-                isSeventeenMatch = builtins.match "^17[.][0-9]+$" version != null;
-                result =
-                  if isOrioledbMatch
-                  then "orioledb-17"
-                  else if isSeventeenMatch
-                  then "17"
-                  else "15";
-              in
-              builtins.trace "Major version result: ${result}" result; # Trace the result                                             # For "15.8"
-
-            # Filter SQL test files
-            filteredSqlTests = filterTestFiles majorVersion ./nix/tests/sql;
-
-            pgPort = if (majorVersion == "17") then
-                "5535"
-                else if (majorVersion == "15") then
-                "5536"
-                else "5537";
-
-            # Convert filtered tests to a sorted list of basenames (without extension)
-            testList = pkgs.lib.mapAttrsToList
-              (name: _:
-                builtins.substring 0 (pkgs.lib.stringLength name - 4) name
-              )
-              filteredSqlTests;
-            sortedTestList = builtins.sort (a: b: a < b) testList;
-
-          in
-          pkgs.runCommand "postgres-${pgpkg.version}-check-harness"
-            {
-              nativeBuildInputs = with pkgs; [
-                coreutils
-                bash
-                perl
-                pgpkg
-                pg_prove
-                pg_regress
-                procps
-                start-postgres-server-bin
-                which
-                getkey-script
-                supabase-groonga
-              ];
-            } ''
-            set -e
-
-            #First we need to create a generic pg cluster for pgtap tests and run those
-            export GRN_PLUGINS_DIR=${supabase-groonga}/lib/groonga/plugins
-            PGTAP_CLUSTER=$(mktemp -d)
-            initdb --locale=C --username=supabase_admin -D "$PGTAP_CLUSTER"
-            substitute ${./nix/tests/postgresql.conf.in} "$PGTAP_CLUSTER"/postgresql.conf \
-              --subst-var-by PGSODIUM_GETKEY_SCRIPT "${getkey-script}/bin/pgsodium-getkey"
-            echo "listen_addresses = '*'" >> "$PGTAP_CLUSTER"/postgresql.conf
-            echo "port = ${pgPort}" >> "$PGTAP_CLUSTER"/postgresql.conf
-            echo "host all all 127.0.0.1/32 trust" >> $PGTAP_CLUSTER/pg_hba.conf
-            echo "Checking shared_preload_libraries setting:"
-            grep -rn "shared_preload_libraries" "$PGTAP_CLUSTER"/postgresql.conf
-            # Remove timescaledb if running orioledb-17 check
-            echo "I AM ${pgpkg.version}===================================================="
-            if [[ "${pgpkg.version}" == *"17"* ]]; then
-              perl -pi -e 's/ timescaledb,//g' "$PGTAP_CLUSTER/postgresql.conf"
-            fi
-            #NOTE in the future we may also need to add the orioledb extension to the cluster when cluster is oriole
-            echo "PGTAP_CLUSTER directory contents:"
-            ls -la "$PGTAP_CLUSTER"
-
-            # Check if postgresql.conf exists
-            if [ ! -f "$PGTAP_CLUSTER/postgresql.conf" ]; then
-                echo "postgresql.conf is missing!"
-                exit 1
-            fi
-
-            # PostgreSQL startup
-            if [[ "$(uname)" == "Darwin" ]]; then
-            pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k "$PGTAP_CLUSTER" -p ${pgPort} -d 5" start 2>&1
-            else
-            mkdir -p "$PGTAP_CLUSTER/sockets"
-            pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k $PGTAP_CLUSTER/sockets -p ${pgPort} -d 5" start 2>&1
-            fi || {
-            echo "pg_ctl failed to start PostgreSQL"
-            echo "Contents of postgresql.log:"
-            cat "$PGTAP_CLUSTER"/postgresql.log
-            exit 1
-            }
-            for i in {1..60}; do
-              if pg_isready -h ${pgsqlDefaultHost} -p ${pgPort}; then
-                echo "PostgreSQL is ready"
-                break
-              fi
-              sleep 1
-              if [ $i -eq 60 ]; then
-                echo "PostgreSQL is not ready after 60 seconds"
-                echo "PostgreSQL status:"
-                pg_ctl -D "$PGTAP_CLUSTER" status
-                echo "PostgreSQL log content:"
-                cat "$PGTAP_CLUSTER"/postgresql.log
-                exit 1
-              fi
-            done
-            createdb -p ${pgPort} -h ${pgsqlDefaultHost} --username=supabase_admin testing
-            if ! psql -p ${pgPort} -h ${pgsqlDefaultHost} --username=supabase_admin -d testing -v ON_ERROR_STOP=1 -Xf ${./nix/tests/prime.sql}; then
-              echo "Error executing SQL file. PostgreSQL log content:"
-              cat "$PGTAP_CLUSTER"/postgresql.log
-              pg_ctl -D "$PGTAP_CLUSTER" stop
-              exit 1
-            fi
-            SORTED_DIR=$(mktemp -d)
-            for t in $(printf "%s\n" ${builtins.concatStringsSep " " sortedTestList}); do
-              psql -p ${pgPort} -h ${pgsqlDefaultHost} --username=supabase_admin -d testing -f "${./nix/tests/sql}/$t.sql" || true
-            done
-            rm -rf "$SORTED_DIR"
-            pg_ctl -D "$PGTAP_CLUSTER" stop
-            rm -rf $PGTAP_CLUSTER
-
-            # End of pgtap tests
-            # from here on out we are running pg_regress tests, we use a different cluster for this
-            # which is start by the start-postgres-server-bin script
-            # start-postgres-server-bin script closely matches our AMI setup, configurations and migrations
-
-            unset GRN_PLUGINS_DIR
-            ${start-postgres-server-bin}/bin/start-postgres-server ${getVersionArg pgpkg} --daemonize
-
-            for i in {1..60}; do
-                if pg_isready -h ${pgsqlDefaultHost} -p ${pgPort} -U supabase_admin -q; then
-                    echo "PostgreSQL is ready"
-                    break
-                fi
-                sleep 1
-                if [ $i -eq 60 ]; then
-                    echo "PostgreSQL failed to start"
-                    exit 1
-                fi
-            done
-
-            if ! psql -p ${pgPort} -h ${pgsqlDefaultHost} --no-password --username=supabase_admin -d postgres -v ON_ERROR_STOP=1 -Xf ${./nix/tests/prime.sql}; then
-              echo "Error executing SQL file"
-              exit 1
-            fi
-
-            mkdir -p $out/regression_output
-            if ! pg_regress \
-              --use-existing \
-              --dbname=postgres \
-              --inputdir=${./nix/tests} \
-              --outputdir=$out/regression_output \
-              --host=${pgsqlDefaultHost} \
-              --port=${pgPort} \
-              --user=supabase_admin \
-              ${builtins.concatStringsSep " " sortedTestList}; then
-              echo "pg_regress tests failed"
-              cat $out/regression_output/regression.diffs
-              exit 1
-            fi
-
-            echo "Running migrations tests"
-            pg_prove -p ${pgPort} -U supabase_admin -h ${pgsqlDefaultHost} -d postgres -v ${./migrations/tests}/test.sql
-
-            # Copy logs to output
-            for logfile in $(find /tmp -name postgresql.log -type f); do
-              cp "$logfile" $out/postgresql.log
-            done
-            exit 0
-          '';
-      in
-      rec {
-        # The list of all packages that can be built with 'nix build'. The list
-        # of names that can be used can be shown with 'nix flake show'
-        packages = flake-utils.lib.flattenTree basePackages // {
-          # Any extra packages we might want to include in our package
-          # set can go here.
-          inherit (pkgs);
-        };
-
-        # The list of exported 'checks' that are run with every run of 'nix
-        # flake check'. This is run in the CI system, as well.
-        checks = {
-          psql_15 = makeCheckHarness basePackages.psql_15.bin;
-          psql_17 = makeCheckHarness basePackages.psql_17.bin;
-          psql_orioledb-17 = makeCheckHarness basePackages.psql_orioledb-17.bin;
-          inherit (basePackages) wal-g-2 wal-g-3 dbmate-tool pg_regress;
-          devShell = devShells.default;
-        } // pkgs.lib.optionalAttrs (system == "aarch64-linux") {
-          inherit (basePackages) postgresql_15_debug postgresql_15_src postgresql_orioledb-17_debug postgresql_orioledb-17_src postgresql_17_debug postgresql_17_src;
-        };
-
-        # Apps is a list of names of things that can be executed with 'nix run';
-        # these are distinct from the things that can be built with 'nix build',
-        # so they need to be listed here too.
-        apps =
-          let
-            mkApp = attrName: binName: {
-              type = "app";
-              program = "${basePackages."${attrName}"}/bin/${binName}";
-            };
-          in
-          {
-            start-server = mkApp "start-server" "start-postgres-server";
-            start-client = mkApp "start-client" "start-postgres-client";
-            start-replica = mkApp "start-replica" "start-postgres-replica";
-            # migrate-postgres = mkApp "migrate-tool" "migrate-postgres";
-            # sync-exts-versions = mkApp "sync-exts-versions" "sync-exts-versions";
-            pg-restore = mkApp "pg-restore" "pg-restore";
-            local-infra-bootstrap = mkApp "local-infra-bootstrap" "local-infra-bootstrap";
-            dbmate-tool = mkApp "dbmate-tool" "dbmate-tool";
-            update-readme = mkApp "update-readme" "update-readme";
-            show-commands = mkApp "show-commands" "show-commands";
-            build-test-ami = mkApp "build-test-ami" "build-test-ami";
-            run-testinfra = mkApp "run-testinfra" "run-testinfra";
-            cleanup-ami = mkApp "cleanup-ami" "cleanup-ami";
-            trigger-nix-build = mkApp "trigger-nix-build" "trigger-nix-build";
-          };
-
-        # 'devShells.default' lists the set of packages that are included in the
-        # ambient $PATH environment when you run 'nix develop'. This is useful
-        # for development and puts many convenient devtools instantly within
-        # reach.
-
-        devShells =
-          let
-            mkCargoPgrxDevShell = { pgrxVersion, rustVersion }: pkgs.mkShell {
-              packages = with pkgs; [
-                basePackages."cargo-pgrx_${pgrxVersion}"
-                (rust-bin.stable.${rustVersion}.default.override {
-                  extensions = [ "rust-src" ];
-                })
-              ];
-              shellHook = ''
-                export HISTFILE=.history
-              '';
-            };
-            nix-fast-build = inputs.nix-fast-build.packages.${system}.default;
-          in
-          {
-            default = pkgs.mkShell {
-              packages = with pkgs; [
-                coreutils
-                just
-                nix-update
-                #pg_prove
-                shellcheck
-                ansible
-                ansible-lint
-                (packer.overrideAttrs (oldAttrs: {
-                  version = "1.7.8";
-                }))
-
-                basePackages.start-server
-                basePackages.start-client
-                basePackages.start-replica
-                basePackages.migrate-tool
-                basePackages.sync-exts-versions
-                basePackages.build-test-ami
-                basePackages.run-testinfra
-                basePackages.cleanup-ami
-                dbmate
-                nushell
-                pythonEnv
-                nix-fast-build
-              ];
-              shellHook = ''
-                export HISTFILE=.history
-              '';
-            };
-            cargo-pgrx_0_11_3 = mkCargoPgrxDevShell {
-              pgrxVersion = "0_11_3";
-              rustVersion = "1.80.0";
-            };
-            cargo-pgrx_0_12_6 = mkCargoPgrxDevShell {
-              pgrxVersion = "0_12_6";
-              rustVersion = "1.80.0";
-            };
-          };
-      }
-    );
+      imports = [
+        nix/apps.nix
+        nix/checks.nix
+        nix/config.nix
+        nix/devShells.nix
+        nix/ext
+        nix/fmt.nix
+        nix/hooks.nix
+        nix/nixpkgs.nix
+        nix/packages
+        nix/overlays
+      ];
+    });
 }
diff --git a/nix/apps.nix b/nix/apps.nix
new file mode 100644
index 000000000..75eaae49e
--- /dev/null
+++ b/nix/apps.nix
@@ -0,0 +1,32 @@
+{ ... }:
+{
+  perSystem =
+    { self', ... }:
+    let
+      mkApp = attrName: binName: {
+        type = "app";
+        program = "${self'.packages."${attrName}"}/bin/${binName}";
+      };
+    in
+    {
+      # Apps is a list of names of things that can be executed with 'nix run';
+      # these are distinct from the things that can be built with 'nix build',
+      # so they need to be listed here too.
+      apps = {
+        start-server = mkApp "start-server" "start-postgres-server";
+        start-client = mkApp "start-client" "start-postgres-client";
+        start-replica = mkApp "start-replica" "start-postgres-replica";
+        # migrate-postgres = mkApp "migrate-tool" "migrate-postgres";
+        # sync-exts-versions = mkApp "sync-exts-versions" "sync-exts-versions";
+        pg-restore = mkApp "pg-restore" "pg-restore";
+        local-infra-bootstrap = mkApp "local-infra-bootstrap" "local-infra-bootstrap";
+        dbmate-tool = mkApp "dbmate-tool" "dbmate-tool";
+        update-readme = mkApp "update-readme" "update-readme";
+        show-commands = mkApp "show-commands" "show-commands";
+        build-test-ami = mkApp "build-test-ami" "build-test-ami";
+        run-testinfra = mkApp "run-testinfra" "run-testinfra";
+        cleanup-ami = mkApp "cleanup-ami" "cleanup-ami";
+        trigger-nix-build = mkApp "trigger-nix-build" "trigger-nix-build";
+      };
+    };
+}
diff --git a/nix/cargo-pgrx/buildPgrxExtension.nix b/nix/cargo-pgrx/buildPgrxExtension.nix
index 89293ab62..0b2b14fb9 100644
--- a/nix/cargo-pgrx/buildPgrxExtension.nix
+++ b/nix/cargo-pgrx/buildPgrxExtension.nix
@@ -27,13 +27,14 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
-{ lib
-, cargo-pgrx
-, pkg-config
-, rustPlatform
-, stdenv
-, Security
-, writeShellScriptBin
+{
+  lib,
+  cargo-pgrx,
+  pkg-config,
+  rustPlatform,
+  stdenv,
+  Security,
+  writeShellScriptBin,
 }:
 
 # The idea behind: Use it mostly like rustPlatform.buildRustPackage and so
@@ -47,26 +48,31 @@
 #                      unnecessary and heavy dependency. If you set this to true, you also
 #                      have to add `rustfmt` to `nativeBuildInputs`.
 
-{ buildAndTestSubdir ? null
-, buildType ? "release"
-, buildFeatures ? [ ]
-, cargoBuildFlags ? [ ]
-, postgresql
-# cargo-pgrx calls rustfmt on generated bindings, this is not strictly necessary, so we avoid the
-# dependency here. Set to false and provide rustfmt in nativeBuildInputs, if you need it, e.g.
-# if you include the generated code in the output via postInstall.
-, useFakeRustfmt ? true
-, usePgTestCheckFeature ? true
-, ...
-} @ args:
+{
+  buildAndTestSubdir ? null,
+  buildType ? "release",
+  buildFeatures ? [ ],
+  cargoBuildFlags ? [ ],
+  postgresql,
+  # cargo-pgrx calls rustfmt on generated bindings, this is not strictly necessary, so we avoid the
+  # dependency here. Set to false and provide rustfmt in nativeBuildInputs, if you need it, e.g.
+  # if you include the generated code in the output via postInstall.
+  useFakeRustfmt ? true,
+  usePgTestCheckFeature ? true,
+  ...
+}@args:
 let
-  rustfmtInNativeBuildInputs = lib.lists.any (dep: lib.getName dep == "rustfmt") (args.nativeBuildInputs or []);
+  rustfmtInNativeBuildInputs = lib.lists.any (dep: lib.getName dep == "rustfmt") (
+    args.nativeBuildInputs or [ ]
+  );
 in
 
-assert lib.asserts.assertMsg ((args.installPhase or "") == "")
-  "buildPgrxExtensions overwrites the installPhase, so providing one does nothing";
-assert lib.asserts.assertMsg ((args.buildPhase or "") == "")
-  "buildPgrxExtensions overwrites the buildPhase, so providing one does nothing";
+assert lib.asserts.assertMsg (
+  (args.installPhase or "") == ""
+) "buildPgrxExtensions overwrites the installPhase, so providing one does nothing";
+assert lib.asserts.assertMsg (
+  (args.buildPhase or "") == ""
+) "buildPgrxExtensions overwrites the buildPhase, so providing one does nothing";
 assert lib.asserts.assertMsg (useFakeRustfmt -> !rustfmtInNativeBuildInputs)
   "The parameter useFakeRustfmt is set to true, but rustfmt is included in nativeBuildInputs. Either set useFakeRustfmt to false or remove rustfmt from nativeBuildInputs.";
 assert lib.asserts.assertMsg (!useFakeRustfmt -> rustfmtInNativeBuildInputs)
@@ -75,7 +81,7 @@ assert lib.asserts.assertMsg (!useFakeRustfmt -> rustfmtInNativeBuildInputs)
 let
   fakeRustfmt = writeShellScriptBin "rustfmt" ''
     exit 0
-    '';
+  '';
   maybeDebugFlag = lib.optionalString (buildType != "release") "--debug";
   maybeEnterBuildAndTestSubdir = lib.optionalString (buildAndTestSubdir != null) ''
     export CARGO_TARGET_DIR="$(pwd)/target"
@@ -97,19 +103,26 @@ let
     pg_ctl stop
   '';
 
-  argsForBuildRustPackage = builtins.removeAttrs args [ "postgresql" "useFakeRustfmt" "usePgTestCheckFeature" ];
+  argsForBuildRustPackage = builtins.removeAttrs args [
+    "postgresql"
+    "useFakeRustfmt"
+    "usePgTestCheckFeature"
+  ];
 
   # so we don't accidentally `(rustPlatform.buildRustPackage argsForBuildRustPackage) // { ... }` because
   # we forgot parentheses
   finalArgs = argsForBuildRustPackage // {
     buildInputs = (args.buildInputs or [ ]) ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 
-    nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
-      cargo-pgrx
-      postgresql
-      pkg-config
-      rustPlatform.bindgenHook
-    ] ++ lib.optionals useFakeRustfmt [ fakeRustfmt ];
+    nativeBuildInputs =
+      (args.nativeBuildInputs or [ ])
+      ++ [
+        cargo-pgrx
+        postgresql
+        pkg-config
+        rustPlatform.bindgenHook
+      ]
+      ++ lib.optionals useFakeRustfmt [ fakeRustfmt ];
 
     buildPhase = ''
       runHook preBuild
@@ -155,7 +168,10 @@ let
     RUST_BACKTRACE = "full";
 
     checkNoDefaultFeatures = true;
-    checkFeatures = (args.checkFeatures or [ ]) ++ (lib.optionals usePgTestCheckFeature [ "pg_test" ]) ++ [ "pg${pgrxPostgresMajor}" ];
+    checkFeatures =
+      (args.checkFeatures or [ ])
+      ++ (lib.optionals usePgTestCheckFeature [ "pg_test" ])
+      ++ [ "pg${pgrxPostgresMajor}" ];
   };
 in
 rustPlatform.buildRustPackage finalArgs
diff --git a/nix/cargo-pgrx/default.nix b/nix/cargo-pgrx/default.nix
index c1e1a4dee..5b5cd7222 100644
--- a/nix/cargo-pgrx/default.nix
+++ b/nix/cargo-pgrx/default.nix
@@ -1,11 +1,12 @@
-{ lib
-, darwin
-, fetchCrate
-, openssl
-, pkg-config
-, makeRustPlatform
-, stdenv
-, rust-bin
+{
+  lib,
+  darwin,
+  fetchCrate,
+  openssl,
+  pkg-config,
+  makeRustPlatform,
+  stdenv,
+  rust-bin,
 }:
 let
   rustVersion = "1.85.1";
@@ -14,9 +15,10 @@ let
     rustc = rust-bin.stable.${rustVersion}.default;
   };
   generic =
-    { version
-    , hash
-    , cargoHash
+    {
+      version,
+      hash,
+      cargoHash,
     }:
     rustPlatform.buildRustPackage rec {
       # rust-overlay uses 'cargo-auditable' wrapper for 'cargo' command, but it
@@ -26,19 +28,13 @@ let
       auditable = false;
       pname = "cargo-pgrx";
       inherit version;
-      src = fetchCrate {
-        inherit version pname hash;
-      };
+      src = fetchCrate { inherit version pname hash; };
       inherit cargoHash;
-      nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
-        pkg-config
-      ];
-      buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
-        openssl
-      ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.Security
-      ];
-      
+      nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
+      buildInputs =
+        lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
       OPENSSL_DIR = "${openssl.dev}";
       OPENSSL_INCLUDE_DIR = "${openssl.dev}/include";
       OPENSSL_LIB_DIR = "${openssl.out}/lib";
diff --git a/nix/checks.nix b/nix/checks.nix
new file mode 100644
index 000000000..fc042ad12
--- /dev/null
+++ b/nix/checks.nix
@@ -0,0 +1,311 @@
+{ self, ... }:
+{
+  perSystem =
+    {
+      lib,
+      self',
+      system,
+      pkgs,
+      ...
+    }:
+    let
+      pkgs-lib = pkgs.callPackage ./packages/lib.nix {
+        psql_15 = self'.packages."psql_15/bin";
+        psql_17 = self'.packages."psql_17/bin";
+        psql_orioledb-17 = self'.packages."psql_orioledb-17/bin";
+        pgroonga = self'.packages."psql_15/exts/pgroonga";
+        inherit (self.supabase) defaults;
+      };
+    in
+    {
+      checks =
+        let
+          # Create a testing harness for a PostgreSQL package. This is used for
+          # 'nix flake check', and works with any PostgreSQL package you hand it.
+          makeCheckHarness =
+            pgpkg:
+            let
+              pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
+              pg_regress = self'.packages.pg_regress;
+              getkey-script = pkgs.stdenv.mkDerivation {
+                name = "pgsodium-getkey";
+                buildCommand = ''
+                  mkdir -p $out/bin
+                  cat > $out/bin/pgsodium-getkey << 'EOF'
+                  #!${pkgs.bash}/bin/bash
+                  set -euo pipefail
+
+                  TMPDIR_BASE=$(mktemp -d)
+
+                  KEY_DIR="''${PGSODIUM_KEY_DIR:-$TMPDIR_BASE/pgsodium}"
+                  KEY_FILE="$KEY_DIR/pgsodium.key"
+
+                  if ! mkdir -p "$KEY_DIR" 2>/dev/null; then
+                    echo "Error: Could not create key directory $KEY_DIR" >&2
+                    exit 1
+                  fi
+                  chmod 1777 "$KEY_DIR"
+
+                  if [[ ! -f "$KEY_FILE" ]]; then
+                    if ! (dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -A n -t x1 | tr -d ' \n' > "$KEY_FILE"); then
+                      if ! (openssl rand -hex 32 > "$KEY_FILE"); then
+                        echo "00000000000000000000000000000000" > "$KEY_FILE"
+                        echo "Warning: Using fallback key" >&2
+                      fi
+                    fi
+                    chmod 644 "$KEY_FILE"
+                  fi
+
+                  if [[ -f "$KEY_FILE" && -r "$KEY_FILE" ]]; then
+                    cat "$KEY_FILE"
+                  else
+                    echo "Error: Cannot read key file $KEY_FILE" >&2
+                    exit 1
+                  fi
+                  EOF
+                  chmod +x $out/bin/pgsodium-getkey
+                '';
+              };
+
+              # Use the shared setup but with a test-specific name
+              start-postgres-server-bin = pkgs-lib.makePostgresDevSetup {
+                inherit pkgs;
+                name = "start-postgres-server-test";
+                extraSubstitutions = {
+                  PGSODIUM_GETKEY = "${getkey-script}/bin/pgsodium-getkey";
+                  PGSQL_DEFAULT_PORT = pgPort;
+                };
+              };
+
+              getVersionArg =
+                pkg:
+                let
+                  name = pkg.version;
+                in
+                if builtins.match "15.*" name != null then
+                  "15"
+                else if builtins.match "17.*" name != null then
+                  "17"
+                else if builtins.match "orioledb-17.*" name != null then
+                  "orioledb-17"
+                else
+                  throw "Unsupported PostgreSQL version: ${name}";
+
+              # Helper function to filter SQL files based on version
+              filterTestFiles =
+                version: dir:
+                let
+                  files = builtins.readDir dir;
+                  isValidFile =
+                    name:
+                    let
+                      isVersionSpecific = builtins.match "z_.*" name != null;
+                      matchesVersion =
+                        if isVersionSpecific then
+                          if version == "orioledb-17" then
+                            builtins.match "z_orioledb-17_.*" name != null
+                          else if version == "17" then
+                            builtins.match "z_17_.*" name != null
+                          else
+                            builtins.match "z_15_.*" name != null
+                        else
+                          true;
+                    in
+                    pkgs.lib.hasSuffix ".sql" name && matchesVersion;
+                in
+                pkgs.lib.filterAttrs (name: _: isValidFile name) files;
+
+              # Get the major version for filtering
+              majorVersion =
+                let
+                  version = builtins.trace "pgpkg.version is: ${pgpkg.version}" pgpkg.version;
+                  isOrioledbMatch = builtins.match "^17_[0-9]+$" version != null;
+                  isSeventeenMatch = builtins.match "^17[.][0-9]+$" version != null;
+                  result =
+                    if isOrioledbMatch then
+                      "orioledb-17"
+                    else if isSeventeenMatch then
+                      "17"
+                    else
+                      "15";
+                in
+                builtins.trace "Major version result: ${result}" result; # Trace the result                                             # For "15.8"
+
+              # Filter SQL test files
+              filteredSqlTests = filterTestFiles majorVersion ./tests/sql;
+
+              pgPort =
+                if (majorVersion == "17") then
+                  "5535"
+                else if (majorVersion == "15") then
+                  "5536"
+                else
+                  "5537";
+
+              # Convert filtered tests to a sorted list of basenames (without extension)
+              testList = pkgs.lib.mapAttrsToList (
+                name: _: builtins.substring 0 (pkgs.lib.stringLength name - 4) name
+              ) filteredSqlTests;
+              sortedTestList = builtins.sort (a: b: a < b) testList;
+            in
+            pkgs.runCommand "postgres-${pgpkg.version}-check-harness"
+              {
+                nativeBuildInputs = with pkgs; [
+                  coreutils
+                  bash
+                  perl
+                  pgpkg
+                  pg_prove
+                  pg_regress
+                  procps
+                  start-postgres-server-bin
+                  which
+                  getkey-script
+                  supabase-groonga
+                ];
+              }
+              ''
+                set -e
+
+                #First we need to create a generic pg cluster for pgtap tests and run those
+                export GRN_PLUGINS_DIR=${pkgs.supabase-groonga}/lib/groonga/plugins
+                PGTAP_CLUSTER=$(mktemp -d)
+                initdb --locale=C --username=supabase_admin -D "$PGTAP_CLUSTER"
+                substitute ${./tests/postgresql.conf.in} "$PGTAP_CLUSTER"/postgresql.conf \
+                  --subst-var-by PGSODIUM_GETKEY_SCRIPT "${getkey-script}/bin/pgsodium-getkey"
+                echo "listen_addresses = '*'" >> "$PGTAP_CLUSTER"/postgresql.conf
+                echo "port = ${pgPort}" >> "$PGTAP_CLUSTER"/postgresql.conf
+                echo "host all all 127.0.0.1/32 trust" >> $PGTAP_CLUSTER/pg_hba.conf
+                echo "Checking shared_preload_libraries setting:"
+                grep -rn "shared_preload_libraries" "$PGTAP_CLUSTER"/postgresql.conf
+                # Remove timescaledb if running orioledb-17 check
+                echo "I AM ${pgpkg.version}===================================================="
+                if [[ "${pgpkg.version}" == *"17"* ]]; then
+                  perl -pi -e 's/ timescaledb,//g' "$PGTAP_CLUSTER/postgresql.conf"
+                fi
+                #NOTE in the future we may also need to add the orioledb extension to the cluster when cluster is oriole
+                echo "PGTAP_CLUSTER directory contents:"
+                ls -la "$PGTAP_CLUSTER"
+
+                # Check if postgresql.conf exists
+                if [ ! -f "$PGTAP_CLUSTER/postgresql.conf" ]; then
+                    echo "postgresql.conf is missing!"
+                    exit 1
+                fi
+
+                # PostgreSQL startup
+                if [[ "$(uname)" == "Darwin" ]]; then
+                pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k "$PGTAP_CLUSTER" -p ${pgPort} -d 5" start 2>&1
+                else
+                mkdir -p "$PGTAP_CLUSTER/sockets"
+                pg_ctl -D "$PGTAP_CLUSTER" -l "$PGTAP_CLUSTER"/postgresql.log -o "-k $PGTAP_CLUSTER/sockets -p ${pgPort} -d 5" start 2>&1
+                fi || {
+                echo "pg_ctl failed to start PostgreSQL"
+                echo "Contents of postgresql.log:"
+                cat "$PGTAP_CLUSTER"/postgresql.log
+                exit 1
+                }
+                for i in {1..60}; do
+                  if pg_isready -h ${self.supabase.defaults.host} -p ${pgPort}; then
+                    echo "PostgreSQL is ready"
+                    break
+                  fi
+                  sleep 1
+                  if [ $i -eq 60 ]; then
+                    echo "PostgreSQL is not ready after 60 seconds"
+                    echo "PostgreSQL status:"
+                    pg_ctl -D "$PGTAP_CLUSTER" status
+                    echo "PostgreSQL log content:"
+                    cat "$PGTAP_CLUSTER"/postgresql.log
+                    exit 1
+                  fi
+                done
+                createdb -p ${pgPort} -h ${self.supabase.defaults.host} --username=supabase_admin testing
+                if ! psql -p ${pgPort} -h ${self.supabase.defaults.host} --username=supabase_admin -d testing -v ON_ERROR_STOP=1 -Xf ${./tests/prime.sql}; then
+                  echo "Error executing SQL file. PostgreSQL log content:"
+                  cat "$PGTAP_CLUSTER"/postgresql.log
+                  pg_ctl -D "$PGTAP_CLUSTER" stop
+                  exit 1
+                fi
+                SORTED_DIR=$(mktemp -d)
+                for t in $(printf "%s\n" ${builtins.concatStringsSep " " sortedTestList}); do
+                  psql -p ${pgPort} -h ${self.supabase.defaults.host} --username=supabase_admin -d testing -f "${./tests/sql}/$t.sql" || true
+                done
+                rm -rf "$SORTED_DIR"
+                pg_ctl -D "$PGTAP_CLUSTER" stop
+                rm -rf $PGTAP_CLUSTER
+
+                # End of pgtap tests
+                # from here on out we are running pg_regress tests, we use a different cluster for this
+                # which is start by the start-postgres-server-bin script
+                # start-postgres-server-bin script closely matches our AMI setup, configurations and migrations
+
+                unset GRN_PLUGINS_DIR
+                ${start-postgres-server-bin}/bin/start-postgres-server ${getVersionArg pgpkg} --daemonize
+
+                for i in {1..60}; do
+                    if pg_isready -h ${self.supabase.defaults.host} -p ${pgPort} -U supabase_admin -q; then
+                        echo "PostgreSQL is ready"
+                        break
+                    fi
+                    sleep 1
+                    if [ $i -eq 60 ]; then
+                        echo "PostgreSQL failed to start"
+                        exit 1
+                    fi
+                done
+
+                if ! psql -p ${pgPort} -h ${self.supabase.defaults.host} --no-password --username=supabase_admin -d postgres -v ON_ERROR_STOP=1 -Xf ${./tests/prime.sql}; then
+                  echo "Error executing SQL file"
+                  exit 1
+                fi
+
+                mkdir -p $out/regression_output
+                if ! pg_regress \
+                  --use-existing \
+                  --dbname=postgres \
+                  --inputdir=${./tests} \
+                  --outputdir=$out/regression_output \
+                  --host=${self.supabase.defaults.host} \
+                  --port=${pgPort} \
+                  --user=supabase_admin \
+                  ${builtins.concatStringsSep " " sortedTestList}; then
+                  echo "pg_regress tests failed"
+                  cat $out/regression_output/regression.diffs
+                  exit 1
+                fi
+
+                echo "Running migrations tests"
+                pg_prove -p ${pgPort} -U supabase_admin -h ${self.supabase.defaults.host} -d postgres -v ${../migrations/tests}/test.sql
+
+                # Copy logs to output
+                for logfile in $(find /tmp -name postgresql.log -type f); do
+                  cp "$logfile" $out/postgresql.log
+                done
+                exit 0
+              '';
+        in
+        {
+          psql_15 = makeCheckHarness self'.packages."psql_15/bin";
+          psql_17 = makeCheckHarness self'.packages."psql_17/bin";
+          psql_orioledb-17 = makeCheckHarness self'.packages."psql_orioledb-17/bin";
+          inherit (self'.packages)
+            wal-g-2
+            wal-g-3
+            dbmate-tool
+            pg_regress
+            ;
+          devShell = self'.devShells.default;
+        }
+        // pkgs.lib.optionalAttrs (system == "aarch64-linux") {
+          inherit (self'.packages)
+            postgresql_15_debug
+            postgresql_15_src
+            postgresql_orioledb-17_debug
+            postgresql_orioledb-17_src
+            postgresql_17_debug
+            postgresql_17_src
+            ;
+        };
+    };
+}
diff --git a/nix/config.nix b/nix/config.nix
new file mode 100644
index 000000000..b1ebe3fd7
--- /dev/null
+++ b/nix/config.nix
@@ -0,0 +1,62 @@
+{ lib, ... }:
+let
+  postgresqlDefaults = lib.types.submodule {
+    options = {
+      port = lib.mkOption {
+        type = lib.types.str;
+        default = "5435";
+      };
+      host = lib.mkOption {
+        type = lib.types.str;
+        default = "localhost";
+      };
+      superuser = lib.mkOption {
+        type = lib.types.str;
+        default = "supabase_admin";
+      };
+    };
+  };
+  postgresqlVersion = lib.types.submodule {
+    options = {
+      version = lib.mkOption { type = lib.types.str; };
+      hash = lib.mkOption { type = lib.types.str; };
+    };
+  };
+  supabaseSubmodule = lib.types.submodule {
+    options = {
+      defaults = lib.mkOption { type = postgresqlDefaults; };
+      supportedPostgresVersions = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.attrsOf postgresqlVersion);
+        default = { };
+      };
+    };
+  };
+in
+{
+  flake = {
+    options = {
+      supabase = lib.mkOption { type = supabaseSubmodule; };
+    };
+    config.supabase = {
+      defaults = { };
+      supportedPostgresVersions = {
+        postgres = {
+          "15" = {
+            version = "15.8";
+            hash = "sha256-RANRX5pp7rPv68mPMLjGlhIr/fiV6Ss7I/W452nty2o=";
+          };
+          "17" = {
+            version = "17.4";
+            hash = "sha256-xGBbc/6hGWNAZpn5Sblm5dFzp+4Myu+JON7AyoqZX+c=";
+          };
+        };
+        orioledb = {
+          "17" = {
+            version = "17_6";
+            hash = "sha256-HbuTcXNanFOl9YfvlSzQJon8CfAhc8TFwo/y7jXy51w=";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/nix/devShells.nix b/nix/devShells.nix
new file mode 100644
index 000000000..7ff4d0720
--- /dev/null
+++ b/nix/devShells.nix
@@ -0,0 +1,81 @@
+{ ... }:
+{
+  perSystem =
+    {
+      pkgs,
+      self',
+      config,
+      ...
+    }:
+    let
+      # Define pythonEnv here
+      pythonEnv = pkgs.python3.withPackages (
+        ps: with ps; [
+          boto3
+          docker
+          pytest
+          pytest-testinfra
+          requests
+          ec2instanceconnectcli
+          paramiko
+        ]
+      );
+      mkCargoPgrxDevShell =
+        { pgrxVersion, rustVersion }:
+        pkgs.mkShell {
+          packages = with pkgs; [
+            self'.packages."cargo-pgrx_${pgrxVersion}"
+            (rust-bin.stable.${rustVersion}.default.override { extensions = [ "rust-src" ]; })
+          ];
+          shellHook = ''
+            export HISTFILE=.history
+          '';
+        };
+    in
+    {
+      devShells = {
+        default = pkgs.mkShell {
+          packages =
+            with pkgs;
+            [
+              coreutils
+              just
+              nix-update
+              #pg_prove
+              shellcheck
+              ansible
+              ansible-lint
+              (packer.overrideAttrs (_oldAttrs: {
+                version = "1.7.8";
+              }))
+
+              self'.packages.start-server
+              self'.packages.start-client
+              self'.packages.start-replica
+              self'.packages.migrate-tool
+              self'.packages.sync-exts-versions
+              self'.packages.build-test-ami
+              self'.packages.run-testinfra
+              self'.packages.cleanup-ami
+              dbmate
+              nushell
+              pythonEnv
+              config.treefmt.build.wrapper
+            ]
+            ++ self'.packages.docs.nativeBuildInputs;
+          shellHook = ''
+            export HISTFILE=.history
+            ${config.pre-commit.installationScript}
+          '';
+        };
+        cargo-pgrx_0_11_3 = mkCargoPgrxDevShell {
+          pgrxVersion = "0_11_3";
+          rustVersion = "1.80.0";
+        };
+        cargo-pgrx_0_12_6 = mkCargoPgrxDevShell {
+          pgrxVersion = "0_12_6";
+          rustVersion = "1.80.0";
+        };
+      };
+    };
+}
diff --git a/nix/docs/README.md b/nix/docs/README.md
index 400632984..66d63ef4c 100644
--- a/nix/docs/README.md
+++ b/nix/docs/README.md
@@ -3,6 +3,36 @@
 This directory contains most of the "runbooks" and documentation on how to use
 this repository.
 
+## Getting Started
+
 You probably want to start with the [starting guide](./start-here.md). Then,
 learn how to play with `postgres` in the [build guide](./build-postgres.md).
-After that, you can probe around a bit.
+
+## Development
+
+- **[Nix tree structure](./nix-directory-structure.md)** - Overview of the Nix directory structure
+- **[Development Workflow](./development-workflow.md)** - Complete development and testing workflow
+- **[Build PostgreSQL](./build-postgres.md)** - Building PostgreSQL from source
+- **[Receipt Files](./receipt-files.md)** - Understanding build receipts
+- **[Start Client/Server](./start-client-server.md)** - Running PostgreSQL client and server
+- **[Docker](./docker.md)** - Docker integration and usage
+- **[Use direnv](./use-direnv.md)** - Development environment with direnv
+- **[Pre-commit Hooks](./pre-commit-hooks.md)** - Automatic formatting and code checks before commits
+- **[Nix Formatter](./nix-formatter.md)** - Code formatting with treefmt
+
+## Package Management
+
+- **[Adding New Packages](./adding-new-package.md)** - How to add new PostgreSQL extensions
+- **[Update Extensions](./update-extension.md)** - How to update existing extensions
+- **[New Major PostgreSQL](./new-major-postgres.md)** - Adding support for new PostgreSQL versions
+- **[Nix Overlays](./nix-overlays.md)** - Understanding and using Nix overlays
+
+## Testing
+
+- **[Adding Tests](./adding-tests.md)** - How to add tests for extensions
+- **[Migration Tests](./migration-tests.md)** - Testing database migrations
+- **[Testing PG Upgrade Scripts](./testing-pg-upgrade-scripts.md)** - Testing PostgreSQL upgrades
+
+## Reference
+
+- **[References](./references.md)** - Useful links and resources
diff --git a/nix/docs/adding-new-package.md b/nix/docs/adding-new-package.md
index 6f7753953..83d546d21 100644
--- a/nix/docs/adding-new-package.md
+++ b/nix/docs/adding-new-package.md
@@ -48,7 +48,7 @@ This uses `stdenv.mkDerivation` which is a general nix builder for C and C++ pro
 
 Your build should produce all of the sql and control files needed for the install phase.
 
-1. Once you have created this file, you can add it to `nix/ext/<yourname>.nix` and edit `flake.nix` and add it to the `ourExtensions` list.
+1. Once you have created this file, you can add it to `nix/ext/<yourname>.nix` and edit `nix/packages/postgres.nix` and add it to the `ourExtensions` list.
 2. `git add .` as nix uses git to track changes 
 3. In your package file, temporarily empty the `hash = "sha256<...>=";` to `hash = "";` and save and `git add .`
 4. Run `nix build .#psql_15/exts/<yourname>`  to try to trigger a build, nix will print the calculated sha256 value that you can add back the the `hash` variable, save the file again, and re-run `nix build .#psql_15/exts/<yourname>`. 
@@ -156,4 +156,4 @@ A few things about `buildPgrxExtension_x`:
 5. You can also run `nix run .#start-server 15` and in a new terminal window run `nix run .#star-client-and-migrate 15` and try to `CREATE EXTENSION <yourname>` and work with it there
 6. Check that your extension works with the `pg_upgrade` process (TODO documentation forthcoming)
 7. Now you are ready to PR the extension
-8. From here, the release process should typically take care of the rest. 
\ No newline at end of file
+8. From here, the release process should typically take care of the rest. 
diff --git a/nix/docs/assets/images/logo.png b/nix/docs/assets/images/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..c5dd5e27aadd48f4de768aac7db1a8575f41b709
GIT binary patch
diff --git a/nix/docs/documentation.md b/nix/docs/documentation.md
new file mode 100644
index 000000000..034b1f460
--- /dev/null
+++ b/nix/docs/documentation.md
@@ -0,0 +1,19 @@
+# Documentation
+
+We are using markdown for documentation in the `nix/docs` directory, which is rendered by [mkdocs](https://www.mkdocs.org/).
+
+## Usage
+
+To generate the documentation locally, you can use the following command in a development shell:
+
+```bash
+cd nix
+mkdocs serve
+```
+
+This will start a local server at `http://localhost:8000` where you can view the documentation.
+The documentation is automatically updated as you make changes to the markdown files.
+
+## Configuration
+
+Mkdocs configuration is done in the `nix/mkdocs.yml` file. Refer to the [Mkdocs documentation](https://www.mkdocs.org/user-guide/configuration/) for details on how to configure the site.
diff --git a/nix/docs/new-major-postgres.md b/nix/docs/new-major-postgres.md
index 1c5a2dffc..b934b38bf 100644
--- a/nix/docs/new-major-postgres.md
+++ b/nix/docs/new-major-postgres.md
@@ -1,9 +1,10 @@
 PostgreSQL versions are managed in upstream nixpkgs.
 
-See this example PR to add a new version of PostgreSQL; this version is for 16
-beta3, but any version is roughly the same. In short, you need to:
+[See this example PR](https://github.com/NixOS/nixpkgs/pull/249030) to add a
+new version of PostgreSQL; this version is for 16 beta3, but any version is
+roughly the same. In short, you need to:
 
-- Add a new version and hash
+- Add a new version and hash to `nix/config.nix`
 - Possibly patch the source code for minor refactorings
   - In this example, an old patch had to be rewritten because a function was
     split into two different functions; the patch is functionally equivalent but
@@ -12,16 +13,14 @@ beta3, but any version is roughly the same. In short, you need to:
 - Integrate inside the CI and get code review
 - Run `nix flake update` to get a new version, once it's ready
 
-https://github.com/NixOS/nixpkgs/pull/249030
-
 ## Adding the major version to this repository
 
 It isn't well abstracted, unfortunately. In short: look for the strings `14` and
-`15` under `flake.nix` and `nix/tools/`. More specifically:
+`15` under the nix configuration files. More specifically:
 
-- Add `psql_XX` to `basePackages` in `flake.nix`
-- Ditto with `checks` in `flake.nix`
-- Modify the tools under `tools/` to understand the new major version
+- Add `psql_XX` to `basePackages` in `nix/packages/postgres.nix`
+- Ditto with `checks` in `nix/checks.nix`
+- Modify the tools under `nix/packages/` to understand the new major version
 - Make sure the CI is integrated under the GitHub Actions.
 
 The third step and fourth steps are the most annoying, really. The first two are
diff --git a/nix/docs/nix-directory-structure.md b/nix/docs/nix-directory-structure.md
new file mode 100644
index 000000000..24ca49943
--- /dev/null
+++ b/nix/docs/nix-directory-structure.md
@@ -0,0 +1,163 @@
+# Nix Directory Structure
+
+This document explains the Nix structure used in this repository. The project uses [flake-parts](https://flake.parts/) to split a `flake.nix` into specialized, maintainable modules.
+
+The root `flake.nix` serves only as an entry point that references specialized modules in the `nix/` directory:
+
+```
+├── flake.nix                  # Root flake file only referencing modules
+nix/
+ ├── apps.nix                 # Application definitions
+ ├── checks.nix               # Build checks and tests
+ ├── config.nix               # Global configuration
+ ├── devShells.nix            # Development environment shell
+ ├── fmt.nix                  # Code formatting configuration
+ ├── hooks.nix                # Git hooks and pre-commit
+ ├── ext/                     # PostgreSQL extensions
+ ├── overlays/                # Nixpkgs overlays
+ ├── packages/                # Custom packages
+ └── postgresql/              # PostgreSQL packages
+```
+
+## Module Descriptions
+
+### Root Files
+
+#### `flake.nix`
+
+The main flake file that:
+
+- Declares inputs (nixpkgs, flake-parts, etc.)
+- Sets up the systems to support (x86_64-linux, aarch64-linux, aarch64-darwin)
+- Imports all module files using flake-parts
+
+#### `flake.lock`
+
+Lockfile containing exact versions of all flake inputs.
+
+### Core Configuration Modules
+
+#### `nix/config.nix`
+
+Global configuration and constants used throughout the flake:
+
+- PostgreSQL default ports and users
+- System-wide package configurations
+- Shared constants and variables
+
+#### `nix/nixpkgs.nix`
+
+Nixpkgs configuration:
+
+- System-specific package imports
+- Overlay applications
+- Package configuration (allow unfree packages, etc.)
+
+### Development Environment
+
+#### `nix/devShells.nix`
+
+Development shell configurations:
+
+- Default development environment
+- Tool dependencies for development
+- Environment variables and setup
+
+#### `nix/fmt.nix`
+
+Code formatting configuration using [treefmt](https://github.com/numtide/treefmt/):
+
+- nixfmt-rfc-style for Nix code formatting
+- deadnix for removing unused nix code
+
+More details in [Code formatter](./nix-formatter.md).
+
+#### `nix/hooks.nix`
+
+Git hooks and pre-commit configuration:
+
+- Integration with [git-hooks.nix](https://github.com/cachix/git-hooks.nix)
+- Automatic formatting on commit
+- Code quality checks
+
+More details in [Pre-coommit hooks](./pre-commit-hooks.md).
+
+### Applications and Packages
+
+#### `nix/apps.nix`
+
+Application definitions accessible via `nix run`:
+
+- Development tools and scripts
+- Build and deployment utilities
+- Testing and validation tools
+
+#### `nix/packages/`
+
+Directory containing custom package definitions such as:
+
+  - `default.nix` - Main package exports and basePackages
+  - `start-client.nix` - PostgreSQL client tools
+  - `start-replica.nix` - Replication tools
+  - `migrate-tool.nix` - Migration utilities
+  - `dbmate-tool.nix` - Database migration tool
+
+#### `nix/checks.nix`
+
+Build checks and validation:
+
+- Package build validation
+- Integration tests
+- Code quality checks
+- Ensures all Postgres packages build correctly
+
+### PostgreSQL-Specific
+
+#### `nix/postgresql/`
+
+PostgreSQL package definitions:
+
+- `default.nix` - Main PostgreSQL package exports
+- `generic.nix` - Generic PostgreSQL build functions
+- `src.nix` - PostgreSQL source package generation
+- `patches/` - PostgreSQL-specific patches
+
+#### `nix/ext/`
+
+PostgreSQL extensions:
+
+- `default.nix` - Extension registry and ourExtensions list
+- Individual `.nix` files - Extension definitions like:
+  - `pgvector.nix` - Vector similarity search
+  - `pgsodium.nix` - Encryption extension
+  - `pg_graphql.nix` - GraphQL support
+  - `timescaledb.nix` - Time-series database
+  - And 30+ other extensions
+
+### System Customization
+
+#### `nix/overlays/`
+
+Nixpkgs overlays for package customization:
+
+- `default.nix` - Main overlay that imports all others
+- `cargo-pgrx-0-11-3.nix` - PGRX toolchain overlay
+- `psql_16-oriole.nix` - OrioleDB PostgreSQL variant
+
+#### `nix/cargo-pgrx/`
+
+Rust-based PostgreSQL extension building:
+
+- `default.nix` - cargo-pgrx package definitions
+- `buildPgrxExtension.nix` - Builder for Rust extensions
+
+### Testing
+
+#### `nix/tests/`
+
+Test suites and expected outputs:
+
+- `sql/` - SQL test files
+- `expected/` - Expected test outputs
+- `migrations/` - Migration test data
+- `smoke/` - Smoke tests for quick validation
diff --git a/nix/docs/nix-formatter.md b/nix/docs/nix-formatter.md
new file mode 100644
index 000000000..22047a4d4
--- /dev/null
+++ b/nix/docs/nix-formatter.md
@@ -0,0 +1,97 @@
+# Code Formatting
+
+This repository uses [treefmt](https://treefmt.com/) with [nixfmt](https://github.com/NixOS/nixfmt) and [deadnix](https://github.com/astro/deadnix) to maintain consistent formatting and clean code in Nix files.
+
+## Formatting Tools
+
+### nixfmt-rfc-style
+
+- **Purpose**: Formats Nix code according to [RFC 166](https://github.com/NixOS/rfcs/blob/master/rfcs/0166-nix-formatting.md) style guidelines
+- **What it does**: 
+
+  - Standardizes indentation and spacing
+  - Formats function calls and attribute sets consistently
+  - Ensures consistent line breaks and alignment
+
+### deadnix
+
+- **Purpose**: Removes unused/dead code from Nix expressions
+- **What it does**:
+
+  - Identifies unused variables and bindings
+  - Removes unused function arguments
+  - Cleans up dead code paths
+
+## Usage
+
+### Command Line
+
+```bash
+# Run treefmt and format all Nix files in the repository
+nix fmt
+```
+
+### In Development Shell
+
+The formatter is available when you enter the development shell:
+
+```bash
+# Enter development shell
+nix develop
+
+# Format all nix files
+treefmt
+
+# Format specific files
+treefmt file1.nix file2.nix
+
+# Check formatting without making changes
+treefmt --check
+
+# Format with verbose output
+treefmt --verbose
+```
+
+### With direnv
+
+If you're using direnv, the formatter is automatically available:
+
+```bash
+cd /path/to/project
+treefmt
+```
+
+## Configuration
+
+The formatter configuration is defined with nix in `nix/fmt.nix` using [treefmt-nix](https://github.com/numtide/treefmt-nix).
+See the [treefmt-nix project documentation](https://github.com/numtide/treefmt-nix?tab=readme-ov-file#supported-programs)
+for the list of supported formatters and their configurations.
+
+## Integration with Pre-commit Hooks
+
+The formatter is automatically run via pre-commit hooks (see [pre-commit-hooks.md](./pre-commit-hooks.md)) to ensure all committed code is properly formatted.
+
+## Best Practices
+
+### 1. Run Formatter Before Committing
+
+```bash
+nix fmt
+git add .
+git commit -m "your message"
+```
+
+### 2. Review Formatting Changes
+
+Sometimes we want to first review formatting changes to ensure they're sensible:
+
+```bash
+# See what would be changed
+treefmt --check --diff
+```
+
+## Editor Integration
+
+### VS Code
+
+Use the [Nix IDE extension](https://marketplace.visualstudio.com/items?itemName=jnoortheen.nix-ide) with treefmt support.
diff --git a/nix/docs/nix-overlays.md b/nix/docs/nix-overlays.md
index 90b6f221f..4ca7d246e 100644
--- a/nix/docs/nix-overlays.md
+++ b/nix/docs/nix-overlays.md
@@ -8,7 +8,7 @@ Overlays are a feature of Nixpkgs that allow you to:
     disabled-by-default feature.
 
 First, you need to define a file for the overlay under
-[overlays/](../overlays/), and then import it in `flake.nix`. There is an
+[overlays/](../overlays/), and then import it in `nix/overlays/default.nix`. There is an
 example pull request in
 [#14](https://github.com/supabase/nix-postgres/issues/14) for this; an overlay
 typically looks like this:
diff --git a/nix/docs/pre-commit-hooks.md b/nix/docs/pre-commit-hooks.md
new file mode 100644
index 000000000..820c3a001
--- /dev/null
+++ b/nix/docs/pre-commit-hooks.md
@@ -0,0 +1,69 @@
+# Pre-commit Hooks
+
+This repository uses [git-hooks.nix](https://github.com/cachix/git-hooks.nix) and [pre-commit](https://pre-commit.com) to automatically run checks before commits.
+
+## What it does
+
+The pre-commit hooks are configured to run `treefmt` which formats Nix files using:
+
+- **nixfmt** (RFC-style) for Nix code formatting
+- **deadnix** for removing dead/unused Nix code
+
+## Setup
+
+### Automatic Setup (Recommended)
+
+If you're using the development shell (via `nix develop` or direnv), the pre-commit hooks are automatically installed and will run before each commit.
+
+## Usage
+
+### Automatic Formatting on Commit
+
+Once set up, the hooks will automatically run before each commit:
+
+```bash
+git add .
+git commit -m "your commit message"
+# treefmt will run automatically and format files if needed
+```
+
+If formatting changes are made, the commit will be aborted and you'll need to review and stage the changes:
+
+```bash
+# Review the formatting changes
+git diff
+
+# Stage the formatted files
+git add .
+
+# Commit again
+git commit -m "your commit message"
+```
+
+### Manual Formatting
+
+You can also run the formatter manually at any time. See [nix-formatter.md](./nix-formatter.md) for details on using `treefmt`.
+
+### Bypassing Hooks (Not Recommended)
+
+If you need to bypass the pre-commit hooks (not recommended for normal development):
+
+```bash
+git commit --no-verify -m "your commit message"
+```
+
+Note that this check will be enforced in CI, so it's best to always run the hooks locally.
+
+## Configuration
+
+The pre-commit hooks are configured in:
+
+- **`nix/hooks.nix`** - Main git-hooks configuration
+- **`nix/fmt.nix`** - treefmt formatter configuration
+
+## Best Practices
+
+1. **Always run formatting before pushing** - Even if you bypass hooks locally, CI may reject improperly formatted code
+2. **Review formatting changes** - Don't blindly accept all formatting changes; review them to ensure they make sense
+3. **Keep formatting commits separate** - If you need to make large formatting changes, consider doing them in a separate commit
+4. **Use the development shell** - The easiest way to ensure everything works is to use `nix develop` or direnv
diff --git a/nix/docs/references.md b/nix/docs/references.md
index fe5b791e2..940f51df0 100644
--- a/nix/docs/references.md
+++ b/nix/docs/references.md
@@ -1,31 +1,37 @@
 Nix references and other useful tools:
 
 - **Zero to Nix**: Start here to get your feet wet with how Nix works, and how
-  to use Nixpkgs: https://zero-to-nix.com/
-- `nix-installer`: My recommended way to install Nix
-  - https://github.com/DeterminateSystems/nix-installer
-- Nix manual https://nixos.org/manual/nix/stable/
-  - Useful primarily for option and command references
-- Flake schema reference https://nixos.wiki/wiki/Flakes
-  - Useful to know what `flake.nix` is referring to
+  to use Nixpkgs: <https://zero-to-nix.com>
+
+- `nix-installer`: My recommended way to install Nix:
+    - <https://github.com/DeterminateSystems/nix-installer>
+
+- Nix manual <https://nixos.org/manual/nix/stable/>:
+    - Useful primarily for option and command references
+
+- Flake schema reference <https://nixos.wiki/wiki/Flakes>
+    - Useful to know what `flake.nix` is referring to
+
 - Example pull requests for this repo:
-  - Adding smoke tests for an extension:
-    https://github.com/supabase/nix-postgres/pull/2
-  - Extension smoke tests, part 2:
-    https://github.com/supabase/nix-postgres/pull/3
-  - Adding an extension and a smoke test at once:
-    https://github.com/supabase/nix-postgres/pull/4/files
-  - Updating an extension to trunk:
-    https://github.com/supabase/nix-postgres/pull/7
-  - Updating an extension to the latest release:
-    https://github.com/supabase/nix-postgres/pull/9
+    - Adding smoke tests for an extension:
+      <https://github.com/supabase/nix-postgres/pull/2>
+    - Extension smoke tests, part 2:
+      <https://github.com/supabase/nix-postgres/pull/3>
+    - Adding an extension and a smoke test at once:
+      <https://github.com/supabase/nix-postgres/pull/4/files>
+    - Updating an extension to trunk:
+      <https://github.com/supabase/nix-postgres/pull/7>
+    - Updating an extension to the latest release:
+      <https://github.com/supabase/nix-postgres/pull/9>
+
 - Contributing to [nixpkgs](https://github.com/nixos/nixpkgs)
-  - Adding a PGRX-powered extension:
-    https://github.com/NixOS/nixpkgs/pull/246803
-  - Adding a normal extension: https://github.com/NixOS/nixpkgs/pull/249000
-  - Adding new PostgreSQL versions: https://github.com/NixOS/nixpkgs/pull/249030
+    - Adding a PGRX-powered extension:
+      <https://github.com/NixOS/nixpkgs/pull/246803>
+    - Adding a normal extension: <https://github.com/NixOS/nixpkgs/pull/249000>
+    - Adding new PostgreSQL versions: <https://github.com/NixOS/nixpkgs/pull/249030>
+
 - NixOS Discourse: https://discourse.nixos.org/
-  - Useful for community feedback, guidance, and help
-- `nix-update`: https://github.com/Mic92/nix-update
-  - Used in this repository to help update extensions
-- pgTAP for testing: https://pgtap.org/documentation.html
+    - Useful for community feedback, guidance, and help
+- `nix-update`: <https://github.com/Mic92/nix-update>
+    - Used in this repository to help update extensions
+- pgTAP for testing: <https://pgtap.org/documentation.html>
diff --git a/nix/docs/site/.keep b/nix/docs/site/.keep
new file mode 100644
index 000000000..e69de29bb
diff --git a/nix/ext/default.nix b/nix/ext/default.nix
new file mode 100644
index 000000000..9cd3de8bc
--- /dev/null
+++ b/nix/ext/default.nix
@@ -0,0 +1,11 @@
+{ ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      packages = {
+        sfcgal = pkgs.callPackage ./sfcgal/sfcgal.nix { };
+        mecab_naist_jdic = pkgs.callPackage ./mecab-naist-jdic/default.nix { };
+      };
+    };
+}
diff --git a/nix/ext/gdal.nix b/nix/ext/gdal.nix
index 83924d9ff..739f7e432 100644
--- a/nix/ext/gdal.nix
+++ b/nix/ext/gdal.nix
@@ -1,22 +1,23 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, curl
-, expat
-, libgeotiff
-, geos
-, json_c
-, libxml2
-, postgresql
-, proj
-, sqlite
-, libtiff
-, zlib
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  curl,
+  expat,
+  libgeotiff,
+  geos,
+  json_c,
+  libxml2,
+  postgresql,
+  proj,
+  sqlite,
+  libtiff,
+  zlib,
 }:
 
-stdenv.mkDerivation rec  {
+stdenv.mkDerivation rec {
   pname = "gdal";
   version = "3.8.5";
 
@@ -46,16 +47,15 @@ stdenv.mkDerivation rec  {
     zlib
   ];
 
-  cmakeFlags = [
-    "-DGDAL_USE_INTERNAL_LIBS=OFF"
-    "-DGEOTIFF_INCLUDE_DIR=${lib.getDev libgeotiff}/include"
-    "-DGEOTIFF_LIBRARY_RELEASE=${lib.getLib libgeotiff}/lib/libgeotiff${stdenv.hostPlatform.extensions.sharedLibrary}"
-    "-DBUILD_PYTHON_BINDINGS=OFF"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
-  ];
+  cmakeFlags =
+    [
+      "-DGDAL_USE_INTERNAL_LIBS=OFF"
+      "-DGEOTIFF_INCLUDE_DIR=${lib.getDev libgeotiff}/include"
+      "-DGEOTIFF_LIBRARY_RELEASE=${lib.getLib libgeotiff}/lib/libgeotiff${stdenv.hostPlatform.extensions.sharedLibrary}"
+      "-DBUILD_PYTHON_BINDINGS=OFF"
+    ]
+    ++ lib.optionals (!stdenv.isDarwin) [ "-DCMAKE_SKIP_BUILD_RPATH=ON" ]
+    ++ lib.optionals stdenv.isDarwin [ "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON" ];
 
   enableParallelBuilding = true;
 
@@ -63,7 +63,13 @@ stdenv.mkDerivation rec  {
     description = "Translator library for raster geospatial data formats (PostGIS-focused build)";
     homepage = "https://www.gdal.org/";
     license = licenses.mit;
-    maintainers = with maintainers; teams.geospatial.members ++ [ marcweber dotlambda ];
+    maintainers =
+      with maintainers;
+      teams.geospatial.members
+      ++ [
+        marcweber
+        dotlambda
+      ];
     platforms = platforms.unix;
   };
 }
diff --git a/nix/ext/hypopg.nix b/nix/ext/hypopg.nix
index ffafe904e..1e38b11c6 100644
--- a/nix/ext/hypopg.nix
+++ b/nix/ext/hypopg.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "hypopg";
diff --git a/nix/ext/index_advisor.nix b/nix/ext/index_advisor.nix
index ae23354b9..19777f39e 100644
--- a/nix/ext/index_advisor.nix
+++ b/nix/ext/index_advisor.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "index_advisor";
diff --git a/nix/ext/mecab-naist-jdic/default.nix b/nix/ext/mecab-naist-jdic/default.nix
index 82f0ed37c..c3148a4e5 100644
--- a/nix/ext/mecab-naist-jdic/default.nix
+++ b/nix/ext/mecab-naist-jdic/default.nix
@@ -1,19 +1,22 @@
-{ lib, stdenv, fetchurl, mecab }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mecab,
+}:
 
 stdenv.mkDerivation rec {
   pname = "mecab-naist-jdic";
   version = "0.6.3b-20111013";
-  
+
   src = fetchurl {
     url = "https://github.com/supabase/mecab-naist-jdic/raw/main/mecab-naist-jdic-${version}.tar.gz";
     sha256 = "sha256-yzdwDcmne5U/K/OxW0nP7NZ4SFMKLPirywm1lMpWKMw=";
   };
-  
+
   buildInputs = [ mecab ];
-  
-  configureFlags = [
-    "--with-charset=utf8"
-  ];
+
+  configureFlags = [ "--with-charset=utf8" ];
 
   buildPhase = ''
     runHook preBuild
diff --git a/nix/ext/orioledb.nix b/nix/ext/orioledb.nix
index 96e70e308..96976f83d 100644
--- a/nix/ext/orioledb.nix
+++ b/nix/ext/orioledb.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, curl, libkrb5, postgresql, python3, openssl }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  curl,
+  libkrb5,
+  postgresql,
+  python3,
+  openssl,
+}:
 
 stdenv.mkDerivation rec {
   pname = "orioledb";
@@ -10,7 +19,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-O4OTi8ickylVXE9FURm5R++A+l15Z22YLna7OVzVMjc=";
   };
   version = "beta10";
-  buildInputs = [ curl libkrb5 postgresql python3 openssl ];
+  buildInputs = [
+    curl
+    libkrb5
+    postgresql
+    python3
+    openssl
+  ];
   buildPhase = "make USE_PGXS=1 ORIOLEDB_PATCHSET_VERSION=6";
   installPhase = ''
     runHook preInstall
diff --git a/nix/ext/pg-safeupdate.nix b/nix/ext/pg-safeupdate.nix
index f5ad17a82..5ac32c352 100644
--- a/nix/ext/pg-safeupdate.nix
+++ b/nix/ext/pg-safeupdate.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg-safeupdate";
@@ -7,9 +12,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ postgresql ];
 
   src = fetchFromGitHub {
-    owner  = "eradman";
-    repo   = pname;
-    rev    = version;
+    owner = "eradman";
+    repo = pname;
+    rev = version;
     hash = "sha256-1cyvVEC9MQGMr7Tg6EUbsVBrMc8ahdFS3+CmDkmAq4Y=";
   };
 
