mixdog 0.7.1

package/scripts/build-runtime-macos.sh

@@ -0,0 +1,217 @@
+#!/usr/bin/env bash
+# build-runtime-macos.sh — Build self-contained PostgreSQL 16 + pgvector runtime on macOS.
+# Uses dylibbundler — the canonical macOS dependency-bundling tool — for @rpath
+# / install_name / transitive dyld closure (auriamg/macdylibbundler). Replaces
+# 200 lines of hand-rolled otool + install_name_tool walking.
+# Produces: dist/mixdog-runtime-darwin-{arch}-pg{pgver}-pgvector{vecver}.tar.gz
+
+set -euo pipefail
+
+PG_VERSION="16.4"
+PGVECTOR_VERSION="0.8.2"
+TARGET_OS="${TARGET_OS:-darwin}"
+TARGET_ARCH="${TARGET_ARCH:-$(uname -m | sed 's/x86_64/x64/')}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+BUILD_DIR="$ROOT_DIR/build/runtime-darwin-$TARGET_ARCH"
+STAGE_DIR="$BUILD_DIR/stage"
+DIST_DIR="$ROOT_DIR/dist"
+RUNTIME_DIR="$BUILD_DIR/runtime"
+
+OUTPUT_NAME="mixdog-runtime-${TARGET_OS}-${TARGET_ARCH}-pg${PG_VERSION}-pgvector${PGVECTOR_VERSION}.tar.gz"
+
+mkdir -p "$BUILD_DIR" "$STAGE_DIR" "$DIST_DIR" "$RUNTIME_DIR"/{bin,lib,share}
+
+echo "==> Installing build dependencies via Homebrew"
+brew install readline icu4c openssl@3 pkg-config curl git dylibbundler
+
+BREW_PREFIX="$(brew --prefix)"
+export CPPFLAGS="-I${BREW_PREFIX}/opt/readline/include -I${BREW_PREFIX}/opt/openssl@3/include -I${BREW_PREFIX}/opt/icu4c/include"
+export LDFLAGS="-L${BREW_PREFIX}/opt/readline/lib -L${BREW_PREFIX}/opt/openssl@3/lib -L${BREW_PREFIX}/opt/icu4c/lib"
+export PKG_CONFIG_PATH="${BREW_PREFIX}/opt/openssl@3/lib/pkgconfig:${BREW_PREFIX}/opt/icu4c/lib/pkgconfig"
+
+if [[ -x "$STAGE_DIR/bin/postgres" ]]; then
+  echo "==> Cache hit: PG already built at $STAGE_DIR — skipping configure/make"
+  unset TARGET_OS TARGET_ARCH
+else
+  echo "==> Downloading PostgreSQL $PG_VERSION source"
+  cd "$BUILD_DIR"
+  if [[ ! -f "postgresql-${PG_VERSION}.tar.gz" ]]; then
+    curl -fsSL "https://ftp.postgresql.org/pub/source/v${PG_VERSION}/postgresql-${PG_VERSION}.tar.gz" \
+      -o "postgresql-${PG_VERSION}.tar.gz"
+  fi
+  rm -rf "postgresql-${PG_VERSION}"
+  tar xzf "postgresql-${PG_VERSION}.tar.gz"
+
+  # macOS 15.4+ SDKs declare strchrnul (non-static, availability-floored at
+  # 15.4). PG 16.4 predates that: with HAVE_STRCHRNUL its unconditional use
+  # trips -Werror=unguarded-availability-new; without it (the ac_cv override
+  # below) its static-inline fallback collides with the SDK declaration
+  # ("static declaration follows non-static declaration"). Rename the
+  # file-local fallback so the build never touches the libc symbol — also
+  # keeps the binary loadable on macOS < 15.4. Upstream fixed this after
+  # 16.4; drop both hunks on the next PG version bump.
+  sed -i '' 's/strchrnul/pg_strchrnul/g' "postgresql-${PG_VERSION}/src/port/snprintf.c"
+
+  echo "==> Configuring + building PostgreSQL"
+  cd "postgresql-${PG_VERSION}"
+  # Xcode 16.4 SDK (macOS 15.5) declares strchrnul with an availability
+  # floor of macOS 15.4; configure's link test passes but compilation under
+  # -Werror=unguarded-availability-new fails when the deployment target is
+  # older (PG 16.4 predates the guard upstream added later). Force-disable
+  # detection so PG uses its portable fallback — keeps the binary loadable
+  # on every macOS the deployment target allows.
+  ./configure \
+    --prefix="$STAGE_DIR" \
+    --without-perl --without-python --without-tcl \
+    --with-openssl --with-icu --with-readline \
+    --enable-thread-safety \
+    ac_cv_func_strchrnul=no \
+    CFLAGS="-O2"
+  unset TARGET_OS TARGET_ARCH
+  make -j"$(sysctl -n hw.logicalcpu)"
+  make install
+  make -C contrib/pgcrypto install
+fi
+
+PG_CONFIG="$STAGE_DIR/bin/pg_config"
+export PATH="$STAGE_DIR/bin:$PATH"
+
+if [[ -f "$STAGE_DIR/lib/postgresql/vector.dylib" ]]; then
+  echo "==> Cache hit: pgvector already installed — skipping clone/build"
+else
+  echo "==> Cloning + building pgvector $PGVECTOR_VERSION"
+  cd "$BUILD_DIR"
+  rm -rf pgvector
+  git clone --branch "v${PGVECTOR_VERSION}" --depth 1 \
+    https://github.com/pgvector/pgvector.git pgvector
+  cd pgvector
+  make PG_CONFIG="$PG_CONFIG" -j"$(sysctl -n hw.logicalcpu)"
+  make PG_CONFIG="$PG_CONFIG" install
+fi
+
+echo "==> Stripping macOS binaries"
+find "$STAGE_DIR/bin" -type f -exec strip -S -x {} \; 2>/dev/null || true
+find "$STAGE_DIR/lib" -name '*.dylib' -type f -exec strip -S -x {} \; 2>/dev/null || true
+
+echo "==> Assembling runtime layout"
+rm -rf "$RUNTIME_DIR"
+mkdir -p "$RUNTIME_DIR"/{bin,lib,share}
+for BIN in postgres pg_ctl pg_dump pg_restore psql initdb; do
+  cp -a "$STAGE_DIR/bin/$BIN" "$RUNTIME_DIR/bin/" 2>/dev/null || echo "WARN: $BIN not found"
+done
+cp -a "$STAGE_DIR/lib"/.   "$RUNTIME_DIR/lib/"   2>/dev/null || true
+cp -a "$STAGE_DIR/share"/. "$RUNTIME_DIR/share/" 2>/dev/null || true
+
+# ---------------------------------------------------------------------------
+# Bundle foreign Homebrew dylibs via dylibbundler. This is the canonical
+# macOS tool: walks transitive deps including @rpath, copies into a target
+# dir, rewrites install_name + LC_RPATH on every Mach-O. Replaces the
+# hand-rolled otool/install_name_tool loop that missed @rpath references.
+#
+# Flags:
+#   -of   overwrite existing files in target dir
+#   -b    bundle (don't only print)
+#   -cd   create-dest if missing
+#   -ns   no-codesign (we ad-hoc sign at the end ourselves)
+#   -p    rpath to use in rewritten install_names (relative to binary)
+#   -d    target lib dir
+#   -x    Mach-O input to scan (repeatable)
+# ---------------------------------------------------------------------------
+echo "==> Bundling foreign deps via dylibbundler"
+DYLIBBUNDLER_ARGS=(-of -b -cd -ns -d "$RUNTIME_DIR/lib/" -p '@executable_path/../lib/')
+for BIN in postgres pg_ctl pg_dump pg_restore psql initdb; do
+  [[ -f "$RUNTIME_DIR/bin/$BIN" ]] && DYLIBBUNDLER_ARGS+=(-x "$RUNTIME_DIR/bin/$BIN")
+done
+while IFS= read -r -d '' ext; do
+  DYLIBBUNDLER_ARGS+=(-x "$ext")
+done < <(find "$RUNTIME_DIR/lib/postgresql" -name '*.dylib' -print0 2>/dev/null)
+dylibbundler "${DYLIBBUNDLER_ARGS[@]}"
+
+echo "==> Stripping static archives from lib/"