@@ -19,10 +24,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A simple extension to PostgreSQL that requires criteria for UPDATE and DELETE";
-    homepage    = "https://github.com/eradman/pg-safeupdate";
-    changelog   = "https://github.com/eradman/pg-safeupdate/raw/${src.rev}/NEWS";
-    platforms   = postgresql.meta.platforms;
-    license     = licenses.postgresql;
-    broken      = versionOlder postgresql.version "14";
+    homepage = "https://github.com/eradman/pg-safeupdate";
+    changelog = "https://github.com/eradman/pg-safeupdate/raw/${src.rev}/NEWS";
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
+    broken = versionOlder postgresql.version "14";
   };
 }
diff --git a/nix/ext/pg_backtrace.nix b/nix/ext/pg_backtrace.nix
index 0a0b0ae4f..7b92f0637 100644
--- a/nix/ext/pg_backtrace.nix
+++ b/nix/ext/pg_backtrace.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_backtrace";
@@ -7,9 +12,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ postgresql ];
 
   src = fetchFromGitHub {
-    owner  = "pashkinelfe";
-    repo   = pname;
-    rev    = "d100bac815a7365e199263f5b3741baf71b14c70";
+    owner = "pashkinelfe";
+    repo = pname;
+    rev = "d100bac815a7365e199263f5b3741baf71b14c70";
     hash = "sha256-IVCL4r4oj1Ams03D8y+XCFkckPFER/W9tQ68GkWQQMY=";
   };
 
@@ -25,8 +30,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Updated fork of pg_backtrace";
-    homepage    = "https://github.com/pashkinelfe/pg_backtrace";
-    platforms   = postgresql.meta.platforms;
-    license     = licenses.postgresql;
+    homepage = "https://github.com/pashkinelfe/pg_backtrace";
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
   };
 }
diff --git a/nix/ext/pg_cron.nix b/nix/ext/pg_cron.nix
index 792db7676..bcaaf180c 100644
--- a/nix/ext/pg_cron.nix
+++ b/nix/ext/pg_cron.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_cron";
@@ -7,9 +12,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ postgresql ];
 
   src = fetchFromGitHub {
-    owner  = "citusdata";
-    repo   = pname;
-    rev    = "v${version}";
+    owner = "citusdata";
+    repo = pname;
+    rev = "v${version}";
     hash = "sha256-t1DpFkPiSfdoGG2NgNT7g1lkvSooZoRoUrix6cBID40=";
   };
 
@@ -23,9 +28,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Run Cron jobs through PostgreSQL";
-    homepage    = "https://github.com/citusdata/pg_cron";
-    changelog   = "https://github.com/citusdata/pg_cron/raw/v${version}/CHANGELOG.md";
-    platforms   = postgresql.meta.platforms;
-    license     = licenses.postgresql;
+    homepage = "https://github.com/citusdata/pg_cron";
+    changelog = "https://github.com/citusdata/pg_cron/raw/v${version}/CHANGELOG.md";
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
   };
 }
diff --git a/nix/ext/pg_graphql.nix b/nix/ext/pg_graphql.nix
index ef406f8d4..ebe6fea7f 100644
--- a/nix/ext/pg_graphql.nix
+++ b/nix/ext/pg_graphql.nix
@@ -1,8 +1,15 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, buildPgrxExtension_0_12_9, cargo, rust-bin }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  buildPgrxExtension_0_12_9,
+  rust-bin,
+}:
 
 let
-    rustVersion = "1.81.0";
-    cargo = rust-bin.stable.${rustVersion}.default;
+  rustVersion = "1.81.0";
+  cargo = rust-bin.stable.${rustVersion}.default;
 in
 buildPgrxExtension_0_12_9 rec {
   pname = "pg_graphql";
@@ -18,25 +25,27 @@ buildPgrxExtension_0_12_9 rec {
 
   nativeBuildInputs = [ cargo ];
   buildInputs = [ postgresql ];
-  
+
   CARGO = "${cargo}/bin/cargo";
-  
+
   cargoLock = {
     lockFile = "${src}/Cargo.lock";
   };
   # Setting RUSTFLAGS in env to ensure it's available for all phases
   env = lib.optionalAttrs stdenv.isDarwin {
     POSTGRES_LIB = "${postgresql}/lib";
-    PGPORT = toString (5430 + 
-      (if builtins.match ".*_.*" postgresql.version != null then 1 else 0) +  # +1 for OrioleDB
-      ((builtins.fromJSON (builtins.substring 0 2 postgresql.version)) - 15) * 2);  # +2 for each major version
+    PGPORT = toString (
+      5430
+      + (if builtins.match ".*_.*" postgresql.version != null then 1 else 0)
+      # +1 for OrioleDB
+      + ((builtins.fromJSON (builtins.substring 0 2 postgresql.version)) - 15) * 2
+    ); # +2 for each major version
     RUSTFLAGS = "-C link-arg=-undefined -C link-arg=dynamic_lookup";
-    NIX_BUILD_CORES = "4";  # Limit parallel jobs
+    NIX_BUILD_CORES = "4"; # Limit parallel jobs
     CARGO_BUILD_JOBS = "4"; # Limit cargo parallelism
   };
   CARGO_PROFILE_RELEASE_BUILD_OVERRIDE_DEBUG = true;
 
-
   doCheck = false;
 
   meta = with lib; {
diff --git a/nix/ext/pg_hashids.nix b/nix/ext/pg_hashids.nix
index 828db60fb..20d39a623 100644
--- a/nix/ext/pg_hashids.nix
+++ b/nix/ext/pg_hashids.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_hashids";
diff --git a/nix/ext/pg_jsonschema.nix b/nix/ext/pg_jsonschema.nix
index 654bb93f5..794757678 100644
--- a/nix/ext/pg_jsonschema.nix
+++ b/nix/ext/pg_jsonschema.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, buildPgrxExtension_0_12_6, cargo, rust-bin }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  buildPgrxExtension_0_12_6,
+  rust-bin,
+}:
 let
   rustVersion = "1.80.0";
   cargo = rust-bin.stable.${rustVersion}.default;
@@ -20,23 +27,34 @@ buildPgrxExtension_0_12_6 rec {
   # update the following array when the pg_jsonschema version is updated
   # required to ensure that extensions update scripts from previous versions are generated
 
-  previousVersions = ["0.3.1" "0.3.0" "0.2.0" "0.1.4" "0.1.4" "0.1.2" "0.1.1" "0.1.0"];
-  CARGO="${cargo}/bin/cargo";
+  previousVersions = [
+    "0.3.1"
+    "0.3.0"
+    "0.2.0"
+    "0.1.4"
+    "0.1.4"
+    "0.1.2"
+    "0.1.1"
+    "0.1.0"
+  ];
+  CARGO = "${cargo}/bin/cargo";
   #darwin env needs PGPORT to be unique for build to not clash with other pgrx extensions
   env = lib.optionalAttrs stdenv.isDarwin {
     POSTGRES_LIB = "${postgresql}/lib";
     RUSTFLAGS = "-C link-arg=-undefined -C link-arg=dynamic_lookup";
-    PGPORT = toString (5441 + 
-      (if builtins.match ".*_.*" postgresql.version != null then 1 else 0) +  # +1 for OrioleDB
-      ((builtins.fromJSON (builtins.substring 0 2 postgresql.version)) - 15) * 2);  # +2 for each major version
-
+    PGPORT = toString (
+      5441
+      + (if builtins.match ".*_.*" postgresql.version != null then 1 else 0)
+      # +1 for OrioleDB
+      + ((builtins.fromJSON (builtins.substring 0 2 postgresql.version)) - 15) * 2
+    ); # +2 for each major version
   };
 
   cargoLock = {
     lockFile = "${src}/Cargo.lock";
     allowBuiltinFetchGit = false;
   };
-  
+
   # FIXME (aseipp): testsuite tries to write files into /nix/store; we'll have
   # to fix this a bit later.
   doCheck = false;
@@ -50,7 +68,7 @@ buildPgrxExtension_0_12_6 rec {
     echo "Creating SQL files for previous versions..."
     current_version="${version}"
     sql_file="$out/share/postgresql/extension/pg_jsonschema--$current_version.sql"
-    
+
     if [ -f "$sql_file" ]; then
       while read -r previous_version; do
         if [ "$(printf '%s\n' "$previous_version" "$current_version" | sort -V | head -n1)" = "$previous_version" ] && [ "$previous_version" != "$current_version" ]; then
@@ -65,7 +83,6 @@ buildPgrxExtension_0_12_6 rec {
     rm git_tags.txt
   '';
 
-
   meta = with lib; {
     description = "JSON Schema Validation for PostgreSQL";
     homepage = "https://github.com/supabase/${pname}";
diff --git a/nix/ext/pg_net.nix b/nix/ext/pg_net.nix
index 0f20163e5..02d673297 100644
--- a/nix/ext/pg_net.nix
+++ b/nix/ext/pg_net.nix
@@ -1,10 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, curl, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  curl,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_net";
   version = "0.14.0";
 
-  buildInputs = [ curl postgresql ];
+  buildInputs = [
+    curl
+    postgresql
+  ];
 
   src = fetchFromGitHub {
     owner = "supabase";
diff --git a/nix/ext/pg_partman.nix b/nix/ext/pg_partman.nix
index 899716b44..08fc74cee 100644
--- a/nix/ext/pg_partman.nix
+++ b/nix/ext/pg_partman.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_partman";
@@ -7,9 +12,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ postgresql ];
 
   src = fetchFromGitHub {
-    owner  = "pgpartman";
-    repo   = pname;
-    rev    = "refs/tags/v${version}";
+    owner = "pgpartman";
+    repo = pname;
+    rev = "refs/tags/v${version}";
     sha256 = "sha256-GrVOJ5ywZMyqyDroYDLdKkXDdIJSDGhDfveO/ZvrmYs=";
   };
 
@@ -24,10 +29,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Partition management extension for PostgreSQL";
-    homepage    = "https://github.com/pgpartman/pg_partman";
-    changelog   = "https://github.com/pgpartman/pg_partman/blob/v${version}/CHANGELOG.md";
-    platforms   = postgresql.meta.platforms;
-    license     = licenses.postgresql;
-    broken      = versionOlder postgresql.version "14";
+    homepage = "https://github.com/pgpartman/pg_partman";
+    changelog = "https://github.com/pgpartman/pg_partman/blob/v${version}/CHANGELOG.md";
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
+    broken = versionOlder postgresql.version "14";
   };
 }
diff --git a/nix/ext/pg_plan_filter.nix b/nix/ext/pg_plan_filter.nix
index 6281d0b67..1e11c1d3f 100644
--- a/nix/ext/pg_plan_filter.nix
+++ b/nix/ext/pg_plan_filter.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_plan_filter";
diff --git a/nix/ext/pg_regress.nix b/nix/ext/pg_regress.nix
index 08f82aa79..6233219b2 100644
--- a/nix/ext/pg_regress.nix
+++ b/nix/ext/pg_regress.nix
@@ -1,6 +1,7 @@
-{ lib
-, stdenv
-, postgresql
+{
+  lib,
+  stdenv,
+  postgresql,
 }:
 
 stdenv.mkDerivation {
diff --git a/nix/ext/pg_repack.nix b/nix/ext/pg_repack.nix
index 076e878f2..1f21335df 100644
--- a/nix/ext/pg_repack.nix
+++ b/nix/ext/pg_repack.nix
@@ -1,12 +1,10 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, openssl
-, postgresql
-, postgresqlTestHook
-, readline
-, testers
-, zlib
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  postgresqlTestHook,
+  testers,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,9 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru.tests = {
-    version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-    };
+    version = testers.testVersion { package = finalAttrs.finalPackage; };
     extension = stdenv.mkDerivation {
       name = "plpgsql-check-test";
       dontUnpack = true;
diff --git a/nix/ext/pg_stat_monitor.nix b/nix/ext/pg_stat_monitor.nix
index 8469f4b98..742e1c0aa 100644
--- a/nix/ext/pg_stat_monitor.nix
+++ b/nix/ext/pg_stat_monitor.nix
@@ -1,20 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
-let
-  # NOTE (aseipp): the 1.x series of pg_stat_monitor has some non-standard and
-  # weird build logic (Percona projects in general seem to have their own
-  # strange build harness) where it will try to pick the right .sql file to
-  # install into the extension dir based on the postgresql major version. for
-  # our purposes, we only need to support v13 and v14+, so just replicate this
-  # logic from the makefile and pick the right file here.
-  #
-  # this seems to all be cleaned up in version 2.0 of the extension, so ideally
-  # we could upgrade to it later on and nuke this.
-  # DEPRECATED sqlFilename = if lib.versionOlder postgresql.version "14"
-  #   then "pg_stat_monitor--1.0.13.sql.in"
-  #   else "pg_stat_monitor--1.0.14.sql.in";
-
-in
 stdenv.mkDerivation rec {
   pname = "pg_stat_monitor";
   version = "2.1.0";
@@ -32,7 +22,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/{lib,share/postgresql/extension}
-  
+
     cp *${postgresql.dlSuffix}      $out/lib
     cp *.sql     $out/share/postgresql/extension
     cp *.control $out/share/postgresql/extension
diff --git a/nix/ext/pg_tle.nix b/nix/ext/pg_tle.nix
index a0e9385b2..df83d4307 100644
--- a/nix/ext/pg_tle.nix
+++ b/nix/ext/pg_tle.nix
@@ -1,11 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, flex, openssl, libkrb5 }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  flex,
+  openssl,
+  libkrb5,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_tle";
   version = "1.4.0";
 
   nativeBuildInputs = [ flex ];
-  buildInputs = [ openssl postgresql libkrb5 ];
+  buildInputs = [
+    openssl
+    postgresql
+    libkrb5
+  ];
 
   src = fetchFromGitHub {
     owner = "aws";
@@ -14,10 +26,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-crxj5R9jblIv0h8lpqddAoYe2UqgUlnvbOajKTzVces=";
   };
 
-  
   makeFlags = [ "FLEX=flex" ];
 
-  
   installPhase = ''
     mkdir -p $out/{lib,share/postgresql/extension}
 
diff --git a/nix/ext/pgaudit.nix b/nix/ext/pgaudit.nix
index 01ab66f15..3535447a7 100644
--- a/nix/ext/pgaudit.nix
+++ b/nix/ext/pgaudit.nix
@@ -1,20 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, libkrb5, openssl, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libkrb5,
+  openssl,
+  postgresql,
+}:
 #adapted from https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/sql/postgresql/ext/pgaudit.nix
 let
-  source = {
-    "17" = {
-      version = "17.0";
-      hash = "sha256-3ksq09wiudQPuBQI3dhEQi8IkXKLVIsPFgBnwLiicro=";
-    };
-    "16" = {
-      version = "16.0";
-      hash = "sha256-8+tGOl1U5y9Zgu+9O5UDDE4bec4B0JC/BQ6GLhHzQzc=";
-    };
-    "15" = {
-      version = "1.7.0";
-      hash = "sha256-8pShPr4HJaJQPjW1iPJIpj3CutTx8Tgr+rOqoXtgCcw=";
-    };
-  }.${lib.versions.major postgresql.version} or (throw "Source for pgaudit is not available for ${postgresql.version}");
+  source =
+    {
+      "17" = {
+        version = "17.0";
+        hash = "sha256-3ksq09wiudQPuBQI3dhEQi8IkXKLVIsPFgBnwLiicro=";
+      };
+      "16" = {
+        version = "16.0";
+        hash = "sha256-8+tGOl1U5y9Zgu+9O5UDDE4bec4B0JC/BQ6GLhHzQzc=";
+      };
+      "15" = {
+        version = "1.7.0";
+        hash = "sha256-8pShPr4HJaJQPjW1iPJIpj3CutTx8Tgr+rOqoXtgCcw=";
+      };
+    }
+    .${lib.versions.major postgresql.version}
+    or (throw "Source for pgaudit is not available for ${postgresql.version}");
 in
 stdenv.mkDerivation {
   pname = "pgaudit";
@@ -27,7 +37,11 @@ stdenv.mkDerivation {
     hash = source.hash;
   };
 
-  buildInputs = [ libkrb5 openssl postgresql ];
+  buildInputs = [
+    libkrb5
+    openssl
+    postgresql
+  ];
 
   makeFlags = [ "USE_PGXS=1" ];
 
diff --git a/nix/ext/pgjwt.nix b/nix/ext/pgjwt.nix
index 4ecd76339..1a2f895b7 100644
--- a/nix/ext/pgjwt.nix
+++ b/nix/ext/pgjwt.nix
@@ -1,13 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, unstableGitUpdater }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  unstableGitUpdater,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pgjwt";
   version = "9742dab1b2f297ad3811120db7b21451bca2d3c9";
 
   src = fetchFromGitHub {
-    owner  = "michelp";
-    repo   = "pgjwt";
-    rev    = "${version}";
+    owner = "michelp";
+    repo = "pgjwt";
+    rev = "${version}";
     hash = "sha256-Hw3R9bMGDmh+dMzjmqZSy/rT4mX8cPU969OJiARFg10=";
   };
 
diff --git a/nix/ext/pgmq.nix b/nix/ext/pgmq.nix
index 97a3c27e3..e718c1d02 100644
--- a/nix/ext/pgmq.nix
+++ b/nix/ext/pgmq.nix
@@ -1,13 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pgmq";
   version = "1.4.4";
   buildInputs = [ postgresql ];
   src = fetchFromGitHub {
-    owner  = "tembo-io";
-    repo   = pname;
-    rev    = "v${version}";
+    owner = "tembo-io";
+    repo = pname;
+    rev = "v${version}";
     hash = "sha256-z+8/BqIlHwlMnuIzMz6eylmYbSmhtsNt7TJf/CxbdVw=";
   };
 
@@ -25,9 +30,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A lightweight message queue. Like AWS SQS and RSMQ but on Postgres.";
-    homepage    = "https://github.com/tembo-io/pgmq";
+    homepage = "https://github.com/tembo-io/pgmq";
     maintainers = with maintainers; [ olirice ];
-    platforms   = postgresql.meta.platforms;
-    license     = licenses.postgresql;
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
   };
 }
diff --git a/nix/ext/pgroonga.nix b/nix/ext/pgroonga.nix
index de0dedc93..d57efc8fb 100644
--- a/nix/ext/pgroonga.nix
+++ b/nix/ext/pgroonga.nix
@@ -1,7 +1,15 @@
-{ lib, stdenv, fetchurl, pkg-config, postgresql, msgpack-c, callPackage, mecab, makeWrapper, xxHash  }:
-let
-  supabase-groonga = callPackage ../supabase-groonga.nix { };
-in
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  postgresql,
+  msgpack-c,
+  mecab,
+  makeWrapper,
+  xxHash,
+  supabase-groonga,
+}:
 stdenv.mkDerivation rec {
   pname = "pgroonga";
   version = "3.2.5";
@@ -9,12 +17,19 @@ stdenv.mkDerivation rec {
     url = "https://packages.groonga.org/source/${pname}/${pname}-${version}.tar.gz";
     sha256 = "sha256-GM9EOQty72hdE4Ecq8jpDudhZLiH3pP9ODLxs8DXcSY=";
   };
-  nativeBuildInputs = [ pkg-config makeWrapper ];
-  
-  buildInputs = [ postgresql msgpack-c supabase-groonga mecab ] ++ lib.optionals stdenv.isDarwin [
-    xxHash
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
   ];
 
+  buildInputs = [
+    postgresql
+    msgpack-c
+    supabase-groonga
+    mecab
+  ] ++ lib.optionals stdenv.isDarwin [ xxHash ];
+
   propagatedBuildInputs = [ supabase-groonga ];
   configureFlags = [
     "--with-mecab=${mecab}"
@@ -23,20 +38,22 @@ stdenv.mkDerivation rec {
     "--with-groonga-plugin-dir=${supabase-groonga}/lib/groonga/plugins"
   ];
 
- makeFlags = [
+  makeFlags = [
     "HAVE_MSGPACK=1"
     "MSGPACK_PACKAGE_NAME=msgpack-c"
     "HAVE_MECAB=1"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin (builtins.concatStringsSep " " [
-    "-Wno-error=incompatible-function-pointer-types"
-    "-Wno-error=format"
-    "-Wno-format"
-    "-I${supabase-groonga}/include/groonga"
-    "-I${xxHash}/include"
-    "-DPGRN_VERSION=\"${version}\""
-  ]);
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin (
+    builtins.concatStringsSep " " [
+      "-Wno-error=incompatible-function-pointer-types"
+      "-Wno-error=format"
+      "-Wno-format"
+      "-I${supabase-groonga}/include/groonga"
+      "-I${xxHash}/include"
+      "-DPGRN_VERSION=\"${version}\""
+    ]
+  );
 
   preConfigure = ''
     export GROONGA_LIBS="-L${supabase-groonga}/lib -lgroonga"
diff --git a/nix/ext/pgrouting.nix b/nix/ext/pgrouting.nix
index 3e898022f..e51b8bada 100644
--- a/nix/ext/pgrouting.nix
+++ b/nix/ext/pgrouting.nix
@@ -1,30 +1,45 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, perl, cmake, boost }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  perl,
+  cmake,
+  boost,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pgrouting";
   version = "3.4.1";
 
-  nativeBuildInputs = [ cmake perl ];
-  buildInputs = [ postgresql boost ];
+  nativeBuildInputs = [
+    cmake
+    perl
+  ];
+  buildInputs = [
+    postgresql
+    boost
+  ];
 
   src = fetchFromGitHub {
-    owner  = "pgRouting";
-    repo   = pname;
-    rev    = "v${version}";
+    owner = "pgRouting";
+    repo = pname;
+    rev = "v${version}";
     hash = "sha256-QC77AnPGpPQGEWi6JtJdiNsB2su5+aV2pKg5ImR2B0k=";
   };
 
   #disable compile time warnings for incompatible pointer types only on macos and pg16
-  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.isDarwin && lib.versionAtLeast postgresql.version "16") 
-  "-Wno-error=int-conversion -Wno-error=incompatible-pointer-types";
-
-  cmakeFlags = [
-    "-DPOSTGRESQL_VERSION=${postgresql.version}"
-  ] ++ lib.optionals (stdenv.isDarwin && lib.versionAtLeast postgresql.version "16")  [
-    "-DCMAKE_MACOSX_RPATH=ON"
-    "-DCMAKE_SHARED_MODULE_SUFFIX=.dylib"
-    "-DCMAKE_SHARED_LIBRARY_SUFFIX=.dylib"
-  ];
+  NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.isDarwin && lib.versionAtLeast postgresql.version "16"
+  ) "-Wno-error=int-conversion -Wno-error=incompatible-pointer-types";
+
+  cmakeFlags =
+    [ "-DPOSTGRESQL_VERSION=${postgresql.version}" ]
+    ++ lib.optionals (stdenv.isDarwin && lib.versionAtLeast postgresql.version "16") [
+      "-DCMAKE_MACOSX_RPATH=ON"
+      "-DCMAKE_SHARED_MODULE_SUFFIX=.dylib"
+      "-DCMAKE_SHARED_LIBRARY_SUFFIX=.dylib"
+    ];
 
   preConfigure = lib.optionalString (stdenv.isDarwin && lib.versionAtLeast postgresql.version "16") ''
     export DLSUFFIX=.dylib
@@ -51,9 +66,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A PostgreSQL/PostGIS extension that provides geospatial routing functionality";
-    homepage    = "https://pgrouting.org/";
-    changelog   = "https://github.com/pgRouting/pgrouting/releases/tag/v${version}";
-    platforms   = postgresql.meta.platforms;
-    license     = licenses.gpl2Plus;
+    homepage = "https://pgrouting.org/";
+    changelog = "https://github.com/pgRouting/pgrouting/releases/tag/v${version}";
+    platforms = postgresql.meta.platforms;
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/nix/ext/pgsodium.nix b/nix/ext/pgsodium.nix
index ec2979499..d843d434f 100644
--- a/nix/ext/pgsodium.nix
+++ b/nix/ext/pgsodium.nix
@@ -1,10 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libsodium,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pgsodium";
   version = "3.1.8";
 
-  buildInputs = [ libsodium postgresql ];
+  buildInputs = [
+    libsodium
+    postgresql
+  ];
 
   src = fetchFromGitHub {
     owner = "michelp";
diff --git a/nix/ext/pgsql-http.nix b/nix/ext/pgsql-http.nix
index 8b74f191b..9f4bae789 100644
--- a/nix/ext/pgsql-http.nix
+++ b/nix/ext/pgsql-http.nix
@@ -1,10 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, curl, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  curl,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pgsql-http";
   version = "1.6.1";
 
-  buildInputs = [ curl postgresql ];
+  buildInputs = [
+    curl
+    postgresql
+  ];
 
   src = fetchFromGitHub {
     owner = "pramsey";
diff --git a/nix/ext/pgtap.nix b/nix/ext/pgtap.nix
index 159fec433..47d211556 100644
--- a/nix/ext/pgtap.nix
+++ b/nix/ext/pgtap.nix
@@ -1,4 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, perl, perlPackages, which }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  perl,
+  perlPackages,
+  which,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pgtap";
@@ -11,7 +19,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-lb0PRffwo6J5a6Hqw1ggvn0cW7gPZ02OEcLPi9ineI8=";
   };
 
-  nativeBuildInputs = [ postgresql perl perlPackages.TAPParserSourceHandlerpgTAP which ];
+  nativeBuildInputs = [
+    postgresql
+    perl
+    perlPackages.TAPParserSourceHandlerpgTAP
+    which
+  ];
 
   installPhase = ''
     install -D {sql/pgtap--${version}.sql,pgtap.control} -t $out/share/postgresql/extension
diff --git a/nix/ext/pgvector.nix b/nix/ext/pgvector.nix
index a7d58ec61..60a8efea3 100644
--- a/nix/ext/pgvector.nix
+++ b/nix/ext/pgvector.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pgvector";
diff --git a/nix/ext/pljava.nix b/nix/ext/pljava.nix
index 51c5e1317..bac5a6646 100644
--- a/nix/ext/pljava.nix
+++ b/nix/ext/pljava.nix
@@ -1,23 +1,48 @@
-{ stdenv, lib, fetchFromGitHub, openssl, openjdk, maven, postgresql, libkrb5, makeWrapper, gcc, pkg-config, which }:
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  openssl,
+  openjdk,
+  maven,
+  postgresql,
+  libkrb5,
+  makeWrapper,
+  gcc,
+  pkg-config,
+  which,
+}:
 
 maven.buildMavenPackage rec {
   pname = "pljava";
 
-  version = "1.6.7"; 
+  version = "1.6.7";
 
   src = fetchFromGitHub {
     owner = "tada";
     repo = "pljava";
-    rev = "V1_6_7";  
-    sha256 = "sha256-M17adSLsw47KZ2BoUwxyWkXKRD8TcexDAy61Yfw4fNU=";  
-    
+    rev = "V1_6_7";
+    sha256 = "sha256-M17adSLsw47KZ2BoUwxyWkXKRD8TcexDAy61Yfw4fNU=";
   };
 
-  mvnParameters = "clean install -Dmaven.test.skip -DskipTests -Dmaven.javadoc.skip=true";  
+  mvnParameters = "clean install -Dmaven.test.skip -DskipTests -Dmaven.javadoc.skip=true";
   mvnHash = "sha256-lcxRduh/nKcPL6YQIVTsNH0L4ga0LgJpQKgX5IPkRzs=";
-  
-  nativeBuildInputs = [ makeWrapper maven openjdk postgresql openssl postgresql gcc libkrb5 pkg-config ];
-  buildInputs = [ stdenv.cc.cc.lib which];
+
+  nativeBuildInputs = [
+    makeWrapper
+    maven
+    openjdk
+    postgresql
+    openssl
+    postgresql
+    gcc
+    libkrb5
+    pkg-config
+  ];
+  buildInputs = [
+    stdenv.cc.cc.lib
+    which
+  ];
   buildPhase = ''
     export PATH=$(lib.makeBinPath [ postgresql ]):$PATH
 
@@ -44,7 +69,7 @@ maven.buildMavenPackage rec {
 
   meta = with lib; {
     description = "PL/Java extension for PostgreSQL";
-    homepage = https://github.com/tada/pljava;
+    homepage = "https://github.com/tada/pljava";
     license = licenses.bsd3;
   };
 }
diff --git a/nix/ext/plpgsql-check.nix b/nix/ext/plpgsql-check.nix
index 7be2aac2a..41312b1c7 100644
--- a/nix/ext/plpgsql-check.nix
+++ b/nix/ext/plpgsql-check.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, postgresqlTestHook }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+  postgresqlTestHook,
+}:
 
 stdenv.mkDerivation rec {
   pname = "plpgsql-check";
diff --git a/nix/ext/plv8.nix b/nix/ext/plv8.nix
index b3fd03e07..9eaa40459 100644
--- a/nix/ext/plv8.nix
+++ b/nix/ext/plv8.nix
@@ -1,19 +1,17 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, v8
-, perl
-, postgresql
-# For passthru test on various systems, and local development on macos
-# not we are not currently using passthru tests but retaining for possible contrib
-# to nixpkgs 
-, runCommand
-, coreutils
-, gnugrep
-, clang
-, xcbuild
-, darwin
-, patchelf
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  v8,
+  perl,
+  postgresql,
+  # For passthru test on various systems, and local development on macos
+  # not we are not currently using passthru tests but retaining for possible contrib
+  # to nixpkgs 
+  clang,
+  xcbuild,
+  darwin,
+  patchelf,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -33,50 +31,58 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-build-Allow-using-V8-from-system.patch
   ];
 
-  nativeBuildInputs = [
-    perl
-  ] ++ lib.optionals stdenv.isDarwin [
-    clang
-    xcbuild
-  ];
-
-  buildInputs = [
-    v8
-    postgresql
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-    darwin.apple_sdk.frameworks.Kerberos
-  ];
+  nativeBuildInputs =
+    [ perl ]
+    ++ lib.optionals stdenv.isDarwin [
+      clang
+      xcbuild
+    ];
+
+  buildInputs =
+    [
+      v8
+      postgresql
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.CoreFoundation
+      darwin.apple_sdk.frameworks.Kerberos
+    ];
 
   buildFlags = [ "all" ];
 
-  makeFlags = [
-    # Nixpkgs build a v8 monolith instead of separate v8_libplatform.
-    "USE_SYSTEM_V8=1"
-    "V8_OUTDIR=${v8}/lib"
-     "PG_CONFIG=${postgresql}/bin/pg_config"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "CC=${clang}/bin/clang"
-    "CXX=${clang}/bin/clang++"
-    "SHLIB_LINK=-L${v8}/lib -lv8_monolith -Wl,-rpath,${v8}/lib"
-  ] ++ lib.optionals (!stdenv.isDarwin) [
-    "SHLIB_LINK=-lv8"
-  ];
-
-  NIX_LDFLAGS = (lib.optionals stdenv.isDarwin [
-    "-L${postgresql}/lib"
-    "-L${v8}/lib"
-    "-lv8_monolith"
-    "-lpq"
-    "-lpgcommon"
-    "-lpgport"
-    "-F${darwin.apple_sdk.frameworks.CoreFoundation}/Library/Frameworks"
-    "-framework" "CoreFoundation"
-    "-F${darwin.apple_sdk.frameworks.Kerberos}/Library/Frameworks"
-    "-framework" "Kerberos"
-    "-undefined" "dynamic_lookup"
-    "-flat_namespace"
-  ]); 
+  makeFlags =
+    [
+      # Nixpkgs build a v8 monolith instead of separate v8_libplatform.
+      "USE_SYSTEM_V8=1"
+      "V8_OUTDIR=${v8}/lib"
+      "PG_CONFIG=${postgresql}/bin/pg_config"
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      "CC=${clang}/bin/clang"
+      "CXX=${clang}/bin/clang++"
+      "SHLIB_LINK=-L${v8}/lib -lv8_monolith -Wl,-rpath,${v8}/lib"
+    ]
+    ++ lib.optionals (!stdenv.isDarwin) [ "SHLIB_LINK=-lv8" ];
+
+  NIX_LDFLAGS = (
+    lib.optionals stdenv.isDarwin [
+      "-L${postgresql}/lib"
+      "-L${v8}/lib"
+      "-lv8_monolith"
+      "-lpq"
+      "-lpgcommon"
+      "-lpgport"
+      "-F${darwin.apple_sdk.frameworks.CoreFoundation}/Library/Frameworks"
+      "-framework"
+      "CoreFoundation"
+      "-F${darwin.apple_sdk.frameworks.Kerberos}/Library/Frameworks"
+      "-framework"
+      "Kerberos"
+      "-undefined"
+      "dynamic_lookup"
+      "-flat_namespace"
+    ]
+  );
 
   installFlags = [
     # PGXS only supports installing to postgresql prefix so we need to redirect this
@@ -97,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     ''}
   '';
 
- postInstall = ''
+  postInstall = ''
     # Move the redirected to proper directory.
     # There appear to be no references to the install directories
     # so changing them does not cause issues.
@@ -119,9 +125,11 @@ stdenv.mkDerivation (finalAttrs: {
         install_name_tool -change @rpath/libv8_monolith.dylib ${v8}/lib/libv8_monolith.dylib $out/lib/plv8.so
       ''}
 
-      ${lib.optionalString (!stdenv.isDarwin) ''
-        ${patchelf}/bin/patchelf --set-rpath "${v8}/lib:${postgresql}/lib:${stdenv.cc.cc.lib}/lib" $out/lib/plv8.so
-      ''}
+      ${
+        lib.optionalString (!stdenv.isDarwin) ''
+          ${patchelf}/bin/patchelf --set-rpath "${v8}/lib:${postgresql}/lib:${stdenv.cc.cc.lib}/lib" $out/lib/plv8.so
+        ''
+      }
     else
       ${lib.optionalString stdenv.isDarwin ''
         install_name_tool -add_rpath "${v8}/lib" $out/lib/plv8-${finalAttrs.version}${postgresql.dlSuffix}
@@ -130,16 +138,23 @@ stdenv.mkDerivation (finalAttrs: {
         install_name_tool -change @rpath/libv8_monolith.dylib ${v8}/lib/libv8_monolith.dylib $out/lib/plv8-${finalAttrs.version}${postgresql.dlSuffix}
       ''}
 
-      ${lib.optionalString (!stdenv.isDarwin) ''
-        ${patchelf}/bin/patchelf --set-rpath "${v8}/lib:${postgresql}/lib:${stdenv.cc.cc.lib}/lib" $out/lib/plv8-${finalAttrs.version}${postgresql.dlSuffix}
-      ''}
+      ${
+        lib.optionalString (!stdenv.isDarwin) ''
+          ${patchelf}/bin/patchelf --set-rpath "${v8}/lib:${postgresql}/lib:${stdenv.cc.cc.lib}/lib" $out/lib/plv8-${finalAttrs.version}${postgresql.dlSuffix}
+        ''
+      }
     fi
   '';
 
   meta = with lib; {
     description = "V8 Engine Javascript Procedural Language add-on for PostgreSQL";
     homepage = "https://plv8.github.io/";
-    platforms = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
     license = licenses.postgresql;
   };
 })
diff --git a/nix/ext/postgis.nix b/nix/ext/postgis.nix
index e5ccda443..27a449210 100644
--- a/nix/ext/postgis.nix
+++ b/nix/ext/postgis.nix
@@ -1,18 +1,20 @@
-{ fetchurl
-, lib, stdenv
-, perl
-, libxml2
-, postgresql
-, geos
-, proj
-, json_c
-, pkg-config
-, file
-, protobufc
-, libiconv
-, pcre2
-, nixosTests
-, callPackage
+{
+  fetchurl,
+  lib,
+  stdenv,
+  perl,
+  libxml2,
+  postgresql,
+  geos,
+  proj,
+  json_c,
+  pkg-config,
+  file,
+  protobufc,
+  libiconv,
+  pcre2,
+  nixosTests,
+  callPackage,
 }:
 
 let
@@ -23,19 +25,33 @@ stdenv.mkDerivation rec {
   pname = "postgis";
   version = "3.3.7";
 
-  outputs = [ "out" "doc" ];
+  outputs = [
+    "out"
+    "doc"
+  ];
 
   src = fetchurl {
     url = "https://download.osgeo.org/postgis/source/postgis-${version}.tar.gz";
     sha256 = "sha256-UHJKDd5JrcJT5Z4CTYsY/va+ToU0GUPG1eHhuXTkP84=";
   };
 
-  buildInputs = [ libxml2 postgresql geos proj gdal json_c protobufc pcre2.dev sfcgal ]
-                ++ lib.optional stdenv.isDarwin libiconv;
-  nativeBuildInputs = [ perl pkg-config ];
+  buildInputs = [
+    libxml2
+    postgresql
+    geos
+    proj
+    gdal
+    json_c
+    protobufc
+    pcre2.dev
+    sfcgal
+  ] ++ lib.optional stdenv.isDarwin libiconv;
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
   dontDisableStatic = true;
 
-
   env.NIX_LDFLAGS = "-L${lib.getLib json_c}/lib";
 
   preConfigure = ''
@@ -57,22 +73,22 @@ stdenv.mkDerivation rec {
     ln -s ${postgresql}/bin/postgres $out/bin/postgres
   '';
 
-postInstall = ''
-  rm $out/bin/postgres
-  for prog in $out/bin/*; do # */
-    ln -s $prog $prog-${version}
-  done
-  # Add function definition and usage to tiger geocoder files
-  for file in $out/share/postgresql/extension/postgis_tiger_geocoder*--${version}.sql; do
-      sed -i "/SELECT postgis_extension_AddToSearchPath('tiger');/a SELECT postgis_extension_AddToSearchPath('extensions');" "$file"
-  done
-  # Original topology patching
-  for file in $out/share/postgresql/extension/postgis_topology*--${version}.sql; do
-    sed -i "/SELECT topology.AddToSearchPath('topology');/i SELECT topology.AddToSearchPath('extensions');" "$file"
-  done
-  mkdir -p $doc/share/doc/postgis
-  mv doc/* $doc/share/doc/postgis/
-'';
+  postInstall = ''
+    rm $out/bin/postgres
+    for prog in $out/bin/*; do # */
+      ln -s $prog $prog-${version}
+    done
+    # Add function definition and usage to tiger geocoder files
+    for file in $out/share/postgresql/extension/postgis_tiger_geocoder*--${version}.sql; do
+        sed -i "/SELECT postgis_extension_AddToSearchPath('tiger');/a SELECT postgis_extension_AddToSearchPath('extensions');" "$file"
+    done
+    # Original topology patching
+    for file in $out/share/postgresql/extension/postgis_topology*--${version}.sql; do
+      sed -i "/SELECT topology.AddToSearchPath('topology');/i SELECT topology.AddToSearchPath('extensions');" "$file"
+    done
+    mkdir -p $doc/share/doc/postgis
+    mv doc/* $doc/share/doc/postgis/
+  '';
 
   passthru.tests.postgis = nixosTests.postgis;
 
diff --git a/nix/ext/rum.nix b/nix/ext/rum.nix
index 574ef3d3a..9dc5d9525 100644
--- a/nix/ext/rum.nix
+++ b/nix/ext/rum.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "rum";
diff --git a/nix/ext/sfcgal/sfcgal.nix b/nix/ext/sfcgal/sfcgal.nix
index b1d5842f8..da962cbf8 100644
--- a/nix/ext/sfcgal/sfcgal.nix
+++ b/nix/ext/sfcgal/sfcgal.nix
@@ -1,4 +1,14 @@
-{ lib, stdenv, fetchFromGitLab, cgal, cmake, pkg-config, gmp, mpfr, boost }:
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cgal,
+  cmake,
+  pkg-config,
+  gmp,
+  mpfr,
+  boost,
+}:
 
 stdenv.mkDerivation rec {
   pname = "sfcgal";
@@ -11,10 +21,19 @@ stdenv.mkDerivation rec {
     hash = "sha256-nKSqiFyMkZAYptIeShb1zFg9lYSny3kcGJfxdeTFqxw=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config cgal gmp mpfr boost ];
-
-  cmakeFlags = [ "-DCGAL_DIR=${cgal}" "-DCMAKE_PREFIX_PATH=${cgal}" ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    cgal
+    gmp
+    mpfr
+    boost
+  ];
 
+  cmakeFlags = [
+    "-DCGAL_DIR=${cgal}"
+    "-DCMAKE_PREFIX_PATH=${cgal}"
+  ];
 
   postPatch = ''
     substituteInPlace sfcgal.pc.in \
@@ -24,7 +43,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A wrapper around CGAL that intents to implement 2D and 3D operations on OGC standards models";
     homepage = "https://sfcgal.gitlab.io/SFCGAL/";
-    license = with licenses; [ gpl3Plus lgpl3Plus];
+    license = with licenses; [
+      gpl3Plus
+      lgpl3Plus
+    ];
     platforms = platforms.all;
   };
 }
diff --git a/nix/ext/supautils.nix b/nix/ext/supautils.nix
index bb01bac55..75c5c029b 100644
--- a/nix/ext/supautils.nix
+++ b/nix/ext/supautils.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "supautils";
diff --git a/nix/ext/timescaledb-2.9.1.nix b/nix/ext/timescaledb-2.9.1.nix
index 92d5d73fe..0df743671 100644
--- a/nix/ext/timescaledb-2.9.1.nix
+++ b/nix/ext/timescaledb-2.9.1.nix
@@ -1,11 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, cmake, postgresql, openssl, libkrb5 }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  postgresql,
+  openssl,
+  libkrb5,
+}:
 
 stdenv.mkDerivation rec {
   pname = "timescaledb-apache";
   version = "2.9.1";
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ postgresql openssl libkrb5 ];
+  buildInputs = [
+    postgresql
+    openssl
+    libkrb5
+  ];
 
   src = fetchFromGitHub {
     owner = "timescale";
@@ -14,8 +26,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-fvVSxDiGZAewyuQ2vZDb0I6tmlDXl6trjZp8+qDBtb8=";
   };
 
-  cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" "-DAPACHE_ONLY=1" ]
-    ++ lib.optionals stdenv.isDarwin [ "-DLINTER=OFF" ];
+  cmakeFlags = [
+    "-DSEND_TELEMETRY_DEFAULT=OFF"
+    "-DREGRESS_CHECKS=OFF"
+    "-DTAP_CHECKS=OFF"
+    "-DAPACHE_ONLY=1"
+  ] ++ lib.optionals stdenv.isDarwin [ "-DLINTER=OFF" ];
 
   # Fix the install phase which tries to install into the pgsql extension dir,
   # and cannot be manually overridden. This is rather fragile but works OK.
@@ -31,7 +47,6 @@ stdenv.mkDerivation rec {
     done
   '';
 
-
   # timescaledb-2.9.1.so already exists in the lib directory
   # we have no need for the timescaledb.so or control file
   postInstall = ''
diff --git a/nix/ext/timescaledb.nix b/nix/ext/timescaledb.nix
index 1d7360762..6f5681546 100644
--- a/nix/ext/timescaledb.nix
+++ b/nix/ext/timescaledb.nix
@@ -1,11 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, cmake, postgresql, openssl, libkrb5 }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  postgresql,
+  openssl,
+  libkrb5,
+}:
 
 stdenv.mkDerivation rec {
   pname = "timescaledb-apache";
   version = "2.16.1";
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ postgresql openssl libkrb5 ];
+  buildInputs = [
+    postgresql
+    openssl
+    libkrb5
+  ];
 
   src = fetchFromGitHub {
     owner = "timescale";
@@ -14,8 +26,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-sLxWdBmih9mgiO51zLLxn9uwJVYc5JVHJjSWoADoJ+w=";
   };
 
-  cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" "-DTAP_CHECKS=OFF" "-DAPACHE_ONLY=1" ]
-    ++ lib.optionals stdenv.isDarwin [ "-DLINTER=OFF" ];
+  cmakeFlags = [
+    "-DSEND_TELEMETRY_DEFAULT=OFF"
+    "-DREGRESS_CHECKS=OFF"
+    "-DTAP_CHECKS=OFF"
+    "-DAPACHE_ONLY=1"
+  ] ++ lib.optionals stdenv.isDarwin [ "-DLINTER=OFF" ];
 
   # Fix the install phase which tries to install into the pgsql extension dir,
   # and cannot be manually overridden. This is rather fragile but works OK.
diff --git a/nix/ext/vault.nix b/nix/ext/vault.nix
index fcc1a9129..275d6967c 100644
--- a/nix/ext/vault.nix
+++ b/nix/ext/vault.nix
@@ -1,10 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libsodium,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "vault";
   version = "0.3.1";
 
-  buildInputs = [ libsodium postgresql ];
+  buildInputs = [
+    libsodium
+    postgresql
+  ];
 
   src = fetchFromGitHub {
     owner = "supabase";
diff --git a/nix/ext/wal2json.nix b/nix/ext/wal2json.nix
index b1f532dcf..deba7f1c6 100644
--- a/nix/ext/wal2json.nix
+++ b/nix/ext/wal2json.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  postgresql,
+}:
 
 stdenv.mkDerivation rec {
   pname = "wal2json";
@@ -7,7 +12,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "eulerto";
     repo = "wal2json";
-    rev = "wal2json_${builtins.replaceStrings ["."] ["_"] version}";
+    rev = "wal2json_${builtins.replaceStrings [ "." ] [ "_" ] version}";
     hash = "sha256-+QoACPCKiFfuT2lJfSUmgfzC5MXf75KpSoc2PzPxKyM=";
   };
 
diff --git a/nix/ext/wrappers/default.nix b/nix/ext/wrappers/default.nix
index 2bd424942..fe8074189 100644
--- a/nix/ext/wrappers/default.nix
+++ b/nix/ext/wrappers/default.nix
@@ -1,15 +1,14 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, openssl
-, pkg-config
-, postgresql
-, buildPgrxExtension_0_12_9
-, cargo
-, darwin
-, jq
-, rust-bin
-, git
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  openssl,
+  pkg-config,
+  postgresql,
+  buildPgrxExtension_0_12_9,
+  darwin,
+  rust-bin,
+  git,
 }:
 let
   rustVersion = "1.84.0";
@@ -20,7 +19,35 @@ buildPgrxExtension_0_12_9 rec {
   version = "0.5.0";
   # update the following array when the wrappers version is updated
   # required to ensure that extensions update scripts from previous versions are generated
-  previousVersions = ["0.4.6" "0.4.5" "0.4.4" "0.4.3" "0.4.2" "0.4.1" "0.4.0" "0.3.1" "0.3.0" "0.2.0" "0.1.19" "0.1.18" "0.1.17" "0.1.16" "0.1.15" "0.1.14" "0.1.12" "0.1.11" "0.1.10" "0.1.9" "0.1.8" "0.1.7" "0.1.6" "0.1.5" "0.1.4" "0.1.1" "0.1.0"];
+  previousVersions = [
+    "0.4.6"
+    "0.4.5"
+    "0.4.4"
+    "0.4.3"
+    "0.4.2"
+    "0.4.1"
+    "0.4.0"
+    "0.3.1"
+    "0.3.0"
+    "0.2.0"
+    "0.1.19"
+    "0.1.18"
+    "0.1.17"
+    "0.1.16"
+    "0.1.15"
+    "0.1.14"
+    "0.1.12"
+    "0.1.11"
+    "0.1.10"
+    "0.1.9"
+    "0.1.8"
+    "0.1.7"
+    "0.1.6"
+    "0.1.5"
+    "0.1.4"
+    "0.1.1"
+    "0.1.0"
+  ];
   inherit postgresql;
   src = fetchFromGitHub {
     owner = "supabase";
@@ -28,13 +55,22 @@ buildPgrxExtension_0_12_9 rec {
     rev = "v${version}";
     hash = "sha256-FbRTUcpEHBa5DI6dutvBeahYM0RZVAXIzIAZWIaxvn0";
   };
- 
-  nativeBuildInputs = [ pkg-config cargo git ];
-  buildInputs = [ openssl postgresql ] ++ lib.optionals (stdenv.isDarwin) [ 
-    darwin.apple_sdk.frameworks.CoreFoundation 
-    darwin.apple_sdk.frameworks.Security 
-    darwin.apple_sdk.frameworks.SystemConfiguration 
+
+  nativeBuildInputs = [
+    pkg-config
+    cargo
+    git
   ];
+  buildInputs =
+    [
+      openssl
+      postgresql
+    ]
+    ++ lib.optionals (stdenv.isDarwin) [
+      darwin.apple_sdk.frameworks.CoreFoundation
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ];
 
   NIX_LDFLAGS = "-L${postgresql}/lib -lpq";
 
@@ -50,16 +86,19 @@ buildPgrxExtension_0_12_9 rec {
     # - PostgreSQL 15.8 → 5435 + 0 + (15-15)*2 = 5435
     # - PostgreSQL 17_0 (OrioleDB) → 5435 + 1 + (17-15)*2 = 5440
     # - PostgreSQL 17.4 → 5435 + 0 + (17-15)*2 = 5439
-    PGPORT = toString (5534 + 
-      (if builtins.match ".*_.*" postgresql.version != null then 1 else 0) +  # +1 for OrioleDB
-      ((builtins.fromJSON (builtins.substring 0 2 postgresql.version)) - 15) * 2);  # +2 for each major version
+    PGPORT = toString (
+      5534
+      + (if builtins.match ".*_.*" postgresql.version != null then 1 else 0)
+      # +1 for OrioleDB
+      + ((builtins.fromJSON (builtins.substring 0 2 postgresql.version)) - 15) * 2
+    ); # +2 for each major version
   };
 
   OPENSSL_NO_VENDOR = 1;
   #need to set this to 2 to avoid cpu starvation
   CARGO_BUILD_JOBS = "2";
-  CARGO="${cargo}/bin/cargo";
-  
+  CARGO = "${cargo}/bin/cargo";
+
   #CARGO_NET_GIT_FETCH_WITH_CLI = "true";
   cargoLock = {
     lockFile = "${src}/Cargo.lock";
@@ -69,9 +108,9 @@ buildPgrxExtension_0_12_9 rec {
     };
   };
 
- preConfigure = ''
+  preConfigure = ''
     cd wrappers
-    
+
     # update the clickhouse-rs dependency
     # append the branch name to the git URL to help cargo locate the commit
     # while maintaining the rev for reproducibility
@@ -93,17 +132,17 @@ buildPgrxExtension_0_12_9 rec {
     }
     { print }
     ' Cargo.toml
-    
+
     # Verify the file is still valid TOML, break build with this error
     # if it is not
     if ! cargo verify-project 2>/dev/null; then
       echo "Failed to maintain valid TOML syntax"
       exit 1
     fi
-    
+
     cd ..
   '';
-  
+
   buildAndTestSubdir = "wrappers";
   buildFeatures = [
     "helloworld_fdw"
@@ -116,53 +155,53 @@ buildPgrxExtension_0_12_9 rec {
     echo '${builtins.concatStringsSep "," previousVersions}' | sed 's/,/\n/g' > git_tags.txt
   '';
 
- postInstall = ''
-   echo "Modifying main SQL file to use unversioned library name..."
-   current_version="${version}"
-   main_sql_file="$out/share/postgresql/extension/wrappers--$current_version.sql"
-   if [ -f "$main_sql_file" ]; then
-     sed -i 's|$libdir/wrappers-[0-9.]*|$libdir/wrappers|g' "$main_sql_file"
-     echo "Modified $main_sql_file"
-   else
-     echo "Warning: $main_sql_file not found"
-   fi
-   echo "Creating and modifying SQL files for previous versions..."
-   
-   if [ -f "$main_sql_file" ]; then
-     while read -r previous_version; do
-       if [ "$(printf '%s\n' "$previous_version" "$current_version" | sort -V | head -n1)" = "$previous_version" ] && [ "$previous_version" != "$current_version" ]; then
-         new_file="$out/share/postgresql/extension/wrappers--$previous_version--$current_version.sql"
-         echo "Creating $new_file"
-         cp "$main_sql_file" "$new_file"
-         sed -i 's|$libdir/wrappers-[0-9.]*|$libdir/wrappers|g' "$new_file"
-         echo "Modified $new_file"
-       fi
-     done < git_tags.txt
-   else
-     echo "Warning: $main_sql_file not found"
-   fi
-   mv $out/lib/wrappers-${version}${postgresql.dlSuffix} $out/lib/wrappers${postgresql.dlSuffix}
-   ln -s $out/lib/wrappers${postgresql.dlSuffix} $out/lib/wrappers-${version}${postgresql.dlSuffix}
+  postInstall = ''
+     echo "Modifying main SQL file to use unversioned library name..."
+     current_version="${version}"
+     main_sql_file="$out/share/postgresql/extension/wrappers--$current_version.sql"
+     if [ -f "$main_sql_file" ]; then
+       sed -i 's|$libdir/wrappers-[0-9.]*|$libdir/wrappers|g' "$main_sql_file"
+       echo "Modified $main_sql_file"
+     else
+       echo "Warning: $main_sql_file not found"
+     fi
+     echo "Creating and modifying SQL files for previous versions..."
+     
+     if [ -f "$main_sql_file" ]; then
+       while read -r previous_version; do
+         if [ "$(printf '%s\n' "$previous_version" "$current_version" | sort -V | head -n1)" = "$previous_version" ] && [ "$previous_version" != "$current_version" ]; then
+           new_file="$out/share/postgresql/extension/wrappers--$previous_version--$current_version.sql"
+           echo "Creating $new_file"
+           cp "$main_sql_file" "$new_file"
+           sed -i 's|$libdir/wrappers-[0-9.]*|$libdir/wrappers|g' "$new_file"
+           echo "Modified $new_file"
+         fi
+       done < git_tags.txt
+     else
+       echo "Warning: $main_sql_file not found"
+     fi
+     mv $out/lib/wrappers-${version}${postgresql.dlSuffix} $out/lib/wrappers${postgresql.dlSuffix}
+     ln -s $out/lib/wrappers${postgresql.dlSuffix} $out/lib/wrappers-${version}${postgresql.dlSuffix}
 
-  echo "Creating wrappers.so symlinks to support pg_upgrade..."
-  if [ -f "$out/lib/wrappers.so" ]; then
-    while read -r previous_version; do
-      if [ "$(printf '%s\n' "$previous_version" "$current_version" | sort -V | head -n1)" = "$previous_version" ] && [ "$previous_version" != "$current_version" ]; then
-        new_file="$out/lib/wrappers-$previous_version.so"
-        echo "Creating $new_file"
-        ln -s "$out/lib/wrappers.so" "$new_file"
-      fi
-    done < git_tags.txt
-  else
-    echo "Warning: $out/lib/wrappers.so not found"
-  fi
+    echo "Creating wrappers.so symlinks to support pg_upgrade..."
+    if [ -f "$out/lib/wrappers.so" ]; then
+      while read -r previous_version; do
+        if [ "$(printf '%s\n' "$previous_version" "$current_version" | sort -V | head -n1)" = "$previous_version" ] && [ "$previous_version" != "$current_version" ]; then
+          new_file="$out/lib/wrappers-$previous_version.so"
+          echo "Creating $new_file"
+          ln -s "$out/lib/wrappers.so" "$new_file"
+        fi
+      done < git_tags.txt
+    else
+      echo "Warning: $out/lib/wrappers.so not found"
+    fi
 
-   rm git_tags.txt
-   echo "Contents of updated wrappers.control:"
-   cat "$out/share/postgresql/extension/wrappers.control"
-   echo "List of generated SQL files:"
-   ls -l $out/share/postgresql/extension/wrappers--*.sql
- '';
+     rm git_tags.txt
+     echo "Contents of updated wrappers.control:"
+     cat "$out/share/postgresql/extension/wrappers.control"
+     echo "List of generated SQL files:"
+     ls -l $out/share/postgresql/extension/wrappers--*.sql
+  '';
 
   meta = with lib; {
     description = "Various Foreign Data Wrappers (FDWs) for PostreSQL";
diff --git a/nix/fmt.nix b/nix/fmt.nix
new file mode 100644
index 000000000..760cb5930
--- /dev/null
+++ b/nix/fmt.nix
@@ -0,0 +1,12 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.treefmt-nix.flakeModule ];
+  perSystem =
+    { pkgs, ... }:
+    {
+      treefmt.programs.deadnix.enable = true;
+
+      treefmt.programs.nixfmt.enable = true;
+      treefmt.programs.nixfmt.package = pkgs.nixfmt-rfc-style;
+    };
+}
diff --git a/nix/hooks.nix b/nix/hooks.nix
new file mode 100644
index 000000000..896c262ba
--- /dev/null
+++ b/nix/hooks.nix
@@ -0,0 +1,19 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.git-hooks.flakeModule ];
+  perSystem =
+    { config, ... }:
+    {
+      pre-commit = {
+        check.enable = true;
+        settings = {
+          hooks = {
+            treefmt = {
+              enable = true;
+              package = config.treefmt.build.wrapper;
+            };
+          };
+        };
+      };
+    };
+}
diff --git a/nix/mkdocs.yml b/nix/mkdocs.yml
new file mode 100644
index 000000000..f472b51c4
--- /dev/null
+++ b/nix/mkdocs.yml
@@ -0,0 +1,132 @@
+# Project info
+site_name: Postgres by Supabase
+site_description: >-
+   Provide some of the most common Postgres extensions with a one-click install.
+
+# Repository
+repo_name: supabase/postgres
+repo_url: https://github.com/supabase/postgres
+
+nav:
+  - Home: README.md
+  - Development:
+    - Getting Started: start-here.md
+    - Nix tree structure: nix-directory-structure.md
+    - Workflow: development-workflow.md
+    - Build PostgreSQL: build-postgres.md
+    - Start Client/Server: start-client-server.md
+    - Docker: docker.md
+    - Use direnv: use-direnv.md
+    - Code Formatter: nix-formatter.md
+    - Pre-commit Hooks: pre-commit-hooks.md
+    - Documentation: documentation.md
+  - Package Management:
+    - Adding New Packages: adding-new-package.md
+    - Update Extensions: update-extension.md
+    - New Major PostgreSQL: new-major-postgres.md
+    - Nix Overlays: nix-overlays.md
+  - Testing:
+    - Adding Tests: adding-tests.md
+    - Migration Tests: migration-tests.md
+    - Testing PG Upgrade Scripts: testing-pg-upgrade-scripts.md
+  - References: references.md
+
+validation:
+    omitted_files: warn
+    absolute_links: warn
+    unrecognized_links: warn
+
+# Configuration
+
+docs_dir: docs
+site_dir: out
+
+theme:
+    name: material
+
+    logo: assets/images/logo.png
+    favicon: assets/images/logo.png
+
+    features:
+        - content.code.annotate
+        - content.code.copy
+        - navigation.footer
+        - navigation.indexes
+        - navigation.path
+        - navigation.sections
+        - navigation.tabs
+        - navigation.tracking
+        - search.highlight
+        - search.share
+        - search.suggest
+
+    font:
+        text: Inter
+        mono: Noto Sans Mono
+    palette:
+        # Palette toggle for automatic mode
+        - media: "(prefers-color-scheme)"
+          toggle:
+              icon: material/brightness-auto
+              name: Switch to light mode
+
+        # Palette toggle for light mode
+        - media: "(prefers-color-scheme: light)"
+          scheme: default
+          toggle:
+              icon: material/brightness-7
+              name: Switch to dark mode
+
+        # Palette toggle for dark mode
+        - media: "(prefers-color-scheme: dark)"
+          scheme: slate
+          toggle:
+              icon: material/brightness-4
+              name: Switch to system preference
+
+extra:
+    version:
+        provider: mike
+    social:
+        - icon: fontawesome/brands/github
+          link: https://github.com/supabase/postgres
+
+extra_css:
+    - stylesheets/extra.css
+
+markdown_extensions:
+    - tables
+    - admonition
+    - attr_list
+    - footnotes
+    - md_in_html
+    - def_list
+    - meta
+    - pymdownx.emoji:
+          emoji_index: !!python/name:material.extensions.emoji.twemoji
+          emoji_generator: !!python/name:material.extensions.emoji.to_svg
+    - pymdownx.tasklist:
+          custom_checkbox: true
+    - pymdownx.superfences
+    - pymdownx.tabbed:
+          alternate_style: true
+    - pymdownx.details
+    - pymdownx.highlight:
+          use_pygments: true
+          linenums: true
+          anchor_linenums: true
+    - pymdownx.inlinehilite
+    - pymdownx.snippets:
+          base_path: ../.
+    - pymdownx.keys
+    - pymdownx.superfences:
+          # make exceptions to highlighting of code:
+        custom_fences:
+          - name: mermaid
+            class: mermaid
+            format: !!python/name:mermaid2.fence_mermaid_custom
+
+plugins:
+    - mike
+    - search
+    - mermaid2
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
new file mode 100644
index 000000000..005dd80aa
--- /dev/null
+++ b/nix/nixpkgs.nix
@@ -0,0 +1,16 @@
+{ self, inputs, ... }:
+{
+  perSystem =
+    { system, ... }:
+    {
+      _module.args.pkgs = import inputs.nixpkgs {
+        inherit system;
+        config.allowUnfree = true;
+        permittedInsecurePackages = [ "v8-9.7.106.18" ];
+        overlays = [
+          (import inputs.rust-overlay)
+          self.overlays.default
+        ];
+      };
+    };
+}
diff --git a/nix/overlays/default.nix b/nix/overlays/default.nix
new file mode 100644
index 000000000..f6eda4243
--- /dev/null
+++ b/nix/overlays/default.nix
@@ -0,0 +1,55 @@
+{ self, ... }:
+{
+  flake.overlays.default = final: prev: {
+    # NOTE: add any needed overlays here. in theory we could
+    # pull them from the overlays/ directory automatically, but we don't
+    # want to have an arbitrary order, since it might matter. being
+    # explicit is better.
+
+    inherit (self.packages.${final.system})
+      postgresql_15
+      postgresql_17
+      postgresql_orioledb-17
+      supabase-groonga
+      ;
+
+    xmrig = throw "The xmrig package has been explicitly disabled in this flake.";
+
+    cargo-pgrx = final.callPackage ../cargo-pgrx/default.nix {
+      inherit (final) lib;
+      inherit (final) darwin;
+      inherit (final) fetchCrate;
+      inherit (final) openssl;
+      inherit (final) pkg-config;
+      inherit (final) makeRustPlatform;
+      inherit (final) stdenv;
+      inherit (final) rust-bin;
+    };
+
+    buildPgrxExtension = final.callPackage ../cargo-pgrx/buildPgrxExtension.nix {
+      inherit (final) cargo-pgrx;
+      inherit (final) lib;
+      inherit (final) Security;
+      inherit (final) pkg-config;
+      inherit (final) makeRustPlatform;
+      inherit (final) stdenv;
+      inherit (final) writeShellScriptBin;
+    };
+
+    buildPgrxExtension_0_11_3 = prev.buildPgrxExtension.override {
+      cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_11_3;
+    };
+
+    buildPgrxExtension_0_12_6 = prev.buildPgrxExtension.override {
+      cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_12_6;
+    };
+
+    buildPgrxExtension_0_12_9 = prev.buildPgrxExtension.override {
+      cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_12_9;
+    };
+
+    buildPgrxExtension_0_14_3 = prev.buildPgrxExtension.override {
+      cargo-pgrx = final.cargo-pgrx.cargo-pgrx_0_14_3;
+    };
+  };
+}
diff --git a/nix/packages/build-test-ami.nix b/nix/packages/build-test-ami.nix
new file mode 100644
index 000000000..115ea793d
--- /dev/null
+++ b/nix/packages/build-test-ami.nix
@@ -0,0 +1,158 @@
+{ pkgs, runCommand }:
+runCommand "build-test-ami"
+  {
+    buildInputs = with pkgs; [
+      packer
+      awscli2
+      yq
+      jq
+      openssl
+      git
+      coreutils
+      aws-vault
+    ];
+  }
+  ''
+    mkdir -p $out/bin
+    cat > $out/bin/build-test-ami << 'EOL'
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    show_help() {
+      cat << EOF
+    Usage: build-test-ami [--help] <postgres-version>
+
+    Build AMI images for PostgreSQL testing.
+
+    This script will:
+    1. Check for required tools and AWS authentication
+    2. Build two AMI stages using Packer
+    3. Clean up any temporary instances
+    4. Output the final AMI name for use with run-testinfra
+
+    Arguments:
+      postgres-version    PostgreSQL major version to build (required)
+
+    Options:
+      --help    Show this help message and exit
+
+    Requirements:
+      - AWS Vault profile must be set in AWS_VAULT environment variable
+      - Packer, AWS CLI, yq, jq, and OpenSSL must be installed
+      - Must be run from a git repository
+
+    Example:
+      aws-vault exec <profile-name> -- nix run .#build-test-ami 15
+    EOF
+    }
+
+    # Handle help flag
+    if [[ "$#" -gt 0 && "$1" == "--help" ]]; then
+      show_help
+      exit 0
+    fi
+
+    export PATH="${
+      pkgs.lib.makeBinPath (
+        with pkgs;
+        [
+          packer
+          awscli2
+          yq
+          jq
+          openssl
+          git
+          coreutils
+          aws-vault
+        ]
+      )
+    }:$PATH"
+
+    # Check for required tools
+    for cmd in packer aws-vault yq jq openssl; do
+      if ! command -v $cmd &> /dev/null; then
+        echo "Error: $cmd is required but not found"
+        exit 1
+      fi
+    done
+
+    # Check AWS Vault profile
+    if [ -z "''${AWS_VAULT:-}" ]; then
+      echo "Error: AWS_VAULT environment variable must be set with the profile name"
+      echo "Usage: aws-vault exec <profile-name> -- nix run .#build-test-ami <postgres-version>"
+      exit 1
+    fi
+
+    # Set values
+    REGION="ap-southeast-1"
+    POSTGRES_VERSION="$1"
+    RANDOM_STRING=$(openssl rand -hex 8)
+    GIT_SHA=$(git rev-parse HEAD)
+    RUN_ID=$(date +%s)
+
+    # Generate common-nix.vars.pkr.hcl
+    PG_VERSION=$(yq -r ".postgres_release[\"postgres$POSTGRES_VERSION\"]" ansible/vars.yml)
+    echo "postgres-version = \"$PG_VERSION\"" > common-nix.vars.pkr.hcl
+
+    # Build AMI Stage 1
+    packer init amazon-arm64-nix.pkr.hcl
+    packer build \
+      -var "git-head-version=$GIT_SHA" \
+      -var "packer-execution-id=$RUN_ID" \
+      -var-file="development-arm.vars.pkr.hcl" \
+      -var-file="common-nix.vars.pkr.hcl" \
+      -var "ansible_arguments=" \
+      -var "postgres-version=$RANDOM_STRING" \
+      -var "region=$REGION" \
+      -var 'ami_regions=["'"$REGION"'"]' \
+      -var "force-deregister=true" \
+      -var "ansible_arguments=-e postgresql_major=$POSTGRES_VERSION" \
+      amazon-arm64-nix.pkr.hcl
+
+    # Build AMI Stage 2
+    packer init stage2-nix-psql.pkr.hcl
+    packer build \
+      -var "git-head-version=$GIT_SHA" \
+      -var "packer-execution-id=$RUN_ID" \
+      -var "postgres_major_version=$POSTGRES_VERSION" \
+      -var-file="development-arm.vars.pkr.hcl" \
+      -var-file="common-nix.vars.pkr.hcl" \
+      -var "postgres-version=$RANDOM_STRING" \
+      -var "region=$REGION" \
+      -var 'ami_regions=["'"$REGION"'"]' \
+      -var "force-deregister=true" \
+      -var "git_sha=$GIT_SHA" \
+      stage2-nix-psql.pkr.hcl
+
+    # Cleanup instances from AMI builds
+    cleanup_instances() {
+      echo "Terminating EC2 instances with tag testinfra-run-id=$RUN_ID..."
+      aws ec2 --region $REGION describe-instances \
+        --filters "Name=tag:testinfra-run-id,Values=$RUN_ID" \
+        --query "Reservations[].Instances[].InstanceId" \
+        --output text | xargs -r aws ec2 terminate-instances \
+        --region $REGION --instance-ids || true
+    }
+
+    # Set up traps for various signals to ensure cleanup
+    trap cleanup_instances EXIT HUP INT QUIT TERM
+
+    # Create and activate virtual environment
+    VENV_DIR=$(mktemp -d)
+    trap 'rm -rf "$VENV_DIR"' EXIT HUP INT QUIT TERM
+    python3 -m venv "$VENV_DIR"
+    source "$VENV_DIR/bin/activate"
+
+    # Install required Python packages
+    echo "Installing required Python packages..."
+    pip install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest paramiko requests
+
+    # Run the tests with aws-vault
+    echo "Running tests for AMI: $RANDOM_STRING using AWS Vault profile: $AWS_VAULT_PROFILE"
+    aws-vault exec $AWS_VAULT_PROFILE -- pytest -vv -s testinfra/test_ami_nix.py
+
+    # Deactivate virtual environment (cleanup is handled by trap)
+    deactivate
+    EOL
+    chmod +x $out/bin/build-test-ami
+  ''
diff --git a/nix/packages/cleanup-ami.nix b/nix/packages/cleanup-ami.nix
new file mode 100644
index 000000000..f1f9cde27
--- /dev/null
+++ b/nix/packages/cleanup-ami.nix
@@ -0,0 +1,61 @@
+{ pkgs, runCommand }:
+runCommand "cleanup-ami"
+  {
+    buildInputs = with pkgs; [
+      awscli2
+      aws-vault
+    ];
+  }
+  ''
+    mkdir -p $out/bin
+    cat > $out/bin/cleanup-ami << 'EOL'
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    export PATH="${
+      pkgs.lib.makeBinPath (
+        with pkgs;
+        [
+          awscli2
+          aws-vault
+        ]
+      )
+    }:$PATH"
+
+    # Check for required tools
+    for cmd in aws-vault; do
+      if ! command -v $cmd &> /dev/null; then
+        echo "Error: $cmd is required but not found"
+        exit 1
+      fi
+    done
+
+    # Check AWS Vault profile
+    if [ -z "''${AWS_VAULT:-}" ]; then
+      echo "Error: AWS_VAULT environment variable must be set with the profile name"
+      echo "Usage: aws-vault exec <profile-name> -- nix run .#cleanup-ami <ami-name>"
+      exit 1
+    fi
+
+    # Check for AMI name argument
+    if [ -z "''${1:-}" ]; then
+      echo "Error: AMI name must be provided"
+      echo "Usage: aws-vault exec <profile-name> -- nix run .#cleanup-ami <ami-name>"
+      exit 1
+    fi
+
+    AMI_NAME="$1"
+    REGION="ap-southeast-1"
+
+    # Deregister AMIs
+    for AMI_PATTERN in "supabase-postgres-ci-ami-test-stage-1" "$AMI_NAME"; do
+      aws ec2 describe-images --region $REGION --owners self \
+        --filters "Name=name,Values=$AMI_PATTERN" \
+        --query 'Images[*].ImageId' --output text | while read -r ami_id; do
+          echo "Deregistering AMI: $ami_id"
+          aws ec2 deregister-image --region $REGION --image-id "$ami_id" || true
+        done
+    done
+    EOL
+    chmod +x $out/bin/cleanup-ami
+  ''
diff --git a/nix/packages/dbmate-tool.nix b/nix/packages/dbmate-tool.nix
new file mode 100644
index 000000000..7ce2c5031
--- /dev/null
+++ b/nix/packages/dbmate-tool.nix
@@ -0,0 +1,45 @@
+{
+  pkgs,
+  system,
+  defaults,
+}:
+let
+  migrationsDir = ../../migrations/db;
+  ansibleVars = ../../ansible/vars.yml;
+  pgbouncerAuthSchemaSql = ../../ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql;
+  statExtensionSql = ../../ansible/files/stat_extension.sql;
+in
+pkgs.runCommand "dbmate-tool"
+  {
+    buildInputs = with pkgs; [
+      overmind
+      dbmate
+      nix
+      jq
+      yq
+    ];
+    nativeBuildInputs = with pkgs; [ makeWrapper ];
+  }
+  ''
+    mkdir -p $out/bin $out/migrations
+    cp -r ${migrationsDir}/* $out
+    substitute ${../tools/dbmate-tool.sh.in} $out/bin/dbmate-tool \
+      --subst-var-by 'PGSQL_DEFAULT_PORT' '${defaults.port}' \
+      --subst-var-by 'MIGRATIONS_DIR' $out \
+      --subst-var-by 'PGSQL_SUPERUSER' '${defaults.superuser}' \
+      --subst-var-by 'ANSIBLE_VARS' ${ansibleVars} \
+      --subst-var-by 'CURRENT_SYSTEM' '${system}' \
+      --subst-var-by 'PGBOUNCER_AUTH_SCHEMA_SQL' '${pgbouncerAuthSchemaSql}' \
+      --subst-var-by 'STAT_EXTENSION_SQL' '${statExtensionSql}'
+    chmod +x $out/bin/dbmate-tool
+    wrapProgram $out/bin/dbmate-tool \
+      --prefix PATH : ${
+        pkgs.lib.makeBinPath [
+          pkgs.overmind
+          pkgs.dbmate
+          pkgs.nix
+          pkgs.jq
+          pkgs.yq
+        ]
+      }
+  ''
diff --git a/nix/packages/default.nix b/nix/packages/default.nix
new file mode 100644
index 000000000..cd6d6a1d0
--- /dev/null
+++ b/nix/packages/default.nix
@@ -0,0 +1,78 @@
+{ self, ... }:
+{
+  imports = [ ./postgres.nix ];
+  perSystem =
+    {
+      inputs',
+      lib,
+      pkgs,
+      self',
+      ...
+    }:
+    let
+      activeVersion = "15";
+      # Function to create the pg_regress package
+      makePgRegress =
+        version:
+        let
+          postgresqlPackage = self'.packages."postgresql_${version}";
+        in
+        pkgs.callPackage ../ext/pg_regress.nix { postgresql = postgresqlPackage; };
+      pgsqlSuperuser = "supabase_admin";
+      pkgs-lib = pkgs.callPackage ./lib.nix {
+        psql_15 = self'.packages."psql_15/bin";
+        psql_17 = self'.packages."psql_17/bin";
+        psql_orioledb-17 = self'.packages."psql_orioledb-17/bin";
+        pgroonga = self'.packages."psql_15/exts/pgroonga";
+        inherit (self.supabase) defaults;
+      };
+    in
+    {
+      packages = (
+        {
+          build-test-ami = pkgs.callPackage ./build-test-ami.nix { };
+          cleanup-ami = pkgs.callPackage ./cleanup-ami.nix { };
+          dbmate-tool = pkgs.callPackage ./dbmate-tool.nix { inherit (self.supabase) defaults; };
+          docs = pkgs.callPackage ./docs.nix { };
+          supabase-groonga = pkgs.callPackage ./groonga { };
+          local-infra-bootstrap = pkgs.callPackage ./local-infra-bootstrap.nix { };
+          migrate-tool = pkgs.callPackage ./migrate-tool.nix { psql_15 = self'.packages."psql_15/bin"; };
+          pg-restore = pkgs.callPackage ./pg-restore.nix { psql_15 = self'.packages."psql_15/bin"; };
+          pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
+          pg_regress = makePgRegress activeVersion;
+          run-testinfra = pkgs.callPackage ./run-testinfra.nix { };
+          show-commands = pkgs.callPackage ./show-commands.nix { };
+          start-client = pkgs.callPackage ./start-client.nix {
+            psql_15 = self'.packages."psql_15/bin";
+            psql_17 = self'.packages."psql_17/bin";
+            psql_orioledb-17 = self'.packages."psql_orioledb-17/bin";
+            inherit (self.supabase) defaults;
+          };
+          start-replica = pkgs.callPackage ./start-replica.nix {
+            psql_15 = self'.packages."psql_15/bin";
+            inherit pgsqlSuperuser;
+          };
+          start-server = pkgs-lib.makePostgresDevSetup {
+            inherit pkgs;
+            name = "start-postgres-server";
+          };
+          sync-exts-versions = pkgs.callPackage ./sync-exts-versions.nix { inherit (inputs') nix-editor; };
+          trigger-nix-build = pkgs.callPackage ./trigger-nix-build.nix { };
+          update-readme = pkgs.callPackage ./update-readme.nix { };
+          inherit (pkgs.callPackage ./wal-g.nix { }) wal-g-2 wal-g-3;
+          inherit (pkgs.cargo-pgrx)
+            cargo-pgrx_0_11_3
+            cargo-pgrx_0_12_6
+            cargo-pgrx_0_12_9
+            cargo-pgrx_0_14_3
+            ;
+        }
+        // lib.filterAttrs (n: _v: n != "override" && n != "overrideAttrs" && n != "overrideDerivation") (
+          pkgs.callPackage ../postgresql/default.nix {
+            inherit self';
+            inherit (self.supabase) supportedPostgresVersions;
+          }
+        )
+      );
+    };
+}
diff --git a/nix/packages/docs.nix b/nix/packages/docs.nix
new file mode 100644
index 000000000..822661368
--- /dev/null
+++ b/nix/packages/docs.nix
@@ -0,0 +1,22 @@
+{ stdenvNoCC, python3Packages, ... }:
+stdenvNoCC.mkDerivation {
+  name = "docs";
+
+  src = ../.;
+
+  nativeBuildInputs = with python3Packages; [
+    mike
+    mkdocs
+    mkdocs-material
+    mkdocs-linkcheck
+    mkdocs-mermaid2-plugin
+  ];
+
+  buildPhase = ''
+    mkdocs build
+  '';
+
+  installPhase = ''
+    mv out $out
+  '';
+}
diff --git a/nix/supabase-groonga.nix b/nix/packages/groonga/default.nix
similarity index 65%
rename from nix/supabase-groonga.nix
rename to nix/packages/groonga/default.nix
index 5035f369f..3fcd4b691 100644
--- a/nix/supabase-groonga.nix
+++ b/nix/packages/groonga/default.nix
@@ -1,22 +1,59 @@
-{ lib, stdenv, cmake, fetchurl, kytea, msgpack-c, mecab, pkg-config, rapidjson
-, testers, xxHash, zstd, postgresqlPackages, makeWrapper, suggestSupport ? false
-, zeromq, libevent, openssl, lz4Support ? false, lz4, zlibSupport ? true, zlib
-, writeShellScriptBin, callPackage }:
-let mecab-naist-jdic = callPackage ./ext/mecab-naist-jdic { };
-in stdenv.mkDerivation (finalAttrs: {
+{
+  lib,
+  stdenv,
+  cmake,
+  fetchurl,
+  kytea,
+  msgpack-c,
+  mecab,
+  pkg-config,
+  rapidjson,
+  xxHash,
+  zstd,
+  makeWrapper,
+  suggestSupport ? false,
+  zeromq,
+  libevent,
+  lz4Support ? false,
+  lz4,
+  zlibSupport ? true,
+  zlib,
+  callPackage,
+}:
+let
+  mecab-naist-jdic = callPackage ../../ext/mecab-naist-jdic { };
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "supabase-groonga";
   version = "14.0.5";
   src = fetchurl {
-    url =
-      "https://packages.groonga.org/source/groonga/groonga-${finalAttrs.version}.tar.gz";
+    url = "https://packages.groonga.org/source/groonga/groonga-${finalAttrs.version}.tar.gz";
     hash = "sha256-y4UGnv8kK0z+br8wXpPf57NMXkdEJHcLCuTvYiubnIc=";
   };
-  patches =
-    [ ./fix-cmake-install-path.patch ./do-not-use-vendored-libraries.patch ];
-  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
-  buildInputs = [ rapidjson xxHash zstd mecab kytea msgpack-c ]
-    ++ lib.optionals lz4Support [ lz4 ] ++ lib.optional zlibSupport [ zlib ]
-    ++ lib.optionals suggestSupport [ zeromq libevent ];
+  patches = [
+    ./fix-cmake-install-path.patch
+    ./do-not-use-vendored-libraries.patch
+  ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+  buildInputs =
+    [
+      rapidjson
+      xxHash
+      zstd
+      mecab
+      kytea
+      msgpack-c
+    ]
+    ++ lib.optionals lz4Support [ lz4 ]
+    ++ lib.optional zlibSupport [ zlib ]
+    ++ lib.optionals suggestSupport [
+      zeromq
+      libevent
+    ];
   cmakeFlags = [
     "-DWITH_MECAB=ON"
     "-DMECAB_DICDIR=${mecab-naist-jdic}/lib/mecab/dic/naist-jdic"
@@ -58,8 +95,7 @@ in stdenv.mkDerivation (finalAttrs: {
       --set GRN_PLUGINS_DIR $out/lib/groonga/plugins 
 
   '';
-  env.NIX_CFLAGS_COMPILE =
-    lib.optionalString zlibSupport "-I${zlib.dev}/include";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString zlibSupport "-I${zlib.dev}/include";
 
   meta = with lib; {
     homepage = "https://groonga.org/";
diff --git a/nix/do-not-use-vendored-libraries.patch b/nix/packages/groonga/do-not-use-vendored-libraries.patch
similarity index 100%
rename from nix/do-not-use-vendored-libraries.patch
rename to nix/packages/groonga/do-not-use-vendored-libraries.patch
diff --git a/nix/fix-cmake-install-path.patch b/nix/packages/groonga/fix-cmake-install-path.patch
similarity index 100%
rename from nix/fix-cmake-install-path.patch
rename to nix/packages/groonga/fix-cmake-install-path.patch
diff --git a/nix/packages/lib.nix b/nix/packages/lib.nix
new file mode 100644
index 000000000..971909162
--- /dev/null
+++ b/nix/packages/lib.nix
@@ -0,0 +1,137 @@
+{
+  psql_17,
+  psql_15,
+  psql_orioledb-17,
+  defaults,
+  supabase-groonga,
+  system,
+  pgroonga,
+}:
+{
+  makePostgresDevSetup =
+    {
+      pkgs,
+      name,
+      extraSubstitutions ? { },
+    }:
+    let
+      paths = {
+        migrationsDir = builtins.path {
+          name = "migrations";
+          path = ../../migrations/db;
+        };
+        postgresqlSchemaSql = builtins.path {
+          name = "postgresql-schema";
+          path = ../tools/postgresql_schema.sql;
+        };
+        pgbouncerAuthSchemaSql = builtins.path {
+          name = "pgbouncer-auth-schema";
+          path = ../../ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql;
+        };
+        statExtensionSql = builtins.path {
+          name = "stat-extension";
+          path = ../../ansible/files/stat_extension.sql;
+        };
+        pgconfigFile = builtins.path {
+          name = "postgresql.conf";
+          path = ../../ansible/files/postgresql_config/postgresql.conf.j2;
+        };
+        supautilsConfigFile = builtins.path {
+          name = "supautils.conf";
+          path = ../../ansible/files/postgresql_config/supautils.conf.j2;
+        };
+        loggingConfigFile = builtins.path {
+          name = "logging.conf";
+          path = ../../ansible/files/postgresql_config/postgresql-csvlog.conf;
+        };
+        readReplicaConfigFile = builtins.path {
+          name = "readreplica.conf";
+          path = ../../ansible/files/postgresql_config/custom_read_replica.conf.j2;
+        };
+        pgHbaConfigFile = builtins.path {
+          name = "pg_hba.conf";
+          path = ../../ansible/files/postgresql_config/pg_hba.conf.j2;
+        };
+        pgIdentConfigFile = builtins.path {
+          name = "pg_ident.conf";
+          path = ../../ansible/files/postgresql_config/pg_ident.conf.j2;
+        };
+        postgresqlExtensionCustomScriptsPath = builtins.path {
+          name = "extension-custom-scripts";
+          path = ../../ansible/files/postgresql_extension_custom_scripts;
+        };
+        getkeyScript = builtins.path {
+          name = "pgsodium_getkey.sh";
+          path = ../tests/util/pgsodium_getkey.sh;
+        };
+      };
+
+      localeArchive =
+        if pkgs.stdenv.isDarwin then
+          "${pkgs.darwin.locale}/share/locale"
+        else
+          "${pkgs.glibcLocales}/lib/locale/locale-archive";
+
+      substitutions = {
+        SHELL_PATH = "${pkgs.bash}/bin/bash";
+        PGSQL_DEFAULT_PORT = "${defaults.port}";
+        PGSQL_SUPERUSER = "${defaults.superuser}";
+        PSQL15_BINDIR = "${psql_15}";
+        PSQL17_BINDIR = "${psql_17}";
+        PSQL_CONF_FILE = "${paths.pgconfigFile}";
+        PSQLORIOLEDB17_BINDIR = "${psql_orioledb-17}";
+        PGSODIUM_GETKEY = "${paths.getkeyScript}";
+        READREPL_CONF_FILE = "${paths.readReplicaConfigFile}";
+        LOGGING_CONF_FILE = "${paths.loggingConfigFile}";
+        SUPAUTILS_CONF_FILE = "${paths.supautilsConfigFile}";
+        PG_HBA = "${paths.pgHbaConfigFile}";
+        PG_IDENT = "${paths.pgIdentConfigFile}";
+        LOCALES = "${localeArchive}";
+        EXTENSION_CUSTOM_SCRIPTS_DIR = "${paths.postgresqlExtensionCustomScriptsPath}";
+        MECAB_LIB = "${pgroonga}/lib/groonga/plugins/tokenizers/tokenizer_mecab.so";
+        GROONGA_DIR = "${supabase-groonga}";
+        MIGRATIONS_DIR = "${paths.migrationsDir}";
+        POSTGRESQL_SCHEMA_SQL = "${paths.postgresqlSchemaSql}";
+        PGBOUNCER_AUTH_SCHEMA_SQL = "${paths.pgbouncerAuthSchemaSql}";
+        STAT_EXTENSION_SQL = "${paths.statExtensionSql}";
+        CURRENT_SYSTEM = "${system}";
+      } // extraSubstitutions; # Merge in any extra substitutions
+    in
+    pkgs.runCommand name
+      {
+        inherit (paths)
+          migrationsDir
+          postgresqlSchemaSql
+          pgbouncerAuthSchemaSql
+          statExtensionSql
+          ;
+      }
+      ''
+        mkdir -p $out/bin $out/etc/postgresql-custom $out/etc/postgresql $out/extension-custom-scripts
+
+        # Copy config files with error handling
+        cp ${paths.supautilsConfigFile} $out/etc/postgresql-custom/supautils.conf || { echo "Failed to copy supautils.conf"; exit 1; }
+        cp ${paths.pgconfigFile} $out/etc/postgresql/postgresql.conf || { echo "Failed to copy postgresql.conf"; exit 1; }
+        cp ${paths.loggingConfigFile} $out/etc/postgresql-custom/logging.conf || { echo "Failed to copy logging.conf"; exit 1; }
+        cp ${paths.readReplicaConfigFile} $out/etc/postgresql-custom/read-replica.conf || { echo "Failed to copy read-replica.conf"; exit 1; }
+        cp ${paths.pgHbaConfigFile} $out/etc/postgresql/pg_hba.conf || { echo "Failed to copy pg_hba.conf"; exit 1; }
+        cp ${paths.pgIdentConfigFile} $out/etc/postgresql/pg_ident.conf || { echo "Failed to copy pg_ident.conf"; exit 1; }
+        cp -r ${paths.postgresqlExtensionCustomScriptsPath}/* $out/extension-custom-scripts/ || { echo "Failed to copy custom scripts"; exit 1; }
+
+        echo "Copy operation completed"
+        chmod 644 $out/etc/postgresql-custom/supautils.conf
+        chmod 644 $out/etc/postgresql/postgresql.conf
+        chmod 644 $out/etc/postgresql-custom/logging.conf
+        chmod 644 $out/etc/postgresql/pg_hba.conf
+
+        substitute ${../tools/run-server.sh.in} $out/bin/start-postgres-server \
+          ${
+            builtins.concatStringsSep " " (
+              builtins.attrValues (
+                builtins.mapAttrs (name: value: "--subst-var-by '${name}' '${value}'") substitutions
+              )
+            )
+          }
+        chmod +x $out/bin/start-postgres-server
+      '';
+}
diff --git a/nix/packages/local-infra-bootstrap.nix b/nix/packages/local-infra-bootstrap.nix
new file mode 100644
index 000000000..82e15de37
--- /dev/null
+++ b/nix/packages/local-infra-bootstrap.nix
@@ -0,0 +1,6 @@
+{ runCommand }:
+runCommand "local-infra-bootstrap" { } ''
+  mkdir -p $out/bin
+  substitute ${./local-infra-bootstrap.sh.in} $out/bin/local-infra-bootstrap
+  chmod +x $out/bin/local-infra-bootstrap
+''
diff --git a/nix/tools/local-infra-bootstrap.sh.in b/nix/packages/local-infra-bootstrap.sh.in
similarity index 100%
rename from nix/tools/local-infra-bootstrap.sh.in
rename to nix/packages/local-infra-bootstrap.sh.in
diff --git a/nix/packages/migrate-tool.nix b/nix/packages/migrate-tool.nix
new file mode 100644
index 000000000..57f218a63
--- /dev/null
+++ b/nix/packages/migrate-tool.nix
@@ -0,0 +1,18 @@
+{ runCommand, psql_15 }:
+let
+  configFile = ../tests/postgresql.conf.in;
+  getkeyScript = ../tests/util/pgsodium_getkey.sh;
+  primingScript = ../tests/prime.sql;
+  migrationData = ../tests/migrations/data.sql;
+in
+runCommand "migrate-postgres" { } ''
+  mkdir -p $out/bin
+  substitute ${../tools/migrate-tool.sh.in} $out/bin/migrate-postgres \
+    --subst-var-by 'PSQL15_BINDIR' '${psql_15}' \
+    --subst-var-by 'PSQL_CONF_FILE' '${configFile}' \
+    --subst-var-by 'PGSODIUM_GETKEY' '${getkeyScript}' \
+    --subst-var-by 'PRIMING_SCRIPT' '${primingScript}' \
+    --subst-var-by 'MIGRATION_DATA' '${migrationData}'
+
+  chmod +x $out/bin/migrate-postgres
+''
diff --git a/nix/packages/pg-restore.nix b/nix/packages/pg-restore.nix
new file mode 100644
index 000000000..aa01e7a7e
--- /dev/null
+++ b/nix/packages/pg-restore.nix
@@ -0,0 +1,7 @@
+{ runCommand, psql_15 }:
+runCommand "run-pg-restore" { } ''
+  mkdir -p $out/bin
+  substitute ${./run-restore.sh.in} $out/bin/pg-restore \
+    --subst-var-by PSQL15_BINDIR '${psql_15}'
+  chmod +x $out/bin/pg-restore
+''
diff --git a/nix/packages/postgres.nix b/nix/packages/postgres.nix
new file mode 100644
index 000000000..bf8710b4d
--- /dev/null
+++ b/nix/packages/postgres.nix
@@ -0,0 +1,176 @@
+{ self, inputs, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    let
+      gitRev = "vcs=${self.shortRev or "dirty"}+${
+        builtins.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")
+      }";
+
+      # Custom extensions that exist in our repository. These aren't upstream
+      # either because nobody has done the work, maintaining them here is
+      # easier and more expedient, or because they may not be suitable, or are
+      # too niche/one-off.
+      #
+      # Ideally, most of these should have copies upstream for third party
+      # use, but even if they did, keeping our own copies means that we can
+      # rollout new versions of these critical things easier without having to
+      # go through the upstream release engineering process.
+      ourExtensions = [
+        ../ext/rum.nix
+        ../ext/timescaledb.nix
+        ../ext/timescaledb-2.9.1.nix
+        ../ext/pgroonga.nix
+        ../ext/index_advisor.nix
+        ../ext/wal2json.nix
+        ../ext/pgmq.nix
+        ../ext/pg_repack.nix
+        ../ext/pg-safeupdate.nix
+        ../ext/plpgsql-check.nix
+        ../ext/pgjwt.nix
+        ../ext/pgaudit.nix
+        ../ext/postgis.nix
+        ../ext/pgrouting.nix
+        ../ext/pgtap.nix
+        ../ext/pg_cron.nix
+        ../ext/pgsql-http.nix
+        ../ext/pg_plan_filter.nix
+        ../ext/pg_net.nix
+        ../ext/pg_hashids.nix
+        ../ext/pgsodium.nix
+        ../ext/pg_graphql.nix
+        ../ext/pg_stat_monitor.nix
+        ../ext/pg_jsonschema.nix
+        ../ext/pgvector.nix
+        ../ext/vault.nix
+        ../ext/hypopg.nix
+        ../ext/pg_tle.nix
+        ../ext/wrappers/default.nix
+        ../ext/supautils.nix
+        ../ext/plv8.nix
+      ];
+
+      #Where we import and build the orioledb extension, we add on our custom extensions
+      # plus the orioledb option
+      #we're not using timescaledb or plv8 in the orioledb-17 version or pg 17 of supabase extensions
+      orioleFilteredExtensions = builtins.filter (
+        x: x != ../ext/timescaledb.nix && x != ../ext/timescaledb-2.9.1.nix && x != ../ext/plv8.nix
+      ) ourExtensions;
+
+      orioledbExtensions = orioleFilteredExtensions ++ [ ../ext/orioledb.nix ];
+      dbExtensions17 = orioleFilteredExtensions;
+      getPostgresqlPackage = version: pkgs."postgresql_${version}";
+      # Create a 'receipt' file for a given postgresql package. This is a way
+      # of adding a bit of metadata to the package, which can be used by other
+      # tools to inspect what the contents of the install are: the PSQL
+      # version, the installed extensions, et cetera.
+      #
+      # This takes two arguments:
+      #  - pgbin: the postgresql package we are building on top of
+      #    not a list of packages, but an attrset containing extension names
+      #    mapped to versions.
+      #  - ourExts: the list of extensions from upstream nixpkgs. This is not
+      #    a list of packages, but an attrset containing extension names
+      #    mapped to versions.
+      #
+      # The output is a package containing the receipt.json file, which can be
+      # merged with the PostgreSQL installation using 'symlinkJoin'.
+      makeReceipt =
+        pgbin: ourExts:
+        pkgs.writeTextFile {
+          name = "receipt";
+          destination = "/receipt.json";
+          text = builtins.toJSON {
+            revision = gitRev;
+            psql-version = pgbin.version;
+            nixpkgs = {
+              revision = inputs.nixpkgs.rev;
+            };
+            extensions = ourExts;
+
+            # NOTE this field can be used to do cache busting (e.g.
+            # force a rebuild of the psql packages) but also to helpfully inform
+            # tools what version of the schema is being used, for forwards and
+            # backwards compatibility
+            receipt-version = "1";
+          };
+        };
+
+      makeOurPostgresPkgs =
+        version:
+        let
+          postgresql = getPostgresqlPackage version;
+          extensionsToUse =
+            if (builtins.elem version [ "orioledb-17" ]) then
+              orioledbExtensions
+            else if (builtins.elem version [ "17" ]) then
+              dbExtensions17
+            else
+              ourExtensions;
+        in
+        map (path: pkgs.callPackage path { inherit postgresql; }) extensionsToUse;
+
+      # Create an attrset that contains all the extensions included in a server.
+      makeOurPostgresPkgsSet =
+        version:
+        (builtins.listToAttrs (
+          map (drv: {
+            name = drv.pname;
+            value = drv;
+          }) (makeOurPostgresPkgs version)
+        ))
+        // {
+          recurseForDerivations = true;
+        };
+
+      # Create a binary distribution of PostgreSQL, given a version.
+      #
+      # NOTE: The version here does NOT refer to the exact PostgreSQL version;
+      # it refers to the *major number only*, which is used to select the
+      # correct version of the package from nixpkgs. This is because we want
+      # to be able to do so in an open ended way. As an example, the version
+      # "15" passed in will use the nixpkgs package "postgresql_15" as the
+      # basis for building extensions, etc.
+      makePostgresBin =
+        version:
+        let
+          postgresql = getPostgresqlPackage version;
+          ourExts = map (ext: {
+            name = ext.pname;
+            version = ext.version;
+          }) (makeOurPostgresPkgs version);
+
+          pgbin = postgresql.withPackages (_ps: makeOurPostgresPkgs version);
+        in
+        pkgs.symlinkJoin {
+          inherit (pgbin) name version;
+          paths = [
+            pgbin
+            (makeReceipt pgbin ourExts)
+          ];
+        };
+
+      # Create an attribute set, containing all the relevant packages for a
+      # PostgreSQL install, wrapped up with a bow on top. There are three
+      # packages:
+      #
+      #  - bin: the postgresql package itself, with all the extensions
+      #    installed, and a receipt.json file containing metadata about the
+      #    install.
+      #  - exts: an attrset containing all the extensions, mapped to their
+      #    package names.
+      makePostgres = version: {
+        bin = makePostgresBin version;
+        exts = makeOurPostgresPkgsSet version;
+        recurseForDerivations = true;
+      };
+      basePackages = {
+        psql_15 = makePostgres "15";
+        psql_17 = makePostgres "17";
+        psql_orioledb-17 = makePostgres "orioledb-17";
+      };
+    in
+    {
+      packages = inputs.flake-utils.lib.flattenTree basePackages;
+    };
+}
diff --git a/nix/tools/run-restore.sh.in b/nix/packages/run-restore.sh.in
similarity index 100%
rename from nix/tools/run-restore.sh.in
rename to nix/packages/run-restore.sh.in
diff --git a/nix/packages/run-testinfra.nix b/nix/packages/run-testinfra.nix
new file mode 100644
index 000000000..92f9d0a4a
--- /dev/null
+++ b/nix/packages/run-testinfra.nix
@@ -0,0 +1,146 @@
+{
+  runCommand,
+  aws-vault,
+  python3,
+  python3Packages,
+  coreutils,
+}:
+runCommand "run-testinfra"
+  {
+    buildInputs = [
+      aws-vault
+      python3
+      python3Packages.pip
+      coreutils
+    ];
+  }
+  ''
+    mkdir -p $out/bin
+    cat > $out/bin/run-testinfra << 'EOL'
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    show_help() {
+      cat << EOF
+    Usage: run-testinfra --ami-name NAME [--aws-vault-profile PROFILE]
+
+    Run the testinfra tests locally against a specific AMI.
+
+    This script will:
+    1. Check if aws-vault is installed and configured
+    2. Set up the required environment variables
+    3. Create and activate a virtual environment
+    4. Install required Python packages from pip
+    5. Run the tests with aws-vault credentials
+    6. Clean up the virtual environment
+
+    Required flags:
+      --ami-name NAME              The name of the AMI to test
+
+    Optional flags:
+      --aws-vault-profile PROFILE  AWS Vault profile to use (default: staging)
+      --help                       Show this help message and exit
+
+    Requirements:
+      - aws-vault installed and configured
+      - Python 3 with pip
+      - Must be run from the repository root
+
+    Examples:
+      run-testinfra --ami-name supabase-postgres-abc123
+      run-testinfra --ami-name supabase-postgres-abc123 --aws-vault-profile production
+    EOF
+    }
+
+    # Default values
+    AWS_VAULT_PROFILE="staging"
+    AMI_NAME=""
+
+    # Parse arguments
+    while [[ $# -gt 0 ]]; do
+      case $1 in
+        --aws-vault-profile)
+          AWS_VAULT_PROFILE="$2"
+          shift 2
+          ;;
+        --ami-name)
+          AMI_NAME="$2"
+          shift 2
+          ;;
+        --help)
+          show_help
+          exit 0
+          ;;
+        *)
+          echo "Error: Unexpected argument: $1"
+          show_help
+          exit 1
+          ;;
+      esac
+    done
+
+    # Check for required tools
+    if ! command -v aws-vault &> /dev/null; then
+      echo "Error: aws-vault is required but not found"
+      exit 1
+    fi
+
+    # Check for AMI name argument
+    if [ -z "$AMI_NAME" ]; then
+      echo "Error: --ami-name is required"
+      show_help
+      exit 1
+    fi
+
+    # Set environment variables
+    export AWS_REGION="ap-southeast-1"
+    export AWS_DEFAULT_REGION="ap-southeast-1"
+    export AMI_NAME="$AMI_NAME"  # Export AMI_NAME for pytest
+    export RUN_ID="local-$(date +%s)"  # Generate a unique RUN_ID
+
+    # Function to terminate EC2 instances
+    terminate_instances() {
+      echo "Terminating EC2 instances with tag testinfra-run-id=$RUN_ID..."
+      aws-vault exec $AWS_VAULT_PROFILE -- aws ec2 --region ap-southeast-1 describe-instances \
+        --filters "Name=tag:testinfra-run-id,Values=$RUN_ID" \
+        --query "Reservations[].Instances[].InstanceId" \
+        --output text | xargs -r aws-vault exec $AWS_VAULT_PROFILE -- aws ec2 terminate-instances \
+        --region ap-southeast-1 --instance-ids || true
+    }
+
+    # Set up traps for various signals to ensure cleanup
+    trap terminate_instances EXIT HUP INT QUIT TERM
+
+    # Create and activate virtual environment
+    VENV_DIR=$(mktemp -d)
+    trap 'rm -rf "$VENV_DIR"' EXIT HUP INT QUIT TERM
+    python3 -m venv "$VENV_DIR"
+    source "$VENV_DIR/bin/activate"
+
+    # Install required Python packages
+    echo "Installing required Python packages..."
+    pip install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest paramiko requests
+
+    # Function to run tests and ensure cleanup
+    run_tests() {
+      local exit_code=0
+      echo "Running tests for AMI: $AMI_NAME using AWS Vault profile: $AWS_VAULT_PROFILE"
+      aws-vault exec "$AWS_VAULT_PROFILE" -- pytest -vv -s testinfra/test_ami_nix.py || exit_code=$?
+      return $exit_code
+    }
+
+    # Run tests and capture exit code
+    run_tests
+    test_exit_code=$?
+
+    # Deactivate virtual environment
+    deactivate
+
+    # Explicitly call cleanup
+    terminate_instances
+
+    # Exit with the test exit code
+    exit $test_exit_code
+    EOL
+    chmod +x $out/bin/run-testinfra
+  ''
diff --git a/nix/packages/show-commands.nix b/nix/packages/show-commands.nix
new file mode 100644
index 000000000..b0733761e
--- /dev/null
+++ b/nix/packages/show-commands.nix
@@ -0,0 +1,23 @@
+{
+  runCommand,
+  makeWrapper,
+  nushell,
+  system ? builtins.currentSystem,
+}:
+runCommand "show-commands"
+  {
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ nushell ];
+  }
+  ''
+    mkdir -p $out/bin
+    cat > $out/bin/show-commands << 'EOF'
+    #!${nushell}/bin/nu
+    let json_output = (nix flake show --json --quiet --all-systems | from json)
+    let apps = ($json_output | get apps.${system})
+    $apps | transpose name info | select name | each { |it| echo $"Run this app with: nix run .#($it.name)" }
+    EOF
+    chmod +x $out/bin/show-commands
+    wrapProgram $out/bin/show-commands \
+      --prefix PATH : ${nushell}/bin
+  ''
diff --git a/nix/packages/start-client.nix b/nix/packages/start-client.nix
new file mode 100644
index 000000000..84ab06209
--- /dev/null
+++ b/nix/packages/start-client.nix
@@ -0,0 +1,27 @@
+{
+  runCommand,
+  psql_15,
+  psql_17,
+  psql_orioledb-17,
+  defaults,
+}:
+let
+  migrationsDir = ../../migrations/db;
+  postgresqlSchemaSql = ../tools/postgresql_schema.sql;
+  pgbouncerAuthSchemaSql = ../../ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql;
+  statExtensionSql = ../../ansible/files/stat_extension.sql;
+in
+runCommand "start-postgres-client" { } ''
+  mkdir -p $out/bin
+  substitute ${../tools/run-client.sh.in} $out/bin/start-postgres-client \
+    --subst-var-by 'PGSQL_DEFAULT_PORT' '${defaults.port}' \
+    --subst-var-by 'PGSQL_SUPERUSER' '${defaults.superuser}' \
+    --subst-var-by 'PSQL15_BINDIR' '${psql_15}' \
+    --subst-var-by 'PSQL17_BINDIR' '${psql_17}' \
+    --subst-var-by 'PSQLORIOLEDB17_BINDIR' '${psql_orioledb-17}' \
+    --subst-var-by 'MIGRATIONS_DIR' '${migrationsDir}' \
+    --subst-var-by 'POSTGRESQL_SCHEMA_SQL' '${postgresqlSchemaSql}' \
+    --subst-var-by 'PGBOUNCER_AUTH_SCHEMA_SQL' '${pgbouncerAuthSchemaSql}' \
+    --subst-var-by 'STAT_EXTENSION_SQL' '${statExtensionSql}'
+  chmod +x $out/bin/start-postgres-client
+''
diff --git a/nix/packages/start-replica.nix b/nix/packages/start-replica.nix
new file mode 100644
index 000000000..129ccd9cc
--- /dev/null
+++ b/nix/packages/start-replica.nix
@@ -0,0 +1,12 @@
+{
+  runCommand,
+  pgsqlSuperuser,
+  psql_15,
+}:
+runCommand "start-postgres-replica" { } ''
+  mkdir -p $out/bin
+  substitute ${./start-replica.sh.in} $out/bin/start-postgres-replica \
+    --subst-var-by 'PGSQL_SUPERUSER' '${pgsqlSuperuser}' \
+    --subst-var-by 'PSQL15_BINDIR' '${psql_15}'
+  chmod +x $out/bin/start-postgres-replica
+''
diff --git a/nix/tools/run-replica.sh.in b/nix/packages/start-replica.sh.in
similarity index 100%
rename from nix/tools/run-replica.sh.in
rename to nix/packages/start-replica.sh.in
diff --git a/nix/packages/sync-exts-versions.nix b/nix/packages/sync-exts-versions.nix
new file mode 100644
index 000000000..d76e66553
--- /dev/null
+++ b/nix/packages/sync-exts-versions.nix
@@ -0,0 +1,17 @@
+{
+  runCommand,
+  jq,
+  yq,
+  nix-editor,
+  nixVersions,
+}:
+runCommand "sync-exts-versions" { } ''
+  mkdir -p $out/bin
+  substitute ${../tools/sync-exts-versions.sh.in} $out/bin/sync-exts-versions \
+    --subst-var-by 'YQ' '${yq}/bin/yq' \
+    --subst-var-by 'JQ' '${jq}/bin/jq' \
+    --subst-var-by 'NIX_EDITOR' '${nix-editor.packages.nix-editor}/bin/nix-editor' \
+    --subst-var-by 'NIXPREFETCHURL' '${nixVersions.nix_2_20}/bin/nix-prefetch-url' \
+    --subst-var-by 'NIX' '${nixVersions.nix_2_20}/bin/nix'
+  chmod +x $out/bin/sync-exts-versions
+''
diff --git a/nix/packages/trigger-nix-build.nix b/nix/packages/trigger-nix-build.nix
new file mode 100644
index 000000000..3c006c028
--- /dev/null
+++ b/nix/packages/trigger-nix-build.nix
@@ -0,0 +1,125 @@
+{
+  runCommand,
+  gh,
+  git,
+  coreutils,
+  lib,
+}:
+runCommand "trigger-nix-build"
+  {
+    buildInputs = [
+      gh
+      git
+      coreutils
+    ];
+  }
+  ''
+    mkdir -p $out/bin
+    cat > $out/bin/trigger-nix-build << 'EOL'
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    show_help() {
+      cat << EOF
+    Usage: trigger-nix-build [--help]
+
+    Trigger the nix-build workflow for the current branch and watch its progress.
+
+    This script will:
+    1. Check if you're authenticated with GitHub
+    2. Get the current branch and commit
+    3. Verify you're on a standard branch (develop or release/*) or prompt for confirmation
+    4. Trigger the nix-build workflow
+    5. Watch the workflow progress until completion
+
+    Options:
+      --help    Show this help message and exit
+
+    Requirements:
+      - GitHub CLI (gh) installed and authenticated
+      - Git installed
+      - Must be run from a git repository
+
+    Example:
+      trigger-nix-build
+    EOF
+    }
+
+    # Handle help flag
+    if [[ "$#" -gt 0 && "$1" == "--help" ]]; then
+      show_help
+      exit 0
+    fi
+
+    export PATH="${
+      lib.makeBinPath ([
+        gh
+        git
+        coreutils
+      ])
+    }:$PATH"
+
+    # Check for required tools
+    for cmd in gh git; do
+      if ! command -v $cmd &> /dev/null; then
+        echo "Error: $cmd is required but not found"
+        exit 1
+      fi
+    done
+
+    # Check if user is authenticated with GitHub
+    if ! gh auth status &>/dev/null; then
+      echo "Error: Not authenticated with GitHub. Please run 'gh auth login' first."
+      exit 1
+    fi
+
+    # Get current branch and commit
+    BRANCH=$(git rev-parse --abbrev-ref HEAD)
+    COMMIT=$(git rev-parse HEAD)
+
+    # Check if we're on a standard branch
+    if [[ "$BRANCH" != "develop" && ! "$BRANCH" =~ ^release/ ]]; then
+      echo "Warning: Running workflow from non-standard branch: $BRANCH"
+      echo "This is supported for testing purposes."
+      read -p "Continue? [y/N] " -n 1 -r
+      echo
+      if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+        echo "Aborted."
+        exit 1
+      fi
+    fi
+
+    # Trigger the workflow
+    echo "Triggering nix-build workflow for branch $BRANCH (commit: $COMMIT)"
+    gh workflow run nix-build.yml --ref "$BRANCH"
+
+    # Wait for workflow to start and get the run ID
+    echo "Waiting for workflow to start..."
+    sleep 5
+
+    # Get the latest run ID for this workflow
+    RUN_ID=$(gh run list --workflow=nix-build.yml --limit 1 --json databaseId --jq '.[0].databaseId')
+
+    if [ -z "$RUN_ID" ]; then
+      echo "Error: Could not find workflow run ID"
+      exit 1
+    fi
+
+    echo "Watching workflow run $RUN_ID..."
+    echo "The script will automatically exit when the workflow completes."
+    echo "Press Ctrl+C to stop watching (workflow will continue running)"
+    echo "----------------------------------------"
+
+    # Try to watch the run, but handle network errors gracefully
+    while true; do
+      if gh run watch "$RUN_ID" --exit-status; then
+        break
+      else
+        echo "Network error while watching workflow. Retrying in 5 seconds..."
+        echo "You can also check the status manually with: gh run view $RUN_ID"
+        sleep 5
+      fi
+    done
+    EOL
+    chmod +x $out/bin/trigger-nix-build
+  ''
diff --git a/nix/packages/update-readme.nix b/nix/packages/update-readme.nix
new file mode 100644
index 000000000..40fd1e6e5
--- /dev/null
+++ b/nix/packages/update-readme.nix
@@ -0,0 +1,17 @@
+{
+  runCommand,
+  makeWrapper,
+  nushell,
+}:
+runCommand "update-readme"
+  {
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ nushell ];
+  }
+  ''
+    mkdir -p $out/bin
+    cp ${../tools/update_readme.nu} $out/bin/update-readme
+    chmod +x $out/bin/update-readme
+    wrapProgram $out/bin/update-readme \
+      --prefix PATH : ${nushell}/bin
+  ''
diff --git a/nix/wal-g.nix b/nix/packages/wal-g.nix
similarity index 90%
rename from nix/wal-g.nix
rename to nix/packages/wal-g.nix
index 0e29fd272..37f4addb7 100644
--- a/nix/wal-g.nix
+++ b/nix/packages/wal-g.nix
@@ -1,14 +1,20 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, brotli
-, libsodium
-, installShellFiles
-,
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  brotli,
+  libsodium,
+  installShellFiles,
 }:
 
 let
-  walGCommon = { version, vendorHash, sha256, majorVersion }:
+  walGCommon =
+    {
+      version,
+      vendorHash,
+      sha256,
+      majorVersion,
+    }:
     buildGoModule rec {
       pname = "wal-g-${majorVersion}";
       inherit version;
@@ -45,14 +51,14 @@ let
 
       postInstall = ''
         mv $out/bin/pg $out/bin/wal-g-${majorVersion}
-        
+
         # Create version-specific completions
         mkdir -p $out/share/bash-completion/completions
         $out/bin/wal-g-${majorVersion} completion bash > $out/share/bash-completion/completions/wal-g-${majorVersion}
-        
+
         mkdir -p $out/share/zsh/site-functions
         $out/bin/wal-g-${majorVersion} completion zsh > $out/share/zsh/site-functions/_wal-g-${majorVersion}
-        
+
       '';
 
       meta = with lib; {
diff --git a/nix/postgresql/15.nix b/nix/postgresql/15.nix
deleted file mode 100644
index 63f492840..000000000
--- a/nix/postgresql/15.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "15.8";
-  hash = "sha256-RANRX5pp7rPv68mPMLjGlhIr/fiV6Ss7I/W452nty2o=";
-}
diff --git a/nix/postgresql/17.nix b/nix/postgresql/17.nix
deleted file mode 100644
index 32102fdb6..000000000
--- a/nix/postgresql/17.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "17.4";
-  hash = "sha256-xGBbc/6hGWNAZpn5Sblm5dFzp+4Myu+JON7AyoqZX+c=";
-}
diff --git a/nix/postgresql/default.nix b/nix/postgresql/default.nix
index f7b3c5583..272dc4f35 100644
--- a/nix/postgresql/default.nix
+++ b/nix/postgresql/default.nix
@@ -1,19 +1,85 @@
-self:
+{
+  self',
+  pkgs,
+  supportedPostgresVersions,
+}:
 let
-  versions = {
-    postgresql_15 = ./15.nix;
-    postgresql_17 = ./17.nix;
-    postgresql_orioledb-17 = ./orioledb-17.nix;
-  };
-  mkAttributes = jitSupport:
-    self.lib.mapAttrs' (version: path:
+  # Creates Postgres packages for a specific flavor (standard or orioledb)
+  mkPostgresqlPackages =
+    {
+      namePrefix,
+      jitSupport,
+      supportedVersions,
+    }:
+    pkgs.lib.mapAttrs' (
+      version: config:
       let
-        attrName = if jitSupport then "${version}_jit" else version;
+        versionSuffix = if jitSupport then "${version}_jit" else version;
       in
-      self.lib.nameValuePair attrName (import path {
-        inherit jitSupport self;
+      pkgs.lib.nameValuePair "${namePrefix}${versionSuffix}" (
+        pkgs.callPackage ./generic.nix {
+          inherit (config) version hash;
+          jitSupport = jitSupport;
+          self = pkgs;
+        }
+      )
+    ) supportedVersions;
+
+  # Define Postgres flavors with their configuration
+  postgresFlavors = [
+    {
+      namePrefix = "postgresql_";
+      versions = supportedPostgresVersions.postgres;
+    }
+    {
+      namePrefix = "postgresql_orioledb-";
+      versions = supportedPostgresVersions.orioledb;
+    }
+  ];
+
+  # Generate packages for all flavors with both JIT enabled and disabled
+  mkAllPackages =
+    flavors: jitSupport:
+    pkgs.lib.foldl' (
+      acc: flavor:
+      acc
+      // (mkPostgresqlPackages {
+        inherit (flavor) namePrefix;
+        inherit jitSupport;
+        supportedVersions = flavor.versions;
       })
-    ) versions;
+    ) { } flavors;
+
+  # Generate source packages dynamically from supported versions
+  mkSourcePackages =
+    flavors:
+    pkgs.lib.foldl' (
+      acc: flavor:
+      acc
+      // (pkgs.lib.mapAttrs' (
+        version: _:
+        pkgs.lib.nameValuePair "${flavor.namePrefix}${version}_src" (
+          pkgs.callPackage ./src.nix { postgresql = self'.packages."${flavor.namePrefix}${version}"; }
+        )
+      ) flavor.versions)
+    ) { } flavors;
+
+  # Generate debug packages dynamically from supported versions (Linux only)
+  mkDebugPackages =
+    flavors:
+    pkgs.lib.foldl' (
+      acc: flavor:
+      acc
+      // (pkgs.lib.mapAttrs' (
+        version: _:
+        pkgs.lib.nameValuePair "${flavor.namePrefix}${version}_debug" (
+          self'.packages."${flavor.namePrefix}${version}".debug
+        )
+      ) flavor.versions)
+    ) { } flavors;
 in
-# variations without and with JIT
-(mkAttributes false) // (mkAttributes true)
+# Combine all PostgreSQL packages: runtime packages + source packages + debug packages
+(mkAllPackages postgresFlavors false)
+// (mkAllPackages postgresFlavors true)
+// (mkSourcePackages postgresFlavors)
+// pkgs.lib.optionalAttrs (pkgs.stdenv.isLinux) (mkDebugPackages postgresFlavors)
diff --git a/nix/postgresql/generic.nix b/nix/postgresql/generic.nix
index cefd5a61b..d922895fa 100644
--- a/nix/postgresql/generic.nix
+++ b/nix/postgresql/generic.nix
@@ -1,320 +1,411 @@
 let
 
   generic =
-      # adapted from the nixpkgs postgresql package
-      # dependencies
-      { stdenv, lib, fetchurl, fetchpatch, makeWrapper
-      , glibc, zlib, readline, openssl, icu, lz4, zstd, systemd, libossp_uuid
-      , pkg-config, libxml2, tzdata, libkrb5, substituteAll, darwin
-      , linux-pam
+    # adapted from the nixpkgs postgresql package
+    # dependencies
+    {
+      stdenv,
+      lib,
+      fetchurl,
+      makeWrapper,
+      glibc,
+      zlib,
+      readline,
+      openssl,
+      icu,
+      lz4,
+      zstd,
+      systemd,
+      libossp_uuid,
+      pkg-config,
+      libxml2,
+      tzdata,
+      libkrb5,
+      substituteAll,
+      darwin,
+      linux-pam,
       #orioledb specific
-      , perl, bison, flex, docbook_xsl, docbook_xml_dtd_45, docbook_xsl_ns, libxslt
+      perl,
+      bison,
+      flex,
+      docbook_xsl,
+      docbook_xml_dtd_45,
+      docbook_xsl_ns,
+      libxslt,
 
       # This is important to obtain a version of `libpq` that does not depend on systemd.
-      , systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd && !stdenv.hostPlatform.isStatic
-      , enableSystemd ? null
-      , gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic
+      systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd && !stdenv.hostPlatform.isStatic,
+      enableSystemd ? null,
+      gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic,
 
       # for postgresql.pkgs
-      , self, newScope, buildEnv
+      self,
+      newScope,
+      buildEnv,
 
       # source specification
-      , version, hash, muslPatches ? {}
+      version,
+      hash,
+      muslPatches ? { },
 
       # for tests
-      , testers
+      testers,
 
       # JIT
-      , jitSupport
-      , nukeReferences, patchelf, llvmPackages
+      jitSupport,
+      nukeReferences,
+      patchelf,
+      llvmPackages,
 