+find "$RUNTIME_DIR/lib" -name '*.a' -delete
+
+echo "==> Ad-hoc re-codesign every Mach-O (dylibbundler invalidates signature)"
+while IFS= read -r -d '' macho; do
+  if file "$macho" 2>/dev/null | grep -q 'Mach-O'; then
+    codesign --force --sign - "$macho" 2>/dev/null || true
+  fi
+done < <(find "$RUNTIME_DIR/bin" "$RUNTIME_DIR/lib" -type f -print0)
+
+echo "==> Self-contained smoke test (initdb + CREATE EXTENSION vector + distance query)"
+unset DYLD_FALLBACK_LIBRARY_PATH DYLD_LIBRARY_PATH
+SMOKE_DATA="$BUILD_DIR/smoke-pgdata"
+SMOKE_LOG="$BUILD_DIR/smoke-pg.log"
+SMOKE_PORT=55899
+rm -rf "$SMOKE_DATA"
+
+"$RUNTIME_DIR/bin/postgres" --version
+BAD="$(otool -L "$RUNTIME_DIR/bin/postgres" | grep -E '(/opt/homebrew|/usr/local/Cellar|/opt/local|'"$STAGE_DIR"')' || true)"
+if [[ -n "$BAD" ]]; then echo "FAIL: stray paths in postgres:"; echo "$BAD"; exit 1; fi
+VECTOR_DYLIB="$RUNTIME_DIR/lib/postgresql/vector.dylib"
+if [[ -f "$VECTOR_DYLIB" ]]; then
+  VBAD="$(otool -L "$VECTOR_DYLIB" | grep -E '(/opt/homebrew|/usr/local/Cellar|/opt/local|'"$STAGE_DIR"')' || true)"
+  if [[ -n "$VBAD" ]]; then echo "FAIL: stray paths in vector.dylib:"; echo "$VBAD"; exit 1; fi
+fi
+
+"$RUNTIME_DIR/bin/initdb" -D "$SMOKE_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
+"$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -o "-p $SMOKE_PORT -h 127.0.0.1" -l "$SMOKE_LOG" -w start
+trap '"$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null 2>&1 || true' EXIT
+
+"$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
+EXTV="$("$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
+DIST="$("$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT '[1,2,3]'::vector <-> '[1,2,4]'::vector;")"
+echo "  vector extension version: $EXTV"
+echo "  distance query result:    $DIST"
+[[ "$EXTV" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extversion=$EXTV expected=$PGVECTOR_VERSION"; exit 1; }
+"$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null
+trap - EXIT
+rm -rf "$SMOKE_DATA"
+echo "  PASS smoke (extension load + vector distance)"
+
+# Licenses
+curl -fsSL "https://raw.githubusercontent.com/postgres/postgres/REL_16_STABLE/COPYRIGHT" \
+  -o "$RUNTIME_DIR/LICENSE.postgresql"
+cp "$BUILD_DIR/pgvector/LICENSE" "$RUNTIME_DIR/LICENSE.pgvector"
+
+echo "==> Creating tarball: $OUTPUT_NAME"
+cd "$BUILD_DIR"
+tar czf "$DIST_DIR/$OUTPUT_NAME" -C "$RUNTIME_DIR" .
+
+echo "==> Generating sha256 sidecar"
+cd "$DIST_DIR"
+shasum -a 256 "$OUTPUT_NAME" > "${OUTPUT_NAME}.sha256"
+
+# ---------------------------------------------------------------------------
+# Phase A: Re-smoke from EXTRACTED tarball with hostile env. Catches false-pass
+# from build-host having Homebrew formulae that bundled tarball might be
+# missing — dylibbundler should have rewritten everything, this is the proof.
+# ---------------------------------------------------------------------------
+echo "==> Re-smoke from extracted tarball (hostile env)"
+EXTRACT_DIR="$BUILD_DIR/extract-smoke"
+rm -rf "$EXTRACT_DIR"; mkdir -p "$EXTRACT_DIR"
+tar xzf "$DIST_DIR/$OUTPUT_NAME" -C "$EXTRACT_DIR"
+EXTRACT_DATA="$EXTRACT_DIR/extract-pgdata"
+EXTRACT_LOG="$EXTRACT_DIR/extract-pg.log"
+EXTRACT_PORT=55898
+
+env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+  "$EXTRACT_DIR/bin/postgres" --version
+env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+  "$EXTRACT_DIR/bin/initdb" -D "$EXTRACT_DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
+env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+  "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -o "-p $EXTRACT_PORT -h 127.0.0.1" -l "$EXTRACT_LOG" -w start
+trap 'env -i HOME="'"$EXTRACT_DIR"'" PATH=/usr/bin:/bin "'"$EXTRACT_DIR"'/bin/pg_ctl" -D "'"$EXTRACT_DATA"'" -m fast stop > /dev/null 2>&1 || true' EXIT
+env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+  "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
+EXTV2="$(env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
+[[ "$EXTV2" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extracted-smoke extversion=$EXTV2"; exit 1; }
+env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+  "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m fast stop > /dev/null
+trap - EXIT
+rm -rf "$EXTRACT_DIR"
+echo "  PASS extracted-tarball smoke"
+
+echo "==> Done: $DIST_DIR/$OUTPUT_NAME"
+ls -lh "$DIST_DIR/$OUTPUT_NAME"

package/scripts/build-runtime-windows.ps1

@@ -0,0 +1,242 @@
+# build-runtime-windows.ps1 — Build PostgreSQL 16 + pgvector runtime on Windows.
+# Uses windows-2022 GHA runner's preinstalled PostgreSQL 16 (consistent
+# pg_config + postgres.exe from same package) — avoids EDB zip's split-version
+# packaging bug that linked pgvector against PG 14 ABI.
+# Builds pgvector from source via MSVC/nmake, then assembles a self-contained
+# runtime tree (bin + lib + share at root). Final smoke: initdb + CREATE
+# EXTENSION vector + distance query.
+# Produces: dist\mixdog-runtime-win32-x64-pg{pgver}-pgvector{vecver}.tar.gz
+
+$ErrorActionPreference = 'Stop'
+
+$PG_VERSION       = '16.4'
+$PGVECTOR_VERSION = '0.8.2'
+$TARGET_OS        = $env:TARGET_OS   ?? 'win32'
+$TARGET_ARCH      = $env:TARGET_ARCH ?? 'x64'
+
+# Auto-detect highest preinstalled PG ≥ 16 OR install via chocolatey.
+$PgInstallRoot = 'C:\Program Files\PostgreSQL'
+
+function Find-PgRoot {
+    if (-not (Test-Path $PgInstallRoot)) { return $null }
+    $cands = Get-ChildItem $PgInstallRoot -Directory -ErrorAction SilentlyContinue |
+        Where-Object { $_.Name -match '^(\d+)' } |
+        Sort-Object { [int]([regex]::Match($_.Name, '^(\d+)').Groups[1].Value) } -Descending
+    foreach ($c in $cands) {
+        $major = [int]([regex]::Match($c.Name, '^(\d+)').Groups[1].Value)
+        if ($major -ge 16 -and (Test-Path "$($c.FullName)\bin\pg_config.exe")) {
+            return $c.FullName
+        }
+    }
+    return $null
+}
+
+$PgRoot = Find-PgRoot
+if (-not $PgRoot) {
+    Write-Host "==> No preinstalled PG ≥ 16 found. Installing via chocolatey..."