       # PL/Python
-      , pythonSupport ? false
-      , python3
+      pythonSupport ? false,
+      python3,
 
       # detection of crypt fails when using llvm stdenv, so we add it manually
       # for <13 (where it got removed: https://github.com/postgres/postgres/commit/c45643d618e35ec2fe91438df15abd4f3c0d85ca)
-      , libxcrypt
-    } @args:
-  let
-    atLeast = lib.versionAtLeast version;
-    olderThan = lib.versionOlder version;
-    lz4Enabled = atLeast "14";
-    zstdEnabled = atLeast "15";
-
-    systemdSupport' = if enableSystemd == null then systemdSupport else (lib.warn "postgresql: argument enableSystemd is deprecated, please use systemdSupport instead." enableSystemd);
-
-    pname = "postgresql";
-
-    stdenv' = if jitSupport then llvmPackages.stdenv else stdenv;
-  in stdenv'.mkDerivation (finalAttrs: {
-    inherit version;
-    pname = pname + lib.optionalString jitSupport "-jit";
-
-    src = if (builtins.match "[0-9][0-9]_.*" version != null) then
-      fetchurl {
-        url = "https://github.com/orioledb/postgres/archive/refs/tags/patches${version}.tar.gz";
-        inherit hash;
-      }
-    else
-      fetchurl {
-        url = "mirror://postgresql/source/v${version}/${pname}-${version}.tar.bz2";
-        inherit hash;
-      };
-
-    hardeningEnable = lib.optionals (!stdenv'.cc.isClang) [ "pie" ];
-
-    outputs = [ "out" "lib" ];
-    setOutputFlags = false; # $out retains configureFlags :-/
-
-    buildInputs = [
-      zlib
-      readline
-      openssl
-      (libxml2.override {python = python3;})
-      icu
-    ]
-      ++ lib.optionals (olderThan "13") [ libxcrypt ]
-      ++ lib.optionals jitSupport [ llvmPackages.llvm ]
-      ++ lib.optionals lz4Enabled [ lz4 ]
-      ++ lib.optionals zstdEnabled [ zstd ]
-      ++ lib.optionals systemdSupport' [ systemd ]
-      ++ lib.optionals pythonSupport [ python3 ]
-      ++ lib.optionals gssSupport [ libkrb5 ]
-      ++ lib.optionals stdenv'.isLinux [ linux-pam ]
-      ++ lib.optionals (!stdenv'.isDarwin) [ libossp_uuid ]
-      ++ lib.optionals ((builtins.match "[0-9][0-9]_.*" version != null) || (lib.versionAtLeast version "17")) [ 
-      perl bison flex docbook_xsl docbook_xml_dtd_45 docbook_xsl_ns libxslt
+      libxcrypt,
+    }@args:
+    let
+      atLeast = lib.versionAtLeast version;
+      olderThan = lib.versionOlder version;
+      lz4Enabled = atLeast "14";
+      zstdEnabled = atLeast "15";
+
+      systemdSupport' =
+        if enableSystemd == null then
+          systemdSupport
+        else
+          (lib.warn "postgresql: argument enableSystemd is deprecated, please use systemdSupport instead." enableSystemd);
+
+      pname = "postgresql";
+
+      stdenv' = if jitSupport then llvmPackages.stdenv else stdenv;
+    in
+    stdenv'.mkDerivation (finalAttrs: {
+      inherit version;
+      pname = pname + lib.optionalString jitSupport "-jit";
+
+      src =
+        if (builtins.match "[0-9][0-9]_.*" version != null) then
+          fetchurl {
+            url = "https://github.com/orioledb/postgres/archive/refs/tags/patches${version}.tar.gz";
+            inherit hash;
+          }
+        else
+          fetchurl {
+            url = "mirror://postgresql/source/v${version}/${pname}-${version}.tar.bz2";
+            inherit hash;
+          };
+
+      hardeningEnable = lib.optionals (!stdenv'.cc.isClang) [ "pie" ];
+
+      outputs = [
+        "out"
+        "lib"
       ];
-
-    nativeBuildInputs = [
-      makeWrapper
-      pkg-config
-    ]
-      ++ lib.optionals jitSupport [ llvmPackages.llvm.dev nukeReferences patchelf ];
-
-    enableParallelBuilding = true;
-
-    separateDebugInfo = true;
-
-    buildFlags = [ "world-bin" ];
-
-    # Makes cross-compiling work when xml2-config can't be executed on the host.
-    # Fixed upstream in https://github.com/postgres/postgres/commit/0bc8cebdb889368abdf224aeac8bc197fe4c9ae6
-    env.NIX_CFLAGS_COMPILE = lib.optionalString (olderThan "13") "-I${libxml2.dev}/include/libxml2";
-
-    configureFlags = [
-      "--with-openssl"
-      "--with-libxml"
-      "--with-icu"
-      "--sysconfdir=/etc"
-      "--libdir=$(lib)/lib"
-      "--with-system-tzdata=${tzdata}/share/zoneinfo"
-      "--enable-debug"
-      (lib.optionalString systemdSupport' "--with-systemd")
-      (if stdenv'.isDarwin then "--with-uuid=e2fs" else "--with-ossp-uuid")
-    ] ++ lib.optionals lz4Enabled [ "--with-lz4" ]
-      ++ lib.optionals zstdEnabled [ "--with-zstd" ]
-      ++ lib.optionals gssSupport [ "--with-gssapi" ]
-      ++ lib.optionals pythonSupport [ "--with-python" ]
-      ++ lib.optionals jitSupport [ "--with-llvm" ]
-      ++ lib.optionals stdenv'.isLinux [ "--with-pam" ];
-
-    patches = [
-      (if atLeast "16" then ./patches/relative-to-symlinks-16+.patch else ./patches/relative-to-symlinks.patch)
-      ./patches/less-is-more.patch
-      ./patches/paths-for-split-outputs.patch
-      ./patches/specify_pkglibdir_at_runtime.patch
-      ./patches/paths-with-postgresql-suffix.patch
-
-      (substituteAll {
-        src = ./patches/locale-binary-path.patch;
-        locale = "${if stdenv.isDarwin then darwin.adv_cmds else lib.getBin stdenv.cc.libc}/bin/locale";
-      })
-    ] ++ lib.optionals stdenv'.hostPlatform.isMusl (
-      # Using fetchurl instead of fetchpatch on purpose: https://github.com/NixOS/nixpkgs/issues/240141
-      map fetchurl (lib.attrValues muslPatches)
-    ) ++ lib.optionals stdenv'.isLinux  [
-      (if atLeast "13" then ./patches/socketdir-in-run-13+.patch else ./patches/socketdir-in-run.patch)
-    ];
-
-    installTargets = [ "install-world-bin" ];
-
-    postPatch = ''
-      # Hardcode the path to pgxs so pg_config returns the path in $out
-      substituteInPlace "src/common/config_info.c" --subst-var out
-    '' + lib.optionalString jitSupport ''
-        # Force lookup of jit stuff in $out instead of $lib
-        substituteInPlace src/backend/jit/jit.c --replace pkglib_path \"$out/lib\"
-        substituteInPlace src/backend/jit/llvm/llvmjit.c --replace pkglib_path \"$out/lib\"
-        substituteInPlace src/backend/jit/llvm/llvmjit_inline.cpp --replace pkglib_path \"$out/lib\"
-    '';
-
-    postInstall =
-      ''
-        moveToOutput "lib/pgxs" "$out" # looks strange, but not deleting it
-        moveToOutput "lib/libpgcommon*.a" "$out"
-        moveToOutput "lib/libpgport*.a" "$out"
-        moveToOutput "lib/libecpg*" "$out"
-
-        # Prevent a retained dependency on gcc-wrapper.
-        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/ld ld
-
-        if [ -z "''${dontDisableStatic:-}" ]; then
-          # Remove static libraries in case dynamic are available.
-          for i in $out/lib/*.a $lib/lib/*.a; do
-            name="$(basename "$i")"
-            ext="${stdenv'.hostPlatform.extensions.sharedLibrary}"
-            if [ -e "$lib/lib/''${name%.a}$ext" ] || [ -e "''${i%.a}$ext" ]; then
-              rm "$i"
-            fi
-          done
-        fi
-      '' + lib.optionalString jitSupport ''
-        # Move the bitcode and libllvmjit.so library out of $lib; otherwise, every client that
-        # depends on libpq.so will also have libLLVM.so in its closure too, bloating it
-        moveToOutput "lib/bitcode" "$out"
-        moveToOutput "lib/llvmjit*" "$out"
-
-        # In the case of JIT support, prevent a retained dependency on clang-wrapper
-        substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/clang clang
-        nuke-refs $out/lib/llvmjit_types.bc $(find $out/lib/bitcode -type f)
-
-        # Stop out depending on the default output of llvm
-        substituteInPlace $out/lib/pgxs/src/Makefile.global \
-          --replace ${llvmPackages.llvm.out}/bin "" \
-          --replace '$(LLVM_BINPATH)/' ""
-
-        # Stop out depending on the -dev output of llvm
-        substituteInPlace $out/lib/pgxs/src/Makefile.global \
-          --replace ${llvmPackages.llvm.dev}/bin/llvm-config llvm-config \
-          --replace -I${llvmPackages.llvm.dev}/include ""
-
-        ${lib.optionalString (!stdenv'.isDarwin) ''
-          # Stop lib depending on the -dev output of llvm
-          rpath=$(patchelf --print-rpath $out/lib/llvmjit.so)
-          nuke-refs -e $out $out/lib/llvmjit.so
-          # Restore the correct rpath
-          patchelf $out/lib/llvmjit.so --set-rpath "$rpath"
-        ''}
-      '';
-
-    postFixup = lib.optionalString (!stdenv'.isDarwin && stdenv'.hostPlatform.libc == "glibc")
-      ''
+      setOutputFlags = false; # $out retains configureFlags :-/
+
+      buildInputs =
+        [
+          zlib
+          readline
+          openssl
+          (libxml2.override { python = python3; })
+          icu
+        ]
+        ++ lib.optionals (olderThan "13") [ libxcrypt ]
+        ++ lib.optionals jitSupport [ llvmPackages.llvm ]
+        ++ lib.optionals lz4Enabled [ lz4 ]
+        ++ lib.optionals zstdEnabled [ zstd ]
+        ++ lib.optionals systemdSupport' [ systemd ]
+        ++ lib.optionals pythonSupport [ python3 ]
+        ++ lib.optionals gssSupport [ libkrb5 ]
+        ++ lib.optionals stdenv'.isLinux [ linux-pam ]
+        ++ lib.optionals (!stdenv'.isDarwin) [ libossp_uuid ]
+        ++
+          lib.optionals
+            ((builtins.match "[0-9][0-9]_.*" version != null) || (lib.versionAtLeast version "17"))
+            [
+              perl
+              bison
+              flex
+              docbook_xsl
+              docbook_xml_dtd_45
+              docbook_xsl_ns
+              libxslt
+            ];
+
+      nativeBuildInputs =
+        [
+          makeWrapper
+          pkg-config
+        ]
+        ++ lib.optionals jitSupport [
+          llvmPackages.llvm.dev
+          nukeReferences
+          patchelf
+        ];
+
+      enableParallelBuilding = true;
+
+      separateDebugInfo = true;
+
+      buildFlags = [ "world-bin" ];
+
+      # Makes cross-compiling work when xml2-config can't be executed on the host.
+      # Fixed upstream in https://github.com/postgres/postgres/commit/0bc8cebdb889368abdf224aeac8bc197fe4c9ae6
+      env.NIX_CFLAGS_COMPILE = lib.optionalString (olderThan "13") "-I${libxml2.dev}/include/libxml2";
+
+      configureFlags =
+        [
+          "--with-openssl"
+          "--with-libxml"
+          "--with-icu"
+          "--sysconfdir=/etc"
+          "--libdir=$(lib)/lib"
+          "--with-system-tzdata=${tzdata}/share/zoneinfo"
+          "--enable-debug"
+          (lib.optionalString systemdSupport' "--with-systemd")
+          (if stdenv'.isDarwin then "--with-uuid=e2fs" else "--with-ossp-uuid")
+        ]
+        ++ lib.optionals lz4Enabled [ "--with-lz4" ]
+        ++ lib.optionals zstdEnabled [ "--with-zstd" ]
+        ++ lib.optionals gssSupport [ "--with-gssapi" ]
+        ++ lib.optionals pythonSupport [ "--with-python" ]
+        ++ lib.optionals jitSupport [ "--with-llvm" ]
+        ++ lib.optionals stdenv'.isLinux [ "--with-pam" ];
+
+      patches =
+        [
+          (
+            if atLeast "16" then
+              ./patches/relative-to-symlinks-16+.patch
+            else
+              ./patches/relative-to-symlinks.patch
+          )
+          ./patches/less-is-more.patch
+          ./patches/paths-for-split-outputs.patch
+          ./patches/specify_pkglibdir_at_runtime.patch
+          ./patches/paths-with-postgresql-suffix.patch
+
+          (substituteAll {
+            src = ./patches/locale-binary-path.patch;
+            locale = "${if stdenv.isDarwin then darwin.adv_cmds else lib.getBin stdenv.cc.libc}/bin/locale";
+          })
+        ]
+        ++ lib.optionals stdenv'.hostPlatform.isMusl (
+          # Using fetchurl instead of fetchpatch on purpose: https://github.com/NixOS/nixpkgs/issues/240141
+          map fetchurl (lib.attrValues muslPatches)
+        )
+        ++ lib.optionals stdenv'.isLinux [
+          (if atLeast "13" then ./patches/socketdir-in-run-13+.patch else ./patches/socketdir-in-run.patch)
+        ];
+
+      installTargets = [ "install-world-bin" ];
+
+      postPatch =
+        ''
+          # Hardcode the path to pgxs so pg_config returns the path in $out
+          substituteInPlace "src/common/config_info.c" --subst-var out
+        ''
+        + lib.optionalString jitSupport ''
+          # Force lookup of jit stuff in $out instead of $lib
+          substituteInPlace src/backend/jit/jit.c --replace pkglib_path \"$out/lib\"
+          substituteInPlace src/backend/jit/llvm/llvmjit.c --replace pkglib_path \"$out/lib\"
+          substituteInPlace src/backend/jit/llvm/llvmjit_inline.cpp --replace pkglib_path \"$out/lib\"
+        '';
+
+      postInstall =
+        ''
+          moveToOutput "lib/pgxs" "$out" # looks strange, but not deleting it
+          moveToOutput "lib/libpgcommon*.a" "$out"
+          moveToOutput "lib/libpgport*.a" "$out"
+          moveToOutput "lib/libecpg*" "$out"
+
+          # Prevent a retained dependency on gcc-wrapper.
+          substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/ld ld
+
+          if [ -z "''${dontDisableStatic:-}" ]; then
+            # Remove static libraries in case dynamic are available.
+            for i in $out/lib/*.a $lib/lib/*.a; do
+              name="$(basename "$i")"
+              ext="${stdenv'.hostPlatform.extensions.sharedLibrary}"
+              if [ -e "$lib/lib/''${name%.a}$ext" ] || [ -e "''${i%.a}$ext" ]; then
+                rm "$i"
+              fi
+            done
+          fi
+        ''
+        + lib.optionalString jitSupport ''
+          # Move the bitcode and libllvmjit.so library out of $lib; otherwise, every client that
+          # depends on libpq.so will also have libLLVM.so in its closure too, bloating it
+          moveToOutput "lib/bitcode" "$out"
+          moveToOutput "lib/llvmjit*" "$out"
+
+          # In the case of JIT support, prevent a retained dependency on clang-wrapper
+          substituteInPlace "$out/lib/pgxs/src/Makefile.global" --replace ${stdenv'.cc}/bin/clang clang
+          nuke-refs $out/lib/llvmjit_types.bc $(find $out/lib/bitcode -type f)
+
+          # Stop out depending on the default output of llvm
+          substituteInPlace $out/lib/pgxs/src/Makefile.global \
+            --replace ${llvmPackages.llvm.out}/bin "" \
+            --replace '$(LLVM_BINPATH)/' ""
+
+          # Stop out depending on the -dev output of llvm
+          substituteInPlace $out/lib/pgxs/src/Makefile.global \
+            --replace ${llvmPackages.llvm.dev}/bin/llvm-config llvm-config \
+            --replace -I${llvmPackages.llvm.dev}/include ""
+
+          ${lib.optionalString (!stdenv'.isDarwin) ''
+            # Stop lib depending on the -dev output of llvm
+            rpath=$(patchelf --print-rpath $out/lib/llvmjit.so)
+            nuke-refs -e $out $out/lib/llvmjit.so
+            # Restore the correct rpath
+            patchelf $out/lib/llvmjit.so --set-rpath "$rpath"
+          ''}
+        '';
+
+      postFixup = lib.optionalString (!stdenv'.isDarwin && stdenv'.hostPlatform.libc == "glibc") ''
         # initdb needs access to "locale" command from glibc.
         wrapProgram $out/bin/initdb --prefix PATH ":" ${glibc.bin}/bin
       '';
 
-    doCheck = !stdenv'.isDarwin;
-    # autodetection doesn't seem to able to find this, but it's there.
-    checkTarget = "check";
-
-    disallowedReferences = [ stdenv'.cc ];
-
-    passthru = let
-      this = self.callPackage generic args;
-      jitToggle = this.override {
-        jitSupport = !jitSupport;
-      };
-    in
-    {
-      psqlSchema = lib.versions.major version;
-
-      withJIT = if jitSupport then this else jitToggle;
-      withoutJIT = if jitSupport then jitToggle else this;
-
-      dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
-
-      pkgs = let
-        scope = {
-          inherit jitSupport;
-          inherit (llvmPackages) llvm;
-          postgresql = this;
-          stdenv = stdenv';
+      doCheck = !stdenv'.isDarwin;
+      # autodetection doesn't seem to able to find this, but it's there.
+      checkTarget = "check";
+
+      disallowedReferences = [ stdenv'.cc ];
+
+      passthru =
+        let
+          this = self.callPackage generic args;
+          jitToggle = this.override { jitSupport = !jitSupport; };
+        in
+        {
+          psqlSchema = lib.versions.major version;
+
+          withJIT = if jitSupport then this else jitToggle;
+          withoutJIT = if jitSupport then jitToggle else this;
+
+          dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
+
+          pkgs =
+            let
+              scope = {
+                inherit jitSupport;
+                inherit (llvmPackages) llvm;
+                postgresql = this;
+                stdenv = stdenv';
+              };
+              newSelf = self // scope;
+              newSuper = {
+                callPackage = newScope (scope // this.pkgs);
+              };
+            in
+            import ./ext newSelf newSuper;
+
+          withPackages = postgresqlWithPackages {
+            inherit makeWrapper buildEnv;
+            postgresql = this;
+          } this.pkgs;
+
+          tests =
+            {
+              postgresql-wal-receiver = import ../../../../nixos/tests/postgresql-wal-receiver.nix {
+                inherit (stdenv) system;
+                pkgs = self;
+                package = this;
+              };
+              pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+            }
+            // lib.optionalAttrs jitSupport {
+              postgresql-jit = import ../../../../nixos/tests/postgresql-jit.nix {
+                inherit (stdenv) system;
+                pkgs = self;
+                package = this;
+              };
+            };
         };
-        newSelf = self // scope;
-        newSuper = { callPackage = newScope (scope // this.pkgs); };
-      in import ./ext newSelf newSuper;
-
-      withPackages = postgresqlWithPackages {
-                       inherit makeWrapper buildEnv;
-                       postgresql = this;
-                     }
-                     this.pkgs;
-
-      tests = {
-        postgresql-wal-receiver = import ../../../../nixos/tests/postgresql-wal-receiver.nix {
-          inherit (stdenv) system;
-          pkgs = self;
-          package = this;
-        };
-        pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      } // lib.optionalAttrs jitSupport {
-        postgresql-jit = import ../../../../nixos/tests/postgresql-jit.nix {
-          inherit (stdenv) system;
-          pkgs = self;
-          package = this;
-        };
-      };
-    };
 
-    meta = with lib; {
-      homepage    = "https://www.postgresql.org";
-      description = "Powerful, open source object-relational database system";
-      license     = licenses.postgresql;
-      changelog   = "https://www.postgresql.org/docs/release/${finalAttrs.version}/";
-      maintainers = with maintainers; [ thoughtpolice danbst globin ivan ma27 wolfgangwalther ];
-      pkgConfigModules = [ "libecpg" "libecpg_compat" "libpgtypes" "libpq" ];
-      platforms   = platforms.unix;
-
-      # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
-      # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
-      # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
-      # host-platform.
-      #
-      # I managed to get a cross-build with JIT support working with
-      # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
-      # resulting LLVM IR isn't platform-independent this doesn't give you much.
-      # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
-      # a query, postgres would coredump with `Illegal instruction`.
-      broken = (jitSupport && stdenv.hostPlatform != stdenv.buildPlatform)
-        # Allmost all tests fail FATAL errors for v12 and v13
-        || (jitSupport && stdenv.hostPlatform.isMusl && olderThan "14");
-    };
-  });
+      meta = with lib; {
+        homepage = "https://www.postgresql.org";
+        description = "Powerful, open source object-relational database system";
+        license = licenses.postgresql;
+        changelog = "https://www.postgresql.org/docs/release/${finalAttrs.version}/";
+        maintainers = with maintainers; [
+          thoughtpolice
+          danbst
+          globin
+          ivan
+          ma27
+          wolfgangwalther
+        ];
+        pkgConfigModules = [
+          "libecpg"
+          "libecpg_compat"
+          "libpgtypes"
+          "libpq"
+        ];
+        platforms = platforms.unix;
+
+        # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
+        # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
+        # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
+        # host-platform.
+        #
+        # I managed to get a cross-build with JIT support working with
+        # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
+        # resulting LLVM IR isn't platform-independent this doesn't give you much.
+        # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
+        # a query, postgres would coredump with `Illegal instruction`.
+        broken =
+          (jitSupport && stdenv.hostPlatform != stdenv.buildPlatform)
+          # Allmost all tests fail FATAL errors for v12 and v13
+          || (jitSupport && stdenv.hostPlatform.isMusl && olderThan "14");
+      };
+    });
 
-  postgresqlWithPackages = { postgresql, makeWrapper, buildEnv }: pkgs: f: buildEnv {
-    name = "postgresql-and-plugins-${postgresql.version}";
-    paths = f pkgs ++ [
+  postgresqlWithPackages =
+    {
+      postgresql,
+      makeWrapper,
+      buildEnv,
+    }:
+    pkgs: f:
+    buildEnv {
+      name = "postgresql-and-plugins-${postgresql.version}";
+      paths = f pkgs ++ [
         postgresql
         postgresql.lib
         #TODO RM postgresql.man   # in case user installs this into environment
-    ];
-    nativeBuildInputs = [ makeWrapper ];
-
-
-    # We include /bin to ensure the $out/bin directory is created, which is
-    # needed because we'll be removing the files from that directory in postBuild
-    # below. See #22653
-    pathsToLink = ["/" "/bin"];
-
-    # Note: the duplication of executables is about 4MB size.
-    # So a nicer solution was patching postgresql to allow setting the
-    # libdir explicitly.
-    postBuild = ''
-      mkdir -p $out/bin
-      rm $out/bin/{pg_config,postgres,pg_ctl}
-      cp --target-directory=$out/bin ${postgresql}/bin/{postgres,pg_config,pg_ctl}
-      wrapProgram $out/bin/postgres --set NIX_PGLIBDIR $out/lib
-    '';
+      ];
+      nativeBuildInputs = [ makeWrapper ];
+
+      # We include /bin to ensure the $out/bin directory is created, which is
+      # needed because we'll be removing the files from that directory in postBuild
+      # below. See #22653
+      pathsToLink = [
+        "/"
+        "/bin"
+      ];
 
-    passthru.version = postgresql.version;
-    passthru.psqlSchema = postgresql.psqlSchema;
-  };
+      # Note: the duplication of executables is about 4MB size.
+      # So a nicer solution was patching postgresql to allow setting the
+      # libdir explicitly.
+      postBuild = ''
+        mkdir -p $out/bin
+        rm $out/bin/{pg_config,postgres,pg_ctl}
+        cp --target-directory=$out/bin ${postgresql}/bin/{postgres,pg_config,pg_ctl}
+        wrapProgram $out/bin/postgres --set NIX_PGLIBDIR $out/lib
+      '';
 
+      passthru.version = postgresql.version;
+      passthru.psqlSchema = postgresql.psqlSchema;
+    };
 in
+generic
 # passed by <major>.nix
-versionArgs:
-# passed by default.nix
-{ self, ... } @defaultArgs:
-self.callPackage generic (defaultArgs // versionArgs)
+# versionArgs:
+# # passed by default.nix
+# { self, ... } @defaultArgs:
+# self.callPackage generic (defaultArgs // versionArgs)
diff --git a/nix/postgresql/orioledb-17.nix b/nix/postgresql/orioledb-17.nix
deleted file mode 100644
index b8e5bc374..000000000
--- a/nix/postgresql/orioledb-17.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "17_6";
-  hash = "sha256-HbuTcXNanFOl9YfvlSzQJon8CfAhc8TFwo/y7jXy51w=";
-}
diff --git a/nix/postgresql/src.nix b/nix/postgresql/src.nix
new file mode 100644
index 000000000..65ba8b1cb
--- /dev/null
+++ b/nix/postgresql/src.nix
@@ -0,0 +1,31 @@
+{
+  stdenv,
+  postgresql,
+  lib,
+  bzip2,
+}:
+stdenv.mkDerivation {
+  pname = "postgresql-${postgresql.version}-src";
+  version = postgresql.version;
+
+  src = postgresql.src;
+
+  nativeBuildInputs = [ bzip2 ];
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r . $out
+  '';
+
+  meta = with lib; {
+    description = "PostgreSQL 15 source files";
+    homepage = "https://www.postgresql.org/";
+    license = licenses.postgresql;
+    inherit (platforms) all;
+  };
+}

From 990483154743590fc95658ff140d4c950aff8bab Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Thu, 3 Jul 2025 10:46:25 -0400
Subject: [PATCH 20/64] docs: update current versions in readme (#1690)

---
 README.md | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index d7b106cf8..edf245bc0 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 ## Primary Features
 - ✅ Postgres [postgresql-15.8](https://www.postgresql.org/docs/15/index.html)
 - ✅ Postgres [postgresql-17.4](https://www.postgresql.org/docs/17/index.html)
-- ✅ Postgres [orioledb-postgresql-17_5](https://github.com/orioledb/orioledb)
+- ✅ Postgres [orioledb-postgresql-17_6](https://github.com/orioledb/orioledb)
 - ✅ Ubuntu 20.04 (Focal Fossa).
 - ✅ [wal_level](https://www.postgresql.org/docs/current/runtime-config-wal.html) = logical and [max_replication_slots](https://www.postgresql.org/docs/current/runtime-config-replication.html) = 5. Ready for replication.
 - ✅ [Large Systems Extensions](https://github.com/aws/aws-graviton-getting-started#building-for-graviton-and-graviton2). Enabled for ARM images.
@@ -39,10 +39,10 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | [plv8](https://github.com/plv8/plv8/archive/v3.1.10.tar.gz) | [3.1.10](https://github.com/plv8/plv8/archive/v3.1.10.tar.gz) | V8 Engine Javascript Procedural Language add-on for PostgreSQL |
 | [postgis](https://download.osgeo.org/postgis/source/postgis-3.3.7.tar.gz) | [3.3.7](https://download.osgeo.org/postgis/source/postgis-3.3.7.tar.gz) | Geographic Objects for PostgreSQL |
 | [rum](https://github.com/postgrespro/rum/archive/1.3.14.tar.gz) | [1.3.14](https://github.com/postgrespro/rum/archive/1.3.14.tar.gz) | Full text search index method for PostgreSQL |
-| [supabase-wrappers](https://github.com/supabase/wrappers/archive/v0.4.5.tar.gz) | [0.4.5](https://github.com/supabase/wrappers/archive/v0.4.5.tar.gz) | Various Foreign Data Wrappers (FDWs) for PostreSQL |
-| [supautils](https://github.com/supabase/supautils/archive/refs/tags/v2.6.0.tar.gz) | [2.6.0](https://github.com/supabase/supautils/archive/refs/tags/v2.6.0.tar.gz) | PostgreSQL extension for enhanced security |
+| [supabase-wrappers](https://github.com/supabase/wrappers/archive/v0.5.0.tar.gz) | [0.5.0](https://github.com/supabase/wrappers/archive/v0.5.0.tar.gz) | Various Foreign Data Wrappers (FDWs) for PostreSQL |
+| [supautils](https://github.com/supabase/supautils/archive/refs/tags/v2.9.4.tar.gz) | [2.9.4](https://github.com/supabase/supautils/archive/refs/tags/v2.9.4.tar.gz) | PostgreSQL extension for enhanced security |
 | [timescaledb-apache](https://github.com/timescale/timescaledb/archive/2.16.1.tar.gz) | [2.16.1](https://github.com/timescale/timescaledb/archive/2.16.1.tar.gz) | Scales PostgreSQL for time-series data via automatic partitioning across time and space |
-| [vault](https://github.com/supabase/vault/archive/refs/tags/v0.2.9.tar.gz) | [0.2.9](https://github.com/supabase/vault/archive/refs/tags/v0.2.9.tar.gz) | Store encrypted secrets in PostgreSQL |
+| [vault](https://github.com/supabase/vault/archive/refs/tags/v0.3.1.tar.gz) | [0.3.1](https://github.com/supabase/vault/archive/refs/tags/v0.3.1.tar.gz) | Store encrypted secrets in PostgreSQL |
 | [wal2json](https://github.com/eulerto/wal2json/archive/wal2json_2_6.tar.gz) | [2_6](https://github.com/eulerto/wal2json/archive/wal2json_2_6.tar.gz) | PostgreSQL JSON output plugin for changeset extraction |
 
 ### PostgreSQL 17 Extensions
@@ -51,7 +51,6 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | [hypopg](https://github.com/HypoPG/hypopg/archive/refs/tags/1.4.1.tar.gz) | [1.4.1](https://github.com/HypoPG/hypopg/archive/refs/tags/1.4.1.tar.gz) | Hypothetical Indexes for PostgreSQL |
 | [index_advisor](https://github.com/olirice/index_advisor/archive/v0.2.0.tar.gz) | [0.2.0](https://github.com/olirice/index_advisor/archive/v0.2.0.tar.gz) | Recommend indexes to improve query performance in PostgreSQL |
 | [pg-safeupdate](https://github.com/eradman/pg-safeupdate/archive/1.4.tar.gz) | [1.4](https://github.com/eradman/pg-safeupdate/archive/1.4.tar.gz) | A simple extension to PostgreSQL that requires criteria for UPDATE and DELETE |
-| [pg_backtrace](https://github.com/pashkinelfe/pg_backtrace/archive/d100bac815a7365e199263f5b3741baf71b14c70.tar.gz) | [1.1](https://github.com/pashkinelfe/pg_backtrace/archive/d100bac815a7365e199263f5b3741baf71b14c70.tar.gz) | Updated fork of pg_backtrace |
 | [pg_cron](https://github.com/citusdata/pg_cron/archive/v1.6.4.tar.gz) | [1.6.4](https://github.com/citusdata/pg_cron/archive/v1.6.4.tar.gz) | Run Cron jobs through PostgreSQL |
 | [pg_graphql](https://github.com/supabase/pg_graphql/archive/v1.5.11.tar.gz) | [1.5.11](https://github.com/supabase/pg_graphql/archive/v1.5.11.tar.gz) | GraphQL support for PostreSQL |
 | [pg_hashids](https://github.com/iCyberon/pg_hashids/archive/cd0e1b31d52b394a0df64079406a14a4f7387cd6.tar.gz) | [cd0e1b31d52b394a0df64079406a14a4f7387cd6](https://github.com/iCyberon/pg_hashids/archive/cd0e1b31d52b394a0df64079406a14a4f7387cd6.tar.gz) | Generate short unique IDs in PostgreSQL |
@@ -62,6 +61,7 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | [pg_stat_monitor](https://github.com/percona/pg_stat_monitor/archive/refs/tags/2.1.0.tar.gz) | [2.1.0](https://github.com/percona/pg_stat_monitor/archive/refs/tags/2.1.0.tar.gz) | Query Performance Monitoring Tool for PostgreSQL |
 | [pg_tle](https://github.com/aws/pg_tle/archive/refs/tags/v1.4.0.tar.gz) | [1.4.0](https://github.com/aws/pg_tle/archive/refs/tags/v1.4.0.tar.gz) | Framework for 'Trusted Language Extensions' in PostgreSQL |
 | [pgaudit](https://github.com/pgaudit/pgaudit/archive/17.0.tar.gz) | [17.0](https://github.com/pgaudit/pgaudit/archive/17.0.tar.gz) | Open Source PostgreSQL Audit Logging |
+| [pgjwt](https://github.com/michelp/pgjwt/archive/9742dab1b2f297ad3811120db7b21451bca2d3c9.tar.gz) | [9742dab1b2f297ad3811120db7b21451bca2d3c9](https://github.com/michelp/pgjwt/archive/9742dab1b2f297ad3811120db7b21451bca2d3c9.tar.gz) | PostgreSQL implementation of JSON Web Tokens |
 | [pgmq](https://github.com/tembo-io/pgmq/archive/v1.4.4.tar.gz) | [1.4.4](https://github.com/tembo-io/pgmq/archive/v1.4.4.tar.gz) | A lightweight message queue. Like AWS SQS and RSMQ but on Postgres. |
 | [pgroonga](https://packages.groonga.org/source/pgroonga/pgroonga-3.2.5.tar.gz) | [3.2.5](https://packages.groonga.org/source/pgroonga/pgroonga-3.2.5.tar.gz) | A PostgreSQL extension to use Groonga as the index |
 | [pgrouting](https://github.com/pgRouting/pgrouting/archive/v3.4.1.tar.gz) | [3.4.1](https://github.com/pgRouting/pgrouting/archive/v3.4.1.tar.gz) | A PostgreSQL/PostGIS extension that provides geospatial routing functionality |
@@ -72,9 +72,9 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | [plpgsql-check](https://github.com/okbob/plpgsql_check/archive/v2.7.11.tar.gz) | [2.7.11](https://github.com/okbob/plpgsql_check/archive/v2.7.11.tar.gz) | Linter tool for language PL/pgSQL |
 | [postgis](https://download.osgeo.org/postgis/source/postgis-3.3.7.tar.gz) | [3.3.7](https://download.osgeo.org/postgis/source/postgis-3.3.7.tar.gz) | Geographic Objects for PostgreSQL |
 | [rum](https://github.com/postgrespro/rum/archive/1.3.14.tar.gz) | [1.3.14](https://github.com/postgrespro/rum/archive/1.3.14.tar.gz) | Full text search index method for PostgreSQL |
-| [supabase-wrappers](https://github.com/supabase/wrappers/archive/v0.4.4.tar.gz) | [0.4.4](https://github.com/supabase/wrappers/archive/v0.4.4.tar.gz) | Various Foreign Data Wrappers (FDWs) for PostreSQL |
-| [supautils](https://github.com/supabase/supautils/archive/refs/tags/v2.6.0.tar.gz) | [2.6.0](https://github.com/supabase/supautils/archive/refs/tags/v2.6.0.tar.gz) | PostgreSQL extension for enhanced security |
-| [vault](https://github.com/supabase/vault/archive/refs/tags/v0.2.9.tar.gz) | [0.2.9](https://github.com/supabase/vault/archive/refs/tags/v0.2.9.tar.gz) | Store encrypted secrets in PostgreSQL |
+| [supabase-wrappers](https://github.com/supabase/wrappers/archive/v0.5.0.tar.gz) | [0.5.0](https://github.com/supabase/wrappers/archive/v0.5.0.tar.gz) | Various Foreign Data Wrappers (FDWs) for PostreSQL |
+| [supautils](https://github.com/supabase/supautils/archive/refs/tags/v2.9.4.tar.gz) | [2.9.4](https://github.com/supabase/supautils/archive/refs/tags/v2.9.4.tar.gz) | PostgreSQL extension for enhanced security |
+| [vault](https://github.com/supabase/vault/archive/refs/tags/v0.3.1.tar.gz) | [0.3.1](https://github.com/supabase/vault/archive/refs/tags/v0.3.1.tar.gz) | Store encrypted secrets in PostgreSQL |
 | [wal2json](https://github.com/eulerto/wal2json/archive/wal2json_2_6.tar.gz) | [2_6](https://github.com/eulerto/wal2json/archive/wal2json_2_6.tar.gz) | PostgreSQL JSON output plugin for changeset extraction |
 
 ### PostgreSQL orioledb-17 Extensions
@@ -82,7 +82,7 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | ------------- | :-------------: | ------------- |
 | [hypopg](https://github.com/HypoPG/hypopg/archive/refs/tags/1.4.1.tar.gz) | [1.4.1](https://github.com/HypoPG/hypopg/archive/refs/tags/1.4.1.tar.gz) | Hypothetical Indexes for PostgreSQL |
 | [index_advisor](https://github.com/olirice/index_advisor/archive/v0.2.0.tar.gz) | [0.2.0](https://github.com/olirice/index_advisor/archive/v0.2.0.tar.gz) | Recommend indexes to improve query performance in PostgreSQL |
-| [orioledb](https://github.com/orioledb/orioledb/archive/beta9.tar.gz) | [orioledb](https://github.com/orioledb/orioledb/archive/beta9.tar.gz) | orioledb |
+| [orioledb](https://github.com/orioledb/orioledb/archive/beta10.tar.gz) | [orioledb](https://github.com/orioledb/orioledb/archive/beta10.tar.gz) | orioledb |
 | [pg-safeupdate](https://github.com/eradman/pg-safeupdate/archive/1.4.tar.gz) | [1.4](https://github.com/eradman/pg-safeupdate/archive/1.4.tar.gz) | A simple extension to PostgreSQL that requires criteria for UPDATE and DELETE |
 | [pg_cron](https://github.com/citusdata/pg_cron/archive/v1.6.4.tar.gz) | [1.6.4](https://github.com/citusdata/pg_cron/archive/v1.6.4.tar.gz) | Run Cron jobs through PostgreSQL |
 | [pg_graphql](https://github.com/supabase/pg_graphql/archive/v1.5.11.tar.gz) | [1.5.11](https://github.com/supabase/pg_graphql/archive/v1.5.11.tar.gz) | GraphQL support for PostreSQL |
@@ -94,6 +94,7 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | [pg_stat_monitor](https://github.com/percona/pg_stat_monitor/archive/refs/tags/2.1.0.tar.gz) | [2.1.0](https://github.com/percona/pg_stat_monitor/archive/refs/tags/2.1.0.tar.gz) | Query Performance Monitoring Tool for PostgreSQL |
 | [pg_tle](https://github.com/aws/pg_tle/archive/refs/tags/v1.4.0.tar.gz) | [1.4.0](https://github.com/aws/pg_tle/archive/refs/tags/v1.4.0.tar.gz) | Framework for 'Trusted Language Extensions' in PostgreSQL |
 | [pgaudit](https://github.com/pgaudit/pgaudit/archive/17.0.tar.gz) | [17.0](https://github.com/pgaudit/pgaudit/archive/17.0.tar.gz) | Open Source PostgreSQL Audit Logging |
+| [pgjwt](https://github.com/michelp/pgjwt/archive/9742dab1b2f297ad3811120db7b21451bca2d3c9.tar.gz) | [9742dab1b2f297ad3811120db7b21451bca2d3c9](https://github.com/michelp/pgjwt/archive/9742dab1b2f297ad3811120db7b21451bca2d3c9.tar.gz) | PostgreSQL implementation of JSON Web Tokens |
 | [pgmq](https://github.com/tembo-io/pgmq/archive/v1.4.4.tar.gz) | [1.4.4](https://github.com/tembo-io/pgmq/archive/v1.4.4.tar.gz) | A lightweight message queue. Like AWS SQS and RSMQ but on Postgres. |
 | [pgroonga](https://packages.groonga.org/source/pgroonga/pgroonga-3.2.5.tar.gz) | [3.2.5](https://packages.groonga.org/source/pgroonga/pgroonga-3.2.5.tar.gz) | A PostgreSQL extension to use Groonga as the index |
 | [pgrouting](https://github.com/pgRouting/pgrouting/archive/v3.4.1.tar.gz) | [3.4.1](https://github.com/pgRouting/pgrouting/archive/v3.4.1.tar.gz) | A PostgreSQL/PostGIS extension that provides geospatial routing functionality |
@@ -104,9 +105,9 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | [plpgsql-check](https://github.com/okbob/plpgsql_check/archive/v2.7.11.tar.gz) | [2.7.11](https://github.com/okbob/plpgsql_check/archive/v2.7.11.tar.gz) | Linter tool for language PL/pgSQL |
 | [postgis](https://download.osgeo.org/postgis/source/postgis-3.3.7.tar.gz) | [3.3.7](https://download.osgeo.org/postgis/source/postgis-3.3.7.tar.gz) | Geographic Objects for PostgreSQL |
 | [rum](https://github.com/postgrespro/rum/archive/1.3.14.tar.gz) | [1.3.14](https://github.com/postgrespro/rum/archive/1.3.14.tar.gz) | Full text search index method for PostgreSQL |
-| [supabase-wrappers](https://github.com/supabase/wrappers/archive/v0.4.5.tar.gz) | [0.4.5](https://github.com/supabase/wrappers/archive/v0.4.5.tar.gz) | Various Foreign Data Wrappers (FDWs) for PostreSQL |
-| [supautils](https://github.com/supabase/supautils/archive/refs/tags/v2.6.0.tar.gz) | [2.6.0](https://github.com/supabase/supautils/archive/refs/tags/v2.6.0.tar.gz) | PostgreSQL extension for enhanced security |
-| [vault](https://github.com/supabase/vault/archive/refs/tags/v0.2.9.tar.gz) | [0.2.9](https://github.com/supabase/vault/archive/refs/tags/v0.2.9.tar.gz) | Store encrypted secrets in PostgreSQL |
+| [supabase-wrappers](https://github.com/supabase/wrappers/archive/v0.5.0.tar.gz) | [0.5.0](https://github.com/supabase/wrappers/archive/v0.5.0.tar.gz) | Various Foreign Data Wrappers (FDWs) for PostreSQL |
+| [supautils](https://github.com/supabase/supautils/archive/refs/tags/v2.9.4.tar.gz) | [2.9.4](https://github.com/supabase/supautils/archive/refs/tags/v2.9.4.tar.gz) | PostgreSQL extension for enhanced security |
+| [vault](https://github.com/supabase/vault/archive/refs/tags/v0.3.1.tar.gz) | [0.3.1](https://github.com/supabase/vault/archive/refs/tags/v0.3.1.tar.gz) | Store encrypted secrets in PostgreSQL |
 | [wal2json](https://github.com/eulerto/wal2json/archive/wal2json_2_6.tar.gz) | [2_6](https://github.com/eulerto/wal2json/archive/wal2json_2_6.tar.gz) | PostgreSQL JSON output plugin for changeset extraction |
 ## Additional Goodies
 *This is only available for our AWS EC2*
@@ -158,4 +159,4 @@ TODO: find way to automate this
 
 We are building the features of Firebase using enterprise-grade, open source products. We support existing communities wherever possible, and if the products don’t exist we build them and open source them ourselves.
 
-[![New Sponsor](https://user-images.githubusercontent.com/10214025/90518111-e74bbb00-e198-11ea-8f88-c9e3c1aa4b5b.png)](https://github.com/sponsors/supabase)
+[![New Sponsor](https://user-images.githubusercontent.com/10214025/90518111-e74bbb00-e198-11ea-8f88-c9e3c1aa4b5b.png)](https://github.com/sponsors/supabase)
\ No newline at end of file

From 48f22dd2eef5bee8f029e82bcf653a68a166a1ec Mon Sep 17 00:00:00 2001
From: Oliver Rice <github@oliverrice.com>
Date: Mon, 7 Jul 2025 14:22:30 -0500
Subject: [PATCH 21/64] pgmq don't manipulate sequences (#1471)

The script being deleted was a hacky solution we put in place to resolve a pg_dump segfault due to its interaction with pgmq tables. It currently introduces errors where sequences become owned by supabase_admin and are inaccessible to users after upgrading.
https://supabase.slack.com/archives/C05Q0CVC65B/p1741093731995359


This update mirrors the same code's removal from our on-backup hook here: https://github.com/supabase/infrastructure/pull/21405/files

Co-authored-by: Bobbie Soedirgo <bobbie@soedirgo.dev>
---
 .../pg_upgrade_scripts/complete.sh            | 67 -------------------
 1 file changed, 67 deletions(-)

diff --git a/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh b/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
index 31cc7d09d..e170482e8 100755
--- a/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
+++ b/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
@@ -148,73 +148,6 @@ EOF
     # Patching pgmq ownership as it resets during upgrade
     HAS_PGMQ=$(run_sql -A -t -c "select count(*) > 0 from pg_extension where extname = 'pgmq';")
     if [ "$HAS_PGMQ" = "t" ]; then
-        PATCH_PGMQ_QUERY=$(cat <<EOF
-        do \$\$
-        declare
-            tbl record;
-            seq_name text;
-            new_seq_name text;
-            archive_table_name text;
-        begin
-            -- Loop through each table in the pgmq schema starting with 'q_'
-            -- Rebuild the pkey column's default to avoid pg_dumpall segfaults
-            for tbl in
-                select c.relname as table_name
-                from pg_catalog.pg_attribute a
-                join pg_catalog.pg_class c on c.oid = a.attrelid
-                join pg_catalog.pg_namespace n on n.oid = c.relnamespace
-                where n.nspname = 'pgmq'
-                    and c.relname like 'q_%'
-                    and a.attname = 'msg_id'
-                    and a.attidentity in ('a', 'd') -- 'a' for ALWAYS, 'd' for BY DEFAULT
-            loop
-                -- Check if msg_id is an IDENTITY column for idempotency
-                -- Define sequence names
-                seq_name := 'pgmq.' || format ('"%s_msg_id_seq"', tbl.table_name);
-                new_seq_name := 'pgmq.' || format ('"%s_msg_id_seq2"', tbl.table_name);
-                archive_table_name := regexp_replace(tbl.table_name, '^q_', 'a_');
-                -- Execute dynamic SQL to perform the required operations
-                execute format('
-                    create sequence %s;
-                    select setval(''%s'', nextval(''%s''));
-                    alter table %s."%s" alter column msg_id drop identity;
-                    alter table %s."%s" alter column msg_id set default nextval(''%s'');
-                    alter sequence %s rename to "%s";',
-                    -- Parameters for format placeholders
-                    new_seq_name,
-                    new_seq_name, seq_name,
-                    'pgmq', tbl.table_name,
-                    'pgmq', tbl.table_name,
-                    new_seq_name,
-                    -- alter seq
-                    new_seq_name, 
-                    tbl.table_name || '_msg_id_seq'
-                );
-            end loop;
-            -- No tables should be owned by the extension.
-            -- We want them to be included in logical backups
-            for tbl in
-                select c.relname as table_name
-                from pg_class c
-                join pg_depend d
-                    on c.oid = d.objid
-                join pg_extension e
-                    on d.refobjid = e.oid
-                where 
-                c.relkind in ('r', 'p', 'u')
-                and e.extname = 'pgmq'
-                and (c.relname like 'q_%' or c.relname like 'a_%')
-            loop
-            execute format('
-                alter extension pgmq drop table pgmq."%s";',
-                tbl.table_name
-            );
-            end loop;
-        end \$\$;
-EOF
-        )
-
-        run_sql -c "$PATCH_PGMQ_QUERY"
         run_sql -c "update pg_extension set extowner = 'postgres'::regrole where extname = 'pgmq';"
     fi
 

From 4db4d5b94269398dc167fe96ea43fc4336bff8b5 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Mon, 7 Jul 2025 17:52:40 -0400
Subject: [PATCH 22/64] fix: needed a release to rollout fixes that address
 pgmq issues (#1693)

related to https://github.com/supabase/postgres/pull/1471
---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 1d24249ad..de488b9ec 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.099-orioledb"
-  postgres17: "17.4.1.049"
-  postgres15: "15.8.1.106"
+  postgresorioledb-17: "17.0.1.100-orioledb"
+  postgres17: "17.4.1.050"
+  postgres15: "15.8.1.107"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From b806c071d09a203ac0fac24b09ddcd8957ecd9c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Tue, 8 Jul 2025 03:46:09 +0200
Subject: [PATCH 23/64] feat: multiple versions for the wrappers extension
 (#1663)

* feat(cargo-pgrx): build extensions with specified Rust version

This change allows developers to target specific Rust versions for
building extensions. It implements support for building cargo extensions
and `cargo-pgrx` using the specified Rust version.

* feat: multiple versions for the wrappers extension

Build multiple versions of the wrappers extension on different PostgreSQL versions.

Add test for the extensions and their upgrade on PostgreSQL 15 and 17.

Make sure we build cargo extension and cargo-pgrx with the specified Rust version.

* Fix darwin build by using unix sockets only

Stop using TCP sockets in builds to avoid port conflicts

* Support more versions of wrappers extension

Update rust overlay to build using more recent rust versions.

* Build wrapper 0.3.0 using pgrx 0.11.3

Avoid compilation errors related to bindgen on aarch64-linux

* Build wrapper 0.5.2 using pgrx 0.14.3

* Limit the numbers of versions to build

* tests: update regress tests for new version of wrappers

* Build and cache a single version

Current MacOS builder cannot handle multiple versions

* Do not run parallel builds on MacOS

Current runner doesn't have enough disk space

* feat: update wrappers to 0.5.3

* feat: bugfix on same version

* fix: free up space in the case of macos builder

* fix: also pass in nix.conf max-jobs setting on macos

* Revert "fix: also pass in nix.conf max-jobs setting on macos"

This reverts commit b67f7cef23fa94b1e73762508aafa2feadc78594.

* fix(ci): only build devshell on linux

aarch64 darwin has issues building all the postgresql with their
extensions in parallel. `devShell` depends on `start-server` which depends
on the `makePostgresDevSetup`which depends on all databases.

* fix(ci): build each postgresql version separately

The `makeCheckHarness` function depends on all postgresql versions.

* chore: fix formatting

* chore: bump versions to release

---------

Co-authored-by: Sam Rose <samuel@supabase.io>
---
 .github/workflows/nix-build.yml               |   28 +-
 ansible/vars.yml                              |    6 +-
 flake.lock                                    |    6 +-
 nix/cargo-pgrx/buildPgrxExtension.nix         |   16 +-
 nix/cargo-pgrx/default.nix                    |   14 +-
 nix/cargo-pgrx/mkPgrxExtension.nix            |   38 +
 nix/cargo-pgrx/versions.json                  |   61 +
 nix/checks.nix                                |   15 +-
 nix/ext/tests/wrappers.nix                    |  157 +
 nix/ext/versions.json                         |   14 +
 .../wrappers/0001-bump-pgrx-to-0.11.3.patch   |  164 +
 nix/ext/wrappers/Cargo.lock-0.3.0             | 5191 +++++++++++++++++
 nix/ext/wrappers/default.nix                  |  381 +-
 nix/tests/expected/z_15_ext_interface.out     |   10 +-
 nix/tests/expected/z_17_ext_interface.out     |   10 +-
 .../expected/z_orioledb-17_ext_interface.out  |   10 +-
 16 files changed, 5904 insertions(+), 217 deletions(-)
 create mode 100644 nix/cargo-pgrx/mkPgrxExtension.nix
 create mode 100644 nix/cargo-pgrx/versions.json
 create mode 100644 nix/ext/tests/wrappers.nix
 create mode 100644 nix/ext/versions.json
 create mode 100644 nix/ext/wrappers/0001-bump-pgrx-to-0.11.3.patch
 create mode 100644 nix/ext/wrappers/Cargo.lock-0.3.0

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 36dc01d05..75f4ae20c 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -57,7 +57,7 @@ jobs:
         run: |
           cat << 'EOF' | sudo tee /etc/nix/upload-to-cache.sh > /dev/null
           #!/usr/bin/env bash
-          set -eouf
+          set -euf
           export IFS=' '
           /nix/var/nix/profiles/default/bin/nix copy --to 's3://nix-postgres-artifacts?secret-key=/etc/nix/nix-secret-key' $OUT_PATHS
           EOF
@@ -77,10 +77,34 @@ jobs:
           extra-conf: |
             substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
             trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+      - name: Aggressive disk cleanup for DuckDB build
+        if: matrix.runner == 'macos-latest-xlarge'
+        run: |
+          echo "=== BEFORE CLEANUP ==="
+          df -h
+          # Remove major space consumers
+          sudo rm -rf /usr/share/dotnet || true
+          sudo rm -rf /usr/local/lib/android || true
+          sudo rm -rf /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform || true
+          sudo rm -rf /Applications/Xcode.app/Contents/Developer/Platforms/watchOS.platform || true
+          sudo rm -rf /Applications/Xcode.app/Contents/Developer/Platforms/tvOS.platform || true
+          # Clean everything possible
+          sudo rm -rf /opt/ghc || true
+          sudo rm -rf /usr/local/share/boost || true
+          sudo rm -rf /opt/homebrew || true
+          sudo xcrun simctl delete all 2>/dev/null || true
+          # Aggressive cache cleanup
+          sudo rm -rf /System/Library/Caches/* 2>/dev/null || true
+          sudo rm -rf /Library/Caches/* 2>/dev/null || true
+          sudo rm -rf ~/Library/Caches/* 2>/dev/null || true
+          sudo rm -rf /private/var/log/* 2>/dev/null || true
+          sudo rm -rf /tmp/* 2>/dev/null || true
+          echo "=== AFTER CLEANUP ==="
+          df -h
       - name: Build psql bundle
         run: >
           nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48" 
-          -- --skip-cached --no-nom 
+          -- --skip-cached --no-nom ${{ matrix.runner == 'macos-latest-xlarge' && '--max-jobs 1' || '' }}
           --flake ".#checks.$(nix eval --raw --impure --expr 'builtins.currentSystem')"
         env:
           AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
diff --git a/ansible/vars.yml b/ansible/vars.yml
index de488b9ec..a3d9565e5 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.100-orioledb"
-  postgres17: "17.4.1.050"
-  postgres15: "15.8.1.107"
+  postgresorioledb-17: "17.0.1.101-orioledb"
+  postgres17: "17.4.1.051"
+  postgres15: "15.8.1.108"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/flake.lock b/flake.lock
index 167905994..8b6d868bf 100644
--- a/flake.lock
+++ b/flake.lock
@@ -304,11 +304,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1746758179,
-        "narHash": "sha256-JECUw1YBEsTsVauvupRzE5ykZaJoyhHCpoY87ZZJGas=",
+        "lastModified": 1749609482,
+        "narHash": "sha256-R+Y3tXIUAMosrgo/ynhIUPEONZ+cM0ScbgN7KA8OkoE=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4fd00513eac6b6140c5dced3e1b8133e2369a0f8",
+        "rev": "a17da8deb943e7c8b4151914abbfe33d5a4e5b0d",
         "type": "github"
       },
       "original": {
diff --git a/nix/cargo-pgrx/buildPgrxExtension.nix b/nix/cargo-pgrx/buildPgrxExtension.nix
index 0b2b14fb9..d62db6b04 100644
--- a/nix/cargo-pgrx/buildPgrxExtension.nix
+++ b/nix/cargo-pgrx/buildPgrxExtension.nix
@@ -26,14 +26,13 @@
 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
-
 {
   lib,
   cargo-pgrx,
   pkg-config,
   rustPlatform,
   stdenv,
-  Security,
+  darwin,
   writeShellScriptBin,
 }:
 
@@ -94,7 +93,13 @@ let
     export PGRX_HOME=$(mktemp -d)
     export PGDATA="$PGRX_HOME/data-${pgrxPostgresMajor}/"
     cargo-pgrx pgrx init "--pg${pgrxPostgresMajor}" ${lib.getDev postgresql}/bin/pg_config
-    echo "unix_socket_directories = '$(mktemp -d)'" > "$PGDATA/postgresql.conf"
+
+    # unix sockets work in sandbox, too.
+    export PGHOST="$(mktemp -d)"
+    cat > "$PGDATA/postgresql.conf" <<EOF
+    listen_addresses = '''
+    unix_socket_directories = '$PGHOST'
+    EOF
 
     # This is primarily for Mac or other Nix systems that don't use the nixbld user.
     export USER="$(whoami)"
@@ -112,7 +117,9 @@ let
   # so we don't accidentally `(rustPlatform.buildRustPackage argsForBuildRustPackage) // { ... }` because
   # we forgot parentheses
   finalArgs = argsForBuildRustPackage // {
-    buildInputs = (args.buildInputs or [ ]) ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+    buildInputs =
+      (args.buildInputs or [ ])
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
     nativeBuildInputs =
       (args.nativeBuildInputs or [ ])
@@ -156,6 +163,7 @@ let
       cargo-pgrx pgrx stop all
 
       mv $out/${postgresql}/* $out
+      mv $out/${postgresql.lib}/* $out
       rm -rf $out/nix
 
       ${maybeLeaveBuildAndTestSubdir}
diff --git a/nix/cargo-pgrx/default.nix b/nix/cargo-pgrx/default.nix
index 5b5cd7222..6d9ef2a1a 100644
--- a/nix/cargo-pgrx/default.nix
+++ b/nix/cargo-pgrx/default.nix
@@ -7,14 +7,14 @@
   makeRustPlatform,
   stdenv,
   rust-bin,
+  rustVersion ? "1.85.1",
 }:
 let
-  rustVersion = "1.85.1";
   rustPlatform = makeRustPlatform {
     cargo = rust-bin.stable.${rustVersion}.default;
     rustc = rust-bin.stable.${rustVersion}.default;
   };
-  generic =
+  mkCargoPgrx =
     {
       version,
       hash,
@@ -57,25 +57,25 @@ let
     };
 in
 {
-  cargo-pgrx_0_11_3 = generic {
+  cargo-pgrx_0_11_3 = mkCargoPgrx {
     version = "0.11.3";
     hash = "sha256-UHIfwOdXoJvR4Svha6ud0FxahP1wPwUtviUwUnTmLXU=";
     cargoHash = "sha256-j4HnD8Zt9uhlV5N7ldIy9564o9qFEqs5KfXHmnQ1WEw=";
   };
-  cargo-pgrx_0_12_6 = generic {
+  cargo-pgrx_0_12_6 = mkCargoPgrx {
     version = "0.12.6";
     hash = "sha256-7aQkrApALZe6EoQGVShGBj0UIATnfOy2DytFj9IWdEA=";
     cargoHash = "sha256-Di4UldQwAt3xVyvgQT1gUhdvYUVp7n/a72pnX45kP0w=";
   };
-  cargo-pgrx_0_12_9 = generic {
+  cargo-pgrx_0_12_9 = mkCargoPgrx {
     version = "0.12.9";
     hash = "sha256-aR3DZAjeEEAjLQfZ0ZxkjLqTVMIEbU0UiZ62T4BkQq8=";
     cargoHash = "sha256-KTKcol9qSNLQZGW32e6fBb6cPkUGItknyVpLdBYqrBY=";
   };
-  cargo-pgrx_0_14_3 = generic {
+  cargo-pgrx_0_14_3 = mkCargoPgrx {
     version = "0.14.3";
     hash = "sha256-3TsNpEqNm3Uol5XPW1i0XEbP2fF2+RKB2d7lO6BDnvQ=";
     cargoHash = "sha256-Ny7j56pwB+2eEK62X0nWfFKQy5fBz+Q1oyvecivxLkk=";
   };
-  inherit rustPlatform;
+  inherit mkCargoPgrx;
 }
diff --git a/nix/cargo-pgrx/mkPgrxExtension.nix b/nix/cargo-pgrx/mkPgrxExtension.nix
new file mode 100644
index 000000000..41eef5091
--- /dev/null
+++ b/nix/cargo-pgrx/mkPgrxExtension.nix
@@ -0,0 +1,38 @@
+{
+  callPackage,
+  rustVersion,
+  pgrxVersion,
+  makeRustPlatform,
+  rust-bin,
+}:
+let
+  inherit ((callPackage ./default.nix { inherit rustVersion; })) mkCargoPgrx;
+
+  rustPlatform = makeRustPlatform {
+    cargo = rust-bin.stable.${rustVersion}.default;
+    rustc = rust-bin.stable.${rustVersion}.default;
+  };
+
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+
+  cargo-pgrx =
+    let
+      pgrx =
+        versions.${pgrxVersion}
+          or (throw "Unsupported pgrx version ${pgrxVersion}. Available versions: ${builtins.toString (builtins.attrNames versions)}. Change 'nix/cargo-pgrx/versions.json' to add support for new versions.");
+      mapping = {
+        inherit (pgrx) hash;
+        cargoHash =
+          pgrx.rust."${rustVersion}".cargoHash
+            or (throw "Unsupported rust version ${rustVersion} for pgrx version ${pgrxVersion}. Available Rust versions: ${builtins.toString (builtins.attrNames pgrx.rust)}. Change 'nix/cargo-pgrx/versions.json' to add support for new versions.");
+      };
+    in
+    mkCargoPgrx {
+      inherit (mapping) hash cargoHash;
+      version = pgrxVersion;
+    };
+in
+callPackage ./buildPgrxExtension.nix {
+  inherit rustPlatform;
+  inherit cargo-pgrx;
+}
diff --git a/nix/cargo-pgrx/versions.json b/nix/cargo-pgrx/versions.json
new file mode 100644
index 000000000..2a4e24192
--- /dev/null
+++ b/nix/cargo-pgrx/versions.json
@@ -0,0 +1,61 @@
+{
+  "0.11.2": {
+    "hash": "sha256-8NlpMDFaltTIA8G4JioYm8LaPJ2RGKH5o6sd6lBHmmM=",
+    "rust": {
+      "1.70.0": {
+        "cargoHash": "sha256-qTb3JV3u42EilaK2jP9oa5D09mkuHyRbGGRs9Rg4TzI="
+      },
+      "1.76.0": {
+        "cargoHash": "sha256-qTb3JV3u42EilaK2jP9oa5D09mkuHyRbGGRs9Rg4TzI="
+      },
+      "1.85.1": {
+        "cargoHash": "sha256-CbU5B0pvB9ApTZOdYP/ZwuIG8bqGzk/ING2PCM0q2bQ="
+      }
+    }
+  },
+  "0.11.3": {
+    "hash": "sha256-UHIfwOdXoJvR4Svha6ud0FxahP1wPwUtviUwUnTmLXU=",
+    "rust": {
+      "1.76.0": {
+        "cargoHash": "sha256-j4HnD8Zt9uhlV5N7ldIy9564o9qFEqs5KfXHmnQ1WEw="
+      },
+      "1.85.1": {
+        "cargoHash": "sha256-KBlT3FARjGcbtHIGDoC6ir3aNXXfDRmIoy990SOqoFg="
+      }
+    }
+  },
+  "0.12.6": {
+    "hash": "sha256-7aQkrApALZe6EoQGVShGBj0UIATnfOy2DytFj9IWdEA=",
+    "rust": {
+      "1.80.0": {
+        "cargoHash": "sha256-Di4UldQwAt3xVyvgQT1gUhdvYUVp7n/a72pnX45kP0w="
+      },
+      "1.81.0": {
+        "cargoHash": "sha256-Di4UldQwAt3xVyvgQT1gUhdvYUVp7n/a72pnX45kP0w="
+      }
+    }
+  },
+  "0.12.9": {
+    "hash": "sha256-aR3DZAjeEEAjLQfZ0ZxkjLqTVMIEbU0UiZ62T4BkQq8=",
+    "rust": {
+      "1.81.0": {
+        "cargoHash": "sha256-53HKhvsKLTa2JCByLEcK3UzWXoM+LTatd98zvS1C9no="
+      },
+      "1.84.0": {
+        "cargoHash": "sha256-KTKcol9qSNLQZGW32e6fBb6cPkUGItknyVpLdBYqrBY="
+      },
+      "1.87.0": {
+        "cargoHash": "sha256-KTKcol9qSNLQZGW32e6fBb6cPkUGItknyVpLdBYqrBY="
+      }
+    }
+  },
+  "0.14.3": {
+    "hash": "sha256-3TsNpEqNm3Uol5XPW1i0XEbP2fF2+RKB2d7lO6BDnvQ=",
+    "rust": {
+      "1.87.0": {
+        "cargoHash": "sha256-Ny7j56pwB+2eEK62X0nWfFKQy5fBz+Q1oyvecivxLkk="
+      }
+    }
+  }
+
+}
diff --git a/nix/checks.nix b/nix/checks.nix
index fc042ad12..d01518dc9 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -22,6 +22,7 @@
         let
           # Create a testing harness for a PostgreSQL package. This is used for
           # 'nix flake check', and works with any PostgreSQL package you hand it.
+          # deadnix: skip
           makeCheckHarness =
             pgpkg:
             let
@@ -286,16 +287,15 @@
               '';
         in
         {
-          psql_15 = makeCheckHarness self'.packages."psql_15/bin";
-          psql_17 = makeCheckHarness self'.packages."psql_17/bin";
-          psql_orioledb-17 = makeCheckHarness self'.packages."psql_orioledb-17/bin";
+          psql_15 = self'.packages."psql_15/bin";
+          psql_17 = self'.packages."psql_17/bin";
+          psql_orioledb-17 = self'.packages."psql_orioledb-17/bin";
           inherit (self'.packages)
             wal-g-2
             wal-g-3
             dbmate-tool
             pg_regress
             ;
-          devShell = self'.devShells.default;
         }
         // pkgs.lib.optionalAttrs (system == "aarch64-linux") {
           inherit (self'.packages)
@@ -306,6 +306,13 @@
             postgresql_17_debug
             postgresql_17_src
             ;
+        }
+        // pkgs.lib.optionalAttrs (system == "x86_64-linux") {
+          wrappers = import ./ext/tests/wrappers.nix {
+            inherit self;
+            inherit pkgs;
+          };
+          devShell = self'.devShells.default;
         };
     };
 }
diff --git a/nix/ext/tests/wrappers.nix b/nix/ext/tests/wrappers.nix
new file mode 100644
index 000000000..54cc63944
--- /dev/null
+++ b/nix/ext/tests/wrappers.nix
@@ -0,0 +1,157 @@
+{ self, pkgs }:
+let
+  pname = "wrappers";
+  inherit (pkgs) lib;
+  installedExtension =
+    postgresMajorVersion: self.packages.${pkgs.system}."psql_${postgresMajorVersion}/exts/${pname}-all";
+  versions = postgresqlMajorVersion: (installedExtension postgresqlMajorVersion).versions;
+  postgresqlWithExtension =
+    postgresql:
+    let
+      majorVersion = lib.versions.major postgresql.version;
+      pkg = pkgs.buildEnv {
+        name = "postgresql-${majorVersion}-${pname}";
+        paths = [
+          postgresql
+          postgresql.lib
+          (installedExtension majorVersion)
+        ];
+        passthru = {
+          inherit (postgresql) version psqlSchema;
+          lib = pkg;
+          withPackages = _: pkg;
+        };
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        pathsToLink = [
+          "/"
+          "/bin"
+          "/lib"
+        ];
+        postBuild = ''
+          wrapProgram $out/bin/postgres --set NIX_PGLIBDIR $out/lib
+          wrapProgram $out/bin/pg_ctl --set NIX_PGLIBDIR $out/lib
+          wrapProgram $out/bin/pg_upgrade --set NIX_PGLIBDIR $out/lib
+        '';
+      };
+    in
+    pkg;
+in
+self.inputs.nixpkgs.lib.nixos.runTest {
+  name = pname;
+  hostPkgs = pkgs;
+  nodes.server =
+    { config, ... }:
+    {
+      virtualisation = {
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = 13022;
+            guest.port = 22;
+          }
+        ];
+      };
+      services.openssh = {
+        enable = true;
+      };
+      users.users.root.openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIo+ulCUfJjnCVgfM4946Ih5Nm8DeZZiayYeABHGPEl7 jfroche"
+      ];
+
+      services.postgresql = {
+        enable = true;
+        package = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_15;
+      };
+
+      specialisation.postgresql17.configuration = {
+        services.postgresql = {
+          package = lib.mkForce (postgresqlWithExtension self.packages.${pkgs.system}.postgresql_17);
+        };
+
+        systemd.services.postgresql-migrate = {
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            User = "postgres";
+            Group = "postgres";
+            StateDirectory = "postgresql";
+            WorkingDirectory = "${builtins.dirOf config.services.postgresql.dataDir}";
+          };
+          script =
+            let
+              oldPostgresql = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_15;
+              newPostgresql = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_17;
+              oldDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${oldPostgresql.psqlSchema}";
+              newDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${newPostgresql.psqlSchema}";
+            in
+            ''
+              if [[ ! -d ${newDataDir} ]]; then
+                install -d -m 0700 -o postgres -g postgres "${newDataDir}"
+                ${newPostgresql}/bin/initdb -D "${newDataDir}"
+                ${newPostgresql}/bin/pg_upgrade --old-datadir "${oldDataDir}" --new-datadir "${newDataDir}" \
+                  --old-bindir "${oldPostgresql}/bin" --new-bindir "${newPostgresql}/bin"
+              else
+                echo "${newDataDir} already exists"
+              fi
+            '';
+        };
+
+        systemd.services.postgresql = {
+          after = [ "postgresql-migrate.service" ];
+          requires = [ "postgresql-migrate.service" ];
+        };
+      };
+    };
+  testScript =
+    { nodes, ... }:
+    let
+      pg17-configuration = "${nodes.server.system.build.toplevel}/specialisation/postgresql17";
+    in
+    ''
+      versions = {
+        "15": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "15"))}],
+        "17": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "17"))}],
+      }
+
+      def run_sql(query):
+        return server.succeed(f"""sudo -u postgres psql -t -A -F\",\" -c \"{query}\" """).strip()
+
+      def check_upgrade_path(pg_version):
+        with subtest("Check ${pname} upgrade path"):
+          firstVersion = versions[pg_version][0]
+          server.succeed("sudo -u postgres psql -c 'DROP EXTENSION IF EXISTS ${pname};'")
+          run_sql(f"""CREATE EXTENSION ${pname} WITH VERSION '{firstVersion}';""")
+          installed_version = run_sql(r"""SELECT extversion FROM pg_extension WHERE extname = '${pname}';""")
+          assert installed_version == firstVersion, f"Expected ${pname} version {firstVersion}, but found {installed_version}"
+          for version in versions[pg_version][1:]:
+            run_sql(f"""ALTER EXTENSION ${pname} UPDATE TO '{version}';""")
+            installed_version = run_sql(r"""SELECT extversion FROM pg_extension WHERE extname = '${pname}';""")
+            assert installed_version == version, f"Expected ${pname} version {version}, but found {installed_version}"
+
+      start_all()
+
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("postgresql.service")
+
+      check_upgrade_path("15")
+
+      with subtest("Check ${pname} latest extension version"):
+        server.succeed("sudo -u postgres psql -c 'DROP EXTENSION ${pname};'")
+        server.succeed("sudo -u postgres psql -c 'CREATE EXTENSION ${pname};'")
+        installed_extensions=run_sql(r"""SELECT extname, extversion FROM pg_extension;""")
+        latestVersion = versions["15"][-1]
+        assert f"${pname},{latestVersion}" in installed_extensions
+
+      with subtest("switch to postgresql 17"):
+        server.succeed(
+          "${pg17-configuration}/bin/switch-to-configuration test >&2"
+        )
+
+      with subtest("Check ${pname} latest extension version"):
+        installed_extensions=run_sql(r"""SELECT extname, extversion FROM pg_extension;""")
+        latestVersion = versions["17"][-1]
+        assert f"${pname},{latestVersion}" in installed_extensions
+
+      check_upgrade_path("17")
+    '';
+}
diff --git a/nix/ext/versions.json b/nix/ext/versions.json
new file mode 100644
index 000000000..e5c4e90b1
--- /dev/null
+++ b/nix/ext/versions.json
@@ -0,0 +1,14 @@
+{
+  "wrappers": {
+    "0.5.3": {
+      "postgresql": [
+        "15",
+        "17",
+        "orioledb-17"
+      ],
+      "hash": "sha256-iaJriPEa0iVLpmnuUk9R3HS545Jhz7aH1clYvHEuEvs=",
+      "pgrx": "0.14.3",
+      "rust": "1.87.0"
+    }
+  }
+}
diff --git a/nix/ext/wrappers/0001-bump-pgrx-to-0.11.3.patch b/nix/ext/wrappers/0001-bump-pgrx-to-0.11.3.patch
new file mode 100644
index 000000000..35006c76a
--- /dev/null
+++ b/nix/ext/wrappers/0001-bump-pgrx-to-0.11.3.patch
@@ -0,0 +1,164 @@
+From 6a14bd4cf44ebfa86404aa3e0b3f12dcac3f160c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
+Date: Thu, 12 Jun 2025 17:26:02 +0200
+Subject: [PATCH] bump pgrx to 0.11.3
+
+Backport https://github.com/supabase/wrappers/pull/254
+---
+ Cargo.lock                   | 36 +++++++++++++++---------------------
+ supabase-wrappers/Cargo.toml |  4 ++--
+ wrappers/Cargo.toml          |  4 ++--
+ 3 files changed, 19 insertions(+), 25 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 7c6b6b2..a3ba635 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -759,16 +759,16 @@ checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+ 
+ [[package]]
+ name = "bindgen"
+-version = "0.68.1"
++version = "0.69.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "726e4313eb6ec35d2730258ad4e15b547ee75d6afaa1361a922e78e59b7d8078"
++checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+ dependencies = [
+  "bitflags 2.4.0",
+  "cexpr",
+  "clang-sys",
++ "itertools",
+  "lazy_static",
+  "lazycell",
+- "peeking_take_while",
+  "proc-macro2",
+  "quote",
+  "regex",
+@@ -2815,12 +2815,6 @@ dependencies = [
+  "libc",
+ ]
+ 
+-[[package]]
+-name = "peeking_take_while"
+-version = "0.1.2"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+-
+ [[package]]
+ name = "percent-encoding"
+ version = "2.3.0"
+@@ -2849,9 +2843,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pgrx"
+-version = "0.11.2"
++version = "0.11.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "cb44171122605250e719ca2ae49afb357bdb2fce4b3c876fcf2225165237328a"
++checksum = "2102faa5ef4a7bf096fefcf67692b293583efd18f9236340ad3169807dfc2b73"
+ dependencies = [
+  "atomic-traits",
+  "bitflags 2.4.0",
+@@ -2874,9 +2868,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pgrx-macros"
+-version = "0.11.2"
++version = "0.11.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a18ac8628b7de2f29a93d0abdbdcaee95a0e0ef4b59fd4de99cc117e166e843b"
++checksum = "c26810d09910ec987a6708d48d243efb5f879331e01c6fec0893714d0eb12bae"
+ dependencies = [
+  "pgrx-sql-entity-graph",
+  "proc-macro2",
+@@ -2886,9 +2880,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pgrx-pg-config"
+-version = "0.11.2"
++version = "0.11.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "acd45ac6eb1142c5690df63c4e0bdfb74f27c9f93a7af84f064dc2c0a2c2d6f7"
++checksum = "0b0099ba4b635dfe1e34afc8bca8be43e9577c5d726aaf1dc7dd23a78f6c8a60"
+ dependencies = [
+  "cargo_toml",
+  "dirs",
+@@ -2904,9 +2898,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pgrx-pg-sys"
+-version = "0.11.2"
++version = "0.11.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "81c6207939582934fc26fceb651cb5338e363c06ddc6b2d50ca71867f7c70ffe"
++checksum = "3f40315259c41fede51eb23b791b48d0a112b0f47d0dcb6862b798d1fa1db6ea"
+ dependencies = [
+  "bindgen",
+  "clang-sys",
+@@ -2928,9 +2922,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pgrx-sql-entity-graph"
+-version = "0.11.2"
++version = "0.11.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a50083de83b1fac2484e8f2c2a7da5fed0193904e2578fa6c4ce02262c455c2b"
++checksum = "7d47a4e991c8c66162c5d6b0fc2bd382e43a58fc893ce05a6a15ddcb1bf7eee4"
+ dependencies = [
+  "convert_case",
+  "eyre",
+@@ -2943,9 +2937,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pgrx-tests"
+-version = "0.11.2"
++version = "0.11.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "6ba0115cd80d9e3ca1d5d2a8ab8b7320d6ed614a53d025b86152696a8b3caa75"
++checksum = "ab3abc01e2bb930b072bd660d04c8eaa69a29d4727d5b2a641f946c603c1605e"
+ dependencies = [
+  "clap-cargo",
+  "eyre",
+diff --git a/supabase-wrappers/Cargo.toml b/supabase-wrappers/Cargo.toml
+index a825fea..be66f25 100644
+--- a/supabase-wrappers/Cargo.toml
++++ b/supabase-wrappers/Cargo.toml
+@@ -19,14 +19,14 @@ pg16 = ["pgrx/pg16", "pgrx-tests/pg16"]
+ pg_test = []
+ 
+ [dependencies]
+-pgrx = { version = "=0.11.2", default-features = false }
++pgrx = { version = "=0.11.3", default-features = false }
+ thiserror = "1.0.48"
+ tokio = { version = "1.35", features = ["rt", "net"] }
+ uuid = { version = "1.2.2" }
+ supabase-wrappers-macros = { version = "0.1", path = "../supabase-wrappers-macros" }
+ 
+ [dev-dependencies]
+-pgrx-tests = "=0.11.2"
++pgrx-tests = "=0.11.3"
+ 
+ [package.metadata.docs.rs]
+ features = ["pg15", "cshim"]
+diff --git a/wrappers/Cargo.toml b/wrappers/Cargo.toml
+index a6dd573..6f63519 100644
+--- a/wrappers/Cargo.toml
++++ b/wrappers/Cargo.toml
+@@ -134,7 +134,7 @@ all_fdws = [
+ ]
+ 
+ [dependencies]
+-pgrx = { version = "=0.11.2" }
++pgrx = { version = "=0.11.3" }
+ #supabase-wrappers = "0.1"
+ supabase-wrappers = { path = "../supabase-wrappers", default-features = false }
+ 
+@@ -204,4 +204,4 @@ redis = { version = "0.24.0", features = ["streams"], optional = true }
+ thiserror = { version = "1.0.48", optional = true }
+ 
+ [dev-dependencies]
+-pgrx-tests = "=0.11.2"
++pgrx-tests = "=0.11.3"
+-- 
+2.49.0
+
diff --git a/nix/ext/wrappers/Cargo.lock-0.3.0 b/nix/ext/wrappers/Cargo.lock-0.3.0
new file mode 100644
index 000000000..a3ba6354f
--- /dev/null
+++ b/nix/ext/wrappers/Cargo.lock-0.3.0
@@ -0,0 +1,5191 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "ahash"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a824f2aa7e75a0c98c5a504fceb80649e9c35265d44525b5f94de4771a395cd"
+dependencies = [
+ "getrandom 0.2.12",
+ "once_cell",
+ "version_check",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77c3a9648d43b9cd48db467b3f87fdd6e146bcc88ab0180006cef2179fe11d01"
+dependencies = [
+ "cfg-if",
+ "const-random",
+ "getrandom 0.2.12",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67fc08ce920c31afb70f013dcce1bfc3a3195de6a228474e45e1f145b36f8d04"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41ed9a86bf92ae6580e0a31281f65a1b1d867c0cc68d5346e2ae128dddfa6a7d"
+
+[[package]]
+name = "anyhow"
+version = "1.0.71"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c7d0618f0e0b7e8ff11427422b64564d5fb0be1940354bfe2e0529b18a9d9b8"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
+name = "arrow-array"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6049e031521c4e7789b7530ea5991112c0a375430094191f3b74bdf37517c9a9"
+dependencies = [
+ "ahash 0.8.7",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "chrono",
+ "half 2.3.1",
+ "hashbrown 0.13.2",
+ "num",
+]
+
+[[package]]
+name = "arrow-buffer"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a83450b94b9fe018b65ba268415aaab78757636f68b7f37b6bc1f2a3888af0a0"
+dependencies = [
+ "half 2.3.1",
+ "num",
+]
+
+[[package]]
+name = "arrow-cast"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "249198411254530414805f77e88e1587b0914735ea180f906506905721f7a44a"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "arrow-select",
+ "chrono",
+ "lexical-core",
+ "num",
+]
+
+[[package]]
+name = "arrow-data"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d48dcbed83d741d4af712af17f6d952972b8f6491b24ee2415243a7e37c6438"
+dependencies = [
+ "arrow-buffer",
+ "arrow-schema",
+ "half 2.3.1",
+ "num",
+]
+
+[[package]]
+name = "arrow-ipc"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea8d7b138c5414aeef5dd08abacf362f87ed9b1168ea38d60a6f67590c3f7d99"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-data",
+ "arrow-schema",
+ "flatbuffers",
+]
+
+[[package]]
+name = "arrow-schema"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b71d8d68d0bc2e648e4e395896dc518be8b90c5f0f763c59083187c3d46184b"
+
+[[package]]
+name = "arrow-select"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470cb8610bdfda56554a436febd4e457e506f3c42e01e545a1ea7ecf2a4c8823"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "num",
+]
+
+[[package]]
+name = "assert-json-diff"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e4f2b81832e72834d7518d8487a0396a28cc408186a2e8854c0f98011faf12"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "async-channel"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+dependencies = [
+ "concurrent-queue",
+ "event-listener",
+ "futures-core",
+]
+
+[[package]]
+name = "async-compression"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "942c7cd7ae39e91bde4820d74132e9862e62c2f386c3aa90ccf55949f5bad63a"
+dependencies = [
+ "bzip2",
+ "flate2",
+ "futures-core",
+ "memchr",
+ "pin-project-lite",
+ "tokio",
+ "xz2",
+]
+
+[[package]]
+name = "async-native-tls"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d57d4cec3c647232e1094dc013546c0b33ce785d8aeb251e1f20dfaf8a9a13fe"
+dependencies = [
+ "futures-util",
+ "native-tls",
+ "thiserror",
+ "url",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd56dd203fef61ac097dd65721a419ddccb106b2d2b70ba60a6b529f03961a51"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ccdd8f2a161be9bd5c023df56f1b2a0bd1d83872ae53b71a84a12c9bf6e842"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "asynchronous-codec"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4057f2c32adbb2fc158e22fb38433c8e9bbf76b75a4732c7c0cbaf695fb65568"
+dependencies = [
+ "bytes",
+ "futures-sink",
+ "futures-util",
+ "memchr",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "atomic-polyfill"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ff7eb3f316534d83a8a2c3d1674ace8a5a71198eba31e2e2b597833f699b28"
+dependencies = [
+ "critical-section",
+]
+
+[[package]]
+name = "atomic-traits"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b29ec3788e96fb4fdb275ccb9d62811f2fa903d76c5eb4dd6fe7d09a7ed5871f"
+dependencies = [
+ "cfg-if",
+ "rustc_version 0.3.3",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "aws-config"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e64b72d4bdbb41a73d27709c65a25b6e4bfc8321bf70fa3a8b19ce7d4eb81b0"
+dependencies = [
+ "aws-credential-types",
+ "aws-http",
+ "aws-runtime",
+ "aws-sdk-sso",
+ "aws-sdk-ssooidc",
+ "aws-sdk-sts",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand 2.0.0",
+ "hex",
+ "http",
+ "hyper",
+ "ring",
+ "time",
+ "tokio",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-credential-types"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a7cb3510b95492bd9014b60e2e3bee3e48bc516e220316f8e6b60df18b47331"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-http"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a95d41abe4e941399fdb4bc2f54713eac3c839d98151875948bb24e66ab658f2"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-runtime"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233cca219c6705d525ace011d6f9bc51aaf32fce5b4c41661d2d7ff22d9b4d49"
+dependencies = [
+ "aws-credential-types",
+ "aws-http",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "fastrand 2.0.0",
+ "http",
+ "percent-encoding",
+ "tracing",
+ "uuid 1.4.1",
+]
+
+[[package]]
+name = "aws-sdk-cognitoidentityprovider"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab24eef715050f56365d129fcff98de9e2981066e221cec8fe7b6170b188fcc"
+dependencies = [
+ "aws-credential-types",
+ "aws-http",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "http",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-s3"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "634fbe5b6591ee2e281cd2ba8641e9bd752dbf5bf338924d6ad4bd5a3304fe31"
+dependencies = [
+ "aws-credential-types",
+ "aws-http",
+ "aws-runtime",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-checksums",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "bytes",
+ "http",
+ "http-body",
+ "once_cell",
+ "percent-encoding",
+ "regex-lite",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "aws-sdk-sso"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee41005e0f3a19ae749c7953d9e1f1ef8d2183f76f64966e346fa41c1ba0ed44"
+dependencies = [
+ "aws-credential-types",
+ "aws-http",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "http",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-ssooidc"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa08168f8a27505e7b90f922c32a489feb1f2133878981a15138bebc849ac09c"
+dependencies = [
+ "aws-credential-types",
+ "aws-http",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "http",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-sts"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29102eff04d50ef70f11a48823db33e33c6cc5f027bfb6ff4864efbd5f1f66f3"
+dependencies = [
+ "aws-credential-types",
+ "aws-http",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-query",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "http",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sigv4"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b92384b39aedb258aa734fe0e7b2ffcd13f33e68227251a72cd2635e0acc8f1a"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "crypto-bigint 0.5.5",
+ "form_urlencoded",
+ "hex",
+ "hmac",
+ "http",
+ "once_cell",
+ "p256",
+ "percent-encoding",
+ "ring",
+ "sha2",
+ "subtle",
+ "time",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-smithy-async"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71d8e1c0904f78c76846a9dad41c28b41d330d97741c3e70d003d9a747d95e2a"
+dependencies = [
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "aws-smithy-checksums"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62d59ef74bf94562512e570eeccb81e9b3879f9136b2171ed4bf996ffa609955"
+dependencies = [
+ "aws-smithy-http",
+ "aws-smithy-types",
+ "bytes",
+ "crc32c",
+ "crc32fast",
+ "hex",
+ "http",
+ "http-body",
+ "md-5",
+ "pin-project-lite",
+ "sha1",
+ "sha2",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-eventstream"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31cf0466890a20988b9b2864250dd907f769bd189af1a51ba67beec86f7669fb"
+dependencies = [
+ "aws-smithy-types",
+ "bytes",
+ "crc32fast",
+]
+
+[[package]]
+name = "aws-smithy-http"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "568a3b159001358dd96143378afd7470e19baffb6918e4b5016abe576e553f9c"
+dependencies = [
+ "aws-smithy-eventstream",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "http",
+ "http-body",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "pin-utils",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-json"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f12bfb23370a069f8facbfd53ce78213461b0a8570f6c81488030f5ab6f8cc4e"
+dependencies = [
+ "aws-smithy-types",
+]
+
+[[package]]
+name = "aws-smithy-query"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b1adc06e0175c175d280267bb8fd028143518013fcb869e1c3199569a2e902a"
+dependencies = [
+ "aws-smithy-types",
+ "urlencoding",
+]
+
+[[package]]
+name = "aws-smithy-runtime"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cf0f6845d2d97b953cea791b0ee37191c5509f2897ec7eb7580a0e7a594e98b"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "fastrand 2.0.0",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-rustls",
+ "once_cell",
+ "pin-project-lite",
+ "pin-utils",
+ "rustls 0.21.10",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-runtime-api"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47798ba97a33979c80e837519cf837f18fd6df0adb02dd5286a75d9891c6e671"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-types",
+ "bytes",
+ "http",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-smithy-types"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e9a85eafeaf783b2408e35af599e8b96f2c49d9a5d13ad3a887fbdefb6bc744"
+dependencies = [
+ "base64-simd",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "http",
+ "http-body",
+ "itoa",
+ "num-integer",
+ "pin-project-lite",
+ "pin-utils",
+ "ryu",
+ "serde",
+ "time",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "aws-smithy-xml"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a84bee2b44c22cbba59f12c34b831a97df698f8e43df579b35998652a00dc13"
+dependencies = [
+ "xmlparser",
+]
+
+[[package]]
+name = "aws-types"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8549aa62c5b7db5c57ab915200ee214b4f5d8f19b29a4a8fa0b3ad3bca1380e3"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "http",
+ "rustc_version 0.4.0",
+ "tracing",
+]
+
+[[package]]
+name = "backtrace"
+version = "0.3.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
+
+[[package]]
+name = "base16ct"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349a06037c7bf932dd7e7d1f653678b2038b9ad46a74102f1fc7bd7872678cce"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "base64"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f1e31e207a6b8fb791a38ea3105e6cb541f55e4d029902d3039a4ad07cc4105"
+
+[[package]]
+name = "base64-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
+dependencies = [
+ "outref",
+ "vsimd",
+]
+
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
+[[package]]
+name = "bindgen"
+version = "0.69.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+dependencies = [
+ "bitflags 2.4.0",
+ "cexpr",
+ "clang-sys",
+ "itertools",
+ "lazy_static",
+ "lazycell",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+
+[[package]]
+name = "bitvec"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "borsh"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58b559fd6448c6e2fd0adb5720cd98a2506594cafa4737ff98c396f3e82f667"
+dependencies = [
+ "borsh-derive",
+ "cfg_aliases",
+]
+
+[[package]]
+name = "borsh-derive"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aadb5b6ccbd078890f6d7003694e33816e6b784358f18e15e7e6d9f065a57cd"
+dependencies = [
+ "once_cell",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+ "syn_derive",
+]
+
+[[package]]
+name = "brotli"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "516074a47ef4bce09577a3b379392300159ce5b1ba2e501ff1c819950066100f"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+
+[[package]]
+name = "bytecheck"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6372023ac861f6e6dc89c8344a8f398fb42aaba2b5dbc649ca0c0e9dbcb627"
+dependencies = [
+ "bytecheck_derive",
+ "ptr_meta",
+ "simdutf8",
+]
+
+[[package]]
+name = "bytecheck_derive"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7ec4c6f261935ad534c0c22dbef2201b45918860eb1c574b972bd213a76af61"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "bytes"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
+
+[[package]]
+name = "bytes-utils"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dafe3a8757b027e2be6e4e5601ed563c55989fcf1546e933c66c8eb3a058d35"
+dependencies = [
+ "bytes",
+ "either",
+]
+
+[[package]]
+name = "bzip2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+dependencies = [
+ "bzip2-sys",
+ "libc",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.11+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "cargo_toml"
+version = "0.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3f9629bc6c4388ea699781dc988c2b99766d7679b151c81990b4fa1208fafd3"
+dependencies = [
+ "serde",
+ "toml",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "jobserver",
+ "libc",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
+
+[[package]]
+name = "chrono"
+version = "0.4.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "wasm-bindgen",
+ "windows-targets 0.48.0",
+]
+
+[[package]]
+name = "chrono-tz"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29c39203181991a7dd4343b8005bd804e7a9a37afb8ac070e43771e8c820bbde"
+dependencies = [
+ "chrono",
+ "chrono-tz-build",
+ "phf",
+]
+
+[[package]]
+name = "chrono-tz-build"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f509c3a87b33437b05e2458750a0700e5bdd6956176773e6c7d6dd15a283a0c"
+dependencies = [
+ "parse-zoneinfo",
+ "phf",
+ "phf_codegen",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c688fc74432808e3eb684cae8830a86be1d66a2bd58e1f248ed0960a590baf6f"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93aae7a4192245f70fe75dd9157fc7b4a5bf53e88d30bd4396f7d8f9284d5acc"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+ "once_cell",
+]
+
+[[package]]
+name = "clap-cargo"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25122ca6ebad5f53578c26638afd9f0160426969970dc37ec6c363ff6b082ebd"
+dependencies = [
+ "clap",
+ "doc-comment",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f423e341edefb78c9caba2d9c7f7687d0e72e89df3ce3394554754393ac3990"
+dependencies = [
+ "anstyle",
+ "bitflags 1.3.2",
+ "clap_lex",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "191d9573962933b4027f932c600cd252ce27a8ad5979418fe78e43c07996f27b"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
+
+[[package]]
+name = "clickhouse-rs"
+version = "1.0.0-alpha.1"
+source = "git+https://github.com/suharev7/clickhouse-rs?rev=ecf28f4677#ecf28f46774773f39c74ee5213ad1e3ea240739b"
+dependencies = [
+ "byteorder",
+ "chrono",
+ "chrono-tz",
+ "clickhouse-rs-cityhash-sys",
+ "combine",
+ "crossbeam",
+ "either",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "hostname",
+ "lazy_static",
+ "log",
+ "lz4",
+ "native-tls",
+ "percent-encoding",
+ "pin-project",
+ "thiserror",
+ "tokio",
+ "tokio-native-tls",
+ "url",
+ "uuid 0.8.2",
+]
+
+[[package]]
+name = "clickhouse-rs-cityhash-sys"
+version = "0.1.2"
+source = "git+https://github.com/suharev7/clickhouse-rs?rev=ecf28f4677#ecf28f46774773f39c74ee5213ad1e3ea240739b"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35ed6e9d84f0b51a7f52daf1c7d71dd136fd7a3f41a8462b8cdb8c78d920fad4"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16048cd947b08fa32c24458a22f5dc5e835264f689f4f5653210c69fd107363"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "connection-string"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "510ca239cf13b7f8d16a2b48f263de7b4f8c566f0af58d901031473c76afb1e3"
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const-random"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aaf16c9c2c612020bcfd042e170f6e32de9b9d75adb5277cdbbd2e2c8c8299a"
+dependencies = [
+ "const-random-macro",
+]
+
+[[package]]
+name = "const-random-macro"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
+dependencies = [
+ "getrandom 0.2.12",
+ "once_cell",
+ "tiny-keccak",
+]
+
+[[package]]
+name = "convert_case"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e4c1eaa2012c47becbbad2ab175484c2a84d1185b566fb2cc5b8707343dfe58"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32c"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f48d60e5b4d2c53d5c2b1d8a58c849a70ae5e5509b08a48d047e3b65714a74"
+dependencies = [
+ "rustc_version 0.4.0",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6548a0ad5d2549e111e1f6a11a6c2e2d00ce6a3dafe22948d67c2b443f775e52"
+
+[[package]]
+name = "crossbeam"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1137cd7e7fc0fb5d3c5a8678be38ec56e819125d8d7907411fe24ccb943faca8"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-epoch",
+ "crossbeam-queue",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "176dc175b78f56c0f321911d9c8eb2b77a78a4860b9c19db83835fea1a46649b"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df0346b5d5e76ac2fe4e327c5fd1118d6be7c51dfb18f9b7922923f287471e35"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
+
+[[package]]
+name = "crunchy"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
+
+[[package]]
+name = "crypto-bigint"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef2b4b23cddf68b89b8f8069890e8c270d54e2d5fe1b143820234805e4cb17ef"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "csv"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "deadpool"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "421fe0f90f2ab22016f32a9881be5134fdd71c65298917084b0c7477cbc3856e"
+dependencies = [
+ "async-trait",
+ "deadpool-runtime",
+ "num_cpus",
+ "retain_mut",
+ "tokio",
+]
+
+[[package]]
+name = "deadpool-runtime"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63dfa964fe2a66f3fde91fc70b267fe193d822c7e603e2a675a49a7f46ad3f49"
+
+[[package]]
+name = "der"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+ "serde",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "dirs"
+version = "5.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "545b22097d44f8a9581187cdf93de7a71e4722bf51200cfaba810865b49a495d"
+
+[[package]]
+name = "ecdsa"
+version = "0.14.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413301934810f597c1d19ca71c8710e99a3f1ba28a0d2ebc01551a2daeea3c5c"
+dependencies = [
+ "der",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+]
+
+[[package]]
+name = "either"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+
+[[package]]
+name = "elliptic-curve"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
+dependencies = [
+ "base16ct",
+ "crypto-bigint 0.4.9",
+ "der",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "encoding"
+version = "0.2.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b0d943856b990d12d3b55b359144ff341533e516d94098b1d3fc1ac666d36ec"
+dependencies = [
+ "encoding-index-japanese",
+ "encoding-index-korean",
+ "encoding-index-simpchinese",
+ "encoding-index-singlebyte",
+ "encoding-index-tradchinese",
+]
+
+[[package]]
+name = "encoding-index-japanese"
+version = "1.20141219.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04e8b2ff42e9a05335dbf8b5c6f7567e5591d0d916ccef4e0b1710d32a0d0c91"
+dependencies = [
+ "encoding_index_tests",
+]
+
+[[package]]
+name = "encoding-index-korean"
+version = "1.20141219.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dc33fb8e6bcba213fe2f14275f0963fd16f0a02c878e3095ecfdf5bee529d81"
+dependencies = [
+ "encoding_index_tests",
+]
+
+[[package]]
+name = "encoding-index-simpchinese"
+version = "1.20141219.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d87a7194909b9118fc707194baa434a4e3b0fb6a5a757c73c3adb07aa25031f7"
+dependencies = [
+ "encoding_index_tests",
+]
+
+[[package]]
+name = "encoding-index-singlebyte"
+version = "1.20141219.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3351d5acffb224af9ca265f435b859c7c01537c0849754d3db3fdf2bfe2ae84a"
+dependencies = [
+ "encoding_index_tests",
+]
+
+[[package]]
+name = "encoding-index-tradchinese"
+version = "1.20141219.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd0e20d5688ce3cab59eb3ef3a2083a5c77bf496cb798dc6fcdb75f323890c18"
+dependencies = [
+ "encoding_index_tests",
+]
+
+[[package]]
+name = "encoding_index_tests"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "enum-map"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c188012f8542dee7b3996e44dd89461d64aa471b0a7c71a1ae2f595d259e96e5"
+dependencies = [
+ "enum-map-derive",
+]
+
+[[package]]
+name = "enum-map-derive"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04d0b288e3bb1d861c4403c1774a6f7a798781dfc519b3647df2a3dd4ae95f25"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "enumflags2"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5998b4f30320c9d93aed72f63af821bfdac50465b75428fce77b48ec482c3939"
+dependencies = [
+ "enumflags2_derive",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f95e2801cd355d4a1a3e3953ce6ee5ae9603a5c833455343a8bfe3f44d418246"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88bffebc5d80432c9b140ee17875ff173a8ab62faad5b257da912bd2f6c1c0a1"
+
+[[package]]
+name = "errno"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
+[[package]]
+name = "eyre"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c2b6b5a29c02cdc822728b7d7b8ae1bab3e3b05d44522770ddd49722eeac7eb"
+dependencies = [
+ "indenter",
+ "once_cell",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
+
+[[package]]
+name = "fastrand"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764"
+
+[[package]]
+name = "ff"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d013fc25338cc558c5c2cfbad646908fb23591e2404481826742b651c9af7160"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
+[[package]]
+name = "flatbuffers"
+version = "23.5.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dac53e22462d78c16d64a1cd22371b54cc3fe94aa15e7886a2fa6e5d1ab8640"
+dependencies = [
+ "bitflags 1.3.2",
+ "rustc_version 0.4.0",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "funty"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
+
+[[package]]
+name = "futures"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+
+[[package]]
+name = "futures-lite"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
+dependencies = [
+ "fastrand 1.9.0",
+ "futures-core",
+ "futures-io",
+ "memchr",
+ "parking",
+ "pin-project-lite",
+ "waker-fn",
+]
+
+[[package]]
+name = "futures-macro"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+
+[[package]]
+name = "futures-task"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+
+[[package]]
+name = "futures-timer"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c"
+
+[[package]]
+name = "futures-util"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "gcp-bigquery-client"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "576b349942a1b96327b1b2e50d271d3d54dc9669eb38271c830916168e753820"
+dependencies = [
+ "async-stream",
+ "async-trait",
+ "dyn-clone",
+ "hyper",
+ "hyper-rustls",
+ "log",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "time",
+ "tokio",
+ "tokio-stream",
+ "url",
+ "yup-oauth2",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gimli"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
+
+[[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+
+[[package]]
+name = "group"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dfbfb3a6cfbd390d5c9564ab283a0349b9b9fcd46a706c1eb10e0db70bfbac7"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eabb4a44450da02c90444cf74558da904edde8fb4e9035a9a6a4e15445af0bd7"
+
+[[package]]
+name = "half"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc52e53916c08643f1b56ec082790d1e86a32e58dc5268f897f313fbae7b4872"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "num-traits",
+]
+
+[[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+dependencies = [
+ "ahash 0.7.7",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+
+[[package]]
+name = "heapless"
+version = "0.7.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db04bc24a18b9ea980628ecf00e6c0264f3c1426dac36c00cb49b6fbad8b0743"
+dependencies = [
+ "atomic-polyfill",
+ "hash32",
+ "rustc_version 0.4.0",
+ "spin",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "hostname"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
+dependencies = [
+ "libc",
+ "match_cfg",
+ "winapi",
+]
+
+[[package]]
+name = "http"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-types"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9b187a72d63adbfba487f48095306ac823049cb504ee195541e91c7775f5ad"
+dependencies = [
+ "anyhow",
+ "async-channel",
+ "base64 0.13.1",
+ "futures-lite",
+ "http",
+ "infer",
+ "pin-project-lite",
+ "rand 0.7.3",
+ "serde",
+ "serde_json",
+ "serde_qs",
+ "serde_urlencoded",
+ "url",
+]
+
+[[package]]
+name = "httparse"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "0.14.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2 0.5.5",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+dependencies = [
+ "futures-util",
+ "http",
+ "hyper",
+ "log",
+ "rustls 0.21.10",
+ "rustls-native-certs",
+ "tokio",
+ "tokio-rustls",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+dependencies = [
+ "bytes",
+ "hyper",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6a67363e2aa4443928ce15e57ebae94fd8949958fd1223c4cfc0cd473ad7539"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "idna"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "indenter"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
+
+[[package]]
+name = "indexmap"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5477fe2230a79769d8dc68e0eabf5437907c0457a5614a9e8dddb67f65eb65d"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.14.0",
+]
+
+[[package]]
+name = "infer"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64e9829a50b42bb782c1df523f78d332fe371b10c661e78b7a3c34b0198e9fac"
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "integer-encoding"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
+
+[[package]]
+name = "ipnet"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
+
+[[package]]
+name = "itertools"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25db6b064527c5d482d0423354fcd07a89a2dfe07b67892e62411946db7f07b0"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"
+
+[[package]]
+name = "jobserver"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c37f63953c4c63420ed5fd3d6d398c719489b9f872b9fa683262f8edd363c7d"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "lexical-core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cde5de06e8d4c2faabc400238f9ae1c74d5412d03a7bd067645ccbc47070e46"
+dependencies = [
+ "lexical-parse-float",
+ "lexical-parse-integer",
+ "lexical-util",
+ "lexical-write-float",
+ "lexical-write-integer",
+]
+
+[[package]]
+name = "lexical-parse-float"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683b3a5ebd0130b8fb52ba0bdc718cc56815b6a097e28ae5a6997d0ad17dc05f"
+dependencies = [
+ "lexical-parse-integer",
+ "lexical-util",
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-parse-integer"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d0994485ed0c312f6d965766754ea177d07f9c00c9b82a5ee62ed5b47945ee9"
+dependencies = [
+ "lexical-util",
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-util"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5255b9ff16ff898710eb9eb63cb39248ea8a5bb036bea8085b1a767ff6c4e3fc"
+dependencies = [
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-write-float"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accabaa1c4581f05a3923d1b4cfd124c329352288b7b9da09e766b0668116862"
+dependencies = [
+ "lexical-util",
+ "lexical-write-integer",
+ "static_assertions",
+]
+
+[[package]]
+name = "lexical-write-integer"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1b6f3d1f4422866b68192d62f77bc5c700bee84f3069f2469d7bc8c77852446"
+dependencies = [
+ "lexical-util",
+ "static_assertions",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+
+[[package]]
+name = "libloading"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
+
+[[package]]
+name = "lock_api"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+ "serde",
+]
+
+[[package]]
+name = "lz4"
+version = "1.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e9e2dd86df36ce760a60f6ff6ad526f7ba1f14ba0356f8254fb6905e6494df1"
+dependencies = [
+ "libc",
+ "lz4-sys",
+]
+
+[[package]]
+name = "lz4-sys"
+version = "1.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57d27b317e207b10f69f5e75494119e391a96f48861ae870d1da6edac98ca900"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "lzma-sys"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "match_cfg"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
+
+[[package]]
+name = "md-5"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6365506850d44bff6e2fbcb5176cf63650e48bd45ef2fe2665ae1570e0f4b9ca"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "md5"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e6bcd6433cff03a4bfc3d9834d504467db1f1cf6d0ea765d37d330249ed629d"
+
+[[package]]
+name = "memchr"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+
+[[package]]
+name = "memoffset"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4192263c238a5f0d0c6bfd21f336a313a4ce1c450542449ca191bb657b4642ef"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "mio"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "ntapi"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8a3895c6391c39d7fe7ebc444a87eb2991b2a0bc718fdabd071eec617fc68e4"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "num"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05180d69e3da0e530ba2a1dae5110317e49e3b7f3d41be227dc5f92e49ee7af"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+dependencies = [
+ "autocfg",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "num_threads"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2819ce041d2ee131036f4fc9d6ae7ae125a3a40e97ba64d04fe799ad9dabbb44"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+
+[[package]]
+name = "openssl"
+version = "0.10.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cde4d2d9200ad5909f8dac647e29482e07c3a35de8a13fce7c9c7747ad9f671"
+dependencies = [
+ "bitflags 2.4.0",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1665caf8ab2dc9aef43d1c0023bd904633a6a05cb30b0ad59bec2ae986e57a7"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "ordered-float"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "outref"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4030760ffd992bef45b0ae3f10ce1aba99e33464c90d14dd7c039884963ddc7a"
+
+[[package]]
+name = "owo-colors"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1b04fb49957986fdce4d6ee7a65027d55d4b6d2265e5848bbb507b58ccfdb6f"
+
+[[package]]
+name = "p256"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51f44edd08f51e2ade572f141051021c5af22677e42b7dd28a88155151c33594"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "sha2",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core 0.8.6",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core 0.9.7",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60a2cfe6f0ad2bfc16aefa463b497d5c7a5ecd44a23efa72aa342d90177356dc"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall 0.2.16",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9069cbb9f99e3a5083476ccb29ceb1de18b9118cafa53e90c9551235de2b9521"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.2.16",
+ "smallvec",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "parquet"
+version = "41.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6880c32d81884ac4441d9f4b027df8561be23b54f3ac1e62086fa42753dd3faa"
+dependencies = [
+ "ahash 0.8.7",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-data",
+ "arrow-ipc",
+ "arrow-schema",
+ "arrow-select",
+ "base64 0.21.1",
+ "brotli",
+ "bytes",
+ "chrono",
+ "flate2",
+ "futures",
+ "hashbrown 0.13.2",
+ "lz4",
+ "num",
+ "num-bigint",
+ "paste",
+ "seq-macro",
+ "snap",
+ "thrift",
+ "tokio",
+ "twox-hash",
+ "zstd",
+]
+
+[[package]]
+name = "parse-zoneinfo"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c705f256449c60da65e11ff6626e0c16a0a0b96aaa348de61376b249bc340f41"
+dependencies = [
+ "regex",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+
+[[package]]
+name = "pathsearch"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da983bc5e582ab17179c190b4b66c7d76c5943a69c6d34df2a2b6bf8a2977b05"
+dependencies = [
+ "anyhow",
+ "libc",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+
+[[package]]
+name = "pest"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e68e84bfb01f0507134eac1e9b410a12ba379d064eab48c50ba4ce329a527b70"
+dependencies = [
+ "thiserror",
+ "ucd-trie",
+]
+
+[[package]]
+name = "petgraph"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
+dependencies = [
+ "fixedbitset",
+ "indexmap",
+]
+
+[[package]]
+name = "pgrx"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2102faa5ef4a7bf096fefcf67692b293583efd18f9236340ad3169807dfc2b73"
+dependencies = [
+ "atomic-traits",
+ "bitflags 2.4.0",
+ "bitvec",
+ "enum-map",
+ "heapless",
+ "libc",
+ "once_cell",
+ "pgrx-macros",
+ "pgrx-pg-sys",
+ "pgrx-sql-entity-graph",
+ "seahash",
+ "seq-macro",
+ "serde",
+ "serde_cbor",
+ "serde_json",
+ "thiserror",
+ "uuid 1.4.1",
+]
+
+[[package]]
+name = "pgrx-macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c26810d09910ec987a6708d48d243efb5f879331e01c6fec0893714d0eb12bae"
+dependencies = [
+ "pgrx-sql-entity-graph",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "pgrx-pg-config"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b0099ba4b635dfe1e34afc8bca8be43e9577c5d726aaf1dc7dd23a78f6c8a60"
+dependencies = [
+ "cargo_toml",
+ "dirs",
+ "eyre",
+ "owo-colors",
+ "pathsearch",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "toml",
+ "url",
+]
+
+[[package]]
+name = "pgrx-pg-sys"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f40315259c41fede51eb23b791b48d0a112b0f47d0dcb6862b798d1fa1db6ea"
+dependencies = [
+ "bindgen",
+ "clang-sys",
+ "eyre",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "pgrx-macros",
+ "pgrx-pg-config",
+ "pgrx-sql-entity-graph",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "shlex",
+ "sptr",
+ "syn 1.0.109",
+ "walkdir",
+]
+
+[[package]]
+name = "pgrx-sql-entity-graph"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d47a4e991c8c66162c5d6b0fc2bd382e43a58fc893ce05a6a15ddcb1bf7eee4"
+dependencies = [
+ "convert_case",
+ "eyre",
+ "petgraph",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "unescape",
+]
+
+[[package]]
+name = "pgrx-tests"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab3abc01e2bb930b072bd660d04c8eaa69a29d4727d5b2a641f946c603c1605e"
+dependencies = [
+ "clap-cargo",
+ "eyre",
+ "libc",
+ "once_cell",
+ "owo-colors",
+ "pgrx",
+ "pgrx-macros",
+ "pgrx-pg-config",
+ "postgres",
+ "proptest",
+ "rand 0.8.5",
+ "regex",
+ "serde",
+ "serde_json",
+ "sysinfo",
+ "thiserror",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "928c6535de93548188ef63bb7c4036bd415cd8f36ad25af44b9789b2ee72a48c"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8d39688d359e6b34654d328e262234662d16cc0f60ec8dcbe5e718709342a5a"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1181c94580fa345f50f19d738aaa39c0ed30a600d95cb2d3e23f94266f14fbf"
+dependencies = [
+ "phf_shared",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1fb5f6f826b772a8d4c0394209441e7d37cbbb967ae9c7e0e8134365c9ee676"
+dependencies = [
+ "siphasher",
+ "uncased",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fda4ed1c6c173e3fc7a83629421152e01d7b1f9b7f65fb301e490e8cfc656422"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkcs8"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69d3587f8a9e599cc7ec2c00e331f71c4e69a5f9a4b8a6efd5b07466b9736f9a"
+
+[[package]]
+name = "postgres"
+version = "0.19.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7915b33ed60abc46040cbcaa25ffa1c7ec240668e0477c4f3070786f5916d451"
+dependencies = [
+ "bytes",
+ "fallible-iterator",
+ "futures-util",
+ "log",
+ "tokio",
+ "tokio-postgres",
+]
+
+[[package]]
+name = "postgres-protocol"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49b6c5ef183cd3ab4ba005f1ca64c21e8bd97ce4699cfea9e8d9a2c4958ca520"
+dependencies = [
+ "base64 0.21.1",
+ "byteorder",
+ "bytes",
+ "fallible-iterator",
+ "hmac",
+ "md-5",
+ "memchr",
+ "rand 0.8.5",
+ "sha2",
+ "stringprep",
+]
+
+[[package]]
+name = "postgres-types"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f028f05971fe20f512bcc679e2c10227e57809a3af86a7606304435bc8896cd6"
+dependencies = [
+ "bytes",
+ "fallible-iterator",
+ "postgres-protocol",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "pretty-hex"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6fa0831dd7cc608c38a5e323422a0077678fa5744aa2be4ad91c4ece8eec8d5"
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b2685dd208a3771337d8d386a89840f0f43cd68be8dae90a5f8c2384effc9cd"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.70"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proptest"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e35c06b98bf36aba164cc17cb25f7e232f5c4aeea73baa14b8a9f0d92dbfa65"
+dependencies = [
+ "bit-set",
+ "bitflags 1.3.2",
+ "byteorder",
+ "lazy_static",
+ "num-traits",
+ "rand 0.8.5",
+ "rand_chacha 0.3.1",
+ "rand_xorshift",
+ "regex-syntax 0.6.29",
+ "rusty-fork",
+ "tempfile",
+ "unarray",
+]
+
+[[package]]
+name = "ptr_meta"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0738ccf7ea06b608c10564b31debd4f5bc5e197fc8bfe088f68ae5ce81e7a4f1"
+dependencies = [
+ "ptr_meta_derive",
+]
+
+[[package]]
+name = "ptr_meta_derive"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16b845dbfca988fa33db069c0e230574d15a3088f147a87b64c7589eb662c9ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "radium"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom 0.1.16",
+ "libc",
+ "rand_chacha 0.2.2",
+ "rand_core 0.5.1",
+ "rand_hc",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom 0.1.16",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.12",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d25bf25ec5ae4a3f1b92f929810509a2f53d7dca2f50b794ff57e3face536c8f"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rayon"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
+[[package]]
+name = "redis"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c580d9cbbe1d1b479e8d67cf9daf6a62c957e6846048408b80b43ac3f6af84cd"
+dependencies = [
+ "combine",
+ "itoa",
+ "percent-encoding",
+ "ryu",
+ "sha1_smol",
+ "socket2 0.4.10",
+ "url",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+dependencies = [
+ "getrandom 0.2.12",
+ "redox_syscall 0.2.16",
+ "thiserror",
+]
+
+[[package]]
+name = "regex"
+version = "1.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax 0.8.2",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.2",
+]
+
+[[package]]
+name = "regex-lite"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30b661b2f27137bdbc16f00eda72866a92bb28af1753ffbd56744fb6e2e9cd8e"
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+
+[[package]]
+name = "rend"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2571463863a6bd50c32f94402933f03457a3fbaf697a707c5be741e459f08fd"
+dependencies = [
+ "bytecheck",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.11.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b1ae8d9ac08420c66222fb9096fc5de435c3c48542bc5336c51892cffafb41"
+dependencies = [
+ "base64 0.21.1",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-rustls",
+ "hyper-tls",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "mime_guess",
+ "native-tls",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls 0.21.10",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "system-configuration",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-rustls",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots",
+ "winreg",
+]
+
+[[package]]
+name = "reqwest-middleware"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88a3e86aa6053e59030e7ce2d2a3b258dd08fc2d337d52f73f6cb480f5858690"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "http",
+ "reqwest",
+ "serde",
+ "task-local-extensions",
+ "thiserror",
+]
+
+[[package]]
+name = "reqwest-retry"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6a11c05102e5bec712c0619b8c7b7eda8b21a558a0bd981ceee15c38df8be4"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "chrono",
+ "futures",
+ "getrandom 0.2.12",
+ "http",
+ "hyper",
+ "parking_lot 0.11.2",
+ "reqwest",
+ "reqwest-middleware",
+ "retry-policies",
+ "task-local-extensions",
+ "tokio",
+ "tracing",
+ "wasm-timer",
+]
+
+[[package]]
+name = "retain_mut"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4389f1d5789befaf6029ebd9f7dac4af7f7e3d61b69d4f30e2ac02b57e7712b0"
+
+[[package]]
+name = "retry-policies"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e09bbcb5003282bcb688f0bae741b278e9c7e8f378f561522c9806c58e075d9b"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "rfc6979"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7743f17af12fa0b03b803ba12cd6a8d9483a587e89c69445e3909655c0b9fabb"
+dependencies = [
+ "crypto-bigint 0.4.9",
+ "hmac",
+ "zeroize",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "688c63d65483050968b2a8937f7995f443e27041a0f7700aa59b0822aedebb74"
+dependencies = [
+ "cc",
+ "getrandom 0.2.12",
+ "libc",
+ "spin",
+ "untrusted",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "rkyv"
+version = "0.7.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527a97cdfef66f65998b5f3b637c26f5a5ec09cc52a3f9932313ac645f4190f5"
+dependencies = [
+ "bitvec",
+ "bytecheck",
+ "bytes",
+ "hashbrown 0.12.3",
+ "ptr_meta",
+ "rend",
+ "rkyv_derive",
+ "seahash",
+ "tinyvec",
+ "uuid 1.4.1",
+]
+
+[[package]]
+name = "rkyv_derive"
+version = "0.7.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5c462a1328c8e67e4d6dbad1eb0355dd43e8ab432c6e227a43657f16ade5033"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "rust_decimal"
+version = "1.33.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06676aec5ccb8fc1da723cc8c0f9a46549f21ebb8753d3915c6c41db1e7f1dc4"
+dependencies = [
+ "arrayvec",
+ "borsh",
+ "bytes",
+ "num-traits",
+ "rand 0.8.5",
+ "rkyv",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc_version"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0dfe2087c51c460008730de8b57e6a320782fbfb312e1f4d520e6c6fae155ee"
+dependencies = [
+ "semver 0.11.0",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver 1.0.17",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed"
+dependencies = [
+ "bitflags 2.4.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.21.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
+[[package]]
+name = "rustls"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.1",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e9d979b3ce68192e42760c7810125eb6cf2ea10efae545a156063e61f314e2a"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.102.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef4ca26037c909dedb327b48c3327d0ba91d3dd3c4e05dad328f210ffb68e95b"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rusty-fork"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
+dependencies = [
+ "fnv",
+ "quick-error",
+ "tempfile",
+ "wait-timeout",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbc91545643bcf3a0bbb6569265615222618bdf33ce4ffbbd13c4bbd4c093534"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "seahash"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
+
+[[package]]
+name = "sec1"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05b64fb303737d99b81884b2c63433e9ae28abebe5eb5045dcdd175dc2ecf4de"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e932934257d3b408ed8f30db49d85ea163bfe74961f017f405b025af298f0c7a"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f301af10236f6df4160f7c3f04eec6dbc70ace82d23326abad5edee88801c6b6"
+dependencies = [
+ "semver-parser",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"
+
+[[package]]
+name = "semver-parser"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0bef5b7f9e0df16536d3961cfb6e84331c065b4066afb39768d0e319411f7"
+dependencies = [
+ "pest",
+]
+
+[[package]]
+name = "seq-macro"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6b44e8fc93a14e66336d230954dda83d18b4605ccace8fe09bc7514a71ad0bc"
+
+[[package]]
+name = "serde"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_cbor"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bef2ebfde456fb76bbcf9f59315333decc4fda0b2b44b420243c11e0f5ec1f5"
+dependencies = [
+ "half 1.8.2",
+ "serde",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.96"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "057d394a50403bcac12672b2b18fb387ab6d289d957dab67dd201875391e52f1"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_qs"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7715380eec75f029a4ef7de39a9200e0a63823176b759d055b613f5a87df6a6"
+dependencies = [
+ "percent-encoding",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12022b835073e5b11e90a14f86838ceb1c8fb0325b72416845c487ac0fa95e80"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha1_smol"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae1a47186c03a32177042e55dbc5fd5aee900b8e0069a8d70fba96a9375cd012"
+
+[[package]]
+name = "sha2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "1.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27f6278552951f1f2b8cf9da965d10969b2efdea95a6ec47987ab46edfe263a"
+
+[[package]]
+name = "siphasher"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bd3e3206899af3f8b12af284fafc038cc1dc2b41d1b89dd17297221c5d225de"
+
+[[package]]
+name = "slab"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6528351c9bc8ab22353f9d776db39a20288e8d6c37ef8cfe3317cf875eecfc2d"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+
+[[package]]
+name = "snap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b"
+
+[[package]]
+name = "socket2"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "socket2"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
+dependencies = [
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sptr"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a"
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "stringprep"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee348cb74b87454fff4b551cbf727025810a004f88aeacae7f85b87f4e9a1c1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "subtle"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+
+[[package]]
+name = "supabase-wrappers"
+version = "0.1.17"
+dependencies = [
+ "pgrx",
+ "pgrx-tests",
+ "supabase-wrappers-macros",
+ "thiserror",
+ "tokio",
+ "uuid 1.4.1",
+]
+
+[[package]]
+name = "supabase-wrappers-macros"
+version = "0.1.15"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239814284fd6f1a4ffe4ca893952cdd93c224b6a1571c9a9eadd670295c0c9e2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn_derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1329189c02ff984e9736652b1631330da25eaa6bc639089ed4915d25446cbe7b"
+dependencies = [
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "sysinfo"
+version = "0.29.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a18d114d420ada3a891e6bc8e96a2023402203296a47cdd65083377dad18ba5"
+dependencies = [
+ "cfg-if",
+ "core-foundation-sys",
+ "libc",
+ "ntapi",
+ "once_cell",
+ "rayon",
+ "winapi",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
+[[package]]
+name = "task-local-extensions"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba323866e5d033818e3240feeb9f7db2c4296674e4d9e16b97b7bf8f490434e8"
+dependencies = [
+ "pin-utils",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+dependencies = [
+ "cfg-if",
+ "fastrand 2.0.0",
+ "redox_syscall 0.3.5",
+ "rustix",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d6d7a740b8a666a7e828dd00da9c0dc290dff53154ea77ac109281de90589b7"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "thrift"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e54bc85fc7faa8bc175c4bab5b92ba8d9a3ce893d0e9f42cc455c8ab16a9e09"
+dependencies = [
+ "byteorder",
+ "integer-encoding",
+ "ordered-float",
+]
+
+[[package]]
+name = "tiberius"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc6e2bf3e4b5be181a2a2ceff4b9b12e2684010d436a6958bd564fbc8094d44d"
+dependencies = [
+ "async-native-tls",
+ "async-trait",
+ "asynchronous-codec",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "connection-string",
+ "encoding",
+ "enumflags2",
+ "futures-util",
+ "num-traits",
+ "once_cell",
+ "pin-project-lite",
+ "pretty-hex",
+ "rust_decimal",
+ "thiserror",
+ "tracing",
+ "uuid 1.4.1",
+ "winauth",
+]
+
+[[package]]
+name = "time"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+dependencies = [
+ "deranged",
+ "itoa",
+ "libc",
+ "num_threads",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "time-macros"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+dependencies = [
+ "time-core",
+]
+
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.35.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89b4efa943be685f629b149f53829423f8f5531ea21249408e8e2f8671ec104"
+dependencies = [
+ "backtrace",
+ "bytes",
+ "libc",
+ "mio",
+ "num_cpus",
+ "parking_lot 0.12.1",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2 0.5.5",
+ "tokio-macros",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-postgres"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d340244b32d920260ae7448cb72b6e238bddc3d4f7603394e7dd46ed8e48f5b8"
+dependencies = [
+ "async-trait",
+ "byteorder",
+ "bytes",
+ "fallible-iterator",
+ "futures-channel",
+ "futures-util",
+ "log",
+ "parking_lot 0.12.1",
+ "percent-encoding",
+ "phf",
+ "pin-project-lite",
+ "postgres-protocol",
+ "postgres-types",
+ "rand 0.8.5",
+ "socket2 0.5.5",
+ "tokio",
+ "tokio-util",
+ "whoami",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.10",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "806fe8c2c87eccc8b3267cbae29ed3ab2d0bd37fca70ab622e46aaa9375ddb7d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-util",
+ "hashbrown 0.12.3",
+ "pin-project-lite",
+ "slab",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1a195ec8c9da26928f773888e0742ca3ca1040c6cd859c919c9f59c1954ab35"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d34d383cd00a163b4a5b85053df514d45bc330f6de7737edfe0a93311d1eaa03"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "twox-hash"
+version = "1.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
+dependencies = [
+ "cfg-if",
+ "static_assertions",
+]
+
+[[package]]
+name = "typenum"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e79c4d996edb816c91e4308506774452e55e95c3c9de07b6729e17e15a5ef81"
+
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
+[[package]]
+name = "uncased"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b9bc53168a4be7402ab86c3aad243a84dd7381d09be0eddc81280c1da95ca68"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "unescape"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccb97dac3243214f8d8507998906ca3e2e0b900bf9bf4870477f125b82e68f6e"
+
+[[package]]
+name = "unicase"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7d2d4dafb69621809a81864c9c1b864479e1235c0dd4e199924b9742439ed89"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5464a87b239f13a63a501f2701565754bae92d243d4bb7eb12f6d57d2269bf4"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+
+[[package]]
+name = "uuid"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79daa5ed5740825c40b389c5e50312b9c86df53fccd33f281df655642b43869d"
+dependencies = [
+ "getrandom 0.2.12",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "vsimd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+
+[[package]]
+name = "wait-timeout"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f200f5b12eb75f8c1ed65abd4b2db8a6e1b138a20de009dacee265a2498f3f6"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "waker-fn"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"
+
+[[package]]
+name = "walkdir"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+
+[[package]]
+name = "wasm-timer"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be0ecb0db480561e9a7642b5d3e4187c128914e58aa84330b9493e3eb68c5e7f"
+dependencies = [
+ "futures",
+ "js-sys",
+ "parking_lot 0.11.2",
+ "pin-utils",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.25.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1778a42e8b3b90bff8d0f5032bf22250792889a5cdc752aa0020c84abe3aaf10"
+
+[[package]]
+name = "whoami"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22fc3756b8a9133049b26c7f61ab35416c130e8c09b660f5b3958b446f52cc50"
+dependencies = [
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "winauth"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f820cd208ce9c6b050812dc2d724ba98c6c1e9db5ce9b3f58d925ae5723a5e6"
+dependencies = [
+ "bitflags 1.3.2",
+ "byteorder",
+ "md5",
+ "rand 0.7.3",
+ "winapi",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets 0.52.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.0",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.0",
+ "windows_aarch64_msvc 0.48.0",
+ "windows_i686_gnu 0.48.0",
+ "windows_i686_msvc 0.48.0",
+ "windows_x86_64_gnu 0.48.0",
+ "windows_x86_64_gnullvm 0.48.0",
+ "windows_x86_64_msvc 0.48.0",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.0",
+ "windows_aarch64_msvc 0.52.0",
+ "windows_i686_gnu 0.52.0",
+ "windows_i686_msvc 0.52.0",
+ "windows_x86_64_gnu 0.52.0",
+ "windows_x86_64_gnullvm 0.52.0",
+ "windows_x86_64_msvc 0.52.0",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+
+[[package]]
+name = "winnow"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c2e3184b9c4e92ad5167ca73039d0c42476302ab603e2fec4487511f38ccefc"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "wiremock"
+version = "0.5.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13a3a53eaf34f390dd30d7b1b078287dd05df2aa2e21a589ccb80f5c7253c2e9"
+dependencies = [
+ "assert-json-diff",
+ "async-trait",
+ "base64 0.21.1",
+ "deadpool",
+ "futures",
+ "futures-timer",
+ "http-types",
+ "hyper",
+ "log",
+ "once_cell",
+ "regex",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "wrappers"
+version = "0.3.0"
+dependencies = [
+ "arrow-array",
+ "async-compression",
+ "aws-config",
+ "aws-sdk-cognitoidentityprovider",
+ "aws-sdk-s3",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "chrono",
+ "chrono-tz",
+ "clickhouse-rs",
+ "csv",
+ "futures",
+ "gcp-bigquery-client",
+ "http",
+ "num-traits",
+ "parquet",
+ "pgrx",
+ "pgrx-tests",
+ "redis",
+ "regex",
+ "reqwest",
+ "reqwest-middleware",
+ "reqwest-retry",
+ "serde",
+ "serde_json",
+ "supabase-wrappers",
+ "thiserror",
+ "tiberius",
+ "tokio",
+ "tokio-util",
+ "url",
+ "wiremock",
+ "yup-oauth2",
+]
+
+[[package]]
+name = "wyz"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+dependencies = [
+ "tap",
+]
+
+[[package]]
+name = "xmlparser"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
+
+[[package]]
+name = "xz2"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2"
+dependencies = [
+ "lzma-sys",
+]
+
+[[package]]
+name = "yup-oauth2"
+version = "8.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b61da40aeb0907a65f7fb5c1de83c5a224d6a9ebb83bf918588a2bb744d636b8"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "base64 0.21.1",
+ "futures",
+ "http",
+ "hyper",
+ "hyper-rustls",
+ "itertools",
+ "log",
+ "percent-encoding",
+ "rustls 0.22.2",
+ "rustls-pemfile",
+ "seahash",
+ "serde",
+ "serde_json",
+ "time",
+ "tokio",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+
+[[package]]
+name = "zstd"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a27595e173641171fc74a1232b7b1c7a7cb6e18222c11e9dfb9888fa424c53c"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "6.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee98ffd0b48ee95e6c5168188e44a54550b1564d9d530ee21d5f0eaed1069581"
+dependencies = [
+ "libc",
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.9+zstd.1.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e16efa8a874a0481a574084d34cc26fdb3b99627480f785888deb6386506656"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/nix/ext/wrappers/default.nix b/nix/ext/wrappers/default.nix
index fe8074189..218c65e77 100644
--- a/nix/ext/wrappers/default.nix
+++ b/nix/ext/wrappers/default.nix
@@ -1,212 +1,217 @@
 {
   lib,
   stdenv,
+  callPackages,
   fetchFromGitHub,
   openssl,
   pkg-config,
   postgresql,
-  buildPgrxExtension_0_12_9,
+  buildEnv,
   darwin,
   rust-bin,
   git,
 }:
 let
-  rustVersion = "1.84.0";
-  cargo = rust-bin.stable.${rustVersion}.default;
-in
-buildPgrxExtension_0_12_9 rec {
-  pname = "supabase-wrappers";
-  version = "0.5.0";
-  # update the following array when the wrappers version is updated
-  # required to ensure that extensions update scripts from previous versions are generated
-  previousVersions = [
-    "0.4.6"
-    "0.4.5"
-    "0.4.4"
-    "0.4.3"
-    "0.4.2"
-    "0.4.1"
-    "0.4.0"
-    "0.3.1"
-    "0.3.0"
-    "0.2.0"
-    "0.1.19"
-    "0.1.18"
-    "0.1.17"
-    "0.1.16"
-    "0.1.15"
-    "0.1.14"
-    "0.1.12"
-    "0.1.11"
-    "0.1.10"
-    "0.1.9"
-    "0.1.8"
-    "0.1.7"
-    "0.1.6"
-    "0.1.5"
-    "0.1.4"
-    "0.1.1"
-    "0.1.0"
-  ];
-  inherit postgresql;
-  src = fetchFromGitHub {
-    owner = "supabase";
-    repo = "wrappers";
-    rev = "v${version}";
-    hash = "sha256-FbRTUcpEHBa5DI6dutvBeahYM0RZVAXIzIAZWIaxvn0";
-  };
+  pname = "wrappers";
+  build =
+    version: hash: rustVersion: pgrxVersion:
+    let
+      cargo = rust-bin.stable.${rustVersion}.default;
+      #previousVersions = lib.filter (v: v != version) versions; # FIXME
+      mkPgrxExtension = callPackages ../../cargo-pgrx/mkPgrxExtension.nix {
+        inherit rustVersion pgrxVersion;
+      };
+    in
+    mkPgrxExtension (
+      rec {
+        inherit pname version postgresql;
 