+    if (Test-Path $PgInstallRoot) {
+        Write-Host "Existing PG dirs (none usable):"
+        Get-ChildItem $PgInstallRoot -Directory -ErrorAction SilentlyContinue | Select-Object Name
+    }
+    choco install postgresql16 --version=16.4.0 --params '/Password:postgres' -y --no-progress 2>&1 | Out-Host
+    if ($LASTEXITCODE -ne 0) { Write-Error "choco install postgresql16 failed (exit $LASTEXITCODE)"; exit 1 }
+    $PgRoot = Find-PgRoot
+    if (-not $PgRoot) {
+        Write-Error "ASSERT FAILED: chocolatey install completed but PG ≥ 16 still not found under $PgInstallRoot"
+        Get-ChildItem $PgInstallRoot -Directory -ErrorAction SilentlyContinue | Select-Object Name
+        exit 1
+    }
+}
+
+$ScriptDir  = Split-Path -Parent $MyInvocation.MyCommand.Path
+$RootDir    = (Resolve-Path "$ScriptDir\..").Path
+$BuildDir   = "$RootDir\build\runtime-win32-$TARGET_ARCH"
+$DistDir    = "$RootDir\dist"
+$RuntimeDir = "$BuildDir\runtime"
+
+$PgBin    = "$PgRoot\bin"
+$PgConfig = "$PgBin\pg_config.exe"
+
+$OutputName = "mixdog-runtime-${TARGET_OS}-${TARGET_ARCH}-pg${PG_VERSION}-pgvector${PGVECTOR_VERSION}.tar.gz"
+
+Write-Host "==> Using preinstalled PG: $PgRoot"
+& $PgConfig --version
+$RealVersion = (& $PgConfig --version) -replace 'PostgreSQL ', ''
+Write-Host "  pg_config reports version: $RealVersion"
+
+if (Test-Path $RuntimeDir) { Remove-Item -Recurse -Force $RuntimeDir }
+New-Item -ItemType Directory -Force -Path $BuildDir, $DistDir,
+  "$RuntimeDir\bin", "$RuntimeDir\lib", "$RuntimeDir\share" | Out-Null
+
+Write-Host "==> Cloning pgvector $PGVECTOR_VERSION"
+$PgVectorDir = "$BuildDir\pgvector"
+$VectorDllBuilt = "$PgVectorDir\vector.dll"
+
+if (Test-Path $VectorDllBuilt) {
+    Write-Host "  Cache hit: vector.dll already built at $VectorDllBuilt"
+} else {
+    if (Test-Path $PgVectorDir) { Remove-Item -Recurse -Force $PgVectorDir }
+    git clone --branch "v$PGVECTOR_VERSION" --depth 1 `
+        https://github.com/pgvector/pgvector.git $PgVectorDir
+
+    Write-Host "==> Building pgvector (MSVC/nmake against system PG 16)"
+    Push-Location $PgVectorDir
+    try {
+        $VsWhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+        $VcVarsAll = & $VsWhere -latest -find 'VC\Auxiliary\Build\vcvarsall.bat' 2>$null | Select-Object -First 1
+        if (-not $VcVarsAll) {
+            Write-Error "vswhere could not locate vcvarsall.bat — Visual Studio Build Tools required."
+            exit 1
+        }
+        # CRITICAL: prepend $PgRoot\bin to PATH so any bare `pg_config` call
+        # inside Makefile.win resolves to PG 16 — runner has PG 14/15
+        # preinstalled and would otherwise win the PATH lookup, producing
+        # PG14-ABI vector.dll that fails to load in our PG 16 postgres.exe.
+        # Set in PowerShell so cmd /c inherits; setting inside the cmd batch
+        # via %PATH% loses vcvarsall's additions due to parse-time expansion.
+        $env:PATH = "$PgRoot\bin;$env:PATH"
+        $env:PGROOT = $PgRoot
+        $BuildCmd = "`"$VcVarsAll`" amd64 && nmake /F Makefile.win PG_CONFIG=`"$PgConfig`""
+        cmd /c $BuildCmd
+        if ($LASTEXITCODE -ne 0) {
+            Write-Error "pgvector nmake build failed (exit $LASTEXITCODE)"
+            exit 1
+        }
+    } finally {
+        Pop-Location
+    }
+}
+
+Write-Host "==> Assembling runtime layout — copy bin (.exe + .dll), lib, share from $PgRoot"
+# Copy ALL .exe + .dll from PG bin so postgres.exe + libpq.dll + libcrypto/libssl/
+# libintl/libiconv/icu*/libxml2/libxslt/libwinpthread/libecpg/libpgtypes etc. all
+# ship together. PG 16 install layout puts these all in bin\.
+Copy-Item "$PgBin\*.exe","$PgBin\*.dll" "$RuntimeDir\bin\" -Force
+
+# lib\: PG extension modules (incl. contrib like pgcrypto.dll). vector.dll
+# placed here below — PG looks for $libdir/<ext>.dll which resolves to lib\.