-  nativeBuildInputs = [
-    pkg-config
-    cargo
-    git
-  ];
-  buildInputs =
-    [
-      openssl
-      postgresql
-    ]
-    ++ lib.optionals (stdenv.isDarwin) [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
-
-  NIX_LDFLAGS = "-L${postgresql}/lib -lpq";
-
-  # Set necessary environment variables for pgrx in darwin only
-  env = lib.optionalAttrs stdenv.isDarwin {
-    POSTGRES_LIB = "${postgresql}/lib";
-    RUSTFLAGS = "-C link-arg=-undefined -C link-arg=dynamic_lookup";
-    # Calculate unique port for each PostgreSQL version:
-    # - Check if version contains underscore (indicating OrioleDB)
-    # - Add 1 to port if it's OrioleDB
-    # - Add 2 for each major version above 15
-    # Examples:
-    # - PostgreSQL 15.8 → 5435 + 0 + (15-15)*2 = 5435
-    # - PostgreSQL 17_0 (OrioleDB) → 5435 + 1 + (17-15)*2 = 5440
-    # - PostgreSQL 17.4 → 5435 + 0 + (17-15)*2 = 5439
-    PGPORT = toString (
-      5534
-      + (if builtins.match ".*_.*" postgresql.version != null then 1 else 0)
-      # +1 for OrioleDB
-      + ((builtins.fromJSON (builtins.substring 0 2 postgresql.version)) - 15) * 2
-    ); # +2 for each major version
-  };
+        src = fetchFromGitHub {
+          owner = "supabase";
+          repo = "wrappers";
+          rev = "v${version}";
+          inherit hash;
+        };
 
-  OPENSSL_NO_VENDOR = 1;
-  #need to set this to 2 to avoid cpu starvation
-  CARGO_BUILD_JOBS = "2";
-  CARGO = "${cargo}/bin/cargo";
-
-  #CARGO_NET_GIT_FETCH_WITH_CLI = "true";
-  cargoLock = {
-    lockFile = "${src}/Cargo.lock";
-    allowBuiltinFetchGit = false;
-    outputHashes = {
-      "clickhouse-rs-1.1.0-alpha.1" = "sha256-G+v4lNP5eK2U45D1fL90Dq24pUSlpIysNCxuZ17eac0=";
-    };
-  };
+        nativeBuildInputs = [
+          pkg-config
+          cargo
+          git
+        ];
+        buildInputs =
+          [
+            openssl
+            postgresql
+          ]
+          ++ lib.optionals stdenv.isDarwin [
+            darwin.apple_sdk.frameworks.CoreFoundation
+            darwin.apple_sdk.frameworks.Security
+            darwin.apple_sdk.frameworks.SystemConfiguration
+          ];
 
-  preConfigure = ''
-    cd wrappers
-
-    # update the clickhouse-rs dependency
-    # append the branch name to the git URL to help cargo locate the commit
-    # while maintaining the rev for reproducibility
-    awk -i inplace '
-    /\[dependencies.clickhouse-rs\]/ {
-      print
-      getline
-      if ($0 ~ /git =/) {
-        print "git = \"https://github.com/suharev7/clickhouse-rs/async-await\""
-      } else {
-        print
-      }
-      while ($0 !~ /^\[/ && NF > 0) {
-        getline
-        if ($0 ~ /rev =/) print
-        if ($0 ~ /^\[/) print
-      }
-      next
-    }
-    { print }
-    ' Cargo.toml
+        NIX_LDFLAGS = "-L${postgresql}/lib -lpq";
 
-    # Verify the file is still valid TOML, break build with this error
-    # if it is not
-    if ! cargo verify-project 2>/dev/null; then
-      echo "Failed to maintain valid TOML syntax"
-      exit 1
-    fi
+        # Set necessary environment variables for pgrx in darwin only
+        env = lib.optionalAttrs stdenv.isDarwin {
+          POSTGRES_LIB = "${postgresql}/lib";
+          RUSTFLAGS = "-C link-arg=-undefined -C link-arg=dynamic_lookup";
+        };
 
-    cd ..
-  '';
+        OPENSSL_NO_VENDOR = 1;
+        #need to set this to 2 to avoid cpu starvation
+        CARGO_BUILD_JOBS = "2";
+        CARGO = "${cargo}/bin/cargo";
 
-  buildAndTestSubdir = "wrappers";
-  buildFeatures = [
-    "helloworld_fdw"
-    "all_fdws"
-  ];
-  doCheck = false;
+        cargoLock = {
+          lockFile = "${src}/Cargo.lock";
+          outputHashes =
+            if builtins.compareVersions "0.4.2" version >= 0 then
+              { "clickhouse-rs-1.0.0-alpha.1" = "sha256-0zmoUo/GLyCKDLkpBsnLAyGs1xz6cubJhn+eVqMEMaw="; }
+            else if builtins.compareVersions "0.5.0" version >= 0 then
+              { "clickhouse-rs-1.1.0-alpha.1" = "sha256-G+v4lNP5eK2U45D1fL90Dq24pUSlpIysNCxuZ17eac0="; }
+            else if builtins.compareVersions "0.5.2" version == 0 then
+              {
+                "clickhouse-rs-1.1.0-alpha.1" = "sha256-nKiGzdsAgJej8NgyVOqHaD1sZLrNF1RPfEhu2pRwZ6o=";
+                "iceberg-catalog-s3tables-0.5.1" = "sha256-1JkB2JExukABlbW1lZPolNQCYb9URi8xNYY3APmiGq0=";
+              }
+            else if builtins.compareVersions "0.5.3" version == 0 then
+              {
+                "clickhouse-rs-1.1.0-alpha.1" = "sha256-nKiGzdsAgJej8NgyVOqHaD1sZLrNF1RPfEhu2pRwZ6o=";
+                "iceberg-catalog-s3tables-0.5.1" = "sha256-1JkB2JExukABlbW1lZPolNQCYb9URi8xNYY3APmiGq0=";
+              }
+            else
+              {
+                "clickhouse-rs-1.1.0-alpha.1" = "sha256-nKiGzdsAgJej8NgyVOqHaD1sZLrNF1RPfEhu2pRwZ6o=";
+                "iceberg-0.5.0" = "sha256-dYPZdpP7kcp49UxsCZrZi3xMJ4rJiB8H65dMMR9Z1Yk=";
+              };
+        };
 
-  preBuild = ''
-    echo "Processing git tags..."
-    echo '${builtins.concatStringsSep "," previousVersions}' | sed 's/,/\n/g' > git_tags.txt
-  '';
+        preConfigure = ''
+          cd wrappers
+
+          # update the clickhouse-rs dependency
+          # append the branch name to the git URL to help cargo locate the commit
+          # while maintaining the rev for reproducibility
+          awk -i inplace '
+          /\[dependencies.clickhouse-rs\]/ {
+            print
+            getline
+            if ($0 ~ /git =/) {
+              print "git = \"https://github.com/burmecia/clickhouse-rs/supabase-patch\""
+            } else {
+              print
+            }
+            while ($0 !~ /^\[/ && NF > 0) {
+              getline
+              if ($0 ~ /rev =/) print
+              if ($0 ~ /^\[/) print
+            }
+            next
+          }
+          { print }
+          ' Cargo.toml
+
+          # Verify the file is still valid TOML, break build with this erroru
+          # if it is not
+          if ! cargo verify-project 2>/dev/null; then
+            echo "Failed to maintain valid TOML syntax"
+            exit 1
+          fi
 
-  postInstall = ''
-     echo "Modifying main SQL file to use unversioned library name..."
-     current_version="${version}"
-     main_sql_file="$out/share/postgresql/extension/wrappers--$current_version.sql"
-     if [ -f "$main_sql_file" ]; then
-       sed -i 's|$libdir/wrappers-[0-9.]*|$libdir/wrappers|g' "$main_sql_file"
-       echo "Modified $main_sql_file"
-     else
-       echo "Warning: $main_sql_file not found"
-     fi
-     echo "Creating and modifying SQL files for previous versions..."
-     
-     if [ -f "$main_sql_file" ]; then
-       while read -r previous_version; do
-         if [ "$(printf '%s\n' "$previous_version" "$current_version" | sort -V | head -n1)" = "$previous_version" ] && [ "$previous_version" != "$current_version" ]; then
-           new_file="$out/share/postgresql/extension/wrappers--$previous_version--$current_version.sql"
-           echo "Creating $new_file"
-           cp "$main_sql_file" "$new_file"
-           sed -i 's|$libdir/wrappers-[0-9.]*|$libdir/wrappers|g' "$new_file"
-           echo "Modified $new_file"
-         fi
-       done < git_tags.txt
-     else
-       echo "Warning: $main_sql_file not found"
-     fi
-     mv $out/lib/wrappers-${version}${postgresql.dlSuffix} $out/lib/wrappers${postgresql.dlSuffix}
-     ln -s $out/lib/wrappers${postgresql.dlSuffix} $out/lib/wrappers-${version}${postgresql.dlSuffix}
-
-    echo "Creating wrappers.so symlinks to support pg_upgrade..."
-    if [ -f "$out/lib/wrappers.so" ]; then
-      while read -r previous_version; do
-        if [ "$(printf '%s\n' "$previous_version" "$current_version" | sort -V | head -n1)" = "$previous_version" ] && [ "$previous_version" != "$current_version" ]; then
-          new_file="$out/lib/wrappers-$previous_version.so"
-          echo "Creating $new_file"
-          ln -s "$out/lib/wrappers.so" "$new_file"
+          cd ..
+        '';
+
+        buildAndTestSubdir = "wrappers";
+        buildFeatures = [
+          "helloworld_fdw"
+          "all_fdws"
+        ];
+        doCheck = false;
+
+        postInstall = ''
+           create_control_files() {
+             sed -e "/^default_version =/d" \
+                 -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
+               $out/share/postgresql/extension/${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
+             rm $out/share/postgresql/extension/${pname}.control
+
+             if [[ "${version}" == "${latestVersion}" ]]; then
+               {
+                 echo "default_version = '${latestVersion}'"
+                 cat $out/share/postgresql/extension/${pname}--${latestVersion}.control
+               } > $out/share/postgresql/extension/${pname}.control
+               ln -sfn ${pname}-${latestVersion}${postgresql.dlSuffix} $out/lib/${pname}${postgresql.dlSuffix}
+             fi
+           }
+
+          create_control_files
+        '';
+
+        meta = with lib; {
+          description = "Various Foreign Data Wrappers (FDWs) for PostreSQL";
+          homepage = "https://github.com/supabase/wrappers";
+          license = licenses.postgresql;
+          inherit (postgresql.meta) platforms;
+        };
+      }
+      // lib.optionalAttrs (version == "0.3.0") {
+        patches = [ ./0001-bump-pgrx-to-0.11.3.patch ];
+
+        cargoLock = {
+          lockFile = ./Cargo.lock-0.3.0;
+          outputHashes = {
+            "clickhouse-rs-1.0.0-alpha.1" = "sha256-0zmoUo/GLyCKDLkpBsnLAyGs1xz6cubJhn+eVqMEMaw=";
+          };
+        };
+      }
+    );
+  allVersions = (builtins.fromJSON (builtins.readFile ../versions.json)).wrappers;
+  supportedVersions = lib.filterAttrs (
+    _: value: builtins.elem (lib.versions.major postgresql.version) value.postgresql
+  ) allVersions;
+  versions = lib.naturalSort (lib.attrNames supportedVersions);
+  latestVersion = lib.last versions;
+  numberOfVersions = builtins.length versions;
+  packages = builtins.attrValues (
+    lib.mapAttrs (name: value: build name value.hash value.rust value.pgrx) supportedVersions
+  );
+in
+buildEnv {
+  name = pname;
+  paths = packages;
+  pathsToLink = [
+    "/lib"
+    "/share/postgresql/extension"
+  ];
+  postBuild = ''
+    # checks
+    (set -x
+       test "$(ls -A $out/lib/${pname}*${postgresql.dlSuffix} | wc -l)" = "${
+         toString (numberOfVersions + 1)
+       }"
+    )
+
+    create_sql_files() {
+      PREVIOUS_VERSION=""
+      while IFS= read -r i; do
+        FILENAME=$(basename "$i")
+        DIRNAME=$(dirname "$i")
+        VERSION="$(grep -oE '[0-9]+\.[0-9]+\.[0-9]+' <<< $FILENAME)"
+        if [[ "$PREVIOUS_VERSION" != "" ]]; then
+          echo "Processing $i"
+          MIGRATION_FILENAME="$DIRNAME/''${FILENAME/$VERSION/$PREVIOUS_VERSION--$VERSION}"
+          cp "$i" "$MIGRATION_FILENAME"
         fi
-      done < git_tags.txt
-    else
-      echo "Warning: $out/lib/wrappers.so not found"
-    fi
-
-     rm git_tags.txt
-     echo "Contents of updated wrappers.control:"
-     cat "$out/share/postgresql/extension/wrappers.control"
-     echo "List of generated SQL files:"
-     ls -l $out/share/postgresql/extension/wrappers--*.sql
-  '';
+        PREVIOUS_VERSION="$VERSION"
+      done < <(find $out -name '*.sql' | sort -V)
+    }
 
-  meta = with lib; {
-    description = "Various Foreign Data Wrappers (FDWs) for PostreSQL";
-    homepage = "https://github.com/supabase/wrappers";
-    platforms = postgresql.meta.platforms;
-    license = licenses.postgresql;
+    create_sql_files
+  '';
+  passthru = {
+    inherit versions numberOfVersions;
+    pname = "${pname}-all";
+    version =
+      "multi-" + lib.concatStringsSep "-" (map (v: lib.replaceStrings [ "." ] [ "-" ] v) versions);
   };
 }
diff --git a/nix/tests/expected/z_15_ext_interface.out b/nix/tests/expected/z_15_ext_interface.out
index 540bee2e8..c652a95eb 100644
--- a/nix/tests/expected/z_15_ext_interface.out
+++ b/nix/tests/expected/z_15_ext_interface.out
@@ -126,7 +126,7 @@ order by
  unaccent                     | t
  uuid-ossp                    | t
  vector                       | t
- wrappers                     | f
+ wrappers                     | t
  xml2                         | f
 (79 rows)
 
@@ -5184,12 +5184,18 @@ order by
  wrappers               | public                   | cognito_fdw_handler                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers               | public                   | cognito_fdw_meta                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers               | public                   | cognito_fdw_validator                            | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
+ wrappers               | public                   | duckdb_fdw_handler                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
+ wrappers               | public                   | duckdb_fdw_meta                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
+ wrappers               | public                   | duckdb_fdw_validator                             | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers               | public                   | firebase_fdw_handler                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers               | public                   | firebase_fdw_meta                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers               | public                   | firebase_fdw_validator                           | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers               | public                   | hello_world_fdw_handler                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers               | public                   | hello_world_fdw_meta                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers               | public                   | hello_world_fdw_validator                        | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
+ wrappers               | public                   | iceberg_fdw_handler                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
+ wrappers               | public                   | iceberg_fdw_meta                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
+ wrappers               | public                   | iceberg_fdw_validator                            | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers               | public                   | logflare_fdw_handler                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers               | public                   | logflare_fdw_meta                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers               | public                   | logflare_fdw_validator                           | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
@@ -5221,7 +5227,7 @@ order by
  xml2                   | public                   | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                   | public                   | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                   | public                   | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(5051 rows)
+(5057 rows)
 
 /*
 
diff --git a/nix/tests/expected/z_17_ext_interface.out b/nix/tests/expected/z_17_ext_interface.out
index f7750f849..d31894bc3 100644
--- a/nix/tests/expected/z_17_ext_interface.out
+++ b/nix/tests/expected/z_17_ext_interface.out
@@ -113,7 +113,7 @@ order by
  unaccent                     | t
  uuid-ossp                    | t
  vector                       | t
- wrappers                     | f
+ wrappers                     | t
  xml2                         | f
 (72 rows)
 
@@ -4828,12 +4828,18 @@ order by
  wrappers             | public         | cognito_fdw_handler                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | cognito_fdw_meta                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | cognito_fdw_validator                            | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
+ wrappers             | public         | duckdb_fdw_handler                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
+ wrappers             | public         | duckdb_fdw_meta                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
+ wrappers             | public         | duckdb_fdw_validator                             | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers             | public         | firebase_fdw_handler                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | firebase_fdw_meta                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | firebase_fdw_validator                           | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers             | public         | hello_world_fdw_handler                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | hello_world_fdw_meta                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | hello_world_fdw_validator                        | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
+ wrappers             | public         | iceberg_fdw_handler                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
+ wrappers             | public         | iceberg_fdw_meta                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
+ wrappers             | public         | iceberg_fdw_validator                            | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers             | public         | logflare_fdw_handler                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | logflare_fdw_meta                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | logflare_fdw_validator                           | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
@@ -4865,7 +4871,7 @@ order by
  xml2                 | public         | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                 | public         | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                 | public         | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(4708 rows)
+(4714 rows)
 
 /*
 
diff --git a/nix/tests/expected/z_orioledb-17_ext_interface.out b/nix/tests/expected/z_orioledb-17_ext_interface.out
index f7750f849..d31894bc3 100644
--- a/nix/tests/expected/z_orioledb-17_ext_interface.out
+++ b/nix/tests/expected/z_orioledb-17_ext_interface.out
@@ -113,7 +113,7 @@ order by
  unaccent                     | t
  uuid-ossp                    | t
  vector                       | t
- wrappers                     | f
+ wrappers                     | t
  xml2                         | f
 (72 rows)
 
@@ -4828,12 +4828,18 @@ order by
  wrappers             | public         | cognito_fdw_handler                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | cognito_fdw_meta                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | cognito_fdw_validator                            | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
+ wrappers             | public         | duckdb_fdw_handler                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
+ wrappers             | public         | duckdb_fdw_meta                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
+ wrappers             | public         | duckdb_fdw_validator                             | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers             | public         | firebase_fdw_handler                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | firebase_fdw_meta                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | firebase_fdw_validator                           | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers             | public         | hello_world_fdw_handler                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | hello_world_fdw_meta                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | hello_world_fdw_validator                        | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
+ wrappers             | public         | iceberg_fdw_handler                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
+ wrappers             | public         | iceberg_fdw_meta                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
+ wrappers             | public         | iceberg_fdw_validator                            | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
  wrappers             | public         | logflare_fdw_handler                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | fdw_handler
  wrappers             | public         | logflare_fdw_meta                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | TABLE(name text, version text, author text, website text)
  wrappers             | public         | logflare_fdw_validator                           | options text[], catalog oid                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | void
@@ -4865,7 +4871,7 @@ order by
  xml2                 | public         | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                 | public         | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                 | public         | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(4708 rows)
+(4714 rows)
 
 /*
 

From d314e8f6638e900f5f74f9e369ec3a0763b2cd77 Mon Sep 17 00:00:00 2001
From: Stojan Dimitrovski <sdimitrovski@gmail.com>
Date: Tue, 8 Jul 2025 22:31:36 +0200
Subject: [PATCH 24/64] feat: bump auth to v2.177.0 (#1694)

---
 ansible/vars.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index a3d9565e5..06522a8d1 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.101-orioledb"
-  postgres17: "17.4.1.051"
-  postgres15: "15.8.1.108"
+  postgresorioledb-17: "17.0.1.102-orioledb"
+  postgres17: "17.4.1.052"
+  postgres15: "15.8.1.109"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -24,8 +24,8 @@ postgrest_release: "12.2.3"
 postgrest_arm_release_checksum: sha1:fbfd6613d711ce1afa25c42d5df8f1b017f396f9
 postgrest_x86_release_checksum: sha1:61c513f91a8931be4062587b9d4a18b42acf5c05
 
-gotrue_release: 2.176.1
-gotrue_release_checksum: sha1:3b392d2e332d5b5114e571c0d62ab9f827fd5b76
+gotrue_release: 2.177.0
+gotrue_release_checksum: sha1:664a26237618c4bfb1e33e4f03a540c3cef3e3c8
 
 aws_cli_release: "2.23.11"
 

From f0a2fc11b04000dda5560723409538733359082e Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Wed, 9 Jul 2025 14:14:24 -0400
Subject: [PATCH 25/64] fix: an errant rebase lost these changes that run funs
 for tests (#1696)

---
 nix/checks.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nix/checks.nix b/nix/checks.nix
index d01518dc9..13be10f23 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -287,9 +287,9 @@
               '';
         in
         {
-          psql_15 = self'.packages."psql_15/bin";
-          psql_17 = self'.packages."psql_17/bin";
-          psql_orioledb-17 = self'.packages."psql_orioledb-17/bin";
+          psql_15 = makeCheckHarness self'.packages."psql_15/bin";
+          psql_17 = makeCheckHarness self'.packages."psql_17/bin";
+          psql_orioledb-17 = makeCheckHarness self'.packages."psql_orioledb-17/bin";
           inherit (self'.packages)
             wal-g-2
             wal-g-3

From f1050d4cc361809bf2ffe54137d4faa86b149a07 Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <bobbie@soedirgo.dev>
Date: Wed, 9 Jul 2025 22:30:57 +0800
Subject: [PATCH 26/64] fix: grant storage schema to postgres with grant option

---
 ...250_grant_storage_schema_to_postgres_with_grant_option.sql | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 migrations/db/migrations/20250709135250_grant_storage_schema_to_postgres_with_grant_option.sql

diff --git a/migrations/db/migrations/20250709135250_grant_storage_schema_to_postgres_with_grant_option.sql b/migrations/db/migrations/20250709135250_grant_storage_schema_to_postgres_with_grant_option.sql
new file mode 100644
index 000000000..604ff998e
--- /dev/null
+++ b/migrations/db/migrations/20250709135250_grant_storage_schema_to_postgres_with_grant_option.sql
@@ -0,0 +1,4 @@
+-- migrate:up
+grant usage on schema storage to postgres with grant option;
+
+-- migrate:down

From e404b56d9ca81bd38d4443afcd3ab0dde241e111 Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <bobbie@soedirgo.dev>
Date: Thu, 10 Jul 2025 00:04:58 +0800
Subject: [PATCH 27/64] chore: bump versions

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 06522a8d1..2f749e143 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.102-orioledb"
-  postgres17: "17.4.1.052"
-  postgres15: "15.8.1.109"
+  postgresorioledb-17: "17.0.1.103-orioledb"
+  postgres17: "17.4.1.053"
+  postgres15: "15.8.1.110"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From 6ac8fca78f5e69d1273dc1c07b546a68b5ff0f39 Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <bobbie@soedirgo.dev>
Date: Thu, 10 Jul 2025 00:23:35 +0800
Subject: [PATCH 28/64] test: postgres storage privs

---
 nix/tests/expected/storage.out | 21 +++++++++++++++++++++
 nix/tests/sql/storage.sql      | 19 +++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/nix/tests/expected/storage.out b/nix/tests/expected/storage.out
index fc1882923..c6edf49e1 100644
--- a/nix/tests/expected/storage.out
+++ b/nix/tests/expected/storage.out
@@ -206,3 +206,24 @@ select * from storage.migrations ;
 ----+------+------+-------------
 (0 rows)
 
+-- postgres can grant storage privileges to custom roles
+create role r;
+grant r to postgres with admin option;
+set role r;
+select * from storage.buckets;
+ERROR:  permission denied for schema storage
+LINE 1: select * from storage.buckets;
+                      ^
+set role postgres;
+grant usage on schema storage to r;
+grant select on storage.buckets to r;
+set role r;
+select * from storage.buckets;
+ id | name | owner | created_at | updated_at 
+----+------+-------+------------+------------
+(0 rows)
+
+set role postgres;
+drop owned by r cascade;
+drop role r;
+reset role;
diff --git a/nix/tests/sql/storage.sql b/nix/tests/sql/storage.sql
index b9d80820f..770741844 100644
--- a/nix/tests/sql/storage.sql
+++ b/nix/tests/sql/storage.sql
@@ -95,3 +95,22 @@ order by
 
 -- storage service migrations
 select * from storage.migrations ;
+
+-- postgres can grant storage privileges to custom roles
+create role r;
+grant r to postgres with admin option;
+
+set role r;
+select * from storage.buckets;
+
+set role postgres;
+grant usage on schema storage to r;
+grant select on storage.buckets to r;
+
+set role r;
+select * from storage.buckets;
+
+set role postgres;
+drop owned by r cascade;
+drop role r;
+reset role;

From a991d3f2d322d96595fbd50cc33b7ee65cfbf630 Mon Sep 17 00:00:00 2001
From: Crispy <12525875+Crispy1975@users.noreply.github.com>
Date: Thu, 10 Jul 2025 00:44:53 +0100
Subject: [PATCH 29/64] fix: hardcode the salt gpg keys path as it never
 changes (#1697)

---
 .../supabase-admin-agent.sudoers.conf                           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf b/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
index 6896e2f0c..df65f1137 100644
--- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf
@@ -1,2 +1,2 @@
 %supabase-admin-agent ALL= NOPASSWD: /usr/bin/salt-call
-%supabase-admin-agent ALL= NOPASSWD: /usr/bin/gpg --homedir {{ gpgdir }} --import, /usr/bin/gpg --homedir {{ gpgdir }} --list-secret-keys *
+%supabase-admin-agent ALL= NOPASSWD: /usr/bin/gpg --homedir /etc/salt/gpgkeys --import, /usr/bin/gpg --homedir /etc/salt/gpgkeys --list-secret-keys *

From 438def297a3f97eca795258a370d85caac3644b8 Mon Sep 17 00:00:00 2001
From: Kang Ming <kang.ming1996@gmail.com>
Date: Thu, 10 Jul 2025 13:57:34 +0800
Subject: [PATCH 30/64] fix: bump ami (#1698)

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 2f749e143..d82a06a65 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.103-orioledb"
-  postgres17: "17.4.1.053"
-  postgres15: "15.8.1.110"
+  postgresorioledb-17: "17.0.1.104-orioledb"
+  postgres17: "17.4.1.054"
+  postgres15: "15.8.1.111"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From a67e2e1cd373acd93e65615cdc3bf8dac6068d73 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Fri, 11 Jul 2025 12:34:01 -0400
Subject: [PATCH 31/64] fix: user cachix nix installer with pinned nix version
 (#1700)

---
 .github/workflows/nix-build.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 75f4ae20c..077c525dd 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -63,18 +63,20 @@ jobs:
           EOF
           sudo chmod +x /etc/nix/upload-to-cache.sh
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: cachix/install-nix-action@v27
         if: ${{ github.secret_source == 'Actions' }}
         with:
-          extra-conf: |
+          install_url: https://releases.nixos.org/nix/nix-2.29.1/install
+          extra_nix_config: |
             substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
             trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
             post-build-hook = /etc/nix/upload-to-cache.sh
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@main
+        uses: cachix/install-nix-action@v27
         if: ${{ github.secret_source == 'None' }}
         with:
-          extra-conf: |
+          install_url: https://releases.nixos.org/nix/nix-2.29.1/install
+          extra_nix_config: |
             substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
             trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
       - name: Aggressive disk cleanup for DuckDB build

From 9b278d51e20748dbce2a54f4753848d4ae545c5c Mon Sep 17 00:00:00 2001
From: Laurence Isla <lau.isla.c@gmail.com>
Date: Fri, 11 Jul 2025 19:52:35 +0000
Subject: [PATCH 32/64] chore: bump to PostgREST v12.2.12 (#1699)

---
 ansible/manifest-playbook.yml     |  2 +-
 ansible/tasks/setup-postgrest.yml |  4 ++--
 ansible/vars.yml                  | 17 ++++++++---------
 3 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/ansible/manifest-playbook.yml b/ansible/manifest-playbook.yml
index 5c1c65053..37c02d2c2 100644
--- a/ansible/manifest-playbook.yml
+++ b/ansible/manifest-playbook.yml
@@ -24,7 +24,7 @@
 
     - name: PostgREST - download ubuntu binary archive (arm)
       get_url:
-        url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-aarch64.tar.xz"
+        url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-20.04-aarch64.tar.xz"
         dest: /tmp/postgrest-{{ postgrest_release }}-arm64.tar.xz
         checksum: "{{ postgrest_arm_release_checksum }}"
         timeout: 60
diff --git a/ansible/tasks/setup-postgrest.yml b/ansible/tasks/setup-postgrest.yml
index b6e0f951c..b786ff3c9 100644
--- a/ansible/tasks/setup-postgrest.yml
+++ b/ansible/tasks/setup-postgrest.yml
@@ -48,7 +48,7 @@
 
 - name: PostgREST - download ubuntu binary archive (arm)
   get_url:
-    url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-aarch64.tar.xz"
+    url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-20.04-aarch64.tar.xz"
     dest: /tmp/postgrest.tar.xz
     checksum: "{{ postgrest_arm_release_checksum }}"
     timeout: 60
@@ -56,7 +56,7 @@
 
 - name: PostgREST - download ubuntu binary archive (x86)
   get_url:
-    url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-linux-static-x64.tar.xz"
+    url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-linux-static-x86-64.tar.xz"
     dest: /tmp/postgrest.tar.xz
     checksum: "{{ postgrest_x86_release_checksum }}"
     timeout: 60    
diff --git a/ansible/vars.yml b/ansible/vars.yml
index d82a06a65..c2c7aed87 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,20 +9,19 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.104-orioledb"
-  postgres17: "17.4.1.054"
-  postgres15: "15.8.1.111"
+  postgresorioledb-17: "17.0.1.105-orioledb"
+  postgres17: "17.4.1.055"
+  postgres15: "15.8.1.112"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
 pgbouncer_release_checksum: sha256:af0b05e97d0e1fd9ad45fe00ea6d2a934c63075f67f7e2ccef2ca59e3d8ce682
 
-# to get these use
-# wget https://github.com/PostgREST/postgrest/releases/download/v12.2.3/postgrest-v12.2.3-ubuntu-aarch64.tar.xz -q -O- | sha1sum
-# wget https://github.com/PostgREST/postgrest/releases/download/v12.2.3/postgrest-v12.2.3-linux-static-x64.tar.xz -q -O- | sha1sum
-postgrest_release: "12.2.3"
-postgrest_arm_release_checksum: sha1:fbfd6613d711ce1afa25c42d5df8f1b017f396f9
-postgrest_x86_release_checksum: sha1:61c513f91a8931be4062587b9d4a18b42acf5c05
+# The checksum can be found under "Assets", in the GitHub release page for each version:
+# https://github.com/PostgREST/postgrest/releases
+postgrest_release: "12.2.12"
+postgrest_arm_release_checksum: sha256:6b2eaa5759329e024df76f79d93f6bb3d87a93de11433acc5d66aa6c96f81f90
+postgrest_x86_release_checksum: sha256:5de4092f1719da3353c40bf96c8dec6913f2254a7cd0b61cc05f233153b557d5
 
 gotrue_release: 2.177.0
 gotrue_release_checksum: sha1:664a26237618c4bfb1e33e4f03a540c3cef3e3c8

From 198cf691a1b5dbf2cd1b0576d9546b5b007ed133 Mon Sep 17 00:00:00 2001
From: Div Arora <darora@users.noreply.github.com>
Date: Tue, 15 Jul 2025 23:28:30 +0800
Subject: [PATCH 33/64] chore!: upgrade Vector to latest release (#1689)

In preliminary testing, shows ~15% lower memory consumption at idle.

Marked as a breaking change as the config needs to be updated in
advance of the new release.
---
 ansible/vars.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index c2c7aed87..885a9bde5 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.105-orioledb"
-  postgres17: "17.4.1.055"
-  postgres15: "15.8.1.112"
+  postgresorioledb-17: "17.0.1.106-orioledb"
+  postgres17: "17.4.1.056"
+  postgres15: "15.8.1.113"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -55,5 +55,5 @@ adminapi_release: 0.84.1
 adminmgr_release: 0.25.1
 supabase_admin_agent_release: 1.4.36
 
-vector_x86_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_amd64.deb"
-vector_arm_deb: "https://packages.timber.io/vector/0.22.3/vector_0.22.3-1_arm64.deb"
+vector_x86_deb: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_amd64.deb"
+vector_arm_deb: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_arm64.deb"

From c27f2450be8159df57a852aebec628c17eaf650b Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Wed, 16 Jul 2025 12:07:01 +0100
Subject: [PATCH 34/64] chore: version bump supabase-admin-agent (#1705)

* chore: version bump supabase-admin-agent

* chore: bump image versions
---
 ansible/vars.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 885a9bde5..cae51b58d 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.106-orioledb"
-  postgres17: "17.4.1.056"
-  postgres15: "15.8.1.113"
+  postgresorioledb-17: "17.0.1.107-orioledb"
+  postgres17: "17.4.1.057"
+  postgres15: "15.8.1.114"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -53,7 +53,7 @@ postgres_exporter_release_checksum:
 
 adminapi_release: 0.84.1
 adminmgr_release: 0.25.1
-supabase_admin_agent_release: 1.4.36
+supabase_admin_agent_release: 1.4.37
 
 vector_x86_deb: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_amd64.deb"
 vector_arm_deb: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_arm64.deb"

From 2442765bf0453bf337e08632ff6cd09ce8e83696 Mon Sep 17 00:00:00 2001
From: steve-chavez <stevechavezast@gmail.com>
Date: Tue, 15 Jul 2025 14:49:27 -0500
Subject: [PATCH 35/64] chore: bump to pg_net 0.19.3

---
 nix/ext/pg_net.nix                                 | 6 ++----
 nix/tests/expected/z_15_ext_interface.out          | 6 ++++--
 nix/tests/expected/z_17_ext_interface.out          | 6 ++++--
 nix/tests/expected/z_orioledb-17_ext_interface.out | 6 ++++--
 4 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/nix/ext/pg_net.nix b/nix/ext/pg_net.nix
index 02d673297..23715fba7 100644
--- a/nix/ext/pg_net.nix
+++ b/nix/ext/pg_net.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_net";
-  version = "0.14.0";
+  version = "0.19.3";
 
   buildInputs = [
     curl
@@ -19,11 +19,9 @@ stdenv.mkDerivation rec {
     owner = "supabase";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-c1pxhTyrE5j6dY+M5eKAboQNofIORS+Dccz+7HKEKQI=";
+    hash = "sha256-PZYIwkXp1rOzRCDZivJFMuEQBYJaaibUN/WkL+6crSg=";
   };
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-
   installPhase = ''
     mkdir -p $out/{lib,share/postgresql/extension}
 
diff --git a/nix/tests/expected/z_15_ext_interface.out b/nix/tests/expected/z_15_ext_interface.out
index c652a95eb..d3d9f7c4f 100644
--- a/nix/tests/expected/z_15_ext_interface.out
+++ b/nix/tests/expected/z_15_ext_interface.out
@@ -1161,9 +1161,11 @@ order by
  pg_net                 | net                      | _urlencode_string                                | string character varying                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | text
  pg_net                 | net                      | check_worker_is_up                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net                 | net                      | http_collect_response                            | request_id bigint, async boolean                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | net.http_response_result
- pg_net                 | net                      | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
+ pg_net                 | net                      | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer, body jsonb                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_net                 | net                      | http_get                                         | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net                 | net                      | http_post                                        | url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
+ pg_net                 | net                      | wait_until_running                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
+ pg_net                 | net                      | wake                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net                 | net                      | worker_restart                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | boolean
  pg_prewarm             | public                   | autoprewarm_dump_now                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_prewarm             | public                   | autoprewarm_start_worker                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
@@ -5227,7 +5229,7 @@ order by
  xml2                   | public                   | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                   | public                   | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                   | public                   | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(5057 rows)
+(5059 rows)
 
 /*
 
diff --git a/nix/tests/expected/z_17_ext_interface.out b/nix/tests/expected/z_17_ext_interface.out
index d31894bc3..46792e48f 100644
--- a/nix/tests/expected/z_17_ext_interface.out
+++ b/nix/tests/expected/z_17_ext_interface.out
@@ -1146,9 +1146,11 @@ order by
  pg_net               | net            | _urlencode_string                                | string character varying                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | text
  pg_net               | net            | check_worker_is_up                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | http_collect_response                            | request_id bigint, async boolean                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | net.http_response_result
- pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
+ pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer, body jsonb                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_net               | net            | http_get                                         | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net               | net            | http_post                                        | url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
+ pg_net               | net            | wait_until_running                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
+ pg_net               | net            | wake                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | worker_restart                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | boolean
  pg_prewarm           | public         | autoprewarm_dump_now                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_prewarm           | public         | autoprewarm_start_worker                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
@@ -4871,7 +4873,7 @@ order by
  xml2                 | public         | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                 | public         | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                 | public         | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(4714 rows)
+(4716 rows)
 
 /*
 
diff --git a/nix/tests/expected/z_orioledb-17_ext_interface.out b/nix/tests/expected/z_orioledb-17_ext_interface.out
index d31894bc3..46792e48f 100644
--- a/nix/tests/expected/z_orioledb-17_ext_interface.out
+++ b/nix/tests/expected/z_orioledb-17_ext_interface.out
@@ -1146,9 +1146,11 @@ order by
  pg_net               | net            | _urlencode_string                                | string character varying                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | text
  pg_net               | net            | check_worker_is_up                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | http_collect_response                            | request_id bigint, async boolean                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | net.http_response_result
- pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
+ pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer, body jsonb                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_net               | net            | http_get                                         | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net               | net            | http_post                                        | url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
+ pg_net               | net            | wait_until_running                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
+ pg_net               | net            | wake                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | worker_restart                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | boolean
  pg_prewarm           | public         | autoprewarm_dump_now                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_prewarm           | public         | autoprewarm_start_worker                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
@@ -4871,7 +4873,7 @@ order by
  xml2                 | public         | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                 | public         | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                 | public         | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(4714 rows)
+(4716 rows)
 
 /*
 

From 922a11aa9218fdb41af2e73d7664e6ec8f7bcbc4 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Wed, 16 Jul 2025 22:36:18 -0400
Subject: [PATCH 36/64] feat: oriole beta12 (#1707)

* feat: oriole beta12

* fix: update testing schema

* chore: bump versions to release
---
 ansible/vars.yml                  | 6 +++---
 migrations/schema-orioledb-17.sql | 4 ++--
 nix/config.nix                    | 4 ++--
 nix/ext/orioledb.nix              | 8 ++++----
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index cae51b58d..830c94fb2 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.0.1.107-orioledb"
-  postgres17: "17.4.1.057"
-  postgres15: "15.8.1.114"
+  postgresorioledb-17: "17.5.1.001-orioledb"
+  postgres17: "17.4.1.058"
+  postgres15: "15.8.1.115"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/migrations/schema-orioledb-17.sql b/migrations/schema-orioledb-17.sql
index 8c5d32c39..5cfda417c 100644
--- a/migrations/schema-orioledb-17.sql
+++ b/migrations/schema-orioledb-17.sql
@@ -2,8 +2,8 @@
 -- PostgreSQL database dump
 --
 
--- Dumped from database version 17.0
--- Dumped by pg_dump version 17.0
+-- Dumped from database version 17.5
+-- Dumped by pg_dump version 17.5
 
 SET statement_timeout = 0;
 SET lock_timeout = 0;
diff --git a/nix/config.nix b/nix/config.nix
index b1ebe3fd7..267ec18a8 100644
--- a/nix/config.nix
+++ b/nix/config.nix
@@ -52,8 +52,8 @@ in
         };
         orioledb = {
           "17" = {
-            version = "17_6";
-            hash = "sha256-HbuTcXNanFOl9YfvlSzQJon8CfAhc8TFwo/y7jXy51w=";
+            version = "17_11";
+            hash = "sha256-RZYU955PmGZExfX2JKw1dIQMMuuswtAXpXjZ9CLbOsw=";
           };
         };
       };
diff --git a/nix/ext/orioledb.nix b/nix/ext/orioledb.nix
index 96976f83d..549aa2ab1 100644
--- a/nix/ext/orioledb.nix
+++ b/nix/ext/orioledb.nix
@@ -15,10 +15,10 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "orioledb";
     repo = "orioledb";
-    rev = "beta10";
-    sha256 = "sha256-O4OTi8ickylVXE9FURm5R++A+l15Z22YLna7OVzVMjc=";
+    rev = "beta12";
+    sha256 = "sha256-5dyVdKD1PzW+F5OPW3TR3OKBaJxxR3OhLbzK+o9Wf+Q=";
   };
-  version = "beta10";
+  version = "beta12";
   buildInputs = [
     curl
     libkrb5
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     python3
     openssl
   ];
-  buildPhase = "make USE_PGXS=1 ORIOLEDB_PATCHSET_VERSION=6";
+  buildPhase = "make USE_PGXS=1 ORIOLEDB_PATCHSET_VERSION=11";
   installPhase = ''
     runHook preInstall
 

From 5547a4f5de9dc9c01a4142c5d9489d27dd16c5d6 Mon Sep 17 00:00:00 2001
From: Div Arora <root@darora.com>
Date: Thu, 17 Jul 2025 18:28:07 +0800
Subject: [PATCH 37/64] feat: disable default database collector for
 postgres_exporter

The database collector emits a metric for the size of each database by
default. We emit a metric that represents the sum of all database,
which suffices for our purposes. This change removes the redundant
per-database metric.

In order to avoid a change in the AMI metrics, the change is only made
for the QEMU artifact.
---
 ansible/files/postgres_exporter.service.j2 | 2 +-
 ansible/vars.yml                           | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ansible/files/postgres_exporter.service.j2 b/ansible/files/postgres_exporter.service.j2
index 0066a76b2..fd8b2a897 100644
--- a/ansible/files/postgres_exporter.service.j2
+++ b/ansible/files/postgres_exporter.service.j2
@@ -3,7 +3,7 @@ Description=Postgres Exporter
 
 [Service]
 Type=simple
-ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal
+ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal {% if qemu_mode is defined and qemu_mode %}--no-collector.database {% endif %}
 User=postgres
 Group=postgres
 Restart=always
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 830c94fb2..d3c1594b1 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.001-orioledb"
-  postgres17: "17.4.1.058"
-  postgres15: "15.8.1.115"
+  postgresorioledb-17: "17.5.1.002-orioledb"
+  postgres17: "17.4.1.059"
+  postgres15: "15.8.1.116"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From 77bb5434f084e03b9832c97423bce5e0cec56288 Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Thu, 17 Jul 2025 15:10:18 +0100
Subject: [PATCH 38/64] chore: repack admin-agent to public artifacts bucket
 (#1710)

---
 ansible/manifest-playbook.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/ansible/manifest-playbook.yml b/ansible/manifest-playbook.yml
index 37c02d2c2..9a1636d0d 100644
--- a/ansible/manifest-playbook.yml
+++ b/ansible/manifest-playbook.yml
@@ -61,6 +61,22 @@
       shell: |
         cd /tmp && tar -cJf admin-mgr-{{ adminmgr_release }}-arm64.tar.xz admin-mgr
 
+    - name: Download supabase-admin-agent archive
+      get_url:
+        url: "https://supabase-public-artifacts-bucket.s3.amazonaws.com/supabase-admin-agent/v{{ supabase_admin_agent_release }}/supabase-admin-agent-{{ supabase_admin_agent_release }}-linux-arm64.tar.gz"
+        dest: "/tmp/supabase-admin-agent.tar.gz"
+        timeout: 90
+
+    - name: supabase-admin-agent - unpack archive in /tmp
+      unarchive:
+        remote_src: yes
+        src: /tmp/supabase-admin-agent.tar.gz
+        dest: /tmp
+
+    - name: supabase-admin-agent - pack archive
+      shell: |
+        cd /tmp && tar -cJf supabase-admin-agent-{{ supabase_admin_agent_release }}-arm64.tar.xz supabase-admin-agent
+
     - name: upload archives
       shell: |
         aws s3 cp /tmp/{{ item.file }} s3://{{ internal_artifacts_bucket }}/upgrades/{{ item.service }}/{{ item.file }}
@@ -73,3 +89,5 @@
           file: supabase-admin-api-{{ adminapi_release }}-arm64.tar.xz
         - service: admin-mgr
           file: admin-mgr-{{ adminmgr_release }}-arm64.tar.xz
+        - service: supabase-admin-agent
+          file: supabase-admin-agent-{{ supabase_admin_agent_release }}-arm64.tar.xz

From a43cbe0f27add2be2d5ac1673df8db69b5ddaaea Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <bobbie@soedirgo.dev>
Date: Wed, 16 Jul 2025 16:36:38 +0800
Subject: [PATCH 39/64] test: alter API roles timeout

---
 nix/tests/expected/roles.out | 5 +++++
 nix/tests/sql/roles.sql      | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/nix/tests/expected/roles.out b/nix/tests/expected/roles.out
index aef247b35..3832b0f00 100644
--- a/nix/tests/expected/roles.out
+++ b/nix/tests/expected/roles.out
@@ -521,3 +521,8 @@ order by schema_order, schema_name, privilege_type, grantee, default_for;
  vault              | USAGE          | supabase_admin           | supabase_admin
 (389 rows)
 
+-- postgres can alter API roles' timeout
+set role postgres;
+alter role anon set statement_timeout = '10min';
+alter role anon reset statement_timeout;
+reset role;
diff --git a/nix/tests/sql/roles.sql b/nix/tests/sql/roles.sql
index 34fd5db7e..5753d34de 100644
--- a/nix/tests/sql/roles.sql
+++ b/nix/tests/sql/roles.sql
@@ -65,3 +65,10 @@ from (
         a.privilege_type in ('CREATE', 'USAGE')
 ) sub
 order by schema_order, schema_name, privilege_type, grantee, default_for;
+
+-- postgres can alter API roles' timeout
+set role postgres;
+alter role anon set statement_timeout = '10min';
+
+alter role anon reset statement_timeout;
+reset role;

From e14b4979ef2a7c032da33debbb182d87dd33dca0 Mon Sep 17 00:00:00 2001
From: Div Arora <darora@users.noreply.github.com>
Date: Mon, 21 Jul 2025 17:55:46 +0800
Subject: [PATCH 40/64] Revert "chore: bump to pg_net 0.19.3"

This reverts commit 2442765bf0453bf337e08632ff6cd09ce8e83696.
---
 nix/ext/pg_net.nix                                 | 6 ++++--
 nix/tests/expected/z_15_ext_interface.out          | 6 ++----
 nix/tests/expected/z_17_ext_interface.out          | 6 ++----
 nix/tests/expected/z_orioledb-17_ext_interface.out | 6 ++----
 4 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/nix/ext/pg_net.nix b/nix/ext/pg_net.nix
index 23715fba7..02d673297 100644
--- a/nix/ext/pg_net.nix
+++ b/nix/ext/pg_net.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_net";
-  version = "0.19.3";
+  version = "0.14.0";
 
   buildInputs = [
     curl
@@ -19,9 +19,11 @@ stdenv.mkDerivation rec {
     owner = "supabase";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PZYIwkXp1rOzRCDZivJFMuEQBYJaaibUN/WkL+6crSg=";
+    hash = "sha256-c1pxhTyrE5j6dY+M5eKAboQNofIORS+Dccz+7HKEKQI=";
   };
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
   installPhase = ''
     mkdir -p $out/{lib,share/postgresql/extension}
 
diff --git a/nix/tests/expected/z_15_ext_interface.out b/nix/tests/expected/z_15_ext_interface.out
index d3d9f7c4f..c652a95eb 100644
--- a/nix/tests/expected/z_15_ext_interface.out
+++ b/nix/tests/expected/z_15_ext_interface.out
@@ -1161,11 +1161,9 @@ order by
  pg_net                 | net                      | _urlencode_string                                | string character varying                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | text
  pg_net                 | net                      | check_worker_is_up                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net                 | net                      | http_collect_response                            | request_id bigint, async boolean                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | net.http_response_result
- pg_net                 | net                      | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer, body jsonb                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
+ pg_net                 | net                      | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net                 | net                      | http_get                                         | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net                 | net                      | http_post                                        | url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
- pg_net                 | net                      | wait_until_running                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
- pg_net                 | net                      | wake                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net                 | net                      | worker_restart                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | boolean
  pg_prewarm             | public                   | autoprewarm_dump_now                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_prewarm             | public                   | autoprewarm_start_worker                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
@@ -5229,7 +5227,7 @@ order by
  xml2                   | public                   | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                   | public                   | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                   | public                   | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(5059 rows)
+(5057 rows)
 
 /*
 
diff --git a/nix/tests/expected/z_17_ext_interface.out b/nix/tests/expected/z_17_ext_interface.out
index 46792e48f..d31894bc3 100644
--- a/nix/tests/expected/z_17_ext_interface.out
+++ b/nix/tests/expected/z_17_ext_interface.out
@@ -1146,11 +1146,9 @@ order by
  pg_net               | net            | _urlencode_string                                | string character varying                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | text
  pg_net               | net            | check_worker_is_up                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | http_collect_response                            | request_id bigint, async boolean                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | net.http_response_result
- pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer, body jsonb                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
+ pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net               | net            | http_get                                         | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net               | net            | http_post                                        | url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
- pg_net               | net            | wait_until_running                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
- pg_net               | net            | wake                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | worker_restart                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | boolean
  pg_prewarm           | public         | autoprewarm_dump_now                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_prewarm           | public         | autoprewarm_start_worker                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
@@ -4873,7 +4871,7 @@ order by
  xml2                 | public         | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                 | public         | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                 | public         | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(4716 rows)
+(4714 rows)
 
 /*
 
diff --git a/nix/tests/expected/z_orioledb-17_ext_interface.out b/nix/tests/expected/z_orioledb-17_ext_interface.out
index 46792e48f..d31894bc3 100644
--- a/nix/tests/expected/z_orioledb-17_ext_interface.out
+++ b/nix/tests/expected/z_orioledb-17_ext_interface.out
@@ -1146,11 +1146,9 @@ order by
  pg_net               | net            | _urlencode_string                                | string character varying                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | text
  pg_net               | net            | check_worker_is_up                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | http_collect_response                            | request_id bigint, async boolean                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | net.http_response_result
- pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer, body jsonb                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
+ pg_net               | net            | http_delete                                      | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net               | net            | http_get                                         | url text, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | bigint
  pg_net               | net            | http_post                                        | url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
- pg_net               | net            | wait_until_running                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
- pg_net               | net            | wake                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
  pg_net               | net            | worker_restart                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | boolean
  pg_prewarm           | public         | autoprewarm_dump_now                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | bigint
  pg_prewarm           | public         | autoprewarm_start_worker                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | void
@@ -4873,7 +4871,7 @@ order by
  xml2                 | public         | xpath_table                                      | text, text, text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | SETOF record
  xml2                 | public         | xslt_process                                     | text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | text
  xml2                 | public         | xslt_process                                     | text, text, text                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | text
-(4716 rows)
+(4714 rows)
 
 /*
 

From 17ee0f50e058c8ef7bed887d8b033c58d6c614c8 Mon Sep 17 00:00:00 2001
From: divit <27228526+delgado3d@users.noreply.github.com>
Date: Mon, 21 Jul 2025 15:48:50 +0530
Subject: [PATCH 41/64] bump ami version

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index d3c1594b1..acd40a2de 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.002-orioledb"
-  postgres17: "17.4.1.059"
-  postgres15: "15.8.1.116"
+  postgresorioledb-17: "17.5.1.003-orioledb"
+  postgres17: "17.4.1.060"
+  postgres15: "15.8.1.117"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From 08d00960c1fc5d7fd504663f367279bbf13b8356 Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <bobbie@soedirgo.dev>
Date: Fri, 18 Jul 2025 02:09:25 +0800
Subject: [PATCH 42/64] feat: supautils grants for auth.mfa_factors

---
 ansible/files/postgresql_config/supautils.conf.j2 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ansible/files/postgresql_config/supautils.conf.j2 b/ansible/files/postgresql_config/supautils.conf.j2
index 321343bbf..f8c4aa0a2 100644
--- a/ansible/files/postgresql_config/supautils.conf.j2
+++ b/ansible/files/postgresql_config/supautils.conf.j2
@@ -1,6 +1,6 @@
 supautils.extensions_parameter_overrides = '{"pg_cron":{"schema":"pg_catalog"}}'
-supautils.policy_grants = '{"postgres":["auth.audit_log_entries","auth.identities","auth.refresh_tokens","auth.sessions","auth.users","realtime.messages","storage.buckets","storage.migrations","storage.objects","storage.s3_multipart_uploads","storage.s3_multipart_uploads_parts"]}'
-supautils.drop_trigger_grants = '{"postgres":["auth.audit_log_entries","auth.identities","auth.refresh_tokens","auth.sessions","auth.users","realtime.messages","storage.buckets","storage.migrations","storage.objects","storage.s3_multipart_uploads","storage.s3_multipart_uploads_parts"]}'
+supautils.policy_grants = '{"postgres":["auth.audit_log_entries","auth.identities","auth.mfa_factors","auth.refresh_tokens","auth.sessions","auth.users","realtime.messages","storage.buckets","storage.migrations","storage.objects","storage.s3_multipart_uploads","storage.s3_multipart_uploads_parts"]}'
+supautils.drop_trigger_grants = '{"postgres":["auth.audit_log_entries","auth.identities","auth.mfa_factors","auth.refresh_tokens","auth.sessions","auth.users","realtime.messages","storage.buckets","storage.migrations","storage.objects","storage.s3_multipart_uploads","storage.s3_multipart_uploads_parts"]}'
 # full list:                                 address_standardizer, address_standardizer_data_us, adminpack, amcheck, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, file_fdw, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intagg, intarray, isn, lo, ltree, moddatetime, old_snapshot, orioledb, pageinspect, pg_buffercache, pg_cron, pg_freespacemap, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_surgery, pg_tle, pg_trgm, pg_visibility, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgmq, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers, xml2
 # omitted because may be unsafe:             adminpack, amcheck, file_fdw, lo, old_snapshot, pageinspect, pg_freespacemap, pg_surgery, pg_visibility
 # omitted because deprecated:                intagg, xml2

From 8526618ef323c188410267f7f3c3a5777f031e72 Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <31685197+soedirgo@users.noreply.github.com>
Date: Tue, 22 Jul 2025 11:16:50 +0800
Subject: [PATCH 43/64] fix: set default_txn_read_only on
 supabase_read_only_user

---
 ansible/vars.yml                                            | 6 +++---
 ...upabase_read_only_user_default_transaction_read_only.sql | 4 ++++
 nix/tests/expected/roles.out                                | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)
 create mode 100644 migrations/db/migrations/20250710151649_supabase_read_only_user_default_transaction_read_only.sql

diff --git a/ansible/vars.yml b/ansible/vars.yml
index acd40a2de..d909120c5 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.003-orioledb"
-  postgres17: "17.4.1.060"
-  postgres15: "15.8.1.117"
+  postgresorioledb-17: "17.5.1.004-orioledb"
+  postgres17: "17.4.1.061"
+  postgres15: "15.8.1.118"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/migrations/db/migrations/20250710151649_supabase_read_only_user_default_transaction_read_only.sql b/migrations/db/migrations/20250710151649_supabase_read_only_user_default_transaction_read_only.sql
new file mode 100644
index 000000000..b60d7ec16
--- /dev/null
+++ b/migrations/db/migrations/20250710151649_supabase_read_only_user_default_transaction_read_only.sql
@@ -0,0 +1,4 @@
+-- migrate:up
+alter role supabase_read_only_user set default_transaction_read_only = on;
+
+-- migrate:down
diff --git a/nix/tests/expected/roles.out b/nix/tests/expected/roles.out
index 3832b0f00..69446110c 100644
--- a/nix/tests/expected/roles.out
+++ b/nix/tests/expected/roles.out
@@ -86,7 +86,7 @@ order by rolname;
  supabase_admin             | {"search_path=\"$user\", public, auth, extensions",log_statement=none}
  supabase_auth_admin        | {search_path=auth,idle_in_transaction_session_timeout=60000,log_statement=none}
  supabase_functions_admin   | 
- supabase_read_only_user    | 
+ supabase_read_only_user    | {default_transaction_read_only=on}
  supabase_replication_admin | 
  supabase_storage_admin     | {search_path=storage,log_statement=none}
 (29 rows)

From cb6184834af249abe72fa0ff06a8f5d6c87ddc67 Mon Sep 17 00:00:00 2001
From: Bobbie Soedirgo <31685197+soedirgo@users.noreply.github.com>
Date: Tue, 22 Jul 2025 14:59:54 +0800
Subject: [PATCH 44/64] fix(ci): supabase-admin-agent naming (#1715)

---
 ansible/manifest-playbook.yml | 2 +-
 ansible/vars.yml              | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ansible/manifest-playbook.yml b/ansible/manifest-playbook.yml
index 9a1636d0d..d297e6ceb 100644
--- a/ansible/manifest-playbook.yml
+++ b/ansible/manifest-playbook.yml
@@ -75,7 +75,7 @@
 
     - name: supabase-admin-agent - pack archive
       shell: |
-        cd /tmp && tar -cJf supabase-admin-agent-{{ supabase_admin_agent_release }}-arm64.tar.xz supabase-admin-agent
+        cd /tmp && tar -cJf supabase-admin-agent-{{ supabase_admin_agent_release }}-arm64.tar.xz supabase-admin-agent-{{ supabase_admin_agent_release }}-linux-arm64
 
     - name: upload archives
       shell: |
diff --git a/ansible/vars.yml b/ansible/vars.yml
index d909120c5..8beb4ea2a 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.004-orioledb"
-  postgres17: "17.4.1.061"
-  postgres15: "15.8.1.118"
+  postgresorioledb-17: "17.5.1.005-orioledb"
+  postgres17: "17.4.1.062"
+  postgres15: "15.8.1.119"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From e2a13f60e76919663618135f7ec618874a44fc31 Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Wed, 23 Jul 2025 16:23:11 +0100
Subject: [PATCH 45/64] fix: missing whitespace after jinja condition (#1718)

---
 ansible/files/postgres_exporter.service.j2 | 1 +
 ansible/vars.yml                           | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/ansible/files/postgres_exporter.service.j2 b/ansible/files/postgres_exporter.service.j2
index fd8b2a897..6baa18c0d 100644
--- a/ansible/files/postgres_exporter.service.j2
+++ b/ansible/files/postgres_exporter.service.j2
@@ -4,6 +4,7 @@ Description=Postgres Exporter
 [Service]
 Type=simple
 ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal {% if qemu_mode is defined and qemu_mode %}--no-collector.database {% endif %}
+
 User=postgres
 Group=postgres
 Restart=always
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 8beb4ea2a..8ea05d022 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.005-orioledb"
-  postgres17: "17.4.1.062"
-  postgres15: "15.8.1.119"
+  postgresorioledb-17: "17.5.1.006-orioledb"
+  postgres17: "17.4.1.063"
+  postgres15: "15.8.1.120"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From 01471804edcff4130e2549d1279aa561a89f5b39 Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Wed, 23 Jul 2025 17:39:17 +0100
Subject: [PATCH 46/64] fix: admin-agent timer file is a template (#1717)

* fix: admin-agent timer file is a template

* fix: create a template and issue variable

* chore: version bump AMIs
---
 ...agent_salt.timer => supabase-admin-agent_salt.timer.j2} | 4 ++--
 ansible/tasks/internal/supabase-admin-agent.yml            | 4 ++--
 ansible/vars.yml                                           | 7 ++++---
 3 files changed, 8 insertions(+), 7 deletions(-)
 rename ansible/files/supabase_admin_agent_config/{supabase-admin-agent_salt.timer => supabase-admin-agent_salt.timer.j2} (63%)

diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2
similarity index 63%
rename from ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer
rename to ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2
index 8044c2e1a..1c59cdc7c 100644
--- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2
@@ -4,8 +4,8 @@ Requires=supabase-admin-agent_salt.service
 
 [Timer]
 OnCalendar=*:0/10
-# Random delay up to {{ splay }} seconds splay
-RandomizedDelaySec={{ splay }}
+# Random delay up to {{ supabase_admin_agent_splay }} seconds splay
+RandomizedDelaySec={{ supabase_admin_agent_splay }}
 AccuracySec=1s
 Persistent=true
 
diff --git a/ansible/tasks/internal/supabase-admin-agent.yml b/ansible/tasks/internal/supabase-admin-agent.yml
index 4e5f87e5e..ef5c948b5 100644
--- a/ansible/tasks/internal/supabase-admin-agent.yml
+++ b/ansible/tasks/internal/supabase-admin-agent.yml
@@ -66,8 +66,8 @@
     force: yes
 
 - name: supabase-admin-agent - create salt systemd timer file
-  copy:
-    src: files/supabase_admin_agent_config/supabase-admin-agent_salt.timer
+  template:
+    src: files/supabase_admin_agent_config/supabase-admin-agent_salt.timer.j2
     dest: /etc/systemd/system/supabase-admin-agent_salt.timer
 
 - name: supabase-admin-agent - create salt service file
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 8ea05d022..927e81b0e 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.006-orioledb"
-  postgres17: "17.4.1.063"
-  postgres15: "15.8.1.120"
+  postgresorioledb-17: "17.5.1.007-orioledb"
+  postgres17: "17.4.1.064"
+  postgres15: "15.8.1.121"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -54,6 +54,7 @@ postgres_exporter_release_checksum:
 adminapi_release: 0.84.1
 adminmgr_release: 0.25.1
 supabase_admin_agent_release: 1.4.37
+supabase_admin_agent_splay: 30
 
 vector_x86_deb: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_amd64.deb"
 vector_arm_deb: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_arm64.deb"

From 02ec87fdad94cd62f7391357b022ffd650ff6608 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Thu, 24 Jul 2025 14:17:14 -0400
Subject: [PATCH 47/64] feat: advance to ubuntu 24.04 (#1416)

* feat: wip advance to ubuntu 24.04

* fix; missing gp3 on image string

* chore: non-interactive

* chore: set hostname in dhcp client

* chore: conform to new networking approach

* ore: reverse he sha values

* chore: fix kong address

* ore: typo in url

* chore: drop old removals

* chore: remove defunct package

* chore: restore wal-g build approach

* chore: permission check and restore kong original version

* chore: log output to debug

* chore: increase wait time before health checks.

* chore: post rebase cleanup

* Update README.md

Co-authored-by: Div Arora <darora@users.noreply.github.com>

* chore: restore function

* chore: remove unused file

* chore: make command non-interactive

* chore: readme script

* chore: ubuntu 24.04 has moved to  use networkd and netplan by default,
... rather than the traditional dhclient.conf approach.