+Copy-Item -Recurse -Force "$PgRoot\lib\*"   "$RuntimeDir\lib\"   -ErrorAction SilentlyContinue
+# share\: extension SQL/control, locale, timezone data, conf samples.
+Copy-Item -Recurse -Force "$PgRoot\share\*" "$RuntimeDir\share\" -ErrorAction SilentlyContinue
+
+Write-Host "==> Manually staging pgvector artifacts (avoid pg_config-derived install paths)"
+$RuntimeExtDir = "$RuntimeDir\share\extension"
+New-Item -ItemType Directory -Force -Path $RuntimeExtDir | Out-Null
+Copy-Item "$PgVectorDir\vector.dll"        "$RuntimeDir\lib\"  -Force
+Copy-Item "$PgVectorDir\vector.control"    $RuntimeExtDir      -Force
+Copy-Item "$PgVectorDir\sql\vector--*.sql" $RuntimeExtDir      -Force
+
+Write-Host "==> Asserting runtime layout"
+$VectorControl = "$RuntimeDir\share\extension\vector.control"
+if (-not (Test-Path $VectorControl)) { Write-Error "ASSERT FAILED: $VectorControl not found"; exit 1 }
+$VectorSql = "$RuntimeDir\share\extension\vector--$PGVECTOR_VERSION.sql"
+if (-not (Test-Path $VectorSql))     { Write-Error "ASSERT FAILED: $VectorSql not found"; exit 1 }
+if (-not (Test-Path "$RuntimeDir\lib\vector.dll")) {
+    Write-Error "ASSERT FAILED: vector.dll not found in lib\"
+    exit 1
+}
+Write-Host "  PASS runtime layout"
+
+# Licenses
+if (Test-Path "$PgRoot\doc\postgresql\COPYRIGHT") {
+    Copy-Item "$PgRoot\doc\postgresql\COPYRIGHT" "$RuntimeDir\LICENSE.postgresql" -Force
+} elseif (Test-Path "$PgRoot\doc\COPYRIGHT") {
+    Copy-Item "$PgRoot\doc\COPYRIGHT" "$RuntimeDir\LICENSE.postgresql" -Force
+}
+if (Test-Path "$PgVectorDir\LICENSE") {
+    Copy-Item "$PgVectorDir\LICENSE" "$RuntimeDir\LICENSE.pgvector" -Force
+}
+
+Write-Host "==> Self-contained smoke test (initdb + CREATE EXTENSION vector + distance query)"
+& "$RuntimeDir\bin\postgres.exe" --version
+if ($LASTEXITCODE -ne 0) { Write-Error "FAIL: postgres.exe --version exit $LASTEXITCODE"; exit 1 }
+
+$SmokeData = "$BuildDir\smoke-pgdata"
+$SmokeLog  = "$BuildDir\smoke-pg.log"
+$SmokePort = 55899
+if (Test-Path $SmokeData) { Remove-Item -Recurse -Force $SmokeData }
+
+& "$RuntimeDir\bin\initdb.exe" -D $SmokeData --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
+if ($LASTEXITCODE -ne 0) { Write-Error "FAIL: initdb"; exit 1 }
+
+& "$RuntimeDir\bin\pg_ctl.exe" -D $SmokeData -o "-p $SmokePort -h 127.0.0.1" -l $SmokeLog -w start
+if ($LASTEXITCODE -ne 0) { Write-Error "FAIL: pg_ctl start (see $SmokeLog)"; Get-Content $SmokeLog | Select-Object -Last 30; exit 1 }
+
+try {
+    & "$RuntimeDir\bin\psql.exe" -h 127.0.0.1 -p $SmokePort -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw "CREATE EXTENSION vector failed" }
+    $ExtV = & "$RuntimeDir\bin\psql.exe" -h 127.0.0.1 -p $SmokePort -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
+    $Dist = & "$RuntimeDir\bin\psql.exe" -h 127.0.0.1 -p $SmokePort -U postgres -d postgres -tAc "SELECT '[1,2,3]'::vector <-> '[1,2,4]'::vector;"
+    Write-Host "  vector extension version: $ExtV"
+    Write-Host "  distance query result:    $Dist"
+    if ($ExtV.Trim() -ne $PGVECTOR_VERSION) {
+        Write-Error "FAIL: extversion='$ExtV' expected='$PGVECTOR_VERSION'"
+        exit 1
+    }
+    Write-Host "  PASS smoke (extension load + vector distance)"
+}
+finally {
+    & "$RuntimeDir\bin\pg_ctl.exe" -D $SmokeData -m fast stop 2>$null | Out-Null
+    Remove-Item -Recurse -Force $SmokeData -ErrorAction SilentlyContinue
+}
+
+Write-Host "==> Creating tarball: $OutputName"
+$DistDirFwd    = $DistDir.Replace('\', '/')
+$RuntimeDirFwd = $RuntimeDir.Replace('\', '/')
+& tar -czf "$DistDirFwd/$OutputName" -C "$RuntimeDirFwd" .