* chore: update README

* chore: bump versions for staging release/testing

* chore: keep kong pinned to this version, was not meant to change

* fix: tmp use 20.04 untl worker scripts can be rewritten

* feat: netplan security and apply

* fix: netplan apply after upgrade

* fix: transitional file name structure

* feat: netplan apply

* feat: Remove Requisite to prevent being killed when restarting networkd

* fix: fix_ipv6 timer not needed in ubuntu 24-04

* feat: restore check and fix but disabled

* chore: update qemu artifact to noble base

Also makes the VM artifact release agnostic.

* fix: restore stage for wal-g tasks to stage 2

* fix: removing arbitrary netplan apply

* fix: file path

* feat: postgrest 13.0.4 (#1685)

* fix: url of postgrest download

* Update ansible/vars.yml

Co-authored-by: Laurence Isla <lau.isla.c@gmail.com>

* fix: correct URL for release

* fix: correct url here too

* chore: bump version for release

---------

Co-authored-by: Div Arora <darora@users.noreply.github.com>
Co-authored-by: Div Arora <root@darora.com>
Co-authored-by: Laurence Isla <lau.isla.c@gmail.com>
---
 .github/workflows/ami-release-nix-single.yml  |  4 ++++
 .github/workflows/ami-release-nix.yml         |  4 ++++
 ...ublish-nix-pgupgrade-bin-flake-version.yml |  8 +++++--
 .github/workflows/testinfra-ami-build.yml     |  4 ++--
 Dockerfile-15                                 |  2 +-
 Dockerfile-kubernetes                         |  2 +-
 Dockerfile-orioledb-17                        |  2 +-
 Makefile                                      |  4 ----
 README.md                                     |  4 ++--
 amazon-arm64-nix.pkr.hcl                      |  4 ++--
 .../pg_upgrade_scripts/complete.sh            |  1 +
 ansible/files/adminapi.sudoers.conf           |  1 +
 ansible/files/permission_check.py             |  2 --
 .../systemd-networkd-check-and-fix.service    |  1 +
 ansible/manifest-playbook.yml                 |  2 +-
 ansible/playbook.yml                          |  4 ++--
 ...{fix_ipv6_ndisc.yml => fix-ipv6-ndisc.yml} |  6 ++---
 ansible/tasks/setup-postgres.yml              |  2 +-
 ansible/tasks/setup-postgrest.yml             |  6 ++---
 ansible/vars.yml                              | 23 ++++++++++---------
 docker/Dockerfile                             |  4 ++--
 ebssurrogate/files/sources-arm64.cfg          | 20 ++++++++--------
 ebssurrogate/files/sources.cfg                | 20 ++++++++--------
 ebssurrogate/scripts/chroot-bootstrap-nix.sh  | 19 ++++++++++++---
 .../scripts/surrogate-bootstrap-nix.sh        |  2 +-
 nix/tools/update_readme.nu                    |  2 +-
 qemu-arm64-nix.pkr.hcl                        |  4 ++--
 scripts/90-cleanup-qemu.sh                    |  6 -----
 scripts/90-cleanup.sh                         |  6 +----
 scripts/99-img_check.sh                       |  2 +-
 testinfra/README.md                           |  4 ++--
 testinfra/test_ami_nix.py                     |  3 +++
 tests/pg_upgrade/debug.sh                     |  2 +-
 33 files changed, 98 insertions(+), 82 deletions(-)
 rename ansible/tasks/{fix_ipv6_ndisc.yml => fix-ipv6-ndisc.yml} (87%)

diff --git a/.github/workflows/ami-release-nix-single.yml b/.github/workflows/ami-release-nix-single.yml
index d99939f1d..500bf26d5 100644
--- a/.github/workflows/ami-release-nix-single.yml
+++ b/.github/workflows/ami-release-nix-single.yml
@@ -103,6 +103,8 @@ jobs:
       - name: Upload nix flake revision to s3 staging
         run: |
           aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
 
       - name: configure aws credentials - prod
         uses: aws-actions/configure-aws-credentials@v4
@@ -122,6 +124,8 @@ jobs:
       - name: Upload nix flake revision to s3 prod
         run: |
           aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
 
       - name: Create release
         uses: softprops/action-gh-release@v2
diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml
index bf2df0c96..0c97d8374 100644
--- a/.github/workflows/ami-release-nix.yml
+++ b/.github/workflows/ami-release-nix.yml
@@ -125,6 +125,8 @@ jobs:
       - name: Upload nix flake revision to s3 staging
         run: |
           aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
 
       - name: configure aws credentials - prod
         uses: aws-actions/configure-aws-credentials@v4
@@ -144,6 +146,8 @@ jobs:
       - name: Upload nix flake revision to s3 prod
         run: |
           aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
 
       - name: Create release
         uses: softprops/action-gh-release@v2
diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
index f816415b3..c8b3abe46 100644
--- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
+++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml
@@ -66,7 +66,9 @@ jobs:
 
       - name: Upload pg_upgrade scripts to s3 staging
         run: |
-          aws s3 cp /tmp/pg_upgrade_bin.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz"
+          aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
@@ -113,7 +115,9 @@ jobs:
   
       - name: Upload pg_upgrade scripts to s3 prod
         run: |
-          aws s3 cp /tmp/pg_upgrade_bin.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz"
+          aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
+          aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
+          aws s3 cp /tmp/pg_upgrade_bin.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index 321430c86..5636a34c3 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -34,8 +34,8 @@ jobs:
         include:
           - runner: arm-runner
             arch: arm64
-            ubuntu_release: focal
-            ubuntu_version: 20.04
+            ubuntu_release: noble
+            ubuntu_version: 24.04
             mcpu: neoverse-n1
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 150
diff --git a/Dockerfile-15 b/Dockerfile-15
index 6acf86037..68e9f4e59 100644
--- a/Dockerfile-15
+++ b/Dockerfile-15
@@ -38,7 +38,7 @@ ARG index_advisor_release=0.2.0
 ARG supautils_release=2.2.0
 ARG wal_g_release=2.0.1
 
-FROM ubuntu:focal as base
+FROM ubuntu:noble as base
 
 RUN apt update -y && apt install -y \
     curl \
diff --git a/Dockerfile-kubernetes b/Dockerfile-kubernetes
index 2a5e1ca1e..7337ee152 100644
--- a/Dockerfile-kubernetes
+++ b/Dockerfile-kubernetes
@@ -1,6 +1,6 @@
 FROM alpine:3.22
 
-ADD ./output-cloudimg/packer-cloudimg /disk/focal.qcow2
+ADD ./output-cloudimg/packer-cloudimg /disk/image.qcow2
 
 RUN apk add --no-cache qemu-system-aarch64 qemu-img openssh-client aavmf virtiofsd \
     && truncate -s 64M /root/varstore.img \
diff --git a/Dockerfile-orioledb-17 b/Dockerfile-orioledb-17
index 4a0413cb0..41254e4f7 100644
--- a/Dockerfile-orioledb-17
+++ b/Dockerfile-orioledb-17
@@ -39,7 +39,7 @@ ARG index_advisor_release=0.2.0
 ARG supautils_release=2.2.0
 ARG wal_g_release=3.0.5
 
-FROM ubuntu:focal as base
+FROM ubuntu:noble as base
 
 RUN apt update -y && apt install -y \
     curl \
diff --git a/Makefile b/Makefile
index 5bef8a430..96a4925ef 100644
--- a/Makefile
+++ b/Makefile
@@ -7,10 +7,6 @@ init: qemu-arm64-nix.pkr.hcl
 output-cloudimg/packer-cloudimg: ansible qemu-arm64-nix.pkr.hcl
 	packer build -var "git_sha=$(UPSTREAM_NIX_GIT_SHA)" qemu-arm64-nix.pkr.hcl
 
-disk/focal-raw.img: output-cloudimg/packer-cloudimg
-	mkdir -p disk
-	sudo qemu-img convert -O raw output-cloudimg/packer-cloudimg disk/focal-raw.img
-
 alpine-image: output-cloudimg/packer-cloudimg
 	sudo nerdctl build . -t supabase-postgres-test:$(GIT_SHA) -f ./Dockerfile-kubernetes
 
diff --git a/README.md b/README.md
index edf245bc0..a176ccec5 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 - ✅ Postgres [postgresql-15.8](https://www.postgresql.org/docs/15/index.html)
 - ✅ Postgres [postgresql-17.4](https://www.postgresql.org/docs/17/index.html)
 - ✅ Postgres [orioledb-postgresql-17_6](https://github.com/orioledb/orioledb)
-- ✅ Ubuntu 20.04 (Focal Fossa).
+- ✅ Ubuntu 24.04 (Noble Numbat).
 - ✅ [wal_level](https://www.postgresql.org/docs/current/runtime-config-wal.html) = logical and [max_replication_slots](https://www.postgresql.org/docs/current/runtime-config-replication.html) = 5. Ready for replication.
 - ✅ [Large Systems Extensions](https://github.com/aws/aws-graviton-getting-started#building-for-graviton-and-graviton2). Enabled for ARM images.
 ## Extensions 
@@ -115,7 +115,7 @@ Unmodified Postgres with some useful plugins. Our goal with this repo is not to
 | Goodie | Version | Description |
 | ------------- | :-------------: | ------------- |
 | [PgBouncer](https://www.pgbouncer.org/) | [1.19.0](http://www.pgbouncer.org/changelog.html#pgbouncer-119x) | Set up Connection Pooling. |
-| [PostgREST](https://postgrest.org/en/stable/) | [v12.2.3](https://github.com/PostgREST/postgrest/releases/tag/v12.2.3) | Instantly transform your database into an RESTful API. |
+| [PostgREST](https://postgrest.org/en/stable/) | [v13.0.4](https://github.com/PostgREST/postgrest/releases/tag/v13.0.4) | Instantly transform your database into an RESTful API. |
 | [WAL-G](https://github.com/wal-g/wal-g#wal-g) | [v2.0.1](https://github.com/wal-g/wal-g/releases/tag/v2.0.1) | Tool for physical database backup and recovery. | -->
 
 ## Install
diff --git a/amazon-arm64-nix.pkr.hcl b/amazon-arm64-nix.pkr.hcl
index e460dfc72..f625ac4af 100644
--- a/amazon-arm64-nix.pkr.hcl
+++ b/amazon-arm64-nix.pkr.hcl
@@ -1,6 +1,6 @@
 variable "ami" {
   type    = string
-  default = "ubuntu/images/hvm-ssd/ubuntu-focal-20.04-arm64-server-*"
+  default = "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-arm64-server-*"
 }
 
 variable "profile" {
@@ -115,7 +115,7 @@ source "amazon-ebssurrogate" "source" {
   #secret_key   = "${var.aws_secret_key}"
   force_deregister = var.force-deregister
 
-  # Use latest official ubuntu focal ami owned by Canonical.
+  # Use latest official ubuntu noble ami owned by Canonical.
   source_ami_filter {
     filters = {
       virtualization-type = "hvm"
diff --git a/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh b/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
index e170482e8..3f6f8d3d9 100755
--- a/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
+++ b/ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh
@@ -266,6 +266,7 @@ function complete_pg_upgrade {
         echo "5.1. Restarting gotrue and postgrest"
         retry 3 service gotrue restart
         retry 3 service postgrest restart
+        
     else
         retry 3 CI_stop_postgres || true
         retry 3 CI_start_postgres
diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf
index ae5537715..531d47ca1 100644
--- a/ansible/files/adminapi.sudoers.conf
+++ b/ansible/files/adminapi.sudoers.conf
@@ -23,6 +23,7 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
 %adminapi ALL= NOPASSWD: /bin/systemctl restart services.slice
 %adminapi ALL= NOPASSWD: /usr/sbin/nft -f /etc/nftables/supabase_managed.conf
 %adminapi ALL= NOPASSWD: /usr/bin/admin-mgr
+%adminapi ALL= NOPASSWD: /usr/sbin/netplan apply
 %adminapi ALL= NOPASSWD: ENVOY
 %adminapi ALL= NOPASSWD: KONG
 %adminapi ALL= NOPASSWD: POSTGREST
diff --git a/ansible/files/permission_check.py b/ansible/files/permission_check.py
index 46f458f9a..72a1a2fe2 100644
--- a/ansible/files/permission_check.py
+++ b/ansible/files/permission_check.py
@@ -40,7 +40,6 @@
     "backup": [{"groupname": "backup", "username": "backup"}],
     "list": [{"groupname": "list", "username": "list"}],
     "irc": [{"groupname": "irc", "username": "irc"}],
-    "gnats": [{"groupname": "gnats", "username": "gnats"}],
     "nobody": [{"groupname": "nogroup", "username": "nobody"}],
     "systemd-network": [
         {"groupname": "systemd-network", "username": "systemd-network"}
@@ -224,7 +223,6 @@ def main():
         "backup",
         "list",
         "irc",
-        "gnats",
         "nobody",
         "systemd-network",
         "systemd-resolve",
diff --git a/ansible/files/systemd-networkd/systemd-networkd-check-and-fix.service b/ansible/files/systemd-networkd/systemd-networkd-check-and-fix.service
index 5e7094388..939edc9ce 100644
--- a/ansible/files/systemd-networkd/systemd-networkd-check-and-fix.service
+++ b/ansible/files/systemd-networkd/systemd-networkd-check-and-fix.service
@@ -1,5 +1,6 @@
 [Unit]
 Description=Check if systemd-networkd has broken NDisc routes and fix
+# Remove Requisite to prevent being killed when restarting networkd
 Requisite=systemd-networkd.service
 After=systemd-networkd.service
 
diff --git a/ansible/manifest-playbook.yml b/ansible/manifest-playbook.yml
index d297e6ceb..ce02c805c 100644
--- a/ansible/manifest-playbook.yml
+++ b/ansible/manifest-playbook.yml
@@ -24,7 +24,7 @@
 
     - name: PostgREST - download ubuntu binary archive (arm)
       get_url:
-        url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-20.04-aarch64.tar.xz"
+        url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-aarch64.tar.xz"
         dest: /tmp/postgrest-{{ postgrest_release }}-arm64.tar.xz
         checksum: "{{ postgrest_arm_release_checksum }}"
         timeout: 60
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index bcd47ac9b..794b69895 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -78,8 +78,8 @@
         - install-supabase-internal
       when: debpkg_mode or nixpkg_mode
 
-    - name: Fix IPv6 NDisc issues
-      import_tasks: tasks/fix_ipv6_ndisc.yml
+    - name: Fix IPv6 NDisc issues (disabled)
+      import_tasks: tasks/fix-ipv6-ndisc.yml
       tags:
         - install-supabase-internal
       when: (debpkg_mode or nixpkg_mode) and (qemu_mode is undefined)
diff --git a/ansible/tasks/fix_ipv6_ndisc.yml b/ansible/tasks/fix-ipv6-ndisc.yml
similarity index 87%
rename from ansible/tasks/fix_ipv6_ndisc.yml
rename to ansible/tasks/fix-ipv6-ndisc.yml
index 7489a2fe1..8953fd880 100644
--- a/ansible/tasks/fix_ipv6_ndisc.yml
+++ b/ansible/tasks/fix-ipv6-ndisc.yml
@@ -25,9 +25,9 @@
 
 - name: fix Network - reload systemd
   systemd:
-    daemon_reload: yes
+    daemon_reload: false
 
-- name: fix Network - enable systemd timer
+- name: fix Network - ensure systemd timer is installed but disabled
   systemd:
     name: systemd-networkd-check-and-fix.timer
-    enabled: true
+    enabled: false
diff --git a/ansible/tasks/setup-postgres.yml b/ansible/tasks/setup-postgres.yml
index a1b7e6c7f..2fe302488 100644
--- a/ansible/tasks/setup-postgres.yml
+++ b/ansible/tasks/setup-postgres.yml
@@ -23,7 +23,7 @@
 
 - name: Postgres - install server
   apt:
-    name: postgresql-{{ postgresql_major }}={{ postgresql_release }}-1.pgdg20.04+1
+    name: postgresql-{{ postgresql_major }}={{ postgresql_release }}-1.pgdg24.04+1
     install_recommends: no
   when: debpkg_mode
 
diff --git a/ansible/tasks/setup-postgrest.yml b/ansible/tasks/setup-postgrest.yml
index b786ff3c9..df9fecb32 100644
--- a/ansible/tasks/setup-postgrest.yml
+++ b/ansible/tasks/setup-postgrest.yml
@@ -8,7 +8,7 @@
 
 - name: PostgREST - add Postgres PPA main
   apt_repository:
-    repo: "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg main"
+    repo: "deb http://apt.postgresql.org/pub/repos/apt/ noble-pgdg {{ postgresql_major }}"
     state: present
     filename: postgresql-pgdg
 
@@ -36,7 +36,7 @@
 
 - name: PostgREST - remove Postgres PPA
   apt_repository:
-    repo: "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg main"
+    repo: "deb http://apt.postgresql.org/pub/repos/apt/ noble-pgdg {{ postgresql_major }}"
     state: absent
 
 - name: postgis - ensure dependencies do not get autoremoved
@@ -48,7 +48,7 @@
 
 - name: PostgREST - download ubuntu binary archive (arm)
   get_url:
-    url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-20.04-aarch64.tar.xz"
+    url: "https://github.com/PostgREST/postgrest/releases/download/v{{ postgrest_release }}/postgrest-v{{ postgrest_release }}-ubuntu-aarch64.tar.xz"
     dest: /tmp/postgrest.tar.xz
     checksum: "{{ postgrest_arm_release_checksum }}"
     timeout: 60
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 927e81b0e..b30469bec 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,19 +9,20 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.007-orioledb"
-  postgres17: "17.4.1.064"
-  postgres15: "15.8.1.121"
+  postgresorioledb-17: "17.5.1.008-orioledb"
+  postgres17: "17.4.1.065"
+  postgres15: "15.8.1.122"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
 pgbouncer_release_checksum: sha256:af0b05e97d0e1fd9ad45fe00ea6d2a934c63075f67f7e2ccef2ca59e3d8ce682
 
-# The checksum can be found under "Assets", in the GitHub release page for each version:
+# The checksum can be found under "Assets", in the GitHub release page for each version.
+# The binaries used are: ubuntu-aarch64 and linux-static.
 # https://github.com/PostgREST/postgrest/releases
-postgrest_release: "12.2.12"
-postgrest_arm_release_checksum: sha256:6b2eaa5759329e024df76f79d93f6bb3d87a93de11433acc5d66aa6c96f81f90
-postgrest_x86_release_checksum: sha256:5de4092f1719da3353c40bf96c8dec6913f2254a7cd0b61cc05f233153b557d5
+postgrest_release: "13.0.4"
+postgrest_arm_release_checksum: sha256:2b400200fb15eb5849267e4375fbbc516dd727afadd8786815b48074ed8c03e1
+postgrest_x86_release_checksum: sha256:a0052c8d4726f52349e0298f98da51140ef4941855548590ee88331afa617811
 
 gotrue_release: 2.177.0
 gotrue_release_checksum: sha1:664a26237618c4bfb1e33e4f03a540c3cef3e3c8
@@ -30,16 +31,16 @@ aws_cli_release: "2.23.11"
 
 salt_minion_version: 3007
 
-golang_version: "1.19.3"
+golang_version: "1.22.11"
 golang_version_checksum:
-  arm64: sha256:99de2fe112a52ab748fb175edea64b313a0c8d51d6157dba683a6be163fd5eab
-  amd64: sha256:74b9640724fd4e6bb0ed2a1bc44ae813a03f1e72a4c76253e2d5c015494430ba
+  arm64: sha256:0fc88d966d33896384fbde56e9a8d80a305dc17a9f48f1832e061724b1719991
+  amd64: sha256:9ebfcab26801fa4cf0627c6439db7a4da4d3c6766142a3dd83508240e4f21031
 
 envoy_release: 1.28.0
 envoy_release_checksum: sha1:b0a06e9cfb170f1993f369beaa5aa9d7ec679ce5
 envoy_hot_restarter_release_checksum: sha1:6d43b89d266fb2427a4b51756b649883b0617eda
 
-kong_release_target: focal # if it works, it works
+kong_release_target: focal
 kong_deb: kong_2.8.1_arm64.deb
 kong_deb_checksum: sha1:2086f6ccf8454fe64435252fea4d29d736d7ec61
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 116377b5d..53a96029e 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,8 +1,8 @@
-ARG ubuntu_release=focal
+ARG ubuntu_release=noble
 FROM ubuntu:${ubuntu_release} as base
 
 ARG ubuntu_release=flocal
-ARG ubuntu_release_no=20.04
+ARG ubuntu_release_no=24.04
 ARG postgresql_major=15
 ARG postgresql_release=${postgresql_major}.1
 
diff --git a/ebssurrogate/files/sources-arm64.cfg b/ebssurrogate/files/sources-arm64.cfg
index a2363773e..eed6c0f16 100644
--- a/ebssurrogate/files/sources-arm64.cfg
+++ b/ebssurrogate/files/sources-arm64.cfg
@@ -1,10 +1,10 @@
-deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ focal main restricted
-deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ focal-updates main restricted
-deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ focal universe
-deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ focal-updates universe
-deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ focal multiverse
-deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ focal-updates multiverse
-deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ focal-backports main restricted universe multiverse
-deb http://ports.ubuntu.com/ubuntu-ports focal-security main restricted
-deb http://ports.ubuntu.com/ubuntu-ports focal-security universe
-deb http://ports.ubuntu.com/ubuntu-ports focal-security multiverse
+deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ noble main restricted
+deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ noble-updates main restricted
+deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ noble universe
+deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ noble-updates universe
+deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ noble multiverse
+deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ noble-updates multiverse
+deb http://REGION.clouds.ports.ubuntu.com/ubuntu-ports/ noble-backports main restricted universe multiverse
+deb http://ports.ubuntu.com/ubuntu-ports noble-security main restricted
+deb http://ports.ubuntu.com/ubuntu-ports noble-security universe
+deb http://ports.ubuntu.com/ubuntu-ports noble-security multiverse
diff --git a/ebssurrogate/files/sources.cfg b/ebssurrogate/files/sources.cfg
index ec3011807..a27be052f 100644
--- a/ebssurrogate/files/sources.cfg
+++ b/ebssurrogate/files/sources.cfg
@@ -1,10 +1,10 @@
-deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ focal main restricted
-deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ focal-updates main restricted
-deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ focal universe
-deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ focal-updates universe
-deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ focal multiverse
-deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ focal-updates multiverse
-deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ focal-backports main restricted universe multiverse
-deb http://security.ubuntu.com/ubuntu focal-security main restricted
-deb http://security.ubuntu.com/ubuntu focal-security universe
-deb http://security.ubuntu.com/ubuntu focal-security multiverse
+deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ noble main restricted
+deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ noble-updates main restricted
+deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ noble universe
+deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ noble-updates universe
+deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ noble multiverse
+deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ noble-updates multiverse
+deb http://REGION.ec2.archive.ubuntu.com/ubuntu/ noble-backports main restricted universe multiverse
+deb http://security.ubuntu.com/ubuntu noble-security main restricted
+deb http://security.ubuntu.com/ubuntu noble-security universe
+deb http://security.ubuntu.com/ubuntu noble-security multiverse
diff --git a/ebssurrogate/scripts/chroot-bootstrap-nix.sh b/ebssurrogate/scripts/chroot-bootstrap-nix.sh
index cda6bd2aa..9a623eb12 100755
--- a/ebssurrogate/scripts/chroot-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/chroot-bootstrap-nix.sh
@@ -58,7 +58,7 @@ function update_install_packages {
 	apt-get upgrade -y
 
 	# Install OpenSSH and other packages
-	sudo add-apt-repository universe
+	sudo add-apt-repository --yes universe
 	apt-get update
 	apt-get install -y --no-install-recommends \
 		openssh-server \
@@ -157,10 +157,21 @@ function disable_fsck {
 
 # Don't request hostname during boot but set hostname
 function setup_hostname {
-	sed -i 's/gethostname()/ubuntu /g' /etc/dhcp/dhclient.conf
-	sed -i 's/host-name,//g' /etc/dhcp/dhclient.conf
+	# Set the static hostname
 	echo "ubuntu" > /etc/hostname
 	chmod 644 /etc/hostname
+	# Update netplan configuration to not send hostname
+	cat << EOF > /etc/netplan/01-hostname.yaml
+network:
+  version: 2
+  ethernets:
+    eth0:
+      dhcp4: true
+      dhcp4-overrides:
+        send-hostname: false
+EOF
+	# Set proper permissions for netplan security
+	chmod 600 /etc/netplan/01-hostname.yaml
 }
 
 # Set options for the default interface
@@ -172,6 +183,8 @@ network:
     eth0:
       dhcp4: true
 EOF
+	# Set proper permissions for netplan security
+	chmod 600 /etc/netplan/eth0.yaml
 }
 
 function disable_sshd_passwd_auth {
diff --git a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
index 39b8f4e82..965b1e07b 100755
--- a/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/surrogate-bootstrap-nix.sh
@@ -148,7 +148,7 @@ EOF
 }
 
 function setup_chroot_environment {
-	UBUNTU_VERSION=$(lsb_release -cs) # 'focal' for Ubuntu 20.04
+	UBUNTU_VERSION=$(lsb_release -cs) # 'noble' for Ubuntu 24.04
 
 	# Bootstrap Ubuntu into /mnt
 	debootstrap --arch ${ARCH} --variant=minbase "$UBUNTU_VERSION" /mnt
diff --git a/nix/tools/update_readme.nu b/nix/tools/update_readme.nu
index bfb46ab0a..b19c266a3 100755
--- a/nix/tools/update_readme.nu
+++ b/nix/tools/update_readme.nu
@@ -153,7 +153,7 @@ def update_readme [] {
     # Update Primary Features section
     let features_content = [
         ($pg_versions | each {|version| create_version_link $version} | str join "\n")
-        "- ✅ Ubuntu 20.04 (Focal Fossa)."
+        "- ✅ Ubuntu 24.04 (Noble Numbat)."
         "- ✅ [wal_level](https://www.postgresql.org/docs/current/runtime-config-wal.html) = logical and [max_replication_slots](https://www.postgresql.org/docs/current/runtime-config-replication.html) = 5. Ready for replication."
         "- ✅ [Large Systems Extensions](https://github.com/aws/aws-graviton-getting-started#building-for-graviton-and-graviton2). Enabled for ARM images."
     ]
diff --git a/qemu-arm64-nix.pkr.hcl b/qemu-arm64-nix.pkr.hcl
index 192796205..352ae5c38 100644
--- a/qemu-arm64-nix.pkr.hcl
+++ b/qemu-arm64-nix.pkr.hcl
@@ -74,8 +74,8 @@ source "qemu" "cloudimg" {
   format         = "qcow2"
   headless       = true
   http_directory = "http"
-  iso_checksum   = "file:https://cloud-images.ubuntu.com/focal/current/SHA256SUMS"
-  iso_url        = "https://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-arm64.img"
+  iso_checksum   = "file:https://cloud-images.ubuntu.com/noble/current/SHA256SUMS"
+  iso_url        = "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-arm64.img"
   memory         = 40000
   qemu_binary    = "qemu-system-aarch64"
   qemuargs = [
diff --git a/scripts/90-cleanup-qemu.sh b/scripts/90-cleanup-qemu.sh
index 50d8d956f..c70c1d246 100644
--- a/scripts/90-cleanup-qemu.sh
+++ b/scripts/90-cleanup-qemu.sh
@@ -24,10 +24,8 @@ elif [ -n "$(command -v apt-get)" ]; then
  	autoconf \
 	autotools-dev \
  	cmake-data \
-	cpp-8  \
 	cpp-9  \
 	cpp-10  \
-	gcc-8  \
 	gcc-9  \
 	gcc-10  \
 	git  \
@@ -44,10 +42,6 @@ elif [ -n "$(command -v apt-get)" ]; then
 
   source /etc/os-release
 
-  apt-mark manual libevent-2.1-7 # required for pgbouncer
-  apt-get -y remove --purge ansible-core apport appstream bash-completion bcache-tools bind9-dnsutils bind9-host bind9-libs bolt btrfs-progs byobu command-not-found console-setup distro-info eject fonts-ubuntu-console friendly-recovery ftp fwupd gawk gdisk keyboard-configuration libvolume-key1 libicu66 libssl-dev lvm2 lxd-agent-loader man-db mdadm modemmanager mtd-utils nano netcat-openbsd nfs-common ntfs-3g parted pastebinit screen strace thin-provisioning-tools tmux usb-modeswitch vim vim-runtime wget whiptail xfsprogs
-  apt remove -y --purge libc6-dev linux-libc-dev libevent-dev libpcre3-dev libsystemd-dev
-
   apt-get -y update
   apt-get -y upgrade
   apt-get -y autoremove
diff --git a/scripts/90-cleanup.sh b/scripts/90-cleanup.sh
index f2e19686d..644e5f7f6 100644
--- a/scripts/90-cleanup.sh
+++ b/scripts/90-cleanup.sh
@@ -24,10 +24,8 @@ elif [ -n "$(command -v apt-get)" ]; then
  	autoconf \
 	autotools-dev \
  	cmake-data \
-	cpp-8  \
 	cpp-9  \
 	cpp-10  \
-	gcc-8  \
 	gcc-9  \
 	gcc-10  \
 	git  \
@@ -36,14 +34,12 @@ elif [ -n "$(command -v apt-get)" ]; then
 	libicu-dev \
 	libcgal-dev \
 	libgcc-9-dev \
-	libgcc-8-dev \
  	ansible
 
   add-apt-repository --yes --remove ppa:ansible/ansible
 
   source /etc/os-release
-  apt-get -y remove --purge linux-headers-5.11.0-1021-aws
-
+  
   apt-get -y update
   apt-get -y upgrade
   apt-get -y autoremove
diff --git a/scripts/99-img_check.sh b/scripts/99-img_check.sh
index 00b547641..ac958a5fc 100755
--- a/scripts/99-img_check.sh
+++ b/scripts/99-img_check.sh
@@ -569,7 +569,7 @@ osv=0
 
 if [[ $OS == "Ubuntu" ]]; then
         ost=1
-    if [[ $VER == "20.04" ]]; then
+    if [[ $VER == "24.04" ]]; then
         osv=1
     elif [[ $VER == "18.04" ]]; then
         osv=1
diff --git a/testinfra/README.md b/testinfra/README.md
index 977043c3b..6ecdeadb5 100644
--- a/testinfra/README.md
+++ b/testinfra/README.md
@@ -32,8 +32,8 @@ for layer in /tmp/extensions/*/layer.tar; do
   tar xvf "$layer" -C ansible/files/extensions --strip-components 1
 done
 docker buildx build \
-  --build-arg ubuntu_release=focal \
-  --build-arg ubuntu_release_no=20.04 \
+  --build-arg ubuntu_release=noble \
+  --build-arg ubuntu_release_no=24.04 \
   --build-arg postgresql_major=15 \
   --build-arg postgresql_release=15.1 \
   --build-arg CPPFLAGS=-mcpu=neoverse-n1 \
diff --git a/testinfra/test_ami_nix.py b/testinfra/test_ami_nix.py
index 864ab2861..d7b3ecca7 100644
--- a/testinfra/test_ami_nix.py
+++ b/testinfra/test_ami_nix.py
@@ -293,6 +293,9 @@ def gzip_then_base64_encode(s: str) -> str:
     )[0]
     instance.wait_until_running()
 
+    # Increase wait time before starting health checks
+    sleep(30)  # Wait for 30 seconds to allow services to start
+
     ec2logger = EC2InstanceConnectLogger(debug=False)
     temp_key = EC2InstanceConnectKey(ec2logger.get_logger())
     ec2ic = boto3.client("ec2-instance-connect", region_name="ap-southeast-1")
diff --git a/tests/pg_upgrade/debug.sh b/tests/pg_upgrade/debug.sh
index b05d8941d..50fb9facc 100755
--- a/tests/pg_upgrade/debug.sh
+++ b/tests/pg_upgrade/debug.sh
@@ -24,7 +24,7 @@ if [ ! -f "$LATEST_VERSION_SCRIPTS" ]; then
 fi
 
 if [ ! -f "$LATEST_VERSION_BIN" ]; then
-  aws s3 cp "s3://${ARTIFACTS_BUCKET_NAME}/upgrades/postgres/supabase-postgres-${LATEST_PG_VERSION}/20.04.tar.gz" "$LATEST_VERSION_BIN"
+  aws s3 cp "s3://${ARTIFACTS_BUCKET_NAME}/upgrades/postgres/supabase-postgres-${LATEST_PG_VERSION}/24.04.tar.gz" "$LATEST_VERSION_BIN"
 fi
 
 rm -rf scripts/pg_upgrade_scripts

From de14ba75e2bc64a8b6b4c9f3877879bdd8fb43ba Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Thu, 24 Jul 2025 21:57:37 -0400
Subject: [PATCH 48/64] fix: a few updates slipped by in merge, this PR fixes
 those (#1719)

---
 Dockerfile-17         | 2 +-
 Dockerfile-kubernetes | 2 +-
 ansible/vars.yml      | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Dockerfile-17 b/Dockerfile-17
index 1f1309fc1..5ad8ed397 100644
--- a/Dockerfile-17
+++ b/Dockerfile-17
@@ -39,7 +39,7 @@ ARG index_advisor_release=0.2.0
 ARG supautils_release=2.2.0
 ARG wal_g_release=3.0.5
 
-FROM ubuntu:focal as base
+FROM ubuntu:noble as base
 
 RUN apt update -y && apt install -y \
     curl \
diff --git a/Dockerfile-kubernetes b/Dockerfile-kubernetes
index 7337ee152..e27ec2ce7 100644
--- a/Dockerfile-kubernetes
+++ b/Dockerfile-kubernetes
@@ -6,7 +6,7 @@ RUN apk add --no-cache qemu-system-aarch64 qemu-img openssh-client aavmf virtiof
     && truncate -s 64M /root/varstore.img \
     && truncate -s 64M /root/efi.img \
     && dd if=/usr/share/AAVMF/QEMU_EFI.fd of=/root/efi.img conv=notrunc \
-    && qemu-img create -f qcow2 /tmp/disk.qcow2 -b /disk/focal.qcow2 -F qcow2 \
+    && qemu-img create -f qcow2 /tmp/disk.qcow2 -b /disk/image.qcow2 -F qcow2 \
     && apk del --no-cache aavmf qemu-img
 
 CMD exec /bin/sh -c "trap : TERM INT; sleep 9999999999d & wait"
diff --git a/ansible/vars.yml b/ansible/vars.yml
index b30469bec..3ab3ab7a3 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.008-orioledb"
-  postgres17: "17.4.1.065"
-  postgres15: "15.8.1.122"
+  postgresorioledb-17: "17.5.1.009-orioledb"
+  postgres17: "17.4.1.066"
+  postgres15: "15.8.1.123"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From ca89fbd84aebaf27bc8b27bb36e636d75572fbe7 Mon Sep 17 00:00:00 2001
From: Div Arora <root@darora.com>
Date: Sun, 27 Jul 2025 10:21:14 +0800
Subject: [PATCH 49/64] chore: remove unused packages from qemu build

---
 ansible/playbook.yml       |  2 +-
 ansible/vars.yml           |  6 ++---
 qemu-arm64-nix.pkr.hcl     |  8 ++++++-
 scripts/90-cleanup-qemu.sh | 47 ++++++++++++++++++++++++++++++++++++--
 4 files changed, 56 insertions(+), 7 deletions(-)

diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index 794b69895..0991a813a 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -198,7 +198,7 @@
         - collect-binaries
       when: debpkg_mode
 
-    - name: Install osquery from nixpkgs binary cache
+    - name: Purge snapd
       become: yes
       shell: |
         apt autoremove -y --purge snapd
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 3ab3ab7a3..580959265 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.009-orioledb"
-  postgres17: "17.4.1.066"
-  postgres15: "15.8.1.123"
+  postgresorioledb-17: "17.5.1.010-orioledb"
+  postgres17: "17.4.1.067"
+  postgres15: "15.8.1.124"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/qemu-arm64-nix.pkr.hcl b/qemu-arm64-nix.pkr.hcl
index 352ae5c38..497871774 100644
--- a/qemu-arm64-nix.pkr.hcl
+++ b/qemu-arm64-nix.pkr.hcl
@@ -74,9 +74,15 @@ source "qemu" "cloudimg" {
   format         = "qcow2"
   headless       = true
   http_directory = "http"
+  # TODO (darora): switch to minimal images
+  # iso_checksum   = "file:https://cloud-images.ubuntu.com/minimal/releases/noble/release/SHA256SUMS"
+  # iso_url        = "https://cloud-images.ubuntu.com/minimal/releases/noble/release/ubuntu-24.04-minimal-cloudimg-arm64.img"
   iso_checksum   = "file:https://cloud-images.ubuntu.com/noble/current/SHA256SUMS"
   iso_url        = "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-arm64.img"
   memory         = 40000
+  qemu_img_args {
+    convert = ["-o", "compression_type=zstd"]
+  }
   qemu_binary    = "qemu-system-aarch64"
   qemuargs = [
     ["-machine", "virt,gic-version=3"],
@@ -84,7 +90,7 @@ source "qemu" "cloudimg" {
     ["-device", "virtio-gpu-pci"],
     ["-drive", "if=pflash,format=raw,id=ovmf_code,readonly=on,file=/usr/share/AAVMF/AAVMF_CODE.fd"],
     ["-drive", "if=pflash,format=raw,id=ovmf_vars,file=AAVMF_VARS.fd"],
-    ["-drive", "file=output-cloudimg/packer-cloudimg,format=qcow2"],
+    ["-drive", "file=output-cloudimg/packer-cloudimg,if=virtio,format=qcow2,discard=on,detect-zeroes=unmap"],
     ["-drive", "file=seeds-cloudimg.iso,format=raw"],
     ["--enable-kvm"]
   ]
diff --git a/scripts/90-cleanup-qemu.sh b/scripts/90-cleanup-qemu.sh
index c70c1d246..e6a585001 100644
--- a/scripts/90-cleanup-qemu.sh
+++ b/scripts/90-cleanup-qemu.sh
@@ -42,15 +42,47 @@ elif [ -n "$(command -v apt-get)" ]; then
 
   source /etc/os-release
 
-  apt-get -y update
-  apt-get -y upgrade
+  apt-mark manual libevent-2.1-7t64
+
+  apt-get remove -y --purge ansible-core apport appstream bash-completion bcache-tools bind9-dnsutils bind9-host bind9-libs bolt btrfs-progs byobu command-not-found console-setup distro-info eject fonts-ubuntu-console friendly-recovery ftp fwupd gawk gdisk keyboard-configuration libvolume-key1 libssl-dev lvm2 lxd-agent-loader man-db mdadm modemmanager mtd-utils nano netcat-openbsd nfs-common ntfs-3g parted pastebinit screen strace thin-provisioning-tools tmux usb-modeswitch vim vim-runtime wget whiptail xfsprogs
+
+  apt remove -y --purge libc6-dev linux-libc-dev libevent-dev libpcre3-dev libsystemd-dev packagekit multipath-tools unattended-upgrades plymouth gnupg open-vm-tools xauth lxd-installer publicsuffix libclang-cpp18 python3-twisted python-babel-localedata libicu74 python3-pygments fonts-dejavu* python3-botocore
+
+  apt-get remove -y --purge linux-headers*
+
+  # remove old kernels
+  # CURRENT_KERNEL="$(uname -r | sed 's/-generic//')"
+  # INSTALLED_KERNELS=$(dpkg -l | awk '{print $2}' | grep -Eo 'linux-(image|headers|modules|tools)-[0-9]+' | sed -E 's/linux-(image|modules|tools)-//' | sort -Vu)
+  # REMOVE_KERNELS=$(echo "$INSTALLED_KERNELS" | grep -v -e "$CURRENT_KERNEL")
+  # for VER in $REMOVE_KERNELS; do
+  #     for PREFIX in linux-image linux-modules linux-tools; do
+  #         for PKG in $(dpkg -l | awk '{print $2}' | grep "^$PREFIX-$VER"); do
+  #             apt-get purge -y "$PKG"
+  #         done
+  #     done
+  # done
+  # update-grub
+
   apt-get -y autoremove
   apt-get -y autoclean
+
+  apt-get -y update
+  apt-get -y upgrade
+
 fi
+
+systemctl set-default multi-user.target
+systemctl disable getty@tty1.service
+systemctl mask getty@tty1.service
+systemctl mask graphical.target
+
 rm -rf /tmp/* /var/tmp/*
 history -c
 cat /dev/null > /root/.bash_history
 unset HISTFILE
+
+journalctl --rotate
+journalctl --vacuum-time=1s
 find /var/log -mtime -1 -type f -exec truncate -s 0 {} \;
 rm -rf /var/log/*.gz /var/log/*.[0-9] /var/log/*-????????
 rm -rf /var/lib/cloud/instances/*
@@ -60,3 +92,14 @@ chmod 600 /etc/ssh/revoked_keys
 
 cat /dev/null > /var/log/lastlog
 cat /dev/null > /var/log/wtmp
+
+dd if=/dev/zero of=/zerofile &
+  PID=$!
+  while [ -d /proc/$PID ]
+    do
+      printf "."
+      sleep 5
+    done
+sync; rm /zerofile; sync
+
+fstrim /

From ae29c6f6d07e8f05f54fe5525ff7827fc3bceb7f Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Tue, 29 Jul 2025 12:23:40 +0100
Subject: [PATCH 50/64] fix: add wants, requires and after to
 supabase-admin-agent systemd unit (#1726)

---
 .../supabase-admin-agent_salt.service                     | 4 +++-
 ansible/vars.yml                                          | 8 ++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service
index 92f1d2e31..f368008b4 100644
--- a/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service
+++ b/ansible/files/supabase_admin_agent_config/supabase-admin-agent_salt.service
@@ -1,6 +1,8 @@
 [Unit]
 Description=Configuration management via supabase-admin-agent salt
-After=network.target
+After=network.target local-fs.target tmp.mount
+Wants=network-online.target
+Requires=local-fs.target
 
 [Service]
 Type=oneshot
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 580959265..fcbe8eb91 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.010-orioledb"
-  postgres17: "17.4.1.067"
-  postgres15: "15.8.1.124"
+  postgresorioledb-17: "17.5.1.011-orioledb"
+  postgres17: "17.4.1.068"
+  postgres15: "15.8.1.125"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -54,7 +54,7 @@ postgres_exporter_release_checksum:
 
 adminapi_release: 0.84.1
 adminmgr_release: 0.25.1
-supabase_admin_agent_release: 1.4.37
+supabase_admin_agent_release: 1.4.38
 supabase_admin_agent_splay: 30
 
 vector_x86_deb: "https://packages.timber.io/vector/0.48.X/vector_0.48.0-1_amd64.deb"

From d0fbf41a7977a6551cc0b191ee6d37abcd9569bf Mon Sep 17 00:00:00 2001
From: andres suarez <valigula@gmail.com>
Date: Wed, 30 Jul 2025 19:11:38 +0200
Subject: [PATCH 51/64] feat: add script to mount/unmount disks (#1727)

* feat: add script to mount/unmount disks

* feat: add script to unmount disk

* fix: rmove files to correct path

* feat: validating the disk in a state

---------

Co-authored-by: andres.suarez <andres.suarez@supabase.io>
---
 .../files/admin_api_scripts/mount-volume.sh   | 62 +++++++++++++++++++
 .../files/admin_api_scripts/unmount-volume.sh | 43 +++++++++++++
 ansible/files/adminapi.sudoers.conf           |  2 +
 ansible/tasks/internal/admin-api.yml          |  2 +
 4 files changed, 109 insertions(+)
 create mode 100644 ansible/files/admin_api_scripts/mount-volume.sh
 create mode 100644 ansible/files/admin_api_scripts/unmount-volume.sh

diff --git a/ansible/files/admin_api_scripts/mount-volume.sh b/ansible/files/admin_api_scripts/mount-volume.sh
new file mode 100644
index 000000000..5f4277f2d
--- /dev/null
+++ b/ansible/files/admin_api_scripts/mount-volume.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DEVICE=${1:-}
+MOUNT_POINT=${2:-}
+
+if [[ -z "$DEVICE" || -z "$MOUNT_POINT" ]]; then
+  echo "Usage: $0 <device> <mount_point>"
+  echo "Example: sudo ./mount-volume.sh /dev/nvme1n1 /data/150008"
+  exit 1
+fi
+
+#  Mount a block device to a specified mount point
+#  If the device is not formatted, format it as ext4
+#  Set ownership to postgres:postgres and permissions to 750
+#  Add the mount entry to /etc/fstab for persistence across reboots
+
+OWNER="postgres:postgres"
+PERMISSIONS="750"
+FSTYPE="ext4"
+MOUNT_OPTS="defaults"
+FSTAB_FILE="/etc/fstab"
+
+if [ ! -b "$DEVICE" ]; then
+  echo "Error: Block device '$DEVICE' does not exist."
+  exit 2
+fi
+
+if ! blkid "$DEVICE" >/dev/null 2>&1; then
+  echo "Device $DEVICE appears unformatted. Formatting as $FSTYPE..."
+  mkfs."$FSTYPE" -F "$DEVICE"
+else
+  echo "$DEVICE already has a filesystem — skipping format."
+fi
+
+mkdir -p "$MOUNT_POINT"
+
+e2fsck -pf "$DEVICE"
+
+if ! mountpoint -q "$MOUNT_POINT"; then
+  echo "Mounting $DEVICE to $MOUNT_POINT"
+  mount -t "$FSTYPE" -o "$MOUNT_OPTS" "$DEVICE" "$MOUNT_POINT"
+else
+  echo "$MOUNT_POINT is already mounted"
+fi
+
+echo "Setting ownership and permissions on $MOUNT_POINT"
+chown "$OWNER" "$MOUNT_POINT"
+chmod "$PERMISSIONS" "$MOUNT_POINT"
+
+UUID=$(blkid -s UUID -o value "$DEVICE")
+FSTAB_LINE="UUID=$UUID  $MOUNT_POINT  $FSTYPE  $MOUNT_OPTS  0  2"
+
+if ! grep -q "$UUID" "$FSTAB_FILE"; then
+  echo "Adding $FSTAB_LINE to $FSTAB_FILE"
+  echo "$FSTAB_LINE" >> "$FSTAB_FILE"
+else
+  echo "UUID $UUID already in $FSTAB_FILE — skipping"
+fi
+
+echo "Mounted $DEVICE at $MOUNT_POINT with postgres:postgres and mode $PERMISSIONS"
diff --git a/ansible/files/admin_api_scripts/unmount-volume.sh b/ansible/files/admin_api_scripts/unmount-volume.sh
new file mode 100644
index 000000000..6250b8c47
--- /dev/null
+++ b/ansible/files/admin_api_scripts/unmount-volume.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+MOUNT_POINT=${1:-}
+DELETE_FLAG=${2:-}
+
+if [[ -z "$MOUNT_POINT" ]]; then
+  echo "Usage: $0 <mount_point> [--delete-dir]"
+  echo "Unmount only: sudo ./unmount-volume.sh /data/150008"
+  echo "Unmount delete dir: sudo ./unmount-volume.sh /data/150008 --delete-dir"
+  exit 1
+fi
+
+# Unmount a block device from a specified mount point
+# Remove the corresponding entry from /etc/fstab for persistence across reboots 
+
+FSTAB_FILE="/etc/fstab"
+BACKUP_FILE="/etc/fstab.bak"
+
+if mountpoint -q "$MOUNT_POINT"; then
+  echo "Unmounting $MOUNT_POINT"
+  umount "$MOUNT_POINT"
+else
+  echo "$MOUNT_POINT is not currently mounted — skipping umount"
+fi
+
+UUID=$(findmnt -no UUID "$MOUNT_POINT" 2>/dev/null || true)
+
+if [[ -n "$UUID" ]]; then
+  echo "Removing UUID=$UUID from $FSTAB_FILE"
+  cp "$FSTAB_FILE" "$BACKUP_FILE"
+  sed -i "/UUID=${UUID//\//\\/}/d" "$FSTAB_FILE"
+else
+  echo "Could not find UUID for $MOUNT_POINT — skipping fstab cleanup"
+fi
+
+if [[ "$DELETE_FLAG" == "--delete-dir" ]]; then
+  echo "Deleting mount point directory: $MOUNT_POINT"
+  rm -rf "$MOUNT_POINT"
+fi
+
+echo "Unmount and cleanup complete for $MOUNT_POINT"
diff --git a/ansible/files/adminapi.sudoers.conf b/ansible/files/adminapi.sudoers.conf
index 531d47ca1..904377c29 100644
--- a/ansible/files/adminapi.sudoers.conf
+++ b/ansible/files/adminapi.sudoers.conf
@@ -5,6 +5,8 @@ Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop got
 Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service, /bin/systemctl try-restart pgbouncer.service
 
 %adminapi ALL= NOPASSWD: /root/grow_fs.sh
+%adminapi ALL= NOPASSWD: /root/mount-volume.sh
+%adminapi ALL= NOPASSWD: /root/unmount-volume.sh
 %adminapi ALL= NOPASSWD: /root/manage_readonly_mode.sh
 %adminapi ALL= NOPASSWD: /etc/adminapi/pg_upgrade_scripts/prepare.sh
 %adminapi ALL= NOPASSWD: /etc/adminapi/pg_upgrade_scripts/initiate.sh
diff --git a/ansible/tasks/internal/admin-api.yml b/ansible/tasks/internal/admin-api.yml
index 5eb6fd276..5844b3f54 100644
--- a/ansible/tasks/internal/admin-api.yml
+++ b/ansible/tasks/internal/admin-api.yml
@@ -14,6 +14,8 @@
     - { file: "grow_fs.sh" }
     - { file: "manage_readonly_mode.sh" }
     - { file: "pg_egress_collect.pl" }
+    - { file: "mount-volume.sh" }
+    - { file: "unmount-volume.sh" }
 
 - name: give adminapi user permissions
   copy:

From e1ac8804019e4c3905fb8d0a47f0468605728f29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Wed, 30 Jul 2025 22:55:37 +0200
Subject: [PATCH 52/64] fix(ext/wrappers): restore backward compatibility files
 for postgres upgrade
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Postgres upgrade is failing due to missing files in the wrappers.

Refactor extension build to move file creation from individual builds to the final buildEnv stage, ensuring all version-specific library symlinks and migration SQL files are properly included for postgres upgrades.

<details>
  <summary>Files present in the extension before upgrading the extension</summary>

  ```bash
  $ nix build -L github:supabase/postgres/4db4d5b94269398dc167fe96ea43fc4336bff8b5\#packages.x86_64-linux.psql_15/exts/supabase-wrappers
  $ tree result
  result/
  ├── lib
  │   ├── wrappers-0.1.0.so -> wrappers.so
  │   ├── wrappers-0.1.10.so -> wrappers.so
  │   ├── wrappers-0.1.11.so -> wrappers.so
  │   ├── wrappers-0.1.12.so -> wrappers.so
  │   ├── wrappers-0.1.14.so -> wrappers.so
  │   ├── wrappers-0.1.15.so -> wrappers.so
  │   ├── wrappers-0.1.16.so -> wrappers.so
  │   ├── wrappers-0.1.17.so -> wrappers.so
  │   ├── wrappers-0.1.18.so -> wrappers.so
  │   ├── wrappers-0.1.19.so -> wrappers.so
  │   ├── wrappers-0.1.1.so -> wrappers.so
  │   ├── wrappers-0.1.4.so -> wrappers.so
  │   ├── wrappers-0.1.5.so -> wrappers.so
  │   ├── wrappers-0.1.6.so -> wrappers.so
  │   ├── wrappers-0.1.7.so -> wrappers.so
  │   ├── wrappers-0.1.8.so -> wrappers.so
  │   ├── wrappers-0.1.9.so -> wrappers.so
  │   ├── wrappers-0.2.0.so -> wrappers.so
  │   ├── wrappers-0.3.0.so -> wrappers.so
  │   ├── wrappers-0.3.1.so -> wrappers.so
  │   ├── wrappers-0.4.0.so -> wrappers.so
  │   ├── wrappers-0.4.1.so -> wrappers.so
  │   ├── wrappers-0.4.2.so -> wrappers.so
  │   ├── wrappers-0.4.3.so -> wrappers.so
  │   ├── wrappers-0.4.4.so -> wrappers.so
  │   ├── wrappers-0.4.5.so -> wrappers.so
  │   ├── wrappers-0.4.6.so -> wrappers.so
  │   ├── wrappers-0.5.0.so -> wrappers.so
  │   └── wrappers.so
  └── share
      └── postgresql
	  └── extension
	      ├── wrappers--0.1.0--0.5.0.sql
	      ├── wrappers--0.1.10--0.5.0.sql
	      ├── wrappers--0.1.1--0.5.0.sql
	      ├── wrappers--0.1.11--0.5.0.sql
	      ├── wrappers--0.1.12--0.5.0.sql
	      ├── wrappers--0.1.14--0.5.0.sql
	      ├── wrappers--0.1.15--0.5.0.sql
	      ├── wrappers--0.1.16--0.5.0.sql
	      ├── wrappers--0.1.17--0.5.0.sql
	      ├── wrappers--0.1.18--0.5.0.sql
	      ├── wrappers--0.1.19--0.5.0.sql
	      ├── wrappers--0.1.4--0.5.0.sql
	      ├── wrappers--0.1.5--0.5.0.sql
	      ├── wrappers--0.1.6--0.5.0.sql
	      ├── wrappers--0.1.7--0.5.0.sql
	      ├── wrappers--0.1.8--0.5.0.sql
	      ├── wrappers--0.1.9--0.5.0.sql
	      ├── wrappers--0.2.0--0.5.0.sql
	      ├── wrappers--0.3.0--0.5.0.sql
	      ├── wrappers--0.3.1--0.5.0.sql
	      ├── wrappers--0.4.0--0.5.0.sql
	      ├── wrappers--0.4.1--0.5.0.sql
	      ├── wrappers--0.4.2--0.5.0.sql
	      ├── wrappers--0.4.3--0.5.0.sql
	      ├── wrappers--0.4.4--0.5.0.sql
	      ├── wrappers--0.4.5--0.5.0.sql
	      ├── wrappers--0.4.6--0.5.0.sql
	      ├── wrappers--0.5.0.sql
	      └── wrappers.control

  5 directories, 58 files
  ```
</details>

<details>
  <summary>Files present in the extension after upgrading the extension (after #1663 was merged)</summary>

  ```bash
  $ nix build -L github:supabase/postgres/develop\#packages.x86_64-linux.psql_15/exts/wrappers-all
  $ tree result
  result/
  ├── lib
  │   ├── wrappers-0.5.3.so -> /nix/store/g84xfq2m4wrxwsrh63yrs4df44bwj52b-wrappers-0.5.3/lib/wrappers-0.5.3.so
  │   └── wrappers.so -> /nix/store/g84xfq2m4wrxwsrh63yrs4df44bwj52b-wrappers-0.5.3/lib/wrappers.so
  └── share
      └── postgresql
	  └── extension
	      ├── wrappers--0.5.3.control -> /nix/store/g84xfq2m4wrxwsrh63yrs4df44bwj52b-wrappers-0.5.3/share/postgresql/extension/wrappers--0.5.3.control
	      ├── wrappers--0.5.3.sql -> /nix/store/g84xfq2m4wrxwsrh63yrs4df44bwj52b-wrappers-0.5.3/share/postgresql/extension/wrappers--0.5.3.sql
	      └── wrappers.control -> /nix/store/g84xfq2m4wrxwsrh63yrs4df44bwj52b-wrappers-0.5.3/share/postgresql/extension/wrappers.control

  5 directories, 5 files
  ```
</details>

<details>
  <summary>Files present in the extension with this commit</summary>

  ```bash
  $ nix build -L .\#packages.x86_64-linux.psql_15/exts/wrappers-all
  $ tree result
  result/
  ├── lib
  │   ├── wrappers-0.1.0.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.10.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.11.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.12.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.14.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.15.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.16.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.17.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.18.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.19.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.1.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.4.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.5.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.6.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.7.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.8.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.1.9.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.2.0.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.3.0.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.3.1.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.4.0.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.4.1.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.4.2.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.4.3.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.4.4.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.4.5.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.4.6.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.5.0.so -> /nix/store/w6yr0d0v8hxm32z1lh3p4m09gayli1sh-wrappers/lib/wrappers.so
  │   ├── wrappers-0.5.3.so -> /nix/store/m15jazn3jznd17naihs4w413r2wdwzpz-wrappers-0.5.3/lib/wrappers-0.5.3.so
  │   └── wrappers.so -> wrappers-0.5.3.so
  └── share
      └── postgresql
	  └── extension
	      ├── wrappers--0.1.0--0.5.3.sql
	      ├── wrappers--0.1.10--0.5.3.sql
	      ├── wrappers--0.1.1--0.5.3.sql
	      ├── wrappers--0.1.11--0.5.3.sql
	      ├── wrappers--0.1.12--0.5.3.sql
	      ├── wrappers--0.1.14--0.5.3.sql
	      ├── wrappers--0.1.15--0.5.3.sql
	      ├── wrappers--0.1.16--0.5.3.sql
	      ├── wrappers--0.1.17--0.5.3.sql
	      ├── wrappers--0.1.18--0.5.3.sql
	      ├── wrappers--0.1.19--0.5.3.sql
	      ├── wrappers--0.1.4--0.5.3.sql
	      ├── wrappers--0.1.5--0.5.3.sql
	      ├── wrappers--0.1.6--0.5.3.sql
	      ├── wrappers--0.1.7--0.5.3.sql
	      ├── wrappers--0.1.8--0.5.3.sql
	      ├── wrappers--0.1.9--0.5.3.sql
	      ├── wrappers--0.2.0--0.5.3.sql
	      ├── wrappers--0.3.0--0.5.3.sql
	      ├── wrappers--0.3.1--0.5.3.sql
	      ├── wrappers--0.4.0--0.5.3.sql
	      ├── wrappers--0.4.1--0.5.3.sql
	      ├── wrappers--0.4.2--0.5.3.sql
	      ├── wrappers--0.4.3--0.5.3.sql
	      ├── wrappers--0.4.4--0.5.3.sql
	      ├── wrappers--0.4.5--0.5.3.sql
	      ├── wrappers--0.4.6--0.5.3.sql
	      ├── wrappers--0.5.0--0.5.3.sql
	      ├── wrappers--0.5.3.control -> /nix/store/m15jazn3jznd17naihs4w413r2wdwzpz-wrappers-0.5.3/share/postgresql/extension/wrappers--0.5.3.control
	      ├── wrappers--0.5.3.sql -> /nix/store/m15jazn3jznd17naihs4w413r2wdwzpz-wrappers-0.5.3/share/postgresql/extension/wrappers--0.5.3.sql
	      └── wrappers.control

  5 directories, 61 files
  ```
</details>
---
 nix/ext/wrappers/default.nix | 113 ++++++++++++++++++++++++-----------
 1 file changed, 77 insertions(+), 36 deletions(-)

diff --git a/nix/ext/wrappers/default.nix b/nix/ext/wrappers/default.nix
index 218c65e77..9b36bec9c 100644
--- a/nix/ext/wrappers/default.nix
+++ b/nix/ext/wrappers/default.nix
@@ -17,7 +17,6 @@ let
     version: hash: rustVersion: pgrxVersion:
     let
       cargo = rust-bin.stable.${rustVersion}.default;
-      #previousVersions = lib.filter (v: v != version) versions; # FIXME
       mkPgrxExtension = callPackages ../../cargo-pgrx/mkPgrxExtension.nix {
         inherit rustVersion pgrxVersion;
       };
@@ -129,20 +128,12 @@ let
         doCheck = false;
 
         postInstall = ''
-           create_control_files() {
-             sed -e "/^default_version =/d" \
-                 -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
-               $out/share/postgresql/extension/${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
-             rm $out/share/postgresql/extension/${pname}.control
-
-             if [[ "${version}" == "${latestVersion}" ]]; then
-               {
-                 echo "default_version = '${latestVersion}'"
-                 cat $out/share/postgresql/extension/${pname}--${latestVersion}.control
-               } > $out/share/postgresql/extension/${pname}.control
-               ln -sfn ${pname}-${latestVersion}${postgresql.dlSuffix} $out/lib/${pname}${postgresql.dlSuffix}
-             fi
-           }
+          create_control_files() {
+            sed -e "/^default_version =/d" \
+                -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}-${version}'|" \
+              $out/share/postgresql/extension/${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
+            rm $out/share/postgresql/extension/${pname}.control
+          }
 
           create_control_files
         '';
@@ -165,6 +156,37 @@ let
         };
       }
     );
+  previouslyPackagedVersions = [
+    "0.5.0"
+    "0.4.6"
+    "0.4.5"
+    "0.4.4"
+    "0.4.3"
+    "0.4.2"
+    "0.4.1"
+    "0.4.0"
+    "0.3.1"
+    "0.3.0"
+    "0.2.0"
+    "0.1.19"
+    "0.1.18"
+    "0.1.17"
+    "0.1.16"
+    "0.1.15"
+    "0.1.14"
+    "0.1.12"
+    "0.1.11"
+    "0.1.10"
+    "0.1.9"
+    "0.1.8"
+    "0.1.7"
+    "0.1.6"
+    "0.1.5"
+    "0.1.4"
+    "0.1.1"
+    "0.1.0"
+  ];
+  numberOfPreviouslyPackagedVersions = builtins.length previouslyPackagedVersions;
   allVersions = (builtins.fromJSON (builtins.readFile ../versions.json)).wrappers;
   supportedVersions = lib.filterAttrs (
     _: value: builtins.elem (lib.versions.major postgresql.version) value.postgresql
@@ -184,29 +206,48 @@ buildEnv {
     "/share/postgresql/extension"
   ];
   postBuild = ''
-    # checks
-    (set -x
-       test "$(ls -A $out/lib/${pname}*${postgresql.dlSuffix} | wc -l)" = "${
-         toString (numberOfVersions + 1)
-       }"
-    )
-
-    create_sql_files() {
-      PREVIOUS_VERSION=""
-      while IFS= read -r i; do
-        FILENAME=$(basename "$i")
-        DIRNAME=$(dirname "$i")
-        VERSION="$(grep -oE '[0-9]+\.[0-9]+\.[0-9]+' <<< $FILENAME)"
-        if [[ "$PREVIOUS_VERSION" != "" ]]; then
-          echo "Processing $i"
-          MIGRATION_FILENAME="$DIRNAME/''${FILENAME/$VERSION/$PREVIOUS_VERSION--$VERSION}"
-          cp "$i" "$MIGRATION_FILENAME"
-        fi
-        PREVIOUS_VERSION="$VERSION"
-      done < <(find $out -name '*.sql' | sort -V)
+    create_control_files() {
+      # Create main control file pointing to latest version
+      {
+        echo "default_version = '${latestVersion}'"
+        cat $out/share/postgresql/extension/${pname}--${latestVersion}.control
+      } > $out/share/postgresql/extension/${pname}.control
+    }
+
+    create_lib_files() {
+      # Create main library symlink to latest version
+      ln -sfn ${pname}-${latestVersion}${postgresql.dlSuffix} $out/lib/${pname}${postgresql.dlSuffix}
+
+      # Create symlinks for all previously packaged versions to main library
+      for v in ${lib.concatStringsSep " " previouslyPackagedVersions}; do
+        ln -sfn $out/lib/${pname}${postgresql.dlSuffix} $out/lib/${pname}-$v${postgresql.dlSuffix}
+      done
     }
 
-    create_sql_files
+    create_migration_sql_files() {
+      # Create migration SQL files from previous versions to newer versions
+      for prev_version in ${lib.concatStringsSep " " previouslyPackagedVersions}; do
+        for curr_version in ${lib.concatStringsSep " " versions}; do
+          if [[ "$(printf '%s\n%s' "$prev_version" "$curr_version" | sort -V | head -n1)" == "$prev_version" ]] && [[ "$prev_version" != "$curr_version" ]]; then
+            main_sql_file="$out/share/postgresql/extension/wrappers--$curr_version.sql"
+            if [ -f "$main_sql_file" ]; then
+              new_file="$out/share/postgresql/extension/wrappers--$prev_version--$curr_version.sql"
+              cp "$main_sql_file" "$new_file"
+              sed -i 's|$libdir/wrappers-[0-9.]*|$libdir/wrappers|g' "$new_file"
+            fi
+          fi
+        done
+      done
+    }
+
+    create_control_files
+    create_lib_files
+    create_migration_sql_files
+
+    # checks
+    (test "$(ls -A $out/lib/${pname}*${postgresql.dlSuffix} | wc -l)" = "${
+      toString (numberOfVersions + numberOfPreviouslyPackagedVersions + 1)
+    }")
   '';
   passthru = {
     inherit versions numberOfVersions;

From b3ce15fe1c671ae3cbdf190ad1dc5326c6fc1ca9 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Mon, 4 Aug 2025 11:42:54 -0400
Subject: [PATCH 53/64] tests: release candidate wrappers fix (#1731)

* tests: release candidate wrappers fix

* chore: rename suffix to avoid conflict

* chore: final version bump to release
---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index fcbe8eb91..e15b730ad 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.011-orioledb"
-  postgres17: "17.4.1.068"
-  postgres15: "15.8.1.125"
+  postgresorioledb-17: "17.5.1.012-orioledb"
+  postgres17: "17.4.1.069"
+  postgres15: "15.8.1.126"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From 9cb7409d83d87c33aac63103704c6c796cb94198 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Fran=C3=A7ois=20Roche?= <jfroche@pyxel.be>
Date: Tue, 5 Aug 2025 23:07:33 +0200
Subject: [PATCH 54/64] feat: support multiple versions of the index_advisor
 extension (#1671)

* feat: multiple versions for the index_advisor extension

Build multiple versions of the index_advisor extension on different PostgreSQL versions.