+if ($LASTEXITCODE -ne 0) { Write-Error "tar failed (exit $LASTEXITCODE)"; exit 1 }
+
+Write-Host "==> Generating sha256 sidecar"
+Push-Location $DistDir
+$Hash = (Get-FileHash -Algorithm SHA256 $OutputName).Hash.ToLower()
+"$Hash  $OutputName" | Out-File -Encoding ascii "${OutputName}.sha256"
+Pop-Location
+
+# ---------------------------------------------------------------------------
+# Phase A: Re-smoke from EXTRACTED tarball with hostile env (cleared PATH,
+# only system32). Catches false-pass where the build host has VC redist /
+# preinstalled DLLs that the tarball might be missing.
+# ---------------------------------------------------------------------------
+Write-Host "==> Re-smoke from extracted tarball (hostile env)"
+$ExtractDir = "$BuildDir\extract-smoke"
+if (Test-Path $ExtractDir) { Remove-Item -Recurse -Force $ExtractDir }
+New-Item -ItemType Directory -Force -Path $ExtractDir | Out-Null
+& tar -xzf "$DistDirFwd/$OutputName" -C ($ExtractDir.Replace('\','/'))
+if ($LASTEXITCODE -ne 0) { Write-Error "extract failed"; exit 1 }
+
+$ExtractData = "$ExtractDir\extract-pgdata"
+$ExtractLog  = "$ExtractDir\extract-pg.log"
+$ExtractPort = 55898
+
+# Snapshot current env, then strip to minimal Windows PATH (no PG14/15/16
+# preinstalled bin, no chocolatey, no MSVC tools).
+$SavedPath  = $env:PATH
+$SavedPgRoot = $env:PGROOT
+$env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
+$env:PGROOT = $null
+$env:PGDATA = $null
+
+try {
+    & "$ExtractDir\bin\postgres.exe" --version
+    if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version under hostile env" }
+    & "$ExtractDir\bin\initdb.exe" -D $ExtractData --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb under hostile env" }
+    & "$ExtractDir\bin\pg_ctl.exe" -D $ExtractData -o "-p $ExtractPort -h 127.0.0.1" -l $ExtractLog -w start
+    if ($LASTEXITCODE -ne 0) { Get-Content $ExtractLog | Select-Object -Last 30; throw "FAIL: pg_ctl start under hostile env" }
+    try {
+        & "$ExtractDir\bin\psql.exe" -h 127.0.0.1 -p $ExtractPort -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION vector under hostile env" }
+        $ExtV2 = & "$ExtractDir\bin\psql.exe" -h 127.0.0.1 -p $ExtractPort -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
+        if ($ExtV2.Trim() -ne $PGVECTOR_VERSION) { throw "FAIL: extracted-smoke extversion='$ExtV2'" }
+        Write-Host "  PASS extracted-tarball smoke (hostile env)"
+    } finally {
+        & "$ExtractDir\bin\pg_ctl.exe" -D $ExtractData -m fast stop 2>$null | Out-Null
+    }
+} finally {
+    $env:PATH   = $SavedPath
+    $env:PGROOT = $SavedPgRoot
+    Remove-Item -Recurse -Force $ExtractDir -ErrorAction SilentlyContinue
+}
+
+Write-Host "==> Done: $DistDir\$OutputName"
+Get-Item "$DistDir\$OutputName" | Select-Object Name, Length