Add test for the extensions and their upgrade on PostgreSQL 15 and 17.

* Change VM name suffix

* chore: bump testing version

* chore: formatting

* tests: bump version to test

* fix: account for access needed by macos

* fix: handle flake check user in darwin env

* fix: pin version of macos

* fix: trying without cleanup

* fix: revert workflow

* fix: disable pgtap

* fix: restore tap tests

* fix: restore and check version

* chore: bump version for final testing

* fix: include orioledb-17 in index_advisor

* feat: bump version to release

---------

Co-authored-by: Sam Rose <samuel@supabase.io>
---
 .github/workflows/nix-build.yml |   1 +
 ansible/vars.yml                |   6 +-
 nix/ext/index_advisor.nix       |  88 ++++++++++++++-----
 nix/ext/tests/index_advisor.nix | 147 ++++++++++++++++++++++++++++++++
 nix/ext/versions.json           |  10 +++
 5 files changed, 230 insertions(+), 22 deletions(-)
 create mode 100644 nix/ext/tests/index_advisor.nix

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 077c525dd..362d3ff5e 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -82,6 +82,7 @@ jobs:
       - name: Aggressive disk cleanup for DuckDB build
         if: matrix.runner == 'macos-latest-xlarge'
         run: |
+          nix --version
           echo "=== BEFORE CLEANUP ==="
           df -h
           # Remove major space consumers
diff --git a/ansible/vars.yml b/ansible/vars.yml
index e15b730ad..4e75577e6 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.012-orioledb"
-  postgres17: "17.4.1.069"
-  postgres15: "15.8.1.126"
+  postgresorioledb-17: "17.5.1.013-orioledb"
+  postgres17: "17.4.1.070"
+  postgres15: "15.8.1.127"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/nix/ext/index_advisor.nix b/nix/ext/index_advisor.nix
index 19777f39e..4e40214ec 100644
--- a/nix/ext/index_advisor.nix
+++ b/nix/ext/index_advisor.nix
@@ -1,34 +1,84 @@
 {
+  pkgs,
   lib,
   stdenv,
   fetchFromGitHub,
   postgresql,
 }:
 
-stdenv.mkDerivation rec {
+let
   pname = "index_advisor";
-  version = "0.2.0";
+  allVersions = (builtins.fromJSON (builtins.readFile ./versions.json)).${pname};
+  supportedVersions = lib.filterAttrs (
+    _: value: builtins.elem (lib.versions.major postgresql.version) value.postgresql
+  ) allVersions;
+  versions = lib.naturalSort (lib.attrNames supportedVersions);
+  latestVersion = lib.last versions;
+  numberOfVersions = builtins.length versions;
+  build =
+    version: hash:
+    stdenv.mkDerivation rec {
+      inherit pname version;
 
-  buildInputs = [ postgresql ];
+      buildInputs = [ postgresql ];
 
-  src = fetchFromGitHub {
-    owner = "olirice";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-G0eQk2bY5CNPMeokN/nb05g03CuiplRf902YXFVQFbs=";
-  };
+      src = fetchFromGitHub {
+        owner = "olirice";
+        repo = pname;
+        rev = "v${version}";
+        inherit hash;
+      };
+
+      installPhase = ''
+        mkdir -p $out/{lib,share/postgresql/extension}
+
+        create_sql_files() {
+          echo "Creating SQL files for previous versions..."
+          if [[ "${version}" == "${latestVersion}" ]]; then
+            cp *.sql $out/share/postgresql/extension
+          fi
+        }
+
+        create_control_files() {
+          sed -e "/^default_version =/d" \
+              -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
+            ${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
+
+          if [[ "${version}" == "${latestVersion}" ]]; then
+            {
+              echo "default_version = '${latestVersion}'"
+              cat $out/share/postgresql/extension/${pname}--${latestVersion}.control
+            } > $out/share/postgresql/extension/${pname}.control
+          fi
+        }
 
-  installPhase = ''
-    mkdir -p $out/{lib,share/postgresql/extension}
+        create_sql_files
+        create_control_files
+      '';
 
-    cp *.sql     $out/share/postgresql/extension
-    cp *.control $out/share/postgresql/extension
-  '';
+      meta = with lib; {
+        description = "Recommend indexes to improve query performance in PostgreSQL";
+        homepage = "https://github.com/olirice/index_advisor";
+        license = licenses.postgresql;
+        inherit (postgresql.meta) platforms;
+      };
+    };
+  packages = builtins.attrValues (
+    lib.mapAttrs (name: value: build name value.hash) supportedVersions
+  );
+in
+pkgs.buildEnv {
+  name = pname;
+  paths = packages;
+  pathsToLink = [
+    "/lib"
+    "/share/postgresql/extension"
+  ];
 
-  meta = with lib; {
-    description = "Recommend indexes to improve query performance in PostgreSQL";
-    homepage = "https://github.com/olirice/index_advisor";
-    platforms = postgresql.meta.platforms;
-    license = licenses.postgresql;
+  passthru = {
+    inherit versions numberOfVersions;
+    pname = "${pname}-all";
+    version =
+      "multi-" + lib.concatStringsSep "-" (map (v: lib.replaceStrings [ "." ] [ "-" ] v) versions);
   };
 }
diff --git a/nix/ext/tests/index_advisor.nix b/nix/ext/tests/index_advisor.nix
new file mode 100644
index 000000000..9f4b22024
--- /dev/null
+++ b/nix/ext/tests/index_advisor.nix
@@ -0,0 +1,147 @@
+{ self, pkgs }:
+let
+  pname = "index_advisor";
+  inherit (pkgs) lib;
+  installedExtension =
+    postgresMajorVersion: self.packages.${pkgs.system}."psql_${postgresMajorVersion}/exts/${pname}-all";
+  versions = postgresqlMajorVersion: (installedExtension postgresqlMajorVersion).versions;
+  postgresqlWithExtension =
+    postgresql:
+    let
+      majorVersion = lib.versions.major postgresql.version;
+      pkg = pkgs.buildEnv {
+        name = "postgresql-${majorVersion}-${pname}";
+        paths = [
+          postgresql
+          postgresql.lib
+          (installedExtension majorVersion)
+          self.packages.${pkgs.system}."psql_${majorVersion}/exts/hypopg" # dependency
+        ];
+        passthru = {
+          inherit (postgresql) version psqlSchema;
+          lib = pkg;
+          withPackages = _: pkg;
+        };
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        pathsToLink = [
+          "/"
+          "/bin"
+          "/lib"
+        ];
+        postBuild = ''
+          wrapProgram $out/bin/postgres --set NIX_PGLIBDIR $out/lib
+          wrapProgram $out/bin/pg_ctl --set NIX_PGLIBDIR $out/lib
+          wrapProgram $out/bin/pg_upgrade --set NIX_PGLIBDIR $out/lib
+        '';
+      };
+    in
+    pkg;
+in
+self.inputs.nixpkgs.lib.nixos.runTest {
+  name = pname;
+  hostPkgs = pkgs;
+  nodes.server =
+    { config, ... }:
+    {
+      virtualisation = {
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = 13022;
+            guest.port = 22;
+          }
+        ];
+      };
+
+      services.postgresql = {
+        enable = true;
+        package = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_15;
+      };
+
+      specialisation.postgresql17.configuration = {
+        services.postgresql = {
+          package = lib.mkForce (postgresqlWithExtension self.packages.${pkgs.system}.postgresql_17);
+        };
+
+        systemd.services.postgresql-migrate = {
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            User = "postgres";
+            Group = "postgres";
+            StateDirectory = "postgresql";
+            WorkingDirectory = "${builtins.dirOf config.services.postgresql.dataDir}";
+          };
+          script =
+            let
+              oldPostgresql = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_15;
+              newPostgresql = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_17;
+              oldDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${oldPostgresql.psqlSchema}";
+              newDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${newPostgresql.psqlSchema}";
+            in
+            ''
+              if [[ ! -d ${newDataDir} ]]; then
+                install -d -m 0700 -o postgres -g postgres "${newDataDir}"
+                ${newPostgresql}/bin/initdb -D "${newDataDir}"
+                ${newPostgresql}/bin/pg_upgrade --old-datadir "${oldDataDir}" --new-datadir "${newDataDir}" \
+                  --old-bindir "${oldPostgresql}/bin" --new-bindir "${newPostgresql}/bin"
+              else
+                echo "${newDataDir} already exists"
+              fi
+            '';
+        };
+
+        systemd.services.postgresql = {
+          after = [ "postgresql-migrate.service" ];
+          requires = [ "postgresql-migrate.service" ];
+        };
+      };
+    };
+  testScript =
+    { nodes, ... }:
+    let
+      pg17-configuration = "${nodes.server.system.build.toplevel}/specialisation/postgresql17";
+    in
+    ''
+      versions = {
+        "15": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "15"))}],
+        "17": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "17"))}],
+      }
+
+      def run_sql(query):
+        return server.succeed(f"""sudo -u postgres psql -t -A -F\",\" -c \"{query}\" """).strip()
+
+      def check_upgrade_path(pg_version):
+        with subtest("Check ${pname} upgrade path"):
+          firstVersion = versions[pg_version][0]
+          server.succeed("sudo -u postgres psql -c 'DROP EXTENSION IF EXISTS ${pname};'")
+          run_sql(f"""CREATE EXTENSION ${pname} WITH VERSION '{firstVersion}' CASCADE;""")
+          installed_version = run_sql(r"""SELECT extversion FROM pg_extension WHERE extname = '${pname}';""")
+          assert installed_version == firstVersion, f"Expected ${pname} version {firstVersion}, but found {installed_version}"
+          for version in versions[pg_version][1:]:
+            run_sql(f"""ALTER EXTENSION ${pname} UPDATE TO '{version}';""")
+            installed_version = run_sql(r"""SELECT extversion FROM pg_extension WHERE extname = '${pname}';""")
+            assert installed_version == version, f"Expected ${pname} version {version}, but found {installed_version}"
+
+      start_all()
+
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("postgresql.service")
+
+      check_upgrade_path("15")
+
+      with subtest("Check ${pname} latest extension version"):
+        server.succeed("sudo -u postgres psql -c 'DROP EXTENSION ${pname};'")
+        server.succeed("sudo -u postgres psql -c 'CREATE EXTENSION ${pname} CASCADE;'")
+        installed_extensions=run_sql(r"""SELECT extname, extversion FROM pg_extension;""")
+        latestVersion = versions["15"][-1]
+        assert f"${pname},{latestVersion}" in installed_extensions
+
+      with subtest("switch to postgresql 17"):
+        server.succeed(
+          "${pg17-configuration}/bin/switch-to-configuration test >&2"
+        )
+
+      check_upgrade_path("17")
+    '';
+}
diff --git a/nix/ext/versions.json b/nix/ext/versions.json
index e5c4e90b1..c77b23be6 100644
--- a/nix/ext/versions.json
+++ b/nix/ext/versions.json
@@ -10,5 +10,15 @@
       "pgrx": "0.14.3",
       "rust": "1.87.0"
     }
+  },
+  "index_advisor": {
+    "0.2.0": {
+      "postgresql": [
+        "15",
+        "17",
+        "orioledb-17"
+      ],
+      "hash": "sha256-G0eQk2bY5CNPMeokN/nb05g03CuiplRf902YXFVQFbs="
+    }
   }
 }

From f75ac46ceba1f62160f6a5d321966a83bbed1f1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cemal=20K=C4=B1l=C4=B1=C3=A7?=
 <cemalkilic@users.noreply.github.com>
Date: Wed, 6 Aug 2025 11:36:01 +0200
Subject: [PATCH 55/64] feat: bump auth to v2.178.0 (#1733)

---
 ansible/vars.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 4e75577e6..949a76cab 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.013-orioledb"
-  postgres17: "17.4.1.070"
-  postgres15: "15.8.1.127"
+  postgresorioledb-17: "17.5.1.014-orioledb"
+  postgres17: "17.4.1.071"
+  postgres15: "15.8.1.128"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
@@ -24,8 +24,8 @@ postgrest_release: "13.0.4"
 postgrest_arm_release_checksum: sha256:2b400200fb15eb5849267e4375fbbc516dd727afadd8786815b48074ed8c03e1
 postgrest_x86_release_checksum: sha256:a0052c8d4726f52349e0298f98da51140ef4941855548590ee88331afa617811
 
-gotrue_release: 2.177.0
-gotrue_release_checksum: sha1:664a26237618c4bfb1e33e4f03a540c3cef3e3c8
+gotrue_release: 2.178.0
+gotrue_release_checksum: sha1:56c5cf913eebf701ab5805e529375483933a0476
 
 aws_cli_release: "2.23.11"
 

From da69a372a3fee5873eb0333662df072a3e2a7918 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Thu, 7 Aug 2025 11:55:41 -0400
Subject: [PATCH 56/64] feat: source specific version of packer and build with
 specific go (#1735)

* feat: source specific version of packer and build with specific go
use in all workflows

* fix: add package to checks to assure it is tested, built cached prior to use

* fix: try to use nix shell to settle permission issue

* fix: install packer with nix in profile within workflow

* fix: use sudo on packer calls

* fix: trying skip regiona validation for now

* fix: use cachix installer with cache config

* fix: try to fix perms and use non-sudo

* fix: assure nix version we need is installed at this stage + perm fix

* fix: see how nix was installed on this machine originally

* fix: for now keep nix and inherit env

* fix: use large-linux-arm here going forward

* fix: try remove job level perms

* fix: match permissions on ami-release

* tests: debug role

* fix: allows workflow to recv secret when called from other workflows

* fix: receive the secret as a parameter

* fix: no need for sudo

* chore: revert qemu workflow/do not change packer handling there

* docs: updating deps doc

* chore: tmp suffix to test release

* chore: restore versions post testing
---
 .github/workflows/ami-release-nix-single.yml | 16 +++--
 .github/workflows/ami-release-nix.yml        | 25 +++++--
 .github/workflows/nix-build.yml              |  2 +
 .github/workflows/testinfra-ami-build.yml    | 56 ++++++++++++----
 flake.lock                                   | 17 +++++
 flake.nix                                    |  1 +
 nix/checks.nix                               |  1 +
 nix/devShells.nix                            |  4 +-
 nix/docs/updating-dependencies.md            | 68 ++++++++++++++++++++
 nix/packages/default.nix                     |  3 +-
 nix/packages/packer.nix                      | 50 ++++++++++++++
 11 files changed, 216 insertions(+), 27 deletions(-)
 create mode 100644 nix/docs/updating-dependencies.md
 create mode 100644 nix/packages/packer.nix

diff --git a/.github/workflows/ami-release-nix-single.yml b/.github/workflows/ami-release-nix-single.yml
index 500bf26d5..dd579df30 100644
--- a/.github/workflows/ami-release-nix-single.yml
+++ b/.github/workflows/ami-release-nix-single.yml
@@ -40,7 +40,13 @@ jobs:
         run: |
           echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
-      - uses: DeterminateSystems/nix-installer-action@main
+      - name: Install nix
+        uses: cachix/install-nix-action@v27
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.29.1/install
+          extra_nix_config: |
+            substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
+            trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
 
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ github.event.inputs.postgres_version }}" >> $GITHUB_ENV
@@ -57,18 +63,18 @@ jobs:
         env:
           POSTGRES_MAJOR_VERSION: ${{ env.POSTGRES_MAJOR_VERSION }}
         run: |
-          packer init amazon-arm64-nix.pkr.hcl
           GIT_SHA=${{ steps.get_sha.outputs.sha }}
-          packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}"  -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=-e postgresql_major=${POSTGRES_MAJOR_VERSION}"  amazon-arm64-nix.pkr.hcl
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- init amazon-arm64-nix.pkr.hcl
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}"  -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=-e postgresql_major=${POSTGRES_MAJOR_VERSION}"  amazon-arm64-nix.pkr.hcl
 
       - name: Build AMI stage 2
         env:
           POSTGRES_MAJOR_VERSION: ${{ env.POSTGRES_MAJOR_VERSION }}
         run: |
-          packer init stage2-nix-psql.pkr.hcl
           GIT_SHA=${{ steps.get_sha.outputs.sha }}
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- init stage2-nix-psql.pkr.hcl
           POSTGRES_MAJOR_VERSION=${{ env.POSTGRES_MAJOR_VERSION }}
-          packer build -var "git_sha=${GIT_SHA}" -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" stage2-nix-psql.pkr.hcl
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- build -var "git_sha=${GIT_SHA}" -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" stage2-nix-psql.pkr.hcl
 
       - name: Grab release version
         id: process_release_version
diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml
index 0c97d8374..df0bf096e 100644
--- a/.github/workflows/ami-release-nix.yml
+++ b/.github/workflows/ami-release-nix.yml
@@ -24,7 +24,13 @@ jobs:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
-      - uses: DeterminateSystems/nix-installer-action@main
+      - name: Install nix
+        uses: cachix/install-nix-action@v27
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.29.1/install
+          extra_nix_config: |
+            substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
+            trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
 
       - name: Set PostgreSQL versions
         id: set-versions
@@ -52,7 +58,14 @@ jobs:
           aws-region: "us-east-1"
           output-credentials: true
           role-duration-seconds: 7200
-      - uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Install nix
+        uses: cachix/install-nix-action@v27
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.29.1/install
+          extra_nix_config: |
+            substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
+            trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
 
       - name: Run checks if triggered manually
         if: ${{ github.event_name == 'workflow_dispatch' }}
@@ -78,19 +91,19 @@ jobs:
         env:
           POSTGRES_MAJOR_VERSION: ${{ env.POSTGRES_MAJOR_VERSION }}
         run: |
-          packer init amazon-arm64-nix.pkr.hcl
           GIT_SHA=${{github.sha}}
+          nix  run github:supabase/postgres/${GIT_SHA}#packer -- init amazon-arm64-nix.pkr.hcl
           # why is postgresql_major defined here instead of where the _three_ other postgresql_* variables are defined?
-          packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}"  -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=-e postgresql_major=${POSTGRES_MAJOR_VERSION}"  amazon-arm64-nix.pkr.hcl
+          nix  run github:supabase/postgres/${GIT_SHA}#packer -- build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}"  -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=-e postgresql_major=${POSTGRES_MAJOR_VERSION}"  amazon-arm64-nix.pkr.hcl
 
       - name: Build AMI stage 2
         env:
           POSTGRES_MAJOR_VERSION: ${{ env.POSTGRES_MAJOR_VERSION }}
         run: |
-          packer init stage2-nix-psql.pkr.hcl
           GIT_SHA=${{github.sha}}
+          nix  run github:supabase/postgres/${GIT_SHA}#packer -- init stage2-nix-psql.pkr.hcl
           POSTGRES_MAJOR_VERSION=${{ env.POSTGRES_MAJOR_VERSION }}
-          packer build -var "git_sha=${GIT_SHA}" -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" stage2-nix-psql.pkr.hcl
+          nix  run github:supabase/postgres/${GIT_SHA}#packer -- build -var "git_sha=${GIT_SHA}" -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" stage2-nix-psql.pkr.hcl
 
       - name: Grab release version
         id: process_release_version
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 362d3ff5e..058d9087b 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -118,6 +118,8 @@ jobs:
     needs: build-run-image
     if: ${{ success() }}
     uses: ./.github/workflows/testinfra-ami-build.yml
+    secrets:
+      DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
 
   run-tests:
     needs: build-run-image
diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml
index 5636a34c3..892b54b74 100644
--- a/.github/workflows/testinfra-ami-build.yml
+++ b/.github/workflows/testinfra-ami-build.yml
@@ -3,9 +3,13 @@ name: Testinfra Integration Tests Nix
 on:
   workflow_dispatch:
   workflow_call:
+    secrets:
+      DEV_AWS_ROLE:
+        description: 'AWS role for dev environment'
+        required: true
 
 permissions:
-  contents: read
+  contents: write
   id-token: write
 
 jobs:
@@ -17,7 +21,13 @@ jobs:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
-      - uses: DeterminateSystems/nix-installer-action@main
+      - name: Install nix
+        uses: cachix/install-nix-action@v27
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.29.1/install
+          extra_nix_config: |
+            substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
+            trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
 
       - name: Set PostgreSQL versions
         id: set-versions
@@ -32,22 +42,44 @@ jobs:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
         include:
-          - runner: arm-runner
+          - runner: large-linux-arm
             arch: arm64
             ubuntu_release: noble
             ubuntu_version: 24.04
             mcpu: neoverse-n1
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 150
-    permissions:
-      contents: write
-      packages: write
-      id-token: write
 
     steps:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
+      - name: Debug AWS role secret
+        run: |
+          echo "Checking DEV_AWS_ROLE secret availability..."
+          if [ -z "${{ secrets.DEV_AWS_ROLE }}" ]; then
+            echo "❌ DEV_AWS_ROLE is empty or not available"
+          else
+            echo "✅ DEV_AWS_ROLE is available"
+          fi
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
+          aws-region: "us-east-1"
+          output-credentials: true
+          role-duration-seconds: 7200
+
+      - name: Install nix
+        uses: cachix/install-nix-action@v27
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.29.1/install
+          extra_nix_config: |
+            substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com
+            trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+
+
       - id: args
         uses: mikefarah/yq@master
         with:
@@ -68,7 +100,7 @@ jobs:
 
       - name: Generate common-nix.vars.pkr.hcl
         run: |
-          PG_VERSION=$(sudo nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
+          PG_VERSION=$(nix run nixpkgs#yq -- '.postgres_release["postgres'${{ matrix.postgres_version }}'"]' ansible/vars.yml)
           PG_VERSION=$(echo "$PG_VERSION" | tr -d '"')  # Remove any surrounding quotes
           echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
           # Ensure there's a newline at the end of the file
@@ -76,15 +108,15 @@ jobs:
 
       - name: Build AMI stage 1
         run: |
-          packer init amazon-arm64-nix.pkr.hcl
           GIT_SHA=${{github.sha}}
-          packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=" -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "ansible_arguments=-e postgresql_major=${POSTGRES_MAJOR_VERSION}" amazon-arm64-nix.pkr.hcl
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- init amazon-arm64-nix.pkr.hcl
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=" -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "ansible_arguments=-e postgresql_major=${POSTGRES_MAJOR_VERSION}" amazon-arm64-nix.pkr.hcl
 
       - name: Build AMI stage 2
         run: |
-          packer init stage2-nix-psql.pkr.hcl
           GIT_SHA=${{github.sha}}
-          packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl"  -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "git_sha=${GITHUB_SHA}"  stage2-nix-psql.pkr.hcl
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- init stage2-nix-psql.pkr.hcl
+          nix run github:supabase/postgres/${GIT_SHA}#packer -- build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl"  -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "git_sha=${GITHUB_SHA}"  stage2-nix-psql.pkr.hcl
 
       - name: Run tests
         timeout-minutes: 10
diff --git a/flake.lock b/flake.lock
index 8b6d868bf..9d2865e1d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -208,6 +208,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-go124": {
+      "locked": {
+        "lastModified": 1754085309,
+        "narHash": "sha256-3RTSdhnqTcxS5wjKNEBpbt0hiSKfBZiQPlWHn90N1qQ=",
+        "owner": "Nixos",
+        "repo": "nixpkgs",
+        "rev": "d2ac4dfa61fba987a84a0a81555da57ae0b9a2b0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Nixos",
+        "repo": "nixpkgs",
+        "rev": "d2ac4dfa61fba987a84a0a81555da57ae0b9a2b0",
+        "type": "github"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "lastModified": 1750555020,
@@ -295,6 +311,7 @@
         "nix-fast-build": "nix-fast-build",
         "nix2container": "nix2container",
         "nixpkgs": "nixpkgs_4",
+        "nixpkgs-go124": "nixpkgs-go124",
         "rust-overlay": "rust-overlay",
         "treefmt-nix": "treefmt-nix_2"
       }
diff --git a/flake.nix b/flake.nix
index 3aa651b09..db14dac9a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,6 +13,7 @@
     treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
     git-hooks.url = "github:cachix/git-hooks.nix";
     git-hooks.inputs.nixpkgs.follows = "nixpkgs";
+    nixpkgs-go124.url = "github:Nixos/nixpkgs/d2ac4dfa61fba987a84a0a81555da57ae0b9a2b0";
   };
 
   outputs =
diff --git a/nix/checks.nix b/nix/checks.nix
index 13be10f23..2dc51797a 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -294,6 +294,7 @@
             wal-g-2
             wal-g-3
             dbmate-tool
+            packer
             pg_regress
             ;
         }
diff --git a/nix/devShells.nix b/nix/devShells.nix
index 7ff4d0720..03768a770 100644
--- a/nix/devShells.nix
+++ b/nix/devShells.nix
@@ -45,9 +45,7 @@
               shellcheck
               ansible
               ansible-lint
-              (packer.overrideAttrs (_oldAttrs: {
-                version = "1.7.8";
-              }))
+              self'.packages.packer
 
               self'.packages.start-server
               self'.packages.start-client
diff --git a/nix/docs/updating-dependencies.md b/nix/docs/updating-dependencies.md
new file mode 100644
index 000000000..73c5cf79a
--- /dev/null
+++ b/nix/docs/updating-dependencies.md
@@ -0,0 +1,68 @@
+# Updating Dependencies
+
+This document explains how to update various dependencies used in the nix configuration.
+
+## Updating Packer
+
+Packer is used for creating machine images and is defined in `nix/packages/packer.nix`.
+
+### Steps to update Packer version:
+
+1. Create a branch off of `develop`
+2. Navigate to `nix/packages/packer.nix`
+3. Update the version field:
+   ```nix
+   version = "1.15.0"; # Update to desired version
+   ```
+4. Update the git revision to match the new version:
+   ```nix
+   rev = "v${version}";
+   ```
+5. Temporarily clear the hash to get the new SHA256:
+   ```nix
+   hash = ""; # Clear this temporarily
+   ```
+6. Save the file and run:
+   ```bash
+   nix build .#packer
+   ```
+7. Nix will fail and output the correct SHA256 hash. Copy this hash and update the file:
+   ```nix
+   hash = "sha256-NEWHASHHEREFROMBUILDOUTPUT";
+   ```
+8. Update the vendorHash if needed. If the build fails due to vendor hash mismatch, temporarily set:
+   ```nix
+   vendorHash = ""; # Clear this temporarily
+   ```
+9. Run `nix build .#packer` again to get the correct vendorHash, then update:
+   ```nix
+   vendorHash = "sha256-NEWVENDORHASHHEREFROMBUILDOUTPUT";
+   ```
+10. Verify the build works:
+    ```bash
+    nix build .#packer
+    ```
+11. Test the packer binary:
+    ```bash
+    ./result/bin/packer version
+    ```
+12. Run the full test suite to ensure nothing is broken:
+    ```bash
+    nix flake check -L
+    ```
+13. Commit your changes and create a PR for review
+14. Update any CI/CD workflows or documentation that reference the old Packer version
+
+### Notes:
+- Always check the [Packer changelog](https://github.com/hashicorp/packer/releases) for breaking changes
+- Packer uses Go, so ensure compatibility with the Go version specified in the flake inputs
+- The current Go version is specified in `flake.nix` under `nixpkgs-go124` input
+- If updating to a major version, test all packer templates (`.pkr.hcl` files) in the repository
+
+## Updating Other Dependencies
+
+Similar patterns can be followed for other dependencies defined in the nix packages. Always:
+1. Check for breaking changes in changelogs
+2. Update version numbers and hashes
+3. Run local tests
+4. Verify functionality before creating PR
\ No newline at end of file
diff --git a/nix/packages/default.nix b/nix/packages/default.nix
index cd6d6a1d0..342763961 100644
--- a/nix/packages/default.nix
+++ b/nix/packages/default.nix
@@ -1,4 +1,4 @@
-{ self, ... }:
+{ self, inputs, ... }:
 {
   imports = [ ./postgres.nix ];
   perSystem =
@@ -37,6 +37,7 @@
           supabase-groonga = pkgs.callPackage ./groonga { };
           local-infra-bootstrap = pkgs.callPackage ./local-infra-bootstrap.nix { };
           migrate-tool = pkgs.callPackage ./migrate-tool.nix { psql_15 = self'.packages."psql_15/bin"; };
+          packer = pkgs.callPackage ./packer.nix { inherit inputs; };
           pg-restore = pkgs.callPackage ./pg-restore.nix { psql_15 = self'.packages."psql_15/bin"; };
           pg_prove = pkgs.perlPackages.TAPParserSourceHandlerpgTAP;
           pg_regress = makePgRegress activeVersion;
diff --git a/nix/packages/packer.nix b/nix/packages/packer.nix
new file mode 100644
index 000000000..7f0063c30
--- /dev/null
+++ b/nix/packages/packer.nix
@@ -0,0 +1,50 @@
+{
+  pkgs,
+  inputs,
+  lib,
+  fetchFromGitHub,
+  installShellFiles,
+  ...
+}:
+let
+  go124 = inputs.nixpkgs-go124.legacyPackages.${pkgs.system}.go_1_24;
+  buildGoModule = pkgs.buildGoModule.override { go = go124; };
+in
+buildGoModule rec {
+  pname = "packer";
+  version = "1.14.1";
+
+  src = fetchFromGitHub {
+    owner = "hashicorp";
+    repo = "packer";
+    rev = "v${version}";
+    hash = "sha256-3g9hsmrfLzGhjcGvUza/L9PMGUFw+KLbg2pIK0CxlQI=";
+  };
+
+  vendorHash = "sha256-F6hn+pXPyPe70UTK8EF24lk7ArYz7ygUyVVsatW6+hI=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = lib.optionals pkgs.stdenv.isDarwin [
+    pkgs.darwin.apple_sdk.frameworks.IOKit
+    pkgs.darwin.apple_sdk.frameworks.Security
+  ];
+
+  postInstall = ''
+    installShellCompletion --zsh contrib/zsh-completion/_packer
+  '';
+
+  meta = {
+    description = "Tool for creating identical machine images for multiple platforms from a single source configuration";
+    homepage = "https://www.packer.io";
+    license = lib.licenses.bsl11;
+    changelog = "https://github.com/hashicorp/packer/blob/v${version}/CHANGELOG.md";
+  };
+}

From ad35eac99f77ccc33b5f5e5af9ae51b005fad07a Mon Sep 17 00:00:00 2001
From: Div Arora <root@darora.com>
Date: Thu, 7 Aug 2025 10:36:30 +0800
Subject: [PATCH 57/64] ci: add failure notifications for v3 build

---
 .github/workflows/qemu-image-build.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index ffd12683c..1ba97b86c 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -144,6 +144,16 @@ jobs:
           docker tag "postgres:$IMAGE_TAG" "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
           docker push "$REGISTRY/$REPOSITORY:$IMAGE_TAG"
 
+      - name: Slack Notification on Failure
+        if: ${{ failure() }}
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
+          SLACK_USERNAME: 'gha-failures-notifier'
+          SLACK_COLOR: 'danger'
+          SLACK_MESSAGE: 'Building Postgres QEMU artifact failed'
+          SLACK_FOOTER: ''
+b
       - name: Cleanup resources after build
         if: ${{ always() }}
         run: |

From cf8739082d1cb35c61d3309e94366573bb5625da Mon Sep 17 00:00:00 2001
From: Div Arora <root@darora.com>
Date: Thu, 7 Aug 2025 10:35:09 +0800
Subject: [PATCH 58/64] ci: remove nix dependency for simple tools

yq and jq are now bundled on the runner image
---
 .github/workflows/qemu-image-build.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index 1ba97b86c..fad63a510 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -26,12 +26,10 @@ jobs:
       - name: Checkout Repo
         uses: supabase/postgres/.github/actions/shared-checkout@HEAD
 
-      - uses: DeterminateSystems/nix-installer-action@main
-
       - name: Set PostgreSQL versions - only builds pg17 atm
         id: set-versions
         run: |
-          VERSIONS=$(nix run nixpkgs#yq --  '.postgres_major[1]' ansible/vars.yml | nix run nixpkgs#jq -- -R -s -c 'split("\n")[:-1]')
+          VERSIONS=$(yq '.postgres_major[1]' ansible/vars.yml | jq -R -s -c 'split("\n")[:-1]')
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   build:
@@ -55,7 +53,7 @@ jobs:
       - name: Run checks if triggered manually
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: |
-          SUFFIX=$(sudo nix run nixpkgs#yq -- ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
+          SUFFIX=$(yq ".postgres_release[\"postgres${{ matrix.postgres_version }}\"]" ansible/vars.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
           if [[ -z $SUFFIX ]] ; then
             echo "Version must include non-numeric characters if built manually."
             exit 1
@@ -153,7 +151,7 @@ jobs:
           SLACK_COLOR: 'danger'
           SLACK_MESSAGE: 'Building Postgres QEMU artifact failed'
           SLACK_FOOTER: ''
-b
+
       - name: Cleanup resources after build
         if: ${{ always() }}
         run: |

From 2262ddeac385212c5d0257724f67d976336dd5e7 Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Fri, 8 Aug 2025 10:42:02 +0100
Subject: [PATCH 59/64] fix: accurately determine disk mount for upgrade disk
 xvdp (#1740)

* chore: install amazon-ec2-utils for ebs nvme mapping tool

* fix: accurately determine disk mount for upgrade disk xvdp
---
 .../pg_upgrade_scripts/initiate.sh            | 24 ++++++++++++++++---
 ansible/tasks/setup-supabase-internal.yml     |  6 +++++
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
index e5c4ddbf7..9f78a8d5e 100755
--- a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
+++ b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
@@ -348,10 +348,28 @@ function initiate_upgrade {
     locale-gen
 
     if [ -z "$IS_CI" ] && [ -z "$IS_LOCAL_UPGRADE" ]; then
-        # awk NF==3 prints lines with exactly 3 fields, which are the block devices currently not mounted anywhere
-        # excluding nvme0 since it is the root disk
+        # DATABASE_UPGRADE_DATA_MIGRATION_DEVICE_NAME = '/dev/xvdp' can be derived from the worker mount
         echo "5. Determining block device to mount"
-        BLOCK_DEVICE=$(lsblk -dprno name,size,mountpoint,type | grep "disk" | grep -v "nvme0" | awk 'NF==3 { print $1; }')
+        if command -v ebsnvme-id >/dev/null 2>&1 && dpkg -l | grep -q amazon-ec2-utils; then
+            for nvme_dev in $(lsblk -dprno name,size,mountpoint,type | grep disk | awk '{print $1}'); do
+                if [ -b "$nvme_dev" ]; then
+                    mapping=$(ebsnvme-id -b "$nvme_dev" 2>/dev/null)
+                    if [[ "$mapping" == "xvdp" || $mapping == "/dev/xvdp" ]]; then
+                        BLOCK_DEVICE="$nvme_dev"
+                        break
+                    fi
+                fi
+            done
+        fi
+
+        # Fallback to lsblk if ebsnvme-id is not available or no mapping found, pre ubuntu 20.04
+        if [ -z "$BLOCK_DEVICE" ]; then
+            echo "No block device found using ebsnvme-id, falling back to lsblk"
+            # awk NF==3 prints lines with exactly 3 fields, which are the block devices currently not mounted anywhere
+            # excluding nvme0 since it is the root disk
+            BLOCK_DEVICE=$(lsblk -dprno name,size,mountpoint,type | grep "disk" | grep -v "nvme0" | awk 'NF==3 { print $1; exit }')  # exit ensures we grab the first only
+        fi
+
         echo "Block device found: $BLOCK_DEVICE"
 
         mkdir -p "$MOUNT_POINT"
diff --git a/ansible/tasks/setup-supabase-internal.yml b/ansible/tasks/setup-supabase-internal.yml
index d5583b597..d63f3abad 100644
--- a/ansible/tasks/setup-supabase-internal.yml
+++ b/ansible/tasks/setup-supabase-internal.yml
@@ -29,6 +29,12 @@
   shell: "/tmp/aws/install --update"
   become: true
 
+- name: install utilities to manage Amazon EC2 instance storage
+  become: true
+  apt:
+    pkg:
+      - amazon-ec2-utils
+
 - name: AWS CLI - configure ipv6 support for s3
   shell: |
     aws configure set default.s3.use_dualstack_endpoint true

From a3d559fd7e264460120e6941a8a2c6e2c99b4dc9 Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Fri, 8 Aug 2025 11:03:08 +0100
Subject: [PATCH 60/64] chore: version bump amis for release (#1741)

---
 ansible/vars.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ansible/vars.yml b/ansible/vars.yml
index 949a76cab..0edea89b3 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.014-orioledb"
-  postgres17: "17.4.1.071"
-  postgres15: "15.8.1.128"
+  postgresorioledb-17: "17.5.1.015-orioledb"
+  postgres17: "17.4.1.072"
+  postgres15: "15.8.1.129"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From 4433e215f0e011ec08a70c234c819d47d0064014 Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Mon, 11 Aug 2025 20:06:59 +0100
Subject: [PATCH 61/64] fix: Ubuntu 24.04 mounts disks when available, can
 change mountpoints" (#1747)

* fix: pipefail handling for missing variables

* fix: detect disks for ubuntu 24.04 inconsistencies

* fix: use findmnt to more robustly discover mount point

* custom ami version for testing

* fix: bump versions
---
 ansible/files/admin_api_scripts/grow_fs.sh    | 58 +++++++++++++------
 .../pg_upgrade_scripts/initiate.sh            |  2 +-
 ansible/vars.yml                              |  6 +-
 3 files changed, 45 insertions(+), 21 deletions(-)

diff --git a/ansible/files/admin_api_scripts/grow_fs.sh b/ansible/files/admin_api_scripts/grow_fs.sh
index c8c14890f..6d9fc8a16 100644
--- a/ansible/files/admin_api_scripts/grow_fs.sh
+++ b/ansible/files/admin_api_scripts/grow_fs.sh
@@ -4,37 +4,61 @@ set -euo pipefail
 
 VOLUME_TYPE=${1:-data}
 
+# lsb release
+UBUNTU_VERSION=$(lsb_release -rs)
+
 if pgrep resizefs; then
     echo "resize2fs is already running"
     exit 1
 fi
 
-# Parses the output of lsblk to get the root partition number
-# Example output:
-# NAME        MOUNTPOINT
-# nvme0n1
-# ├─nvme0n1p1 /boot
-# └─nvme0n1p3 /
-# nvme1n1     /data
-#
-# Resulting in:
-# └─nvme0n1p3 / -> nvme0n1p3 -> 3
-ROOT_PARTITION_NUMBER=$(lsblk -no NAME,MOUNTPOINT | grep ' /$' | awk '{print $1;}' | sed 's/.*nvme[0-9]n[0-9]p//g')
+# install amazon disk utilities if not present on 24.04
+if [ "${UBUNTU_VERSION}" = "24.04" ] && ! dpkg -l | grep -q amazon-ec2-utils; then
+    apt-get update
+    apt-get install -y amazon-ec2-utils || true
+fi
+
+# We currently mount 3 possible disks
+# - /dev/xvda (root disk)
+# - /dev/xvdh (data disk)
+# - /dev/xvdp (upgrade data disk), not used here
+# Initialize variables at 20.04 levels
+XVDA_DEVICE="/dev/nvme0n1"
+XVDH_DEVICE="/dev/nvme1n1"
+# Map AWS devices to NVMe for ubuntu 24.04 and later
+if [ "${UBUNTU_VERSION}" = "24.04" ] && dpkg -l | grep -q amazon-ec2-utils; then
+    for nvme_dev in $(lsblk -dprno name,type | grep disk | awk '{print $1}'); do
+        if [ -b "$nvme_dev" ]; then
+            mapping=$(ebsnvme-id -b "$nvme_dev" 2>/dev/null)
+            case "$mapping" in
+                "xvda"|"/dev/xvda") XVDA_DEVICE="$nvme_dev" ;;
+                "xvdh"|"/dev/xvdh") XVDH_DEVICE="$nvme_dev" ;;
+            esac
+        fi
+    done
+fi
+
+echo "Using devices - Root: $XVDA_DEVICE, Data: $XVDH_DEVICE"
+
+# Get root partition using findmnt
+ROOT_DEVICE_FULL=$(findmnt -no SOURCE /)
+ROOT_DEVICE=$(lsblk -no PKNAME "$ROOT_DEVICE_FULL")
+ROOT_PARTITION_NUMBER=$(echo "$ROOT_DEVICE_FULL" | sed "s|.*${ROOT_DEVICE}p||")
 
 if ! [[ "$ROOT_PARTITION_NUMBER" =~ ^[0-9]+$ ]]; then
   echo "Error: ROOT_PARTITION_NUMBER is not a valid number: $ROOT_PARTITION_NUMBER"
   exit 1
 fi
 
-if [ -b /dev/nvme1n1 ] ; then
+if [ -b "${XVDH_DEVICE}" ] ; then
     if [[ "${VOLUME_TYPE}" == "data" ]]; then
-        resize2fs /dev/nvme1n1
+        resize2fs "${XVDH_DEVICE}"
 
     elif [[ "${VOLUME_TYPE}" == "root" ]] ; then
         PLACEHOLDER_FL=/home/ubuntu/50M_PLACEHOLDER
         rm -f "${PLACEHOLDER_FL}" || true
-        growpart /dev/nvme0n1 "${ROOT_PARTITION_NUMBER}"
-        resize2fs "/dev/nvme0n1p${ROOT_PARTITION_NUMBER}"
+        growpart "${XVDA_DEVICE}" "${ROOT_PARTITION_NUMBER}"
+        resize2fs "${XVDA_DEVICE}p${ROOT_PARTITION_NUMBER}"
         if [[ ! -f "${PLACEHOLDER_FL}" ]] ; then
             fallocate -l50M "${PLACEHOLDER_FL}"
         fi
@@ -43,7 +67,7 @@ if [ -b /dev/nvme1n1 ] ; then
         exit 1
     fi
 else
-    growpart /dev/nvme0n1 "${ROOT_PARTITION_NUMBER}"
-    resize2fs "/dev/nvme0n1p${ROOT_PARTITION_NUMBER}"
+    growpart "${XVDA_DEVICE}" "${ROOT_PARTITION_NUMBER}"
+    resize2fs "${XVDA_DEVICE}p${ROOT_PARTITION_NUMBER}"
 fi
 echo "Done resizing disk"
diff --git a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
index 9f78a8d5e..9017f6169 100755
--- a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
+++ b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
@@ -363,7 +363,7 @@ function initiate_upgrade {
         fi
 
         # Fallback to lsblk if ebsnvme-id is not available or no mapping found, pre ubuntu 20.04
-        if [ -z "$BLOCK_DEVICE" ]; then
+        if [ -z "${BLOCK_DEVICE:-}" ]; then
             echo "No block device found using ebsnvme-id, falling back to lsblk"
             # awk NF==3 prints lines with exactly 3 fields, which are the block devices currently not mounted anywhere
             # excluding nvme0 since it is the root disk
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 0edea89b3..99de42a6b 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.015-orioledb"
-  postgres17: "17.4.1.072"
-  postgres15: "15.8.1.129"
+  postgresorioledb-17: "17.5.1.016-orioledb"
+  postgres17: "17.4.1.073"
+  postgres15: "15.8.1.130"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"

From ae728fa9443d72c6e97034d0b4dc48b79f42ac6d Mon Sep 17 00:00:00 2001
From: Raminder Singh <romi_ssk@yahoo.co.in>
Date: Tue, 12 Aug 2025 15:01:41 +0530
Subject: [PATCH 62/64] feat: add supabase_etl_admin user

---
 ansible/files/postgresql_config/supautils.conf.j2           | 4 ++--
 ansible/vars.yml                                            | 6 +++---
 .../db/init-scripts/00000000000000-initial-schema.sql       | 5 +++++
 nix/tests/expected/roles.out                                | 6 ++++--
 nix/tests/expected/z_15_roles.out                           | 3 ++-
 nix/tests/expected/z_17_roles.out                           | 6 ++++--
 nix/tools/postgresql_schema.sql                             | 1 +
 testinfra/test_ami_nix.py                                   | 1 +
 8 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/ansible/files/postgresql_config/supautils.conf.j2 b/ansible/files/postgresql_config/supautils.conf.j2
index f8c4aa0a2..a3456f699 100644
--- a/ansible/files/postgresql_config/supautils.conf.j2
+++ b/ansible/files/postgresql_config/supautils.conf.j2
@@ -11,5 +11,5 @@ supautils.extension_custom_scripts_path = '/etc/postgresql-custom/extension-cust
 supautils.privileged_extensions_superuser = 'supabase_admin'
 supautils.privileged_role = 'postgres'
 supautils.privileged_role_allowed_configs = 'auto_explain.*, log_lock_waits, log_min_duration_statement, log_min_messages, log_replication_commands, log_statement, log_temp_files, pg_net.batch_size, pg_net.ttl, pg_stat_statements.*, pgaudit.log, pgaudit.log_catalog, pgaudit.log_client, pgaudit.log_level, pgaudit.log_relation, pgaudit.log_rows, pgaudit.log_statement, pgaudit.log_statement_once, pgaudit.role, pgrst.*, plan_filter.*, safeupdate.enabled, session_replication_role, track_io_timing, wal_compression'
-supautils.reserved_memberships = 'pg_read_server_files, pg_write_server_files, pg_execute_server_program, supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, dashboard_user, pgbouncer, authenticator'
-supautils.reserved_roles = 'supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, dashboard_user, pgbouncer, service_role*, authenticator*, authenticated*, anon*'
+supautils.reserved_memberships = 'pg_read_server_files, pg_write_server_files, pg_execute_server_program, supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, supabase_etl_admin, dashboard_user, pgbouncer, authenticator'
+supautils.reserved_roles = 'supabase_admin, supabase_auth_admin, supabase_storage_admin, supabase_read_only_user, supabase_realtime_admin, supabase_replication_admin, supabase_etl_admin, dashboard_user, pgbouncer, service_role*, authenticator*, authenticated*, anon*'
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 99de42a6b..cd7ea6a28 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -9,9 +9,9 @@ postgres_major:
 
 # Full version strings for each major version
 postgres_release:
-  postgresorioledb-17: "17.5.1.016-orioledb"
-  postgres17: "17.4.1.073"
-  postgres15: "15.8.1.130"
+  postgresorioledb-17: "17.5.1.017-orioledb"
+  postgres17: "17.4.1.074"
+  postgres15: "15.8.1.131"
 
 # Non Postgres Extensions
 pgbouncer_release: "1.19.0"
diff --git a/migrations/db/init-scripts/00000000000000-initial-schema.sql b/migrations/db/init-scripts/00000000000000-initial-schema.sql
index 272c989c0..2406a7485 100644
--- a/migrations/db/init-scripts/00000000000000-initial-schema.sql
+++ b/migrations/db/init-scripts/00000000000000-initial-schema.sql
@@ -10,6 +10,11 @@ alter user  supabase_admin with superuser createdb createrole replication bypass
 -- Supabase replication user
 create user supabase_replication_admin with login replication;
 
+-- Supabase etl user
+create user supabase_etl_admin with login replication;
+grant pg_read_all_data to supabase_etl_admin;
+grant create on database postgres to supabase_etl_admin;
+
 -- Supabase read-only user
 create role supabase_read_only_user with login bypassrls;
 grant pg_read_all_data to supabase_read_only_user;
diff --git a/nix/tests/expected/roles.out b/nix/tests/expected/roles.out
index 69446110c..9c5a47a71 100644
--- a/nix/tests/expected/roles.out
+++ b/nix/tests/expected/roles.out
@@ -46,11 +46,12 @@ order by rolname;
  service_role               | f             | f           | f        | t          | f           | f              |           -1 | t            | 
  supabase_admin             | t             | t           | t        | t          | t           | t              |           -1 | t            | 
  supabase_auth_admin        | t             | t           | f        | f          | f           | f              |           -1 | f            | 
+ supabase_etl_admin         | f             | t           | f        | t          | f           | t              |           -1 | f            | 
  supabase_functions_admin   | t             | t           | f        | f          | f           | f              |           -1 | f            | 
  supabase_read_only_user    | f             | t           | f        | t          | f           | f              |           -1 | t            | 
  supabase_replication_admin | f             | t           | f        | t          | f           | t              |           -1 | f            | 
  supabase_storage_admin     | t             | t           | f        | f          | f           | f              |           -1 | f            | 
-(29 rows)
+(30 rows)
 
 select
   rolname,
@@ -85,11 +86,12 @@ order by rolname;
  service_role               | 
  supabase_admin             | {"search_path=\"$user\", public, auth, extensions",log_statement=none}
  supabase_auth_admin        | {search_path=auth,idle_in_transaction_session_timeout=60000,log_statement=none}
+ supabase_etl_admin         | 
  supabase_functions_admin   | 
  supabase_read_only_user    | {default_transaction_read_only=on}
  supabase_replication_admin | 
  supabase_storage_admin     | {search_path=storage,log_statement=none}
-(29 rows)
+(30 rows)
 
 -- Check all privileges of the roles on the schemas
 select schema_name, privilege_type, grantee, default_for
diff --git a/nix/tests/expected/z_15_roles.out b/nix/tests/expected/z_15_roles.out
index 42c2314e8..796b298bb 100644
--- a/nix/tests/expected/z_15_roles.out
+++ b/nix/tests/expected/z_15_roles.out
@@ -29,7 +29,8 @@ order by
  postgres                | pg_signal_backend      | f
  postgres                | pgtle_admin            | f
  postgres                | service_role           | f
+ supabase_etl_admin      | pg_read_all_data       | f
  supabase_read_only_user | pg_read_all_data       | f
  supabase_storage_admin  | authenticator          | f
-(18 rows)
+(19 rows)
 
diff --git a/nix/tests/expected/z_17_roles.out b/nix/tests/expected/z_17_roles.out
index 40ce6007d..ecda2ffde 100644
--- a/nix/tests/expected/z_17_roles.out
+++ b/nix/tests/expected/z_17_roles.out
@@ -66,9 +66,10 @@ order by
  postgres                | pg_signal_backend      | t
  postgres                | pgtle_admin            | f
  postgres                | service_role           | t
+ supabase_etl_admin      | pg_read_all_data       | f
  supabase_read_only_user | pg_read_all_data       | f
  supabase_storage_admin  | authenticator          | f
-(20 rows)
+(21 rows)
 
 -- Check version-specific privileges of the roles on the schemas
 select schema_name, privilege_type, grantee, default_for
@@ -157,7 +158,8 @@ order by
  postgres                | pg_signal_backend      | t
  postgres                | pgtle_admin            | f
  postgres                | service_role           | t
+ supabase_etl_admin      | pg_read_all_data       | f
  supabase_read_only_user | pg_read_all_data       | f
  supabase_storage_admin  | authenticator          | f
-(19 rows)
+(20 rows)
 
diff --git a/nix/tools/postgresql_schema.sql b/nix/tools/postgresql_schema.sql
index 4547ab239..7c2ae21a9 100644
--- a/nix/tools/postgresql_schema.sql
+++ b/nix/tools/postgresql_schema.sql
@@ -7,5 +7,6 @@ ALTER USER pgbouncer WITH PASSWORD 'postgres';
 ALTER USER supabase_auth_admin WITH PASSWORD 'postgres';
 ALTER USER supabase_storage_admin WITH PASSWORD 'postgres';
 ALTER USER supabase_replication_admin WITH PASSWORD 'postgres';
+ALTER USER supabase_etl_admin WITH PASSWORD 'postgres';
 ALTER ROLE supabase_read_only_user WITH PASSWORD 'postgres';
 ALTER ROLE supabase_admin SET search_path TO "$user",public,auth,extensions;
diff --git a/testinfra/test_ami_nix.py b/testinfra/test_ami_nix.py
index d7b3ecca7..96ce12dab 100644
--- a/testinfra/test_ami_nix.py
+++ b/testinfra/test_ami_nix.py
@@ -32,6 +32,7 @@
 ALTER USER supabase_auth_admin WITH PASSWORD 'postgres';
 ALTER USER supabase_storage_admin WITH PASSWORD 'postgres';
 ALTER USER supabase_replication_admin WITH PASSWORD 'postgres';
+ALTER USER supabase_etl_admin WITH PASSWORD 'postgres';
 ALTER ROLE supabase_read_only_user WITH PASSWORD 'postgres';
 ALTER ROLE supabase_admin SET search_path TO "$user",public,auth,extensions;
 """

From 24430eebc66f4150ecfc45da617df1012fe43419 Mon Sep 17 00:00:00 2001
From: samrose <samuel@supabase.io>
Date: Tue, 12 Aug 2025 16:28:18 -0400
Subject: [PATCH 63/64] fix: pin entrypoint file download until we can test
 changes (#1752)

---
 Dockerfile-15          | 4 ++--
 Dockerfile-17          | 4 ++--
 Dockerfile-orioledb-17 | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Dockerfile-15 b/Dockerfile-15
index 68e9f4e59..b4561db23 100644
--- a/Dockerfile-15
+++ b/Dockerfile-15
@@ -190,10 +190,10 @@ COPY migrations/db /docker-entrypoint-initdb.d/
 COPY ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql /docker-entrypoint-initdb.d/init-scripts/00-schema.sql
 COPY ansible/files/stat_extension.sql /docker-entrypoint-initdb.d/migrations/00-extension.sql
 
-# # Add upstream entrypoint script
+# # Add upstream entrypoint script pinned for now to last tested version
 COPY --from=gosu /usr/local/bin/gosu /usr/local/bin/gosu
 ADD --chmod=0755 \
-    https://github.com/docker-library/postgres/raw/master/15/bullseye/docker-entrypoint.sh \
+    https://github.com/docker-library/postgres/raw/889f9447cd2dfe21cccfbe9bb7945e3b037e02d8/15/bullseye/docker-entrypoint.sh \
     /usr/local/bin/docker-entrypoint.sh
 
 RUN mkdir -p /var/run/postgresql && chown postgres:postgres /var/run/postgresql
diff --git a/Dockerfile-17 b/Dockerfile-17
index 5ad8ed397..1c7f5e575 100644
--- a/Dockerfile-17
+++ b/Dockerfile-17
@@ -198,10 +198,10 @@ COPY migrations/db /docker-entrypoint-initdb.d/
 COPY ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql /docker-entrypoint-initdb.d/init-scripts/00-schema.sql
 COPY ansible/files/stat_extension.sql /docker-entrypoint-initdb.d/migrations/00-extension.sql
 
-# # Add upstream entrypoint script
+# # Add upstream entrypoint script pinned for now to last tested version
 COPY --from=gosu /usr/local/bin/gosu /usr/local/bin/gosu
 ADD --chmod=0755 \
-    https://github.com/docker-library/postgres/raw/master/17/bullseye/docker-entrypoint.sh \
+    https://github.com/docker-library/postgres/raw/889f9447cd2dfe21cccfbe9bb7945e3b037e02d8/17/bullseye/docker-entrypoint.sh \
     /usr/local/bin/docker-entrypoint.sh
 
 RUN mkdir -p /var/run/postgresql && chown postgres:postgres /var/run/postgresql
diff --git a/Dockerfile-orioledb-17 b/Dockerfile-orioledb-17
index 41254e4f7..2a9dfe982 100644
--- a/Dockerfile-orioledb-17
+++ b/Dockerfile-orioledb-17
@@ -203,10 +203,10 @@ COPY ansible/files/stat_extension.sql /docker-entrypoint-initdb.d/migrations/00-
 RUN echo "CREATE EXTENSION orioledb;" > /docker-entrypoint-initdb.d/init-scripts/00-pre-init.sql && \
     chown postgres:postgres /docker-entrypoint-initdb.d/init-scripts/00-pre-init.sql
 
-# # Add upstream entrypoint script
+# # Add upstream entrypoint script pinned for now to last tested version
 COPY --from=gosu /usr/local/bin/gosu /usr/local/bin/gosu
 ADD --chmod=0755 \
-    https://github.com/docker-library/postgres/raw/master/17/bullseye/docker-entrypoint.sh \
+    https://github.com/docker-library/postgres/raw/889f9447cd2dfe21cccfbe9bb7945e3b037e02d8/17/bullseye/docker-entrypoint.sh \
     /usr/local/bin/docker-entrypoint.sh
 
 RUN mkdir -p /var/run/postgresql && chown postgres:postgres /var/run/postgresql

From defc662f7258025f3a28a12b0c0bee61aa6893bd Mon Sep 17 00:00:00 2001
From: Tom Ashley <tom.ashley@gmail.com>
Date: Thu, 14 Aug 2025 10:28:53 +0100
Subject: [PATCH 64/64] fix: ensure amazon-ec2-utils is installed before 24.04
 upgrade (#1759)

* fix: ensure amazon-ec2-utils is installed before 24.04 upgrade

* fix: detect package installed, pipefail friendly

* fix: pipefail friendly way to detect package
---
 ansible/files/admin_api_scripts/grow_fs.sh               | 4 ++--
 .../admin_api_scripts/pg_upgrade_scripts/initiate.sh     | 9 ++++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/ansible/files/admin_api_scripts/grow_fs.sh b/ansible/files/admin_api_scripts/grow_fs.sh
index 6d9fc8a16..01e4736ed 100644
--- a/ansible/files/admin_api_scripts/grow_fs.sh
+++ b/ansible/files/admin_api_scripts/grow_fs.sh
@@ -13,7 +13,7 @@ if pgrep resizefs; then
 fi
 
 # install amazon disk utilities if not present on 24.04
-if [ "${UBUNTU_VERSION}" = "24.04" ] && ! dpkg -l | grep -q amazon-ec2-utils; then
+if [ "${UBUNTU_VERSION}" = "24.04" ] && ! /usr/bin/dpkg-query -W amazon-ec2-utils >/dev/null 2>&1; then
     apt-get update
     apt-get install -y amazon-ec2-utils || true
 fi
@@ -26,7 +26,7 @@ fi
 XVDA_DEVICE="/dev/nvme0n1"
 XVDH_DEVICE="/dev/nvme1n1"
 # Map AWS devices to NVMe for ubuntu 24.04 and later
-if [ "${UBUNTU_VERSION}" = "24.04" ] && dpkg -l | grep -q amazon-ec2-utils; then
+if [ "${UBUNTU_VERSION}" = "24.04" ] && /usr/bin/dpkg-query -W amazon-ec2-utils >/dev/null 2>&1; then
     for nvme_dev in $(lsblk -dprno name,type | grep disk | awk '{print $1}'); do
         if [ -b "$nvme_dev" ]; then
             mapping=$(ebsnvme-id -b "$nvme_dev" 2>/dev/null)
diff --git a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
index 9017f6169..71016a294 100755
--- a/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
+++ b/ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh
@@ -350,7 +350,14 @@ function initiate_upgrade {
     if [ -z "$IS_CI" ] && [ -z "$IS_LOCAL_UPGRADE" ]; then
         # DATABASE_UPGRADE_DATA_MIGRATION_DEVICE_NAME = '/dev/xvdp' can be derived from the worker mount
         echo "5. Determining block device to mount"
-        if command -v ebsnvme-id >/dev/null 2>&1 && dpkg -l | grep -q amazon-ec2-utils; then
+        # lsb release
+        UBUNTU_VERSION=$(lsb_release -rs)
+        # install amazon disk utilities if not present on 24.04
+        if [ "${UBUNTU_VERSION}" = "24.04" ] && ! /usr/bin/dpkg-query -W amazon-ec2-utils >/dev/null 2>&1; then
+            apt-get update
+            apt-get install -y amazon-ec2-utils || true
+        fi
+        if command -v ebsnvme-id >/dev/null 2>&1 && /usr/bin/dpkg-query -W amazon-ec2-utils >/dev/null 2>&1; then
             for nvme_dev in $(lsblk -dprno name,size,mountpoint,type | grep disk | awk '{print $1}'); do
                 if [ -b "$nvme_dev" ]; then
                     mapping=$(ebsnvme-id -b "$nvme_dev" 2>/dev/null)